How your data — and your patients' data — is protected. Last updated August 14, 2026.
How your data is protected
OpTally was built privacy-first. The single most important idea: your case data is encrypted on your own device before it is ever uploaded, and no one — not OpTally, not your program admin, not the hosting company — can read it.
In one sentence: your cases and any patient identifiers are encrypted on your phone/computer with a key only you hold, so the server only ever stores unreadable ciphertext.
End-to-end, zero-knowledge encryption
- Everything is encrypted on your device using AES-256, with a key derived from your password (PBKDF2, 210,000 rounds) — before anything is sent anywhere.
- The server stores only ciphertext plus a one-way login verifier. A full breach of our servers would yield unreadable gibberish.
- This is called zero-knowledge: we have no ability to decrypt your data, because we never hold your key.
Patient identifiers (MRN)
- The MRN is the only patient identifier OpTally handles. It is stripped from your dictation on your device before any AI parsing, so it is never sent to Claude or any AI service.
- When it syncs between your devices, it travels only as encrypted ciphertext. No plaintext patient data ever leaves your device.
What your program admin can (and cannot) see
- Admins see only account metadata: your name, email, how many cases you've logged, and usage counts.
- Admins cannot see your actual cases, procedures, notes, or MRNs. This is not a policy choice — it is mathematically impossible, because case contents are end-to-end encrypted.
AI parsing
- To structure your dictation, a de-identified narrative (no MRN, no patient name) is sent to Anthropic's Claude API and structured into fields. AI suggestions (CPT codes, titles, notes) are just that — suggestions you review.
- Per Anthropic's commercial API terms, data sent through the API is not used to train their models.
Access & recovery
- App lock: you can require Face ID / Touch ID or a PIN every time the app opens on your device.
- Recovery code: at signup you receive a one-time recovery code that can restore access if you forget your password. If you lose both your password and your recovery code, your data cannot be recovered — that is the inherent trade-off of true encryption.
Infrastructure
- Hosted on Cloudflare; all traffic is encrypted in transit over HTTPS.
- Because the server never holds readable patient data, OpTally is designed to avoid handling protected health information in a form that would require a HIPAA Business Associate Agreement. (Your institution may still have its own review requirements.)
The Chrome extension (ACGME auto-fill)
- The optional browser extension fills the ACGME "Add Cases" form for you. It is a separate, local-only tool.
- It makes zero network calls — it never sends your data anywhere.
- It runs only on the ACGME case-entry page — it cannot access other tabs, sites, cookies, or history.
- It requests a single browser permission (
storage), used only to hold your queue on your device so it survives ACGME's page reloads — nothing more.
- It handles the MRN only to type it into ACGME's Case ID field (which ACGME requires) — exactly what you'd do by hand. Nothing is ever auto-submitted; you review and click Submit.
- Your queue — including the MRN — is stored only in the extension's own private storage on your device (not in the web page's storage), and is cleared when you finish the queue or automatically after about 2 hours.
Honest limits
- OpTally is a productivity tool, not a certified electronic health record. Your ACGME case log (or specialty board's log) remains the official record.
- Storing your key locally for convenience means the app-lock (Face ID/PIN) is what protects data on an unlocked device — as with any app on your phone.
Terms of Service Draft
A plain-language starting point, pending legal review.
1. Acceptance
By creating an account or using OpTally ("the Service"), you agree to these Terms. If you don't agree, don't use the Service.
2. Who can use it
OpTally is intended for physicians and physicians-in-training (residents/fellows) who are 18+ and authorized to log the cases they enter.
3. OpTally is an aid, not the official record
The Service helps you capture and organize your surgical/procedural cases. It is not the system of record. Your ACGME case log (or your specialty board's log) is the authoritative record, and you are solely responsible for the accuracy, completeness, and timely submission of your official logs.
4. Your responsibilities
- Enter accurate information and review all AI suggestions (CPT codes, titles, notes) before relying on them.
- Safeguard your password and recovery code. You are responsible for activity under your account.
- Comply with your institution's policies and all applicable patient-privacy laws when using the Service.
- Only enter data you are authorized to record.
5. Acceptable use
Don't use the Service unlawfully, don't attempt to breach or abuse it, don't reverse-engineer it, and don't upload content you have no right to.
6. AI outputs
AI-generated content (codes, titles, operative notes) is provided for convenience and may contain errors. It is not medical, coding, billing, or legal advice. You must independently verify it.
7. No warranty; limitation of liability
The Service is provided "as is," without warranties of any kind. To the maximum extent permitted by law, OpTally and its creators are not liable for indirect or consequential damages, or for any inaccuracies in your official case logs.
8. Termination & deletion
You may delete your account and data at any time from within the app. We may suspend accounts that violate these Terms.
9. Changes
We may update these Terms; material changes will be posted here with a new "last updated" date.
10. Contact
Questions: mentorxmed@gmail.com.
Privacy Policy Draft
What we collect, what we can't see, and who we share with. Pending legal review.
What we collect
- Account info: your email and display name.
- Usage metadata: counts of AI parses, timestamps like last login/last active, and your case count.
- Encrypted case data: your cases are stored as ciphertext we cannot read.
What we cannot access
- Your case contents, procedures, operative notes, or preferences.
- Patient MRNs — these are encrypted, and we hold no key.
How we use what we collect
- To provide the Service and sync it across your devices.
- To show program admins aggregate/metadata dashboards (never case contents).
- To keep the Service reliable and prevent abuse (e.g., usage caps).
Third parties
- Cloudflare — hosting and storage of your encrypted data. Their policy.
- Anthropic (Claude) — receives only de-identified text for AI parsing; no patient identifiers. Their policy.
Patient data
OpTally is designed so that no patient identifiers are ever exposed to us or to third parties. Your MRN is encrypted on your device before it syncs — the server only ever stores unreadable ciphertext — and the de-identified narrative used for parsing (sent to Claude) contains no MRN or patient identifiers.
Retention & your rights
- Your data is retained until you delete it. You can delete your account and all data at any time from Settings, or download a backup.
- Because your data lives (decrypted) only on your own devices, you always have direct access to it.
Children
OpTally is not directed at anyone under 18.
Changes & contact
We'll post updates here with a new date. Questions: mentorxmed@gmail.com.