Privacy Policy
Sandstone Summit LLC, doing business as OM+ (“OM+,” “we,” “us”), provides practice-management software for orofacial myofunctional therapists. This Privacy Policy explains how we collect, use, and protect information.
Who This Policy Covers
OM+ serves two groups of people, and our role differs for each:
Practices and therapists who subscribe to OM+ are our direct customers. We collect and use their information to provide our software service.
Patients of practices using OM+ are not our customers — the practice is. Under HIPAA, OM+ acts as a Business Associate to each practice, which remains the Covered Entity responsible for patient care and privacy obligations. We handle patient information only as directed by and on behalf of the practice, under a signed Business Associate Agreement. If you are a patient with questions about your own health information, please contact your treating practice directly — they are responsible for your privacy notice and consent forms, not OM+.
Information We Collect
From practices and therapists: name, email address, business/practice information, and billing information (payment processing is handled directly by Stripe; we do not store full payment card details).
On behalf of practices, from their patients: contact information, appointment scheduling information, and — only as entered by the practice or the patient through practice-directed workflows — clinical intake and treatment information. This information is entered and controlled by the practice, not collected by OM+ independently.
How We Use Information
- To provide, maintain, and improve the OM+ platform
- To process subscription billing (via Stripe)
- To send transactional communications explicitly related to your account or a scheduled appointment — such as invite links, intake links, invoices, and appointment confirmations. We do not send marketing email, and every recipient is either an OM+ account holder or a patient entered by their own practice for a specific, existing relationship.
- To maintain the security and integrity of the platform
We do not sell personal information, and we do not use patient information for advertising or marketing of any kind.
How Information Is Shared
We share information only as necessary to operate the service, including with infrastructure providers (such as Amazon Web Services) and payment processors (Stripe), each under appropriate data protection agreements — including a signed Business Associate Agreement with AWS covering any protected health information.
We do not sell or rent personal information to third parties.
Data Security
We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the information we handle, consistent with HIPAA’s Security Rule, including encryption, access controls, and audit logging.
Your Choices
Practices and therapists may access, update, or request deletion of their account information by contacting us. Patients should direct requests regarding their own health information to their treating practice.
Contact Us
Questions about this policy can be directed to info@capitalfusion.com.