Privacy Policy

Account information. Your name, email address, password (stored only as a cryptographic hash), phone number, job title and time zone. If you sign in with Google, we receive your name, email address and profile image from that provider.

Professional records. Certification details and numbers, credential dates and standing, continuing education and professional development units, training certificates you upload, employment history, supervision sessions, service hours, competency assessments, onboarding progress and development reviews.

Documents you upload. Certificates, verification letters and similar files, plus text extracted from them so entries can be filled in automatically.

Signatures. When a supervisor signs a supervision log, we store the drawn signature image, their name, the time of signing and the record it applies to.

Payment information. Subscription status, plan and billing history. Card details are collected and stored by our payment processor, Stripe — we never see or store full card numbers.

Device and usage information. Push notification tokens if you enable notifications, log data such as IP address and browser type, and basic usage events used to keep the service reliable and secure.

• To provide the service: tracking supervision, credentials, continuing education and onboarding.
• To calculate compliance status against published certification requirements.
• To send reminders, renewal notices and signature requests you have asked for.
• To read uploaded certificates with automated extraction so you type less.
• To process subscriptions and prevent abuse.
• To support you when you contact us, and to fix faults.

We do not sell your personal information, and we do not use it for third-party advertising.

Your Professional Passport is yours. Credentials, continuing education and personal records you add to your own passport are private to you unless you share them.

Supervisors. A supervisor you connect with can see the supervision and development records relevant to that supervisory relationship. You can end a connection at any time.

Organizations. If you are a member of an organization, administrators and clinical leaders in that organization can see your employment record, onboarding, supervision and credential compliance for that organization. Access is restricted by role, and database access rules enforce it on every request.

Links you create. Public share links and signature links show only the specific record they were created for, to anyone holding the link. You can revoke them.

Service providers. Hosting and database infrastructure, email delivery, payment processing and the AI provider used for certificate extraction. They process data on our instructions only.

We may also disclose information where required by law, or to protect the safety and rights of users and the service.

When you upload a certificate, its contents are sent to an AI provider to extract fields such as the event title, date, provider, unit counts and certification numbers. The extracted values are shown to you for review before they are saved, and you can edit or delete them. This processing is used only to fill in your own records.

Data is stored on managed cloud infrastructure in the United States. Access is protected by authentication, row-level database security policies scoped to your account and organization, encryption in transit and encryption at rest. Uploaded files are held in access-controlled storage.

If you use the installed app or mobile app, a copy of your recent records is cached on the device so it works offline. Signing out or clearing app data removes that local copy.

We keep your records for as long as your account is active, because certification cycles and audits often require several years of history. Deleted entries are removed from your workspace immediately. When you close your account, personal data is deleted within 30 days, except records we are required to keep for legal, tax or dispute-resolution purposes.

Organization-owned employment records may be retained by the organization after you leave it. Records in your Professional Passport stay with you.

• Access and correct your personal details from My Account.
• Export your passport records and supervision logs as PDF or CSV at any time.
• Turn email reminders and push notifications on or off in your preferences.
• Revoke share links and supervisor connections you no longer want.
• Request deletion of your account and personal data by writing to privacy@operation-optimize.com.

Depending on where you live, you may also have rights to object to or restrict processing, and to lodge a complaint with a supervisory authority.

Operation Optimize is a professional tool intended for people aged 18 and over. We do not knowingly collect information from children. The platform is not designed to hold client or patient records — please do not enter protected health information about the people you serve.

We will update this page when our practices change and revise the date above. If a change materially affects how your information is used, we will notify you by email or in the app.

Questions about privacy, or a request about your data: privacy@operation-optimize.com. See also our Terms of Service.