Privacy Policy
Last updated:
How Optimus FZCO collects, uses and protects personal information on the Helix website and platform.
Contents
Who we are
Helix is an integrated Electronic Medical Records (EMR) and Enterprise Resource Planning (ERP) platform for healthcare providers. Helix and the website helixbydoctors.com are operated by Optimus FZCO ("Optimus", "we", "us"), a company registered in Dubai, United Arab Emirates, with its office at 3022, A5, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates.
This Privacy Policy explains how we collect, use, share and protect personal information. It covers two things: (1) our website and the forms on it, and (2) the Helix platform and related apps that we provide to healthcare organisations. We are committed to complying with the laws that apply to healthcare data, financial records and third-party integrations such as Meta platforms (Facebook and Instagram).
Our role: controller and processor
- Website visitors and business contacts. For information you give us on the website (for example when you book a demo) and for website analytics, Optimus is the data controller.
- Patient and clinic data in the platform. Healthcare facilities that use Helix decide what patient, clinical and financial data they record. For that data the facility is the data controller and Optimus acts as a data processor (service provider), processing it only on the facility's instructions and under our customer agreement.
- If you are a patient and have a question about your health record, please contact your healthcare provider first. We will support them in answering your request.
Information we collect on this website
Information you give us
When you book a demo, contact us, download a guide or subscribe to updates, we collect the details you enter. Depending on the form, this can include:
- Your name, work email address and phone number
- Your organisation or clinic name, your role, country and specialty
- The number of branches or users, the systems you use today, and your message to us
- Your preferred time for a demo and how you heard about us
Please do not send us patient information or other health data through the website forms.
Information collected automatically
- Device and browser information, IP address (used to estimate your country and city), language and screen size
- Pages you visit, links you click, the page you came from, and the time and date of your visit
- Campaign information in the link you followed, such as UTM parameters and ad click identifiers (for example the Google click ID "gclid" or the Meta click ID "fbclid")
- Cookies and similar technologies, as described in our Cookie Policy
How we use website information
| Purpose | Examples | Legal basis (where GDPR applies) |
|---|---|---|
| Respond to your request | Schedule and run a demo, answer a question, send a guide you asked for | Steps at your request before a contract; legitimate interests |
| Sales and customer relationship | Follow up on your enquiry, prepare a proposal, manage our relationship with your organisation | Legitimate interests |
| Marketing | Send product news and invitations; you can unsubscribe at any time | Consent where required by law; otherwise legitimate interests |
| Analytics | Understand how the website is used so we can improve it | Consent (in the EEA, UK and Switzerland); legitimate interests elsewhere |
| Advertising measurement | Measure which ads lead to demo requests and show relevant ads | Consent (in the EEA, UK and Switzerland); legitimate interests elsewhere |
| Security and legal | Prevent spam and abuse of our forms, keep records we are required to keep | Legitimate interests; legal obligation |
Where your enquiry goes
When you submit a form, your details are stored in Octopus, our internal sales and customer-success system, which runs on our own cloud infrastructure. Octopus notifies our team by email at info@optimusme.com so that the right person can respond. Only Optimus staff who need the information to help you (sales, customer success and management) can access it. We do not sell your personal information.
Cookies, analytics and advertising
Our website uses the following tools. With the exception of strictly necessary storage, they only set cookies or collect data in line with your cookie choices (see the next section). Full details, including the cookies each tool sets, are in our Cookie Policy.
- Google Tag Manager — a tool that loads our other website tags. It does not itself build a profile of you.
- Google Analytics 4 — measures visits, pages viewed and conversions (such as demo requests) so we can improve the website. We use it in a privacy-conscious configuration and do not use it to identify you personally.
- Google Ads — measures whether our ads lead to enquiries and helps us show relevant ads to people who visited our website (remarketing).
- Meta Pixel and Conversions API — measure the results of our ads on Facebook and Instagram and help us reach relevant audiences. The Conversions API sends event information from our servers to Meta; where it includes contact details, they are hashed before they are sent.
- LinkedIn Insight Tag — measures the results of our LinkedIn campaigns and provides aggregated, anonymised insights about the professional audience visiting our website.
These providers may process information on their own servers, including outside the United Arab Emirates, and may use it in line with their own privacy policies.
Your consent and how to withdraw it
- When you first visit, a banner asks you to accept or reject non-essential cookies. We use Google Consent Mode: for visitors in the European Economic Area, the United Kingdom and Switzerland, analytics and advertising storage is off by default until you accept. In other regions it is on by default and you can reject it at any time.
- You can change your choice at any time using the Cookie settings link in the footer of every page.
- You can also block or delete cookies in your browser settings, and manage ad personalisation in your Google, Meta and LinkedIn account settings.
- To stop marketing emails, use the unsubscribe link in any email or write to info@optimusme.com.
- Withdrawing consent does not affect processing that took place before you withdrew it.
Information we process in the Helix platform
Helix collects various types of data necessary to provide and improve our services to healthcare organisations:
- Personal information: names, contact details and identification information of patients, staff and other users.
- Health information: medical history, treatment records, prescriptions, results and other healthcare information managed through the EMR.
- Financial data: billing information, insurance claims, payment history and other financial records managed through the ERP functions.
