1. Introduction
NexaPax, Inc. ("NexaPax", "we", "us", or "our") operates a digital care coordination platform designed to help patients, families, caregivers, and healthcare professionals stay connected and organized throughout the care journey. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use our platform, website, and related services (collectively, the "Services"). By accessing or using our Services, you agree to the practices described in this policy. If you do not agree, please discontinue use of our Services.
2. Information We Collect
We collect information you provide directly, information generated through your use of the platform, and information from third parties where applicable. This includes: (a) Account information such as name, email address, and role (patient, family member, caregiver, or healthcare professional); (b) Health-related information you voluntarily enter, including care timelines, medication records, treatment notes, and progress updates; (c) Communication data from messages and updates shared within the platform; (d) Device and usage data such as IP address, browser type, operating system, pages visited, and interaction timestamps; (e) Information submitted through our early access waitlist form, including your health situation and role.
3. Health and Sensitive Data
NexaPax handles health-related information with the highest level of care. We are committed to implementing safeguards consistent with applicable health data regulations, including the Health Insurance Portability and Accountability Act (HIPAA) where applicable, and equivalent frameworks in other jurisdictions. Health information you enter into the platform is used solely to provide and improve the Services. We do not sell, rent, or share your health data with third parties for advertising or marketing purposes. We apply encryption at rest and in transit for all health-related data. Access to health data is strictly limited to authorized users within your designated care circle and to NexaPax personnel with a legitimate operational need.
4. How We Use Your Information
We use the information we collect to: (a) Provide, operate, and improve the NexaPax platform and Services; (b) Personalize your experience and deliver relevant features and recommendations; (c) Send transactional communications such as account confirmations, security alerts, and service updates; (d) Respond to your inquiries and provide customer support; (e) Analyze usage patterns to improve platform performance and user experience; (f) Comply with legal obligations and enforce our Terms of Service; (g) Protect the security and integrity of our platform and users.
5. How We Share Your Information
We do not sell your personal information. We may share your information in the following limited circumstances: (a) With members of your designated care circle, as authorized by you; (b) With trusted service providers who assist us in operating the platform (e.g., cloud hosting, analytics, email delivery), subject to strict confidentiality agreements; (c) With healthcare professionals or organizations you explicitly connect through the platform; (d) In response to valid legal process, court orders, or government requests; (e) To protect the rights, property, or safety of NexaPax, our users, or the public; (f) In connection with a merger, acquisition, or sale of assets, with appropriate notice to users.
6. Data Retention
We retain your personal information for as long as your account is active or as needed to provide the Services. You may request deletion of your account and associated data at any time by contacting us at [email protected]. We will process deletion requests within 30 days, subject to legal retention obligations. Some information may be retained in anonymized or aggregated form for analytical purposes.
7. Your Privacy Rights
Depending on your jurisdiction, you may have the following rights regarding your personal information: (a) Right to access — request a copy of the personal data we hold about you; (b) Right to rectification — request correction of inaccurate or incomplete data; (c) Right to erasure — request deletion of your personal data; (d) Right to portability — receive your data in a structured, machine-readable format; (e) Right to object — object to certain processing activities; (f) Right to restrict processing — request that we limit how we use your data. To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. Users in the European Economic Area (EEA) have additional rights under the General Data Protection Regulation (GDPR).
8. Cookies and Tracking Technologies
We use cookies and similar tracking technologies to operate and improve our Services. Essential cookies are required for the platform to function. Analytics cookies help us understand how users interact with the platform. You may manage cookie preferences through your browser settings. We do not use cookies for targeted advertising. We do not share cookie data with advertising networks.
9. Data Security
We implement industry-standard technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include TLS encryption for data in transit, AES-256 encryption for data at rest, role-based access controls, regular security audits, and employee training on data handling. No method of transmission over the internet is 100% secure. We encourage you to use strong, unique passwords and to notify us immediately at [email protected] if you suspect unauthorized access to your account.
10. Children's Privacy
Our Services are not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13 without parental consent, we will take steps to delete that information promptly. If you believe we may have collected information from a child under 13, please contact us at [email protected].
11. International Data Transfers
NexaPax is based in the United States. If you access our Services from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate. We ensure that such transfers comply with applicable data protection laws, including through the use of Standard Contractual Clauses or other approved transfer mechanisms for users in the EEA.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting the updated policy on our website and, where appropriate, by sending an email notification. Your continued use of the Services after the effective date of the updated policy constitutes your acceptance of the changes.
13. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: NexaPax, Inc. | Email: [email protected] | For GDPR-related inquiries, you may also contact our Data Protection Officer at [email protected].
