Employee SMS Data Handling Policy

Customer Data Is Confidential

Phone numbers, names, message content, and any information a customer shares by text are confidential business records of OCuSOFT and the customer’s personal information. Treat them with the same care as any other sensitive customer record.

• Do not copy, export, screenshot, forward, or download recipient lists or conversations except as required to do your job.
• Do not share customer numbers or message content with anyone outside OCuSOFT, or with coworkers who have no business need to see them.
• Do not use customer contact information for any purpose other than the authorized business reason it was collected for.

Access Is Limited to Your Job Duties

Access to SMS Pulse is granted through your OCuSOFT account and limited to authorized staff. Only access the numbers, batches, and conversations you need for your assigned work.

• Keep your login credentials private. Never share your account or let someone send under your identity.
• Sign in only on OCuSOFT-managed or trusted devices, and lock your screen when you step away.
• Actions you take in the tool (sending, replying, opting out) are recorded in the audit log and tied to your account.

Lawful Basis & Consent Before Messaging

Only message a person when OCuSOFT has a lawful basis to contact them — an existing business relationship, their prior request, or their consent. Do not load numbers obtained without permission, purchased lists, or numbers scraped from third-party sources.

• On first contact, the message must identify OCuSOFT and include opt-out language (“Reply STOP to opt out”).
• Send only during reasonable hours (generally 8am–9pm in the recipient’s local time).
• Consent records must be truthful. Only mark a customer as opted in (via the inbox badge or the admin opt-in list) when they actually agreed to receive texts. Fabricating a consent record is a serious compliance violation.
• If you are unsure whether you may message someone, do not send — ask your supervisor first.

Honor Opt-Outs Without Exception

When a customer replies STOP, UNSUBSCRIBE, or CANCEL, the system suppresses their number automatically. You must never undermine that.

• Never message a number on the opt-out / suppression list, and never try to bypass or remove the suppression.
• Do not re-add an opted-out person from a new number, alternate spelling, or a separate list to “get around” the block.
• Only re-enable messaging if the customer clearly opts back in (e.g., replies START or YES, or asks in writing).

No Sensitive or Health Information

SMS is not a secure channel. Do not request, send, or store protected health information (PHI), payment card numbers, government IDs, passwords, or other sensitive data through text messages. If a customer sends such information, do not repeat it back; move the conversation to an appropriate secure channel such as email.

Retention

Message records are retained in SMS Pulse for legitimate business and compliance purposes and are managed centrally. Do not keep your own separate copies of customer numbers or conversations (spreadsheets, notes apps, personal phones). Delete any working copies once they are no longer needed.

Report Problems Immediately

If you suspect customer data has been exposed, lost, sent to the wrong person, or accessed without authorization, or if you sent a message in error, report it right away to your supervisor and IT. Prompt reporting protects the customer and the company; concealment makes it worse.

Enforcement

Following this policy is a condition of your access to SMS Pulse. Violations may result in loss of access and disciplinary action up to and including termination, and may carry legal consequences for conduct that violates privacy or anti-spam laws.

Questions

Direct questions about this policy to your supervisor or to ithelp@ocusoft.com / (281) 239-9800. See also the Employee SMS Terms of Use.