Privacy Policy

Opis Security Investigations ("Opis," "we," "our," or "us") is committed to protecting your privacy and handling your personal information with the highest level of discretion and security. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit our website or engage our services.

This policy is designed to comply with applicable privacy laws including the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), the Health Insurance Portability and Accountability Act (HIPAA), and applicable federal and state investigative privacy regulations.

We may collect the following categories of information:

• Contact information (name, email address, phone number, company)
• Inquiry and case-related information you voluntarily provide
• Technical data (IP address, browser type, device info) via standard server logs
• For medical/healthcare clients: Protected Health Information (PHI) only as required and under formal data processing agreements
• Communications you initiate with us (contact forms, email, phone)

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

We use collected information solely to:

• Respond to your inquiries and provide requested services
• Schedule consultations and demos
• Communicate regarding active engagements
• Comply with legal obligations and regulatory requirements
• Improve our website and service delivery
• Connect you with appropriate training or partner resources

When engaged by hospitals, medical practices, insurers, or healthcare entities, Opis Security Investigations operates in compliance with HIPAA. Any Protected Health Information (PHI) shared in the course of a medical malpractice investigation, internal hospital inquiry, or insurance investigation is handled under a Business Associate Agreement (BAA) and is subject to strict access controls, encryption, and confidentiality obligations.

PHI is accessed only on a need-to-know basis, retained only as long as required by law or the engagement agreement, and disposed of securely upon conclusion of services.

If you are located in the European Union or United Kingdom, you have the following rights under the GDPR:

• Right to access the personal data we hold about you
• Right to rectification of inaccurate data
• Right to erasure (“right to be forgotten”)
• Right to restrict or object to processing
• Right to data portability
• Right to withdraw consent at any time

To exercise any of these rights, contact us at privacy@opissecurity.com.

California residents have the right to know what personal information we collect, the right to delete personal information, and the right to opt out of the sale of personal information. We do not sell personal information. To submit a CCPA request, contact us at privacy@opissecurity.com.

We implement industry-standard technical and organizational security measures to protect your information against unauthorized access, disclosure, alteration, or destruction. All sensitive communications and case files are handled through encrypted channels. Our personnel are bound by confidentiality obligations.

We retain personal information only as long as necessary to fulfill the purposes outlined in this policy, comply with legal obligations, resolve disputes, and enforce agreements. Healthcare-related records are retained in accordance with HIPAA retention requirements (minimum 6 years from creation or last effective date).

We do not sell or share your information with third parties except in the following limited circumstances:

• With your explicit consent (e.g., referral to training partners)
• To comply with a legal obligation, court order, or law enforcement request
• To protect the rights, safety, or property of Opis or others
• With vetted sub-processors under data processing agreements

Our website uses only essential cookies necessary for basic site functionality. We do not use tracking or advertising cookies without your consent. You may disable cookies through your browser settings; however, some site features may be affected.

For any privacy-related questions, data requests, or to report a concern:

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. Continued use of our website or services constitutes acceptance of the revised policy.