Privacy Policy
Effective date: November 1, 2026 · Controller: [Company legal name], doing business as Nuvanei Health, [address]
This Privacy Policy (the "Policy") describes how [Company legal name] ("Nuvanei Health," the "Company") collects, uses, discloses and protects personal information in connection with the Nuvanei Health practice-management platform, the patient mobile application, the public website at [website] and related services (collectively, the "Services"). It applies to the following categories of individuals: practice owners, providers and staff who use the Services on behalf of a health care practice ("Practice Users"); patients who use the patient application at a practice's invitation ("Patient Users"); and visitors to the public website and persons who contact the Company ("Visitors").
Protected Health Information. When a health care practice uses the Services, the Company processes patients' Protected Health Information ("PHI") on the practice's behalf as a Business Associate under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"). That processing is governed by the Business Associate Agreement between the Company and the practice and by the practice's own Notice of Privacy Practices, not by this Policy. Patient Users with questions about the use or disclosure of their health information, or who wish to exercise HIPAA rights of access, amendment or accounting, should contact their practice. Sections 2 through 4 of this Policy describe the Company's role with respect to PHI for completeness only.
1. Scope and Definitions
1.1 "Personal Information" means information that identifies, relates to, describes or is reasonably capable of being associated with a particular individual or household. Personal Information does not include de-identified or aggregated information that cannot reasonably be linked to an individual, or publicly available information.
1.2 "Account Information" means Personal Information that a Practice User or Patient User provides to create and maintain an account, as described in Section 2.1.
1.3 This Policy does not apply to the practices of health care practices that use the Services, to Partner Services accessed through the Services (such as laboratories, pharmacies, payment processors and video-visit providers), or to third-party websites linked from the Services, each of which is governed by its own privacy practices.
2. Personal Information the Company Collects
2.1 Information provided directly
| Category | Examples | Who provides it |
|---|---|---|
| Identifiers and contact details | Name, work or personal email address, telephone number, mailing address | Practice Users, Patient Users, Visitors |
| Professional information | Professional title and credentials, role within the practice, National Provider Identifier, licensure details submitted for verification | Practice Users |
| Practice information | Practice legal and display name, specialty, time zone, locations, branding | Practice owners |
| Account credentials | Password (stored only as a salted hash), or the identifier returned by a third-party identity provider such as Google or Microsoft Entra ID | Practice Users, Patient Users |
| Agreement records | Version, date, time, network address and cryptographic fingerprint of each agreement accepted; typed name and title used for electronic signature | Practice Users, Patient Users |
| Subscription information | Selected plan and billing interval, trial dates and, when payment processing is enabled, billing contact details (card numbers are held by the payment processor, never by the Company) | Practice owners |
| Communications | Content of inquiries, demonstration requests and support correspondence | Visitors, Practice Users |
2.2 Information collected automatically
| Category | Examples | Purpose |
|---|---|---|
| Activity and audit records | Sign-in events, records accessed, approvals and rejections of AI-assisted drafts, agreement acceptances, administrative changes, request identifiers | Security, accountability and HIPAA documentation; reviewable by the practice |
| Technical data | Internet protocol address, browser and device type, operating system, language, approximate location derived from IP address, crash and error reports | Operating, securing and supporting the Services |
| Usage data | Features used and frequency of use, in aggregate | Capacity planning and product improvement |
2.3 Cookies and similar technologies
The Services use strictly necessary cookies and local storage for authentication, session continuity and protection against cross-site request forgery. These cannot be disabled without preventing use of the Services. The public website does not use advertising or cross-site tracking cookies. If the Company uses website analytics, they are configured to truncate IP addresses and not to build profiles of individual Visitors. Because the Services do not track Visitors across third-party websites, they do not respond to "Do Not Track" signals, which have no standardized meaning.
2.4 Information from third parties
The Company may receive limited information from identity providers selected by the user (for example, a verified email address from Google or Microsoft Entra ID), from public professional registries used to verify practices (for example, the National Plan and Provider Enumeration System), and from Partner Services as necessary to operate an integration the practice has enabled.
3. Purposes and Legal Bases for Processing
The Company processes Personal Information for the following purposes:
- To provide the Services, including creating and administering accounts, authenticating users, delivering features, synchronizing with Partner Services the practice has enabled, and providing support.
- To verify practices and prevent fraud and abuse, including confirming professional credentials and detecting unauthorized access.
- To maintain security and audit trails, including the activity records described in Section 2.2, which are required for the Company's obligations under HIPAA and its Business Associate Agreements.
- To administer subscriptions, including trial periods, plan changes and, when enabled, invoicing and payment collection through a licensed payment processor.
- To communicate with users about the Services, including service announcements, security notices, changes to agreements and responses to inquiries.
- To improve the Services, using aggregated or de-identified information.
- To comply with legal obligations and to establish, exercise or defend legal claims.
The Company does not sell Personal Information, does not "share" Personal Information for cross-context behavioral advertising, and does not use PHI or Account Information for advertising of any kind. Information processed by the Services' AI-assisted functions is used solely to generate the requested output for the practice and is not used to train, fine-tune or evaluate machine-learning models for use outside that practice's tenant.
