OnyeSync Privacy Policy

Onye Inc. ("Onye," "we," "us," "our") is committed to protecting your privacy and ensuring you have a positive experience on our platform, OnyeSync.

This Privacy Policy explains how Onye collects, uses, discloses, and safeguards information when you use our website (https://www.onyeone.com) and our cloud-based medical imaging platform, OnyeSync (the "Service"). Where enabled under the Services Agreement, the Service may include Patient Access API services, retrieval through TEFCA Individual Access Services, FHIR R4 data normalization, patient identity matching, and secure API integrations.

Note for Healthcare Organizations: The Service is provided to healthcare organizations (hospitals, imaging centers, clinics, and other healthcare providers). These organizations are responsible for managing patient access, consent, and notification.

When this Privacy Policy refers to "you" or "patient," it describes how healthcare organizations and patients interact with OnyeSync. Organizations control what PHI is shared and with whom, and organizations are responsible for obtaining necessary patient consent and providing required privacy notices to their patients.

1. WHAT INFORMATION WE COLLECT

1.1 Patient Medical Imaging Data (PHI)

Medical Imaging (DICOM Files):

• DICOM image files (CT scans, MRI scans, X-rays, ultrasound, PET, etc.)
• DICOM metadata (patient ID, name, date of birth, imaging modality, study date, radiologist info)

Radiology Reports:

• Structured radiology reports in HL7 ORU format
• Radiologist interpretations and impressions

Other Health Information and Interoperability Data: Where enabled under the Services Agreement, health information retrieved through Patient Access API services and TEFCA Individual Access Services, and data used to standardize records in FHIR R4 format and match patient identities across multiple healthcare providers.

1.2 Healthcare Provider Information

When you access OnyeSync as a clinician, we collect:

• Your name, credentials (MD, DO, NP, PA), and NPI number
• Your facility affiliation and role
• Your email address and phone number (optional)

1.3 Website Visitor Information

When you visit our website, we collect:

• IP address, browser type, device type, pages visited
• Time spent on pages and links clicked
• Approximate geographic location (city-level)

2. HOW WE USE YOUR INFORMATION

2.1 Patient Medical Imaging (PHI)

Primary Purpose: Patient Care

• Retrieve medical imaging and radiology reports from connected PACS systems and other authorized source systems
• Where enabled under the Services Agreement, retrieve health information via Patient Access API services and TEFCA Individual Access Services
• Where enabled under the Services Agreement, normalize and standardize data in FHIR R4 format and match patient identities across multiple healthcare providers
• Display imaging and reports to authorized radiologists and referring providers for patient care
• Share imaging and reports with patient-authorized providers, as permitted by HIPAA
• Transmit PHI to Customer via secure API where enabled under the Services Agreement

Prohibited Purposes (We DO NOT):

• Sell patient data to third parties
• Use data for marketing or advertising
• Use data for non-treatment research without consent
• Share with pharmaceutical companies

3. WHO WE SHARE YOUR INFORMATION WITH

3.1 Authorized Healthcare Providers (With Consent)

When you authorize sharing, Onye shares your imaging with referring providers you've designated. Sharing is limited to imaging needed for your care. Patients can revoke sharing authorization at any time.

3.2 Onye Employees (Limited Access)

• Engineering team (system maintenance/troubleshooting only)
• Security team (breach investigation/prevention only)
• Compliance officer (audit trail review only)

3.3 Third-Party Service Providers (Business Associates)

Onye uses HIPAA-compliant vendors:

• Supabase — Data storage and servers
• Backblaze B2 — Backup and disaster recovery

Each vendor has signed a Business Associate Agreement and complies with HIPAA.

4. DATA RETENTION & DELETION

4.1 How Long We Keep Your Data

Patient Medical Imaging: Retained while the Customer's account is active, for up to seven (7) years from the date of creation or last access, or longer if required by law. After account termination, PHI is returned or destroyed as described in the Terms of Use and the BAA.

Audit Logs: Retained for minimum 6 years (HIPAA requirement)

De-Identified Data: May be retained by Onye for analytics, research, benchmarking, and other lawful purposes, subject to applicable law and Onye's commitment not to re-identify the data.

5. DATA SECURITY SAFEGUARDS

5.1 Encryption

Data in Transit (Network):

• TLS 1.2 or higher encryption for all connections
• Certificate-based HTTPS for all web connections

Data at Rest (Stored):

• AES-256 encryption for all PHI storage
• Separate encryption keys per customer
• Annual key rotation

5.2 Access Controls

• Multi-factor authentication (MFA) required for all users
• Sign-in code required for every login
• Session timeout after 15 minutes of inactivity

6. YOUR PRIVACY RIGHTS

6.1 Patient Rights Under HIPAA

Right to Access: Request and receive a copy of your health information in DICOM or PDF format. Timeline: 30 days.

Right to Amendment: Request correction of inaccurate health information. Timeline: Response within 60 days.

Right to Accounting of Disclosures: Request a list of everyone we disclosed your information to. Timeline: 30 days. Frequency: Once per year free.

7. PRIVACY BREACH NOTIFICATION

If a breach affecting your data is suspected or discovered, Onye will:

1. Begin investigating promptly and no later than 24 hours from discovery
2. Notify your healthcare provider and assess the scope (within 24 hours of discovery)
3. Provide detailed breach investigation report (within 7 days of discovery)
4. Offer remediation services (such as credit monitoring if SSN or financial data compromised)

8. CONTACT US

Privacy Questions:
Email: info@onyeone.com | Phone: 917-557-2585

Breach Reporting (Urgent):
Email: info@onyeone.com | Phone: 917-557-2585

ACKNOWLEDGMENT

By using OnyeSync, you acknowledge that you have read this Privacy Policy, understand our practices, and consent to the data practices described herein.

View or download PDF