- Social media and messaging data: content, campaigns and conversations when a facility connects Meta platforms (Facebook, Instagram, WhatsApp) to Helix.
- Usage data: how users interact with Helix, including log data, audit trails, usage patterns and preferences.
Consent
- Healthcare data: facilities are responsible for obtaining the consents that healthcare regulations require; Helix provides tools such as electronic consent forms with signatures.
- Financial data: consent is obtained for processing financial transactions and storing financial information where required.
- Social media data: users must explicitly connect their Meta accounts to Helix before content-management features are enabled.
- Third-party integrations: data is shared with third parties, including government health information exchanges, only with the explicit permission of the healthcare facility.
How platform data is used
- Healthcare management: to manage and store electronic health records, support patient care and help facilities comply with healthcare regulations.
- Financial operations: to manage billing, payments, claims and other financial transactions.
- Social media management: to create and manage content, campaigns and conversations on Meta platforms.
- Service operation and improvement: to provide support, keep the service secure and reliable, and improve our services using usage data.
AI features (Verto)
Helix includes AI features, called Verto, that can transcribe consultations, draft clinical notes and help staff with tasks. These features run on AI models hosted in Helix's own cloud environment; platform data is not sent to third-party AI services and is not used to train AI models. AI outputs are suggestions: clinicians and staff review, edit and approve them, and consequential actions require a human decision. AI actions are recorded in an audit log.
Sharing and disclosure
- Healthcare providers: data is shared with authorised healthcare providers only as needed for patient care, as configured by the facility.
- Government health systems and payers: data may be shared with health information exchanges (such as NABIDH or Malaffi), insurance and claims platforms, and e-invoicing authorities only when the healthcare facility enables and authorises it.
- Meta platforms: content and related data are shared with Meta as needed for the content-management and campaign features a facility turns on.
- Service providers: we use carefully selected providers for hosting, communications (such as SMS, email and WhatsApp delivery), analytics and advertising. They may only use the data to provide their service to us and are bound by confidentiality and data-protection obligations.
- Legal obligations: we may disclose data when the law requires it, to protect our legal rights, or to comply with regulatory requirements.
- Business changes: if Optimus is involved in a merger, acquisition or sale of assets, information may be transferred as part of that transaction, subject to this policy.
Data residency and international transfers
Customer data in the Helix platform is hosted with full GCC data residency. Information collected on our website (such as enquiries in Octopus) is stored on our cloud infrastructure. Some website tools, such as Google, Meta and LinkedIn, may process data in other countries, including the United States. Where the law requires it, we rely on appropriate safeguards for these transfers, such as standard contractual clauses.
How we protect information
- Encryption: sensitive data, including health and financial information, is encrypted in transit and at rest.
- Access controls: role-based permissions ensure that only authorised people can access sensitive information, and access is recorded in audit logs.
- Reviews: we carry out regular security reviews and vulnerability assessments.
No system is completely secure, but we work continuously to protect the information entrusted to us. You can read more on our Security page.
How long we keep information
- Website enquiries: for as long as needed to respond and to manage our relationship with you or your organisation. We periodically review enquiries that did not lead to a business relationship and delete or anonymise those we no longer need.
- Analytics and advertising data: according to the retention settings we configure in each tool and the provider's own policies.
- Health records: retained by the healthcare facility in line with healthcare regulations and our customer agreement.
- Financial records: retained for financial reporting, audit and legal compliance.
- Social media data: retained while a facility uses our social media features.
Your rights
Depending on where you live, you may have the right to:
- Access the personal information we hold about you
- Correct inaccurate or incomplete information
- Delete your information, subject to legal and regulatory retention obligations
- Object to certain processing, including direct marketing at any time
- Restrict processing in certain circumstances
- Portability — receive your information in a portable format or have it transferred to another provider
- Withdraw consent at any time, where we rely on consent
To exercise your rights, email support@optimusme.com. We may need to verify your identity. We aim to respond within one month. If your request concerns patient data held in the platform, we will pass it to, and work with, the healthcare facility that controls that data.
Visitors from the EEA, UK and Switzerland
If you are in the European Economic Area, the United Kingdom or Switzerland, the General Data Protection Regulation (GDPR) or equivalent local law gives you the rights listed above. The legal bases we rely on are set out in the table under "How we use website information". You also have the right to lodge a complaint with your local data protection authority, although we would appreciate the chance to address your concern first.
Children
Our website and marketing are intended for healthcare professionals and businesses. They are not directed at children, and we do not knowingly collect personal information from children through the website. The Helix platform may hold records of patients who are minors; this data is processed on behalf of, and under the responsibility of, the healthcare facility.
Governing law
This Privacy Policy is governed by the laws of the United Arab Emirates as applied in the Emirate of Dubai, without affecting any rights you have under the mandatory data protection laws of the country where you live.
Changes to this policy
We may update this Privacy Policy to reflect changes in our practices, technology or legal requirements. We will post the updated version on this page with a new "Last updated" date, and we will communicate significant changes through our website or by email.
Contact us
- Privacy questions and requests: support@optimusme.com
- General enquiries: info@optimusme.com
- Phone: +971 4 371 2718
- Post: Optimus FZCO, 3022, A5, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates