Privacy Policy

1. Information We Collect

We collect the information described below when you create an account, complete your professional profile, enroll in and take courses, or join our mailing list.

A. Account and Profile Information

You provide this information directly when you register and build your CME profile:

• Name, including honorific, first, middle, and last name, and any professional title
• Email address and password (your password is stored only in hashed form)
• Professional information used to issue and report CME credit: credential or degree (e.g., MD, DO, NP, PA, RN, PharmD), National Provider Identifier (NPI), professional license number and licensing state, and specialty
• Institution or practice affiliation and a short professional bio
• Phone number and postal mailing address
• Date of birth, used to match your records with certifying board systems
• Financial-disclosure information you provide to meet ACCME requirements for accredited education

B. Enrollment and Payment Information

When you enroll in a course, we record your enrollment and completion status. Paid enrollments are processed by our payment processor, Authorize.Net. We do not receive or store your full card number; we retain only a reference to the processor's transaction and, for our records, the amount charged and any discount or refund.

C. Course Activity and Video-Integrity Data

Because our CME credits require verified engagement with course material, we collect learning-activity data as you take a course, including:

• Lesson progress, watch time, and completion status
• Quiz attempts, answers, and scores; course and program evaluation responses; and your attestation of the amount of credit you are claiming
• Video-integrity signals used to confirm genuine viewing, such as periodic playback position (heartbeats), blocked forward-skip attempts, the number of times the browser tab was left during playback, and the highest playback speed used

This information is used to verify that credit requirements were met and to protect the integrity of accredited education.

D. Mailing-List Information

If you sign up to hear from us through a form on our public site, we collect your email address, optionally your name and specialty interest, and a record of your consent to be contacted.

E. CME Certificates and Credit Records

When you complete a course, we generate a CME certificate and a corresponding credit record that includes your name, credential, NPI, the course, and the credit earned.

2. How We Use Your Information

We use the information we collect to:

• Create and manage your account and process your course enrollments and payments
• Deliver course content and track your progress toward completion
• Deliver accredited CME/CE, verify that credit requirements have been met, issue your certificate, and record and report the credit you earn — including to the ACCME's Program and Activity Reporting System (PARS) and to the specialty certifying boards and state licensing boards that recognize the credit
• Send you transactional messages, such as receipts, enrollment confirmations, and certificates
• Send course announcements and educational updates, where you have opted in to receive them
• Maintain the security and integrity of our platform and our accredited education, and comply with our legal and accreditation obligations

3. How We Share Your Information

We do not sell your personal information. We share information only with the service providers that help us operate OFLA, and as required for accreditation or by law. Our service providers include:

• Authorize.Net — payment processing
• Resend — delivery of transactional email (receipts, confirmations, certificates)
• Mux — video hosting and playback
• Google — optional “Sign in with Google” authentication, if you choose to use it
• Sentry — application error monitoring and diagnostics
• Neon — database hosting
• Vercel — application hosting and privacy-focused web analytics
• Anthropic — AI-assisted generation of quiz questions. Only course and lesson content is sent to this service; it does not receive your personal information.

These providers process information on our behalf to provide their services. We also share your CME completion and credit information with accreditation and certifying organizations — including the ACCME's Program and Activity Reporting System (PARS) and the specialty and state boards that recognize your credit — as needed to issue and report your credit. We may disclose information if required to do so by law or to respond to lawful requests by public authorities. We do not permit any of these providers to use your information for their own advertising, and we do not share your data with third-party advertising or ad-tracking networks.

4. Cookies & Video Analytics

OFLA uses strictly necessary cookies to keep you signed in and to secure your session (including authentication and CSRF-protection cookies). We also use limited error- monitoring instrumentation (Sentry) to detect and diagnose problems with the platform. We do not use advertising cookies, and we do not track your activity across other websites for marketing.

We use Vercel Web Analytics to understand how the site is used. It records page views without cookies — the page visited, the referring site, country, and device and browser type — and counts visitors using an anonymized identifier that resets every day, so it does not build a profile of you or track you across other websites. We see this data only in aggregate.

When you watch a course video, our video provider (Mux) collects playback and quality-of- experience data associated with an identifier for your account. We use this solely to operate the platform and to verify course completion for CME credit — not for advertising. See Mux's privacy practices for details. Because our essential cookies are required to keep you logged in, disabling them will prevent you from using the learning platform.

5. Data Security

We use industry-standard safeguards to protect your information:

• Information is transmitted over encrypted connections using Transport Layer Security (TLS/HTTPS).
• Data is encrypted at rest in our hosted database. Sensitive contact and identity details — your mailing address, phone number, and date of birth — are additionally protected with application-level field encryption. Professional identifiers such as your NPI and license number, which are part of public provider registries, are stored in our access-controlled database.
• Passwords are never stored in plain text; they are kept only as a bcrypt hash.
• Access to personal and professional data is limited through role-based access controls.

No method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security, but we work to protect your information against unauthorized access, loss, or disclosure.

6. Your Choices and Rights

• Email preferences: If you have an account, you can turn course and marketing emails on or off using the Email Preferences setting in your account. If you joined our mailing list without an account, every marketing email includes an unsubscribe link.
• Update your profile: You can review and edit your profile and professional information at any time in your Account Settings.
• Access, correction, and deletion: You may request access to, correction of, or deletion of the personal information we hold about you by emailing us at spetterson@ofals.org. These requests are handled manually by our team. We will verify your identity and honor valid requests, subject to one important exception: accreditation and credit records must be retained for the audit periods described below and cannot be deleted on request.
• California residents: California residents have the right to know what personal information we collect about them, to request its deletion, and to opt out of the sale of personal information. OFLA does not sell personal information, so there is nothing to opt out of. To exercise your rights, contact us at the email address above.
• Other states: Depending on your state of residence, you may have additional privacy rights, such as the right to access, correct, or delete your personal information. We will respond to verifiable requests as required by applicable law.

7. Children's Privacy

OFLA is intended for licensed and practicing healthcare professionals. Our services are not directed to children, and we do not knowingly collect personal information from anyone under the age of 13 (or under 16 where a higher age applies). If you believe a child has provided us with personal information, please contact us and we will delete it.

8. Data Retention

We retain your account and profile information for as long as your account is active and as needed to provide our services. If you close your account or ask us to delete your data, we will do so subject to an important exception: CME certificates and the credit and completion records that support them are retained as long as required for accreditation, credit reporting, and audit purposes, even after your account is changed or closed. This is necessary to verify the validity of continuing education credit and to meet the long-term audit obligations of the ACCME and of the specialty certifying and state licensing boards that recognize the credit.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. Material changes will be reflected here, and your continued use of OFLA after an update means you accept the revised policy.

10. Contact Us

If you have any questions about this Privacy Policy or how your information is handled, please contact us: