About This Portal WebRX is the ordering portal Valley Contax provides to eye care practices for placing and tracking custom contact lens orders. This notice explains what information the portal collects, how it is used, and who can see it. Patient Information Orders may include patient details your practice enters — the patient’s name, a patient ID, lens prescription parameters, keratometry readings and refraction data, and any files you attach (for example, topography maps or images). This is protected health information. It is used solely to design, manufacture, and support the ordered lenses, and is never used for marketing. Please enter only the patient information needed to fulfill the order. Account Information We keep the details needed to operate your account: practice or company name, contact name, email address, phone number, username, account number, and any sub-user accounts you create. Passwords are stored as one-way hashes and cannot be read by anyone, including Valley Contax staff. Cookies The portal sets a session cookie that keeps you signed in. It is first-party, cannot be read by page scripts (HttpOnly), and expires after two hours of inactivity. If you choose "trust this device" during two-factor authentication, a second cookie remembers the device for the period configured by the administrator (30 days by default) so you are not asked for a code on every sign-in; our servers store only a hashed token. Neither cookie is used for advertising, analytics, or cross-site tracking, and because both are essential to providing the service they do not require opt-in consent. What We Record For security and auditing we log sign-in attempts — successful and failed — including the account involved, the date and time, and the IP address the request came from. We also record order submissions and changes, comments, file uploads, and administrative actions in an internal audit trail. When you trust a device for two-factor authentication, we record the browser identifier and IP address it was trusted from. Verification codes are stored hashed and expire within minutes. Email The portal sends transactional email only: order confirmations, order status updates, comment notifications, and two-factor authentication codes. Messages are delivered through our email provider. We do not send marketing email from the portal. Retention and Backups Orders, comments, files, and audit records are retained as business records for as long as needed to support your account, meet warranty and quality obligations, and satisfy legal requirements. The database and uploaded files are backed up regularly. Security Access requires a username and password, with email-based two-factor authentication available (and required for some roles). Passwords are hashed, sessions end after two hours of inactivity, uploaded files are validated, and role-based permissions restrict every user to the records their role allows. Who Can Access Your Information Your orders are visible to the users on your account (including sub-users you create) and to authorized Valley Contax staff who process and support them. We do not sell your information and we do not share it with third parties for marketing. Contact Questions about this notice, or requests to review or correct your information? Contact Valley Contax at 541.744.9393. Last updated: July 29, 2026