Privacy Policy

Optical Diary ("we", "us", "our") provides practice-management software for optical retailers (each a "Shop"), including a web dashboard and a companion mobile app used by Shop staff. This Privacy Policy explains what data we collect, how it is used, and your rights, both for Shop staff who use our software and for patients whose records a Shop stores in Optical Diary.

1. Who controls the data

Each optical Shop is the data controller for the patient records it enters into Optical Diary. Optical Diary acts as the data processor, storing and processing that data on the Shop's behalf. If you are a patient with a question about your records, please contact the optical Shop you visited directly; they control what is stored and can correct or delete it on your behalf.

2. Information we collect

Shop & staff account data

• Name, email address, phone/mobile number, username
• Shop details: business name, email, phone, address, city, state, postal code, country
• Subscription plan, scan-credit usage, and (if applicable) payment method type and billing history

Patient records (entered by Shop staff)

• Name, date of birth, gender, mobile number, email, address
• Optical prescription data: sphere, cylinder, axis, addition, prism/base, pupillary distance, prescription type, clinic/optometrist name, prescription and expiry dates, notes
• A photo of the patient's prescription card, when a Shop uses the "Scan Prescription" feature

Prospective customer / lead data

• Name, email, phone, shop name, and any message submitted through our "Get Started" / request-account form

We do not collect device advertising identifiers, precise location/GPS data, or use any third-party analytics or advertising SDKs in the mobile app.

3. How the prescription photo is processed

When a Shop uses the Scan Prescription feature, a photo of the prescription card is sent from the app to our server, which forwards it to Google's Gemini AI API for a single, in-memory read that extracts the prescription values (sphere, cylinder, axis, etc.) as text. Google does not retain or use the image beyond that single request. The extracted values are then saved to the patient's record. If the Shop chooses to keep the original image on file (for reference), it is stored in our cloud storage (Cloudflare R2) and access-controlled to that Shop's staff, or to a patient who has been given a secure share link.

4. How we use information

• To provide, operate, and secure the Optical Diary dashboard and mobile app
• To let Shop staff record, retrieve, and share patient prescription history
• To meter and enforce subscription and scan-credit limits
• To respond to support requests and account/lead inquiries
• To detect abuse and keep the multi-tenant platform secure (each Shop's data is isolated from other Shops)

We do not sell personal data, and we do not use patient data for advertising.

5. Where data is stored

Account and patient data is stored in our Supabase-hosted database with row-level security so that a Shop can only access its own records. Prescription card images, if retained, are stored in Cloudflare R2 object storage. Data may be processed on servers located outside your country.

6. Data sharing

We share data only with service providers who help us run the platform, under agreements limiting their use of it:

• Supabase (database & authentication hosting)
• Cloudflare (image storage)
• Google (Gemini AI, for one-time prescription-image OCR only)

We do not share patient or Shop data with advertisers or data brokers.

7. Data retention & deletion

We retain account and patient data for as long as the Shop's account is active. When a Shop staff member deletes a patient record, the associated prescription records and any stored prescription image are deleted as well. Shops may request full account deletion by contacting us at the email below.

8. Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal data. Patients should raise these requests with the optical Shop they visited; Shop account holders can contact us directly using the details below.

9. Children's privacy

Optical Diary is intended for use by optical business staff, not by children. Patient records may include minors' prescription data where a Shop provides eyecare to children, entered and controlled by the Shop, not the child directly.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be posted on this page with a new effective date.

11. Contact us

Questions about this Privacy Policy or your data can be sent to hello@opticaldiary.com.