4. Disclosure of Personal Information
The Company discloses Personal Information only as follows:
4.1 Service providers and subcontractors. To vendors that process information on the Company's behalf and under written contracts restricting their use of it, including cloud infrastructure and hosting, private model hosting for AI-assisted functions, email and notification delivery, customer-support tooling, and payment processing. Vendors that handle PHI are bound by Business Associate Agreements. A current list of subcontractors that handle PHI is available to practices on request.
4.2 The practice. To the health care practice that administers a Practice User's or Patient User's account. Practice owners and administrators can view Practice Users' activity within their tenant through the audit log.
4.3 Partner Services. To Partner Services that the practice has enabled and that an authorized Practice User chooses to use, such as a laboratory or electronic-prescribing network, to the extent necessary to perform the requested action.
4.4 Legal requirements and protection of rights. When required by law, subpoena, court order or other legal process, or when the Company believes in good faith that disclosure is necessary to comply with law, to protect the rights, property or safety of the Company, its users or others, or to investigate fraud or security incidents. Where legally permitted, the Company will notify the affected practice before disclosing PHI in response to legal process.
4.5 Corporate transactions. In connection with a merger, acquisition, financing, reorganization or sale of all or part of the Company's assets, in which case the Company will notify affected practices, and the successor will be bound by this Policy and the applicable Business Associate Agreements.
4.6 With consent. For any other purpose disclosed at the time of collection and with the individual's consent.
5. Data Retention
| Information | Retention period |
|---|---|
| Account Information | For the life of the account and up to twelve (12) months thereafter, unless a longer period is required to resolve disputes or comply with law |
| Agreement acceptance records | At least six (6) years after the agreement is superseded or the account is closed, consistent with 45 C.F.R. § 164.316(b)(2) |
| Audit and activity records | At least six (6) years; these records contain no clinical content |
| PHI processed for a practice | As directed by the practice and as provided in the Business Associate Agreement, including return or destruction on termination |
| Inquiry and support correspondence | Up to two (2) years after the last communication |
| Technical and usage logs | Up to thirteen (13) months, unless retained longer as part of a security investigation |
Retention periods may be extended where required by a legal hold or applicable law. Information is deleted or de-identified at the end of the applicable period.
6. Security
The Company maintains an information-security program with administrative, physical and technical safeguards designed to protect Personal Information against unauthorized access, use, disclosure, alteration and destruction. These safeguards include isolation of each practice's data enforced by database row-level security, encryption of data in transit using TLS and at rest using managed keys, role-based access control, multi-factor authentication for platform administrators, append-only audit logging, workforce security training, and periodic review of access and configuration. No system is completely secure. In the event of a security incident affecting Personal Information, the Company will notify affected practices and individuals as required by applicable law and its contractual commitments.
7. Your Rights and Choices
7.1 Access and correction. Practice Users may view and update their profile information within the Services. Patient Users may update their contact details in the patient application. Requests relating to PHI must be directed to the practice.
7.2 Deletion. Practice Users may request deletion of their account through their practice owner; practice owners may request closure of the practice account through support. Certain records, including audit logs and agreement acceptance records, must be retained as described in Section 5.
7.3 Communications. The Company sends transactional and security communications that are necessary to operate the Services. Optional product communications include an unsubscribe mechanism.
7.4 State privacy rights. Residents of certain states, including California, Colorado, Connecticut, Virginia and others with comprehensive privacy laws, may have the right to know what Personal Information the Company holds about them, to access it in a portable format, to correct or delete it, to opt out of its sale or sharing (which the Company does not do), and not to be discriminated against for exercising these rights. Health information held by a HIPAA covered entity or business associate is generally exempt from these laws. To exercise a right, contact the Company as described in Section 11. The Company will verify the identity of the requester, may require additional information to do so, and will respond within the time required by applicable law. An authorized agent may submit a request on an individual's behalf with written authorization.
7.5 Appeals. If the Company declines to act on a request, the individual may appeal by contacting [privacy email] with the subject line "Privacy appeal." The Company will respond to the appeal in writing within the time required by applicable law.
8. Children's Privacy
The Services are not directed to children under thirteen (13), and the Company does not knowingly collect Personal Information from children except as part of a patient account created at the direction of a health care practice and the child's parent or legal guardian in accordance with applicable law. A parent or guardian who believes that a child has provided Personal Information without authorization should contact the practice or the Company.
9. International Users
The Services are hosted and operated in the United States and are intended for practices located in the United States. Personal Information accessed from outside the United States will be transferred to, stored and processed in the United States, where privacy laws may differ from those of the user's jurisdiction.
10. Changes to This Policy
The Company may revise this Policy from time to time. The effective date at the top of the Policy indicates when the current version took effect. Material changes will be announced through the Services, and Practice Users will be asked to accept the revised Policy before continued use. Prior versions are available on request.
11. Contact
Questions, requests and complaints regarding this Policy may be directed to:
[Company legal name], Attention: Privacy Officer, [address]. Privacy inquiries and rights requests: [privacy email]. Security vulnerability reports: [security email]. Practices with questions about the Business Associate Agreement: [legal notice email].
This document is a pre-release draft provided for review and has not yet been approved by legal counsel. A final version will be published and, where required, re-acceptance requested.