OPIA Clinical LLC ("OPIA," "we," "us") provides an eSource (electronic source data capture) platform used by clinical trial sites to record and manage subject visit data for ophthalmology studies. This policy explains what data the platform collects, how it's used, and who's responsible for it.
OPIA is used by site staff — study coordinators, principal investigators (PIs), and clinical research associates (CRAs) — not directly by clinical trial subjects. Subject data is entered into the platform by authorized site personnel on the subject's behalf, under the site's own informed consent and IRB/ethics approval for the study.
Data entered by a site remains that site's data. OPIA acts as a data processor / business associate on the site's behalf — we store and make the data available to the site, but the site (and its sponsor, where applicable) controls what the data is used for and remains responsible for compliance with its own IRB, informed consent, and applicable research regulations.
Data is used solely to operate the platform for the site(s) that entered it: displaying visit records, generating source document exports, computing monitoring/audit views for authorized CRAs, and sending account and notification emails (e.g. query alerts, weekly digests) to authorized users. We do not sell subject or coordinator data, and we do not share it with third parties beyond the infrastructure providers listed below.
We use trusted third-party service providers to operate OPIA, including for cloud database hosting and authentication, application hosting, and transactional email delivery (e.g. notifications and digests). These providers are contractually restricted from using data for any purpose other than providing their service to us. A full list of current subprocessors is available on request.
We retain a site's data for as long as the site's account is active. If a site's contract with OPIA ends, we make that site's data available for export for a defined period before deletion.
Data is encrypted in transit and at rest by our infrastructure providers. Access to subject data is restricted to authenticated site personnel with an appropriate role, and all data changes are recorded in an audit trail. Accounts support multi-factor authentication (TOTP) and are automatically logged out after a period of inactivity.
Because OPIA acts as a processor on behalf of sites, requests to access, correct, or delete subject data should generally go through the site that entered it. Site staff can contact us directly for account-level requests (e.g. deactivating a coordinator account).
OPIA Clinical LLC is a California limited liability company. Depending on the nature and volume of data processed, California residents may have rights under the CCPA/CPRA to know, delete, or opt out of certain uses of their personal information.
OPIA is a business tool used by clinical research professionals and is not directed at children. Where a study protocol enrolls pediatric subjects, subject data is entered by site staff, not by the child directly.
If we become aware of a security incident affecting a site's data, we will notify the affected site without unreasonable delay so that it can meet its own regulatory and sponsor notification obligations.
We'll update the "last updated" date below when this policy changes, and will notify site administrators of material changes.
Contact: support@opiaclinical.com
Last updated: working draft, September 25, 2026 — pending attorney review before use with real subject data.