1. Information We Collect

Website Visitors

When you visit odysseysolutions.co, we may automatically collect limited technical information through cookies and server log files, including your IP address, browser type, operating system, referring URL, pages viewed, and time of visit. Cookies are small text files stored on your device that help us understand how the site is used. We use this information internally to improve site performance and content — we do not sell it to third parties.

Contact Form & Consultation Requests

When you request a free consultation or contact us through the website, we ask you to provide: your name, business or practice name, email address, phone number, and a description of your IT, compliance, or web-development needs. Providing this information is voluntary, but required to respond to your inquiry.

Client Information

When your business engages Odyssey Solutions for services, we collect additional information necessary to deliver those services, including business contact information, billing details, system and network information, and — where we act as a Business Associate under HIPAA — Protected Health Information (PHI) belonging to your patients. All PHI is handled strictly in accordance with our HIPAA Notice and the signed Business Associate Agreement with each covered-entity client.

2. How We Use Your Information

• Respond to consultation requests and communicate about our services
• Deliver, configure, monitor, and support the services you engage us for
• Process payments and issue invoices
• Send service-related communications (scheduled maintenance, incident notices, compliance updates, renewals)
• Improve our services, website, and internal operations
• Detect and prevent fraud, unauthorized access, or security incidents
• Comply with legal, regulatory, and contractual obligations
• Enforce our Terms of Service and protect our legal rights

We may use your information for more than one of these purposes at a time. We do not sell your personal information, and we do not share it for third-party marketing.

3. How We Share Your Information

We only share your information in the following limited circumstances:

• Service providers and subcontractors that help us deliver our services (cloud infrastructure, email, backup, ticketing, payment processing). Each provider is bound by contract to protect your data; where PHI is involved, each is covered by a Business Associate Agreement.
• Your authorized representatives (staff, managed-service vendors, auditors) when you direct us to share information with them.
• Legal and regulatory authorities when required by law, subpoena, or court order, or to respond to a credible threat to health or safety.
• Successors in the event of a merger, acquisition, or sale of assets — subject to the same obligations described here.

We will never sell, rent, or trade your personal information; share website analytics data with unaffiliated third parties for marketing; or disclose client PHI outside the terms of your Business Associate Agreement.

4. Text Message (SMS) Communication

With your consent, we may send text messages for appointment reminders, scheduling confirmations, service-incident alerts, and compliance-program communications. You can opt out at any time by replying STOP to any message. Replying HELP will return contact information. Message and data rates may apply. To re-enroll, contact us at the Privacy Officer details below.

5. Cookies & Analytics

Our website uses first-party cookies to remember preferences and may use privacy-respecting analytics to measure site performance. You can disable cookies in your browser settings; some site features may not work without them. We do not use third-party advertising cookies or cross-site tracking.

6. Data Security

We maintain administrative, physical, and technical safeguards aligned with the HIPAA Security Rule and industry best practices, including: encryption of data in transit and at rest, role-based access control, multi-factor authentication, continuous monitoring, regular backup and restore testing, documented risk assessments, and a written incident-response plan. No internet-connected system can guarantee absolute security, but we treat protecting your data as foundational to our business.

7. Data Retention

We retain personal information only as long as needed to deliver our services, satisfy legal and regulatory requirements, resolve disputes, and enforce our agreements. Client records covered by HIPAA are retained for at least six (6) years from creation or last effective date, consistent with HIPAA documentation-retention rules. Website log data is retained for a limited period and purged on a rolling basis.

8. Your Rights

• Access the personal information we hold about you
• Correct information that is inaccurate or incomplete
• Request deletion of information we are not legally or contractually required to retain
• Restrict or object to certain uses of your information
• Withdraw consent for communications or processing where consent was the basis
• Opt out of SMS communications (reply STOP)

To exercise any of these rights, contact our Privacy Officer using the details below. We will respond within a reasonable time frame and at no cost to you.

9. Children's Privacy

Our services are offered to businesses. Our website is not directed to children under 13, and we do not knowingly collect personal information from children. If you believe a child has submitted information through our site, contact us and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last Updated" date at the top of the page reflects the most recent revision. Material changes will be communicated through a notice on our website or directly to clients via email at the address on file. Continued use of our services after changes take effect constitutes acceptance of the revised policy.

