Privacy Policy

2

Data we collect for ourselves

When you visit this site, contact us, or subscribe to a Neovexa product, we collect: contact details you provide (name, email, organization); account information (users, roles, settings); billing information (organization name, billing address, plan, and payment records — card and bank details are collected and stored by Stripe, our payment processor, not by us); site analytics (aggregate usage of our website); and support correspondence. We use this data to provide and bill the services, respond to you, and improve our products. We do not sell it, and we do not use it for third-party advertising.

3

Data we process on our customers' behalf

Our products hold operational data that belongs to the customer organization: client records, caregiver records, schedules, visit and EVV data, and call recordings. For this data, the customer is the controller (and, under HIPAA, typically the covered entity); Neovexa is a processor and, where the data constitutes protected health information, a business associate operating under a Business Associate Agreement executed with the customer.

We process this data only to provide the contracted services — never for our own purposes, never for advertising, and never for sale. Access within Neovexa is limited to what operating the service requires, and every access path is role-gated and audit-logged.

4

Subprocessors

We use the following subprocessors to operate our services. Each is bound to protections consistent with this policy and, where PHI is involved, with HIPAA:

Payment data deserves a plain statement: no protected health information reaches Stripe. The only data our billing integration sends to Stripe is a tenant identifier, the organization's name, and its plan — no client names, no visit details, no caregiver names.

5

Security

Data is encrypted in transit and at rest. Access is controlled by role-based permissions, actions are audit-logged, and each customer organization's data lives in its own isolated database. Our own operational access follows the same discipline: named accounts, least privilege, and logged access.

6

Retention and deletion

Customer data is retained for the life of the subscription. After a subscription ends, we retain the customer's data for ninety (90) days so the customer can complete an export — available at any time at no charge — after which it is deleted from production systems, with residual copies removed from backups on the normal backup expiry cycle. Data we hold as controller (Section 2) is retained only as long as needed for the purposes described there or as law requires.

7

Your rights and how requests are handled

You may request access to, correction of, or deletion of personal data we hold about you as controller by contacting privacy@neovexa.com. We respond within the timelines applicable law requires.

Requests concerning data inside a customer's CareAvail, Corra, or PathBright tenant — for example, a request about an agency's client records — are routed to that agency, which as the covered entity and controller is the party responsible for deciding them. We support our customers in fulfilling such requests as their processor and business associate.

8

Cookies and analytics

This website uses no third-party advertising trackers. We use only the cookies needed to operate the site and our products (such as authentication sessions) and privacy-respecting aggregate analytics to understand site usage.

9

Changes to this policy

We may update this policy from time to time. For material changes, we will give at least thirty (30) days notice — by email to the account owner, by notice in the product, or both — before the change takes effect.

10

Contact

Privacy enquiries: privacy@neovexa.com, or Neovexa Inc., 2 Broad Street, Suite 609, Bloomfield, NJ 07003. The terms that govern use of our services are in the Terms of Service.