OpTally · Privacy & Security

How your data is protected

OpTally was built privacy-first. The single most important idea: your case data is encrypted on your own device before it is ever uploaded, and no one — not OpTally, not the hosting company — can read it.

End-to-end, zero-knowledge encryption

• Everything is encrypted on your device using AES-256, with a key derived from your password (PBKDF2, 210,000 rounds) — before anything is sent anywhere.
• The server stores only ciphertext plus a one-way login verifier. A full breach of our servers would yield unreadable gibberish.
• This is called zero-knowledge: we have no ability to decrypt your data, because we never hold your key.

Patient identifiers (MRN)

• OpTally does not collect medical record numbers. There is no MRN field. If you say an MRN while dictating, it is stripped on your device before any AI parsing, so it is never sent to Claude or any AI service, and it is then discarded rather than saved. A save is refused if a long number appears in free text.
• Each case carries a random OpTally code (OT- followed by eight characters) that identifies nobody. That code is what goes into ACGME's Case ID field.
• Any MRN entered before the identifier-free design took effect (September 2026) was removed from every device and from the encrypted copy on our server the next time the app opened. A salted hash that cannot be turned back into the number remains, so a later ACGME import still matches the case.
• The operative date is kept on each case because the ACGME log requires it. It sits only inside your encrypted record, next to no patient identity.
• When your cases sync between your devices, they travel only as encrypted ciphertext. No plaintext case data ever leaves your device.
• Your ACGME export. The case-log CSV you download from ACGME and import contains MRNs (as Case IDs), operation dates, attending names, your role, and each patient's age band and sex. It is read on your device and never sent to the AI. OpTally keeps, encrypted on your device, what it needs for your log: the operation date, procedure and CPT codes, attending, role, site, rotation, ACGME's category assignment, whether the patient was pediatric, and the date ACGME recorded the entry. The Case ID column, patient birth year and sex are discarded. Importing the file is your choice; it is your own case log, which ACGME provides to you for exactly this kind of use, and nothing in it becomes readable to us or to your program.

Programs

Sharing your ACGME category counts with a residency program is off by default and happens only if you turn it on yourself; even then it is counts and totals, never a case, a note, a date or a patient.

AI parsing

• To structure your dictation, a de-identified narrative (no MRN, no patient name) is sent to Anthropic's Claude API and structured into fields. AI suggestions (CPT codes, titles, notes) are just that — suggestions you review.
• Importing your own notes. If you paste or upload case notes (from Notes, OneNote, a document or a spreadsheet), patient identifiers are removed on your device before anything is sent for parsing: MRNs, patient names, initials, dates of birth and the date of the operation (the operative date is parsed on your device and never sent). They are also scrubbed from the saved case, so a patient name is never stored in OpTally. Automatic removal is thorough but not a guarantee — please do not paste patient names; OpTally never needs them, and you review every imported case before it is saved.
• Anthropic processes that text under a HIPAA Business Associate Agreement with OpTally LLC (executed September 21, 2026) in a HIPAA-configured API organization, and per its commercial API terms the data is not used to train their models.

Voice dictation

• When you dictate, OpTally records the audio and sends it to our own transcription service running on Amazon Transcribe, a HIPAA-eligible service covered by our Business Associate Agreement with AWS. Your audio does not go to Google or Apple.
• If you say a medical record number out loud by habit, it is removed on your device and never stored. There is no need to say it.
• There is still no reason to say a patient's name: OpTally never stores one, and never needs one.
• Audio is transcribed and discarded. We do not keep recordings.
• One exception. On a device where OpTally cannot capture audio itself, it falls back to your browser's built-in speech recognition — and that audio does go to Google (Chrome) or Apple (Safari), outside our agreements. The app tells you when this happens. On such a device, type the MRN rather than saying it.

Access & recovery

• App lock: you can require Face ID / Touch ID or a PIN every time the app opens on your device.
• Recovery code: at signup you receive a one-time recovery code that can restore access if you forget your password. If you lose both your password and your recovery code, your data cannot be recovered — that is the inherent trade-off of true encryption.

Where your data lives

• Your encrypted cases are stored on Amazon Web Services (Oregon, US), encrypted both by us on your device and again by AWS at rest. We hold a HIPAA Business Associate Agreement with AWS.
• The app itself — the page, its code and styling — is served by Cloudflare. Those files are identical for every user and contain no patient data of any kind, so no agreement is required for them.
• Our support mailboxes run on Google Workspace, where we also hold a HIPAA Business Associate Agreement, because a bug report could contain patient information even though we ask that it not.
• All traffic is encrypted in transit over HTTPS.

Being straight about HIPAA

• OpTally is designed not to hold protected health information. No patient identifier is collected; an operative date with no patient identity attached to it does not identify anyone. If your own free text nonetheless contains something identifying, it is encrypted with a key only you hold. Encryption is a safeguard, not a loophole, and we would rather say so plainly than imply otherwise.
• What our encryption does mean is narrower and still worth a lot: we cannot read your cases, and neither can anyone else. The server holds ciphertext we have no key for.
• Business Associate Agreements are in place with AWS, Google Workspace and Anthropic (the last executed September 21, 2026). The de-identification described above still applies: the agreements are a backstop, not a reason to send identifiers.
• An internal HIPAA risk analysis was completed in September 2026 and has not yet been reviewed by outside counsel. Your institution may have its own review requirements, and you remain responsible for following them.

The Chrome extension (ACGME auto-fill)

• The browser extension (Chrome or Edge on a computer; Safari inside the iPhone app) fills the ACGME "Add Cases" form for you. It is a local-only tool.
• It makes zero network calls — it never sends your data anywhere.
• It runs on ACGME's case-entry page, and on optally.io only to receive your queue — it cannot access other tabs, sites, cookies, or history.
• It requests a single browser permission (storage), used only to hold your queue on your device so it survives ACGME's page reloads — nothing more.
• It types each case's OpTally code into ACGME's Case ID field, and the case details into the other fields — exactly what you'd do by hand. Nothing is ever auto-submitted; you review and click Submit.
• Your queue is stored only in the extension's own private storage on your device (not in the web page's storage), and is cleared when you finish the queue or automatically after about 2 hours.
• How the queue gets there. OpTally opens a page on optally.io with your queue in the part of the address that is never sent to any server (the fragment); the extension takes it into its own storage and removes it from the address. Older versions of the extension used your system clipboard instead, which OpTally cleared when you closed the export screen.

What we never do with your data

• We never use your data to train or improve any AI model — not ours, not Anthropic's, not anyone's. This covers your cases, your dictations, your notes, and everything in the ACGME export you import.
• We never sell, share, license, or disclose your data to anyone. The only people who ever see anything derived from it are you, and, only if you turn program sharing on yourself, a residency program's staff, who see counts and totals and nothing else.
• Data from your ACGME export is used for one purpose: building your own log and your own progress view on your own device. It is not aggregated for research, benchmarking, or product analytics, and it is not readable by us.
• The usage measurements described under What we collect are counts and timings, used only to improve OpTally. They are not shared with anyone.
• If any of this ever changed, we would have to ask you first, in the app, and you could say no or delete your account.

Honest limits

• OpTally is a productivity tool, not a certified electronic health record. Your ACGME case log (or specialty board's log) remains the official record.
• Storing your key locally for convenience means the app-lock (Face ID/PIN) is what protects data on an unlocked device — as with any app on your phone.
• Compliance status. These documents are drafts pending attorney review. Business Associate Agreements are signed with AWS (which covers storage and dictation transcription), Google Workspace and Anthropic (September 2026). An internal HIPAA risk analysis was completed in September 2026 and is available to institutions on request; it has not yet been reviewed by outside counsel. Log only the minimum you need, and follow your institution's policies.
• Automatic removal of patient identifiers before AI parsing is thorough but is not a guarantee — because you type free text, please don't enter patient names. OpTally doesn't need them.

Terms of Service Draft

A plain-language starting point, pending legal review.

1. Acceptance

By creating an account or using OpTally ("the Service"), operated by OpTally LLC, a Texas limited liability company ("we", "us"), you agree to these Terms. If you don't agree, don't use the Service.

2. Who can use it

OpTally is intended for physicians and physicians-in-training (residents/fellows) who are 18+ and authorized to log the cases they enter.

3. OpTally is an aid, not the official record

The Service helps you capture and organize your surgical/procedural cases. It is not the system of record. Your ACGME case log (or your specialty board's log) is the authoritative record, and you are solely responsible for the accuracy, completeness, and timely submission of your official logs.

4. Your responsibilities

• Do not enter patient names or medical record numbers, in any field or by voice. OpTally never needs them, does not collect them, and will refuse a save that contains a long number.
• Enter accurate information and review all AI suggestions (CPT codes, titles, notes) before relying on them.
• Safeguard your password and recovery code. You are responsible for activity under your account.
• Your institution's rules are yours to follow. The Service is a personal tool. It is not provided, approved, or endorsed by your residency program, hospital, or health system, and nothing in the Service or on this site says otherwise. Whether you may use a personal tool for your work, and any permission your institution requires, is yours to check and yours to obtain before you use the Service. If your institution does not permit it, do not use the Service for that work. You are responsible for complying with your institution's policies and with all applicable patient-privacy laws.
• Only enter data you are authorized to record. If you import your ACGME case log, you confirm it is your own log and that your institution permits you to hold it in a personal tool.
• You review and submit. The browser extension fills ACGME's form from what you logged; it never submits. Every entry you send to ACGME is one you checked and submitted yourself, and its accuracy is yours.

5. Acceptable use

Don't use the Service unlawfully, don't attempt to breach or abuse it, don't reverse-engineer it, and don't upload content you have no right to.

5a. Beta software

The Service is in beta: features change, and something may occasionally break. You are welcome to talk about the Service, show it to colleagues, share screenshots, and describe your experience. Nothing in these terms asks you to keep it confidential.

6. AI outputs

AI-generated content (codes, titles, operative notes) is provided for convenience and may contain errors. It is not medical, coding, billing, or legal advice. You must independently verify it.

7. No warranty; limitation of liability

The Service is provided "as is" and "as available," without warranties of any kind, express or implied, including any implied warranty of merchantability, fitness for a particular purpose, accuracy, or non-infringement. You use it at your own risk.

To the maximum extent permitted by law, OpTally LLC and its member will not be liable for any indirect, incidental, special, consequential, or punitive damages, or for loss of data, loss of profits, or any consequence of an inaccuracy or omission in what you log, however caused and under any theory of liability. OpTally LLC's total liability for all claims arising from or relating to the Service will not exceed the greater of the amount you paid us for the Service in the twelve months before the claim or one hundred US dollars ($100). Some jurisdictions do not allow certain limitations; in those, our liability is limited to the fullest extent the law permits.

You are responsible for the accuracy and completeness of your official case log, for compliance with your institution's policies, and for any patient information you choose to enter. Whether your institution permits use of the Service is between you and your institution.

Governing law. These Terms are governed by the laws of the State of Texas, without regard to its conflict-of-laws rules. Any dispute arising from the Service will be brought exclusively in the state or federal courts located in Travis County, Texas, and you consent to their jurisdiction.

8. Termination & deletion

You may delete your account and data at any time from within the app. We may suspend accounts that violate these Terms.

9. Changes

We may update these Terms; material changes will be posted here with a new "last updated" date.

10. Contact

Questions: support@optally.io, or see the support page.

Privacy Policy Draft

What we collect, what we can't see, and who we share with. Pending legal review.

What we collect

• Account info: your email and display name.
• Usage metadata: counts of AI parses, timestamps like last login/last active, and your case count.
• Usage measurements (counts and timings only): when the app was opened; how many cases were logged and by which method (voice, typed, import); the number of days between an operation and its entry, and between logging and ACGME submission; which tabs were used; whether the browser extension is installed; whether a dictation failed and why (timeout, network); which parsed fields you corrected before saving (field names only, such as "attending"); your weekly answer to "any cases not logged yet?"; your category totals against the ACGME minimums; and, from your imported ACGME history, how long entries used to take. If the app hits an error, it reports the error message and location with any long number masked. None of this contains a procedure, a patient, an MRN, or an operation date.
• Encrypted case data: your cases are stored as ciphertext we cannot read.

What we cannot access

• Your case contents, procedures, operative notes, or preferences.
• Patient identifiers — none are collected.

How we use what we collect

• To provide the Service and sync it across your devices.
• To improve OpTally: to measure whether cases get logged sooner and more completely, and, only if you turn program sharing on, to show a residency program's staff counts and totals (never case contents).
• To keep the Service reliable and prevent abuse (e.g., usage caps).

Third parties

• Amazon Web Services — stores your encrypted cases. BAA in place. Their policy.
• Cloudflare — serves the application files and our DNS. Holds no patient data. Their policy.
• Anthropic (Claude) — receives only de-identified text for AI parsing; no patient identifiers. BAA in place (September 2026). Their policy.
• Resend — delivers our account emails (confirmation, password reset, invitations). Receives your email address, your display name, and the email itself; never case data. Their policy.
• Google Workspace — our support and privacy mailboxes. BAA in place. Their terms.
• Amazon Transcribe (part of AWS) — transcribes your dictation audio. Under our BAA; audio is not retained.
• Your browser vendor (Google or Apple) — only in the fallback case described above, where OpTally cannot capture audio itself. Not under our agreements.

Patient data

OpTally is designed so that no patient identifiers are ever exposed to us or to third parties. OpTally has no MRN field. Dictation and imported notes are stripped of MRNs, patient names, initials and dates of birth on your device before parsing, and those identifiers are never stored on a case. Your cases (procedure, date, attending, role, CPT codes, your notes) do sync between your own devices through Amazon Web Services, under a Business Associate Agreement; they are encrypted on your device first, so the server stores only ciphertext it cannot read. "Never leaves your device" would be inaccurate; "never readable by us or by the AI" is the accurate claim.

No training, no sharing

Nothing you put into OpTally — cases, dictations, notes, or your imported ACGME export — is used to train or improve any AI model, ours or a vendor's, or is sold, shared, or disclosed to anyone. See What we never do with your data.

Retention & your rights

• Your data is retained until you delete it. You can delete your account and all data at any time from Settings, or download a backup. Deletion removes your account, your encrypted data and your usage measurements immediately; encrypted copies can persist in our database backups for up to 35 days before they age out.
• Usage measurements are kept for 400 days and then expire automatically.
• Because your data lives (decrypted) only on your own devices, you always have direct access to it.

Children

OpTally is not directed at anyone under 18.

Changes & contact

We'll post updates here with a new date. Questions: privacy@optally.io.

To report a security issue: security@optally.io.