1. Who We Are

Odyssey Solutions is a Texas-based provider of managed IT services, HIPAA compliance and training services, and web development. References to "we," "us," or "our" mean Odyssey Solutions. References to "you" or "Client" mean the individual or business accessing our website or engaging our services.

2. Services

We provide the services described on this website, including but not limited to: managed IT services, cybersecurity, HIPAA program design and staff training, risk assessments, policy development, Business Associate Agreement management, web design and development, and ongoing support. The specific scope, deliverables, fees, and timelines for any engagement are set out in a written Statement of Work (SOW) or service agreement signed by both parties.

3. Your Responsibilities

• Provide accurate, complete, and current information when you submit inquiries or engage our services
• Designate authorized personnel to make decisions on behalf of your organization
• Grant timely access to systems, facilities, and information we reasonably need to deliver services
• Maintain lawful licensing for any third-party software or content you ask us to install, host, or work with
• Keep your own account credentials secure and notify us immediately of any suspected compromise
• Comply with applicable laws, including privacy and healthcare regulations, regarding the data you share with us

4. Fees & Payment

Fees are set out in your signed SOW or service agreement. Unless otherwise agreed, invoices are due within thirty (30) days of issuance. Past-due balances may accrue interest at 1.5% per month or the maximum permitted by Texas law, whichever is less. We may suspend services for accounts more than 30 days past due, after reasonable notice.

5. Intellectual Property

All content on this website — including text, graphics, logos, images, and code — is owned by Odyssey Solutions or its licensors and protected by U.S. and international intellectual-property law. You may not copy, modify, redistribute, or create derivative works from our content without prior written consent.

For client engagements: upon full payment, you own the final, delivered work product (website, written policies, configuration documentation) specific to your business. We retain ownership of our underlying tools, templates, methodologies, know-how, and any general-purpose software or components we develop. We grant you a perpetual, non-exclusive license to use those underlying materials as needed to benefit from the delivered work.

6. Confidentiality

Each party agrees to protect the other's confidential information with at least the same care used for its own, and only to use that information for the purposes of the engagement. Where Protected Health Information is involved, the terms of the signed Business Associate Agreement govern — see our HIPAA Notice for details.

7. Disclaimers

Our website and any free content on it are provided "as is" without warranty of any kind. Client engagements are governed by the warranties (if any) expressly set out in the signed SOW or service agreement — no additional warranties are implied. We do not warrant that our website will be uninterrupted, error-free, or free of viruses or other harmful components.

8. Limitation of Liability

To the fullest extent permitted by law, Odyssey Solutions is not liable for any indirect, incidental, consequential, special, or punitive damages arising out of or related to your use of our website, including lost profits, lost data, or business interruption. For paid engagements, our total aggregate liability for any claim is limited to the fees paid by the Client to Odyssey Solutions in the twelve (12) months immediately preceding the claim. These limits do not apply to liability that cannot be limited under applicable law, or to obligations under a signed Business Associate Agreement.

9. Indemnification

You agree to indemnify and hold Odyssey Solutions harmless from claims, damages, and expenses (including reasonable attorneys' fees) arising from: (a) your breach of these Terms or any signed service agreement; (b) your violation of applicable law; or (c) your unlawful use of the services we provide.

10. Termination

Either party may terminate an engagement in accordance with the termination provisions in the signed SOW. Either party may terminate for material breach if the breach is not cured within thirty (30) days of written notice. On termination, we will return or securely destroy client data as required by the Business Associate Agreement (if applicable) and assist with a reasonable, good-faith transition at then-current rates.

11. Third-Party Services

We integrate with and rely on third-party vendors (cloud providers, email providers, backup services, payment processors, scheduling tools). Your use of those services through us is also subject to the third party's terms. We are not responsible for the acts, omissions, or outages of third-party services except as expressly agreed in a signed SOW.

12. Governing Law & Disputes

These Terms are governed by the laws of the State of Texas, without regard to conflict-of-laws rules. Any dispute arising out of or related to these Terms or our services will be brought exclusively in the state or federal courts located in Harris County, Texas, and both parties consent to the jurisdiction of those courts.

13. Changes to These Terms

We may update these Terms periodically. Material changes will be posted on this page with a new "Last Updated" date and, for active clients, communicated via email. Continued use of our website or services after the effective date constitutes acceptance.

14. Entire Agreement

These Terms, together with our Privacy Policy, HIPAA Notice, and any signed SOW or service agreement, form the complete agreement between you and Odyssey Solutions regarding the subject matter. If any provision is held unenforceable, the remaining provisions remain in full effect.

