1. Introduction
NexaPax, Inc. ("NexaPax", "we", "us", or "our") operates a digital care coordination platform designed to help patients, families, caregivers, and authorized healthcare professionals stay connected and organized throughout a health journey. NexaPax organizes care information around a Pax Case — a shared coordination space for a specific person and their care circle. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use our platform, website, and related services (collectively, the "Services"). By accessing or using our Services, you agree to the practices described in this policy. If you do not agree, please discontinue use of our Services.
2. Information We Collect
We collect information you provide directly, information generated through your use of the platform, and information from third parties where applicable. This includes: (a) Account information: name, email address, and role (patient, family member, caregiver, or authorized healthcare professional); (b) Contact and profile information: phone number, language preference, and communication settings; (c) Pax Case data: information associated with a specific care coordination case, including the care recipient's profile, timeline entries, caregiver observations, family updates, and basic operational medication records; (d) Consent and permissions records: who authorized access, what was shared, with whom, and when; (e) Coordination log: activity entries, notes, and care milestones entered by circle members; (f) Support and communications data: messages exchanged with our support team and in-platform communications; (g) Usage and analytics events: pages visited, features used, interaction timestamps, device type, browser, and IP address; (h) Early access and waitlist information: role, health situation context, and contact details submitted through our waitlist form.
3. Health and Coordination Data
NexaPax handles health-related and care coordination information with the highest level of care. Information entered into a Pax Case — including medication records, caregiver observations, care timelines, and health situation context — is used solely for coordination and continuity of care purposes. It is not used for diagnosis, prescription, clinical treatment, or any purpose unrelated to the coordination of care for the person the Pax Case belongs to. We do not sell, rent, or share your health or coordination data with third parties for advertising or marketing purposes. We apply encryption in transit and at rest for all care-related data. Access is strictly limited to authorized members of the care circle and to NexaPax personnel with a legitimate operational need. Where applicable and as required by law, we implement safeguards consistent with relevant health data regulations, including HIPAA where applicable and equivalent frameworks in other jurisdictions, subject to ongoing legal review.
4. Consent and Permissions
Access to a Pax Case is governed by explicit permissions. The person who creates a Pax Case (typically the primary caregiver or the care recipient) controls who can view or contribute to it. Permissions are role-based: family members, caregivers, and authorized healthcare professionals may have different levels of access depending on what the case owner grants. Sharing health or coordination information about another person requires that you have obtained their consent or have valid legal authority to act on their behalf. You may revoke access for any circle member at any time through your account settings. Revocation takes effect immediately. NexaPax does not grant or expand access beyond what the case owner explicitly authorizes.
5. How We Use Your Information
We use the information we collect to: (a) Provide, operate, and improve the NexaPax platform and Services; (b) Organize and display Pax Case information to authorized circle members; (c) Send transactional communications such as account confirmations, security alerts, and service updates; (d) Respond to your inquiries and provide customer support; (e) Analyze usage patterns to improve platform performance and user experience — using only the minimum data necessary; (f) Comply with legal obligations and enforce our Terms of Service; (g) Protect the security and integrity of our platform and users. We do not use your information to build advertising profiles or to target you with third-party advertising.
6. Claudia and AI-Assisted Features
NexaPax includes Claudia, an AI-assisted feature designed to help caregivers and families organize information, navigate onboarding, and understand how to use the platform. Claudia may help structure Pax Case information, suggest next steps in the coordination flow, and surface relevant platform features. Claudia does not diagnose medical conditions, prescribe treatments, provide clinical guidance, or replace the judgment of qualified healthcare professionals. Any information processed by Claudia is subject to the same data protection standards described in this policy. Claudia's responses are informational and coordination-oriented only — they should not be interpreted as medical, legal, or financial advice.
7. How We Share Your Information
We do not sell your personal information. We may share your information in the following limited circumstances: (a) With members of your designated care circle, as explicitly authorized by you through the permissions system; (b) With trusted service providers who assist us in operating the platform (e.g., cloud hosting, analytics, email delivery), subject to strict confidentiality agreements and data processing terms; (c) With authorized healthcare professionals you explicitly connect through the platform, within the scope of their granted access; (d) In response to valid legal process, court orders, or government requests; (e) To protect the rights, property, or safety of NexaPax, our users, or the public; (f) In connection with a merger, acquisition, or sale of assets, with appropriate notice to users.
8. Data Retention
We retain your information for as long as your account or associated Pax Case is active, or as needed to provide the Services. Data may also be retained as necessary for support, security, audit, compliance, or applicable legal obligations, subject to our final retention policy. You may request deletion of your account and associated data at any time by contacting us at privacy@nexapax.com. We will process deletion requests within 30 days, subject to legal retention requirements. Some information may be retained in anonymized or aggregated form for product improvement purposes.
9. Your Privacy Rights
Depending on your jurisdiction, you may have the following rights regarding your personal information: (a) Right to access — request a copy of the personal data we hold about you; (b) Right to rectification — request correction of inaccurate or incomplete data; (c) Right to erasure — request deletion of your personal data; (d) Right to portability — receive your data in a structured, machine-readable format; (e) Right to object — object to certain processing activities; (f) Right to restrict processing — request that we limit how we use your data. To exercise any of these rights, contact us at privacy@nexapax.com. We will respond within 30 days. Users in the European Economic Area may have additional rights under the GDPR, where applicable.
10. Cookies and Tracking Technologies
We use cookies and similar tracking technologies to operate and improve our Services. Essential cookies are required for the platform to function. Analytics cookies help us understand how users interact with the platform and improve the experience. You may manage cookie preferences through your browser settings or through the consent banner displayed on our site. We do not use cookies for targeted advertising. We do not share cookie data with advertising networks.
11. Data Security
We implement technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include encryption for data in transit and at rest, role-based access controls, and internal data handling practices. No method of transmission over the internet is 100% secure. We encourage you to use strong, unique passwords and to notify us immediately at security@nexapax.com if you suspect unauthorized access to your account.
12. Children's Privacy
Our Services are not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. When a Pax Case involves a minor as the care recipient, the account must be created and managed by a parent, legal guardian, or authorized representative. If you believe we may have collected information from a child under 13 without appropriate authorization, please contact us at privacy@nexapax.com and we will take prompt action.
13. International Data Transfers
NexaPax is based in the United States. If you access our Services from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate. We take reasonable steps to ensure that such transfers are handled in a manner consistent with applicable data protection requirements. Specific transfer mechanisms (such as Standard Contractual Clauses or equivalent safeguards) are subject to ongoing legal review and will be implemented as applicable.
14. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting the updated policy on our website and, where appropriate, by sending an email notification. Your continued use of the Services after the effective date of the updated policy constitutes your acceptance of the changes.
15. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: NexaPax, Inc. | Privacy: privacy@nexapax.com | Security: security@nexapax.com | General contact: contacto@nexapax.com
