Last updated 3 November 2026
Privacy Policy
This policy explains how Specs Hub LLC (“we”) handles information when an optician or lab uses Opto360. We operate the service. Our website is specshubllc.com. Email specshub@gmail.com. We do not publish a phone number for this service.
The service is free
Opto360 is free to use for opticians and labs. We do not charge a subscription inside the app, and we do not sell a paid messaging add-on.
The optician owns the patient data
If you store patients in Opto360, you own that patient data. You are the data controller. You decide what to record, who on your staff may see it, and when it may leave the clinic.
We only process and host that data so we can provide Opto360 to you. We do not become the owner of your patient list. We do not use patient data for any other business, and we do not use it for marketing.
We do not sell or share patient data
Patient data is never sold. It is not shared with other clinics, advertisers, or data brokers. It is not used to build a product that is separate from running Opto360 for you.
Patient or prescription details leave your clinic account only when you choose to send an order to a connected lab. Until you do that, the record stays in your clinic account.
Where the service is hosted
The app is hosted on Vercel and the database on Neon. Both are in the United States. People you invite to your clinic can see the records you store, according to the role you give them. We do not offer a separate hosting region.
Cookies
We use a cookie only to keep you signed in. It remembers the session after you log in. We do not use advertising cookies or analytics cookies on this policy.
Export, delete, and closing an account
You can export patients, prescriptions, and invoices from the app, and you can delete patient records you no longer need. To close the clinic account, email specshub@gmail.com. When the account is closed, we delete that clinic’s data from Opto360. An order you already chose to send to a connected lab stays with that lab under its own terms. We may keep a minimal record if the law requires it, such as proof that an account existed.
Security
Passwords are stored as a hash, not as the password you typed. The sign-in cookie is httpOnly, so ordinary page scripts cannot read it. The app loads a clinic’s records only for users of that clinic. No method of storage is perfect. Please use a strong password and remove staff who leave the practice.
Not a HIPAA service
Opto360 is not HIPAA-certified. Clinics in the United States must not store protected health information (PHI) in this service. At sign-up you can choose an order-only account, which is for sending lab orders without storing patient names or contact details.
Consent is your responsibility
You are responsible for telling your patients what you record and for getting any consent your local law requires. We do not collect consent from your patients for you.
Changes
If this policy changes, we will update this page and the date at the top. The current page is the one that applies.