1. Our Role Under HIPAA

A Covered Entity (for example, a dental practice, medical clinic, or mental-health provider) collects and maintains PHI in the course of patient care. When that Covered Entity engages Odyssey Solutions to deliver IT infrastructure, cybersecurity, backups, EHR support, policy development, or HIPAA training, we become a Business Associate. Our responsibilities are governed by:

• The HIPAA Privacy Rule (45 CFR Part 160 and Subparts A and E of Part 164)
• The HIPAA Security Rule (45 CFR Part 160 and Subparts A and C of Part 164)
• The HIPAA Breach Notification Rule (45 CFR §§ 164.400-414)
• The HITECH Act and subsequent Omnibus rulemaking
• A signed Business Associate Agreement (BAA) with each Covered Entity client

2. Business Associate Agreements

We sign a Business Associate Agreement with every Covered Entity client before handling any PHI. The BAA sets out the permitted uses and disclosures of PHI, the safeguards we must implement, our breach-notification obligations, and the terms under which we return or destroy PHI at the end of the engagement.

When our engagement requires PHI to pass through third-party vendors (cloud hosting, offsite backup, email filtering, helpdesk tooling), we sign downstream BAAs with each of those subcontractors. If a subcontractor will not sign a BAA, we do not route PHI through them.

3. Safeguards We Maintain

Administrative Safeguards

• Written HIPAA Security policies and procedures, reviewed at least annually
• Documented risk analysis and risk-management plan
• Role-based access controls — workforce members only access the PHI required for their assigned duties
• Mandatory HIPAA training for every technician before they are assigned to a covered account
• Sanctions policy for workforce members who violate HIPAA policies
• Written incident-response and breach-notification procedures

Technical Safeguards

• Encryption of PHI in transit (TLS) and at rest (AES-256 or equivalent)
• Multi-factor authentication for all workforce and vendor access to PHI systems
• Unique user IDs, automatic session timeouts, and audit logging
• Endpoint protection, patch management, and vulnerability monitoring
• Segmented networks, firewall rules, and VPN-only remote access for administrative tasks
• Backup integrity testing and documented recovery procedures

Physical Safeguards

• Workstation use and device controls per written policy
• Secure disposal and media re-use procedures for any device that has stored PHI
• Facility and workstation security guidance issued to every client as part of onboarding

4. Permitted Uses & Disclosures of PHI

We use and disclose PHI only as permitted by the signed BAA with the relevant Covered Entity and as required or permitted by law. Typical permitted activities include:

• Performing the IT, security, backup, EHR-support, or compliance services specified in the engagement
• Providing required reporting to the Covered Entity about incidents, backups, and security events
• Disclosure to our own subcontractors under BAA, strictly as needed
• Disclosures required by law, subpoena, or valid regulatory request

We do not use or disclose PHI for marketing, advertising, sale, or any purpose outside the scope of the BAA.

5. Breach Notification

If we discover a breach or suspected breach of unsecured PHI, we will notify the affected Covered Entity without unreasonable delay and no later than the time frame required by the BAA and 45 CFR § 164.410 (generally, within 60 days of discovery). Our notification will include the information reasonably available to us about the incident, the individuals and systems involved, the steps taken to mitigate harm, and our plan to prevent recurrence. The Covered Entity remains responsible for any required notifications to affected individuals and the U.S. Department of Health and Human Services.

6. Workforce Training

Every Odyssey Solutions technician, engineer, and compliance consultant completes HIPAA Privacy, Security, and Breach Notification training before handling any PHI and annually thereafter. Training records are maintained for at least six (6) years and are available to audited Covered Entity clients on request.

7. Record Retention

We retain HIPAA-required documentation (policies, risk assessments, training records, incident reports, access logs, BAAs, backup verification logs) for at least six (6) years from the date of creation or the date last in effect, whichever is later, consistent with 45 CFR § 164.316(b)(2).

8. Termination of Engagement

At the end of a client engagement, we return or securely destroy all PHI in our possession — including PHI held by our subcontractors — unless return or destruction is not feasible, in which case the protections of the BAA continue for as long as we retain the information.

9. Changes to This Notice

We may update this HIPAA Notice to reflect changes in law, our practices, or our engagements. The "Last Updated" date at the top of the page identifies the most recent revision. Material changes are communicated directly to Covered Entity clients.