Privacy Policy

1.1 This Privacy Policy ("Policy") describes how NexProLink, Inc. ("NexProLink," "we," "us," or "our") collects, uses, shares, and protects personal information when you use our mobile application, website, or Services (as defined in our Terms of Service). "Personal Information" means data that identifies or relates to you as an individual.

1.2 By using the Services, you consent to the practices described herein. If you do not agree, please do not use the Services. This Policy incorporates our Terms of Service by reference.

1.3 We act as the data controller for the Personal Information we collect. For EU/EEA users, we comply with GDPR; contact us at support@nexprolink.com for data protection matters. Our practices may vary by jurisdiction to meet legal requirements.

We do not knowingly collect sensitive data (e.g., health, race) unless voluntarily provided by consultants for verification.

3.1 To provide and maintain Services (e.g., account management, matching, payments, video sessions).

3.2 To improve the App (e.g., analytics, bug fixes, feature development using aggregate data).

3.3 To communicate (e.g., updates, support, notifications).

3.4 To enforce Terms (e.g., detect fraud, violations).

3.5 For security and legal compliance (e.g., audits, investigations).

3.6 To generate anonymized aggregate analytics (e.g., "users average 120 sessions in 2025") for business intelligence; no Personal Information is used.

We do not use Personal Information for automated decisions with legal effects without consent.

4.5 We do not sell or rent Personal Information to marketers. No sharing with unaffiliated third parties except as described.

4.6 Aggregated and De-Identified Data. We create aggregated and de-identified information from Service-Generated Data as described in Section 27 of our Terms of Service. We maintain and use it only in aggregated or de-identified form, we do not attempt to re-identify it, and we require by contract that anyone who receives it does the same and does not combine it with other data to identify any person, household or device.

4.7 What We Sell. We do not sell or share Personal Information for money or other valuable consideration, and we do not use it for cross-context behavioral advertising. We do sell and license aggregated, de-identified data. Under the California Consumer Privacy Act and similar state laws, aggregate consumer information and properly de-identified information are not treated as personal information.

4.8 Small Groups and Free Text. Before data leaves NexProLink we apply a minimum group size of five (5) and remove free-text search terms seen fewer than five times, handles, and identifier-like strings. Hashing or masking an identifier alone is not treated as de-identification.

4.9 Healthcare. We do not sell patient-level or provider-level health information. Data connected with the Healthcare Ecosystem is included only as counts and statistics de-identified in accordance with applicable law.

5.1 We retain Personal Information only as long as necessary for the purposes above or legal obligations.

5.2 Active Accounts: Retained while in use, plus a reasonable period for backups.

5.3 Deleted Accounts: Upon request or termination, we delete or anonymize Personal Information within 30 days, except:

• Transaction/financial records: Up to 7 years for tax, accounting, and audit compliance (per IRS and Stripe requirements).
• Session recordings: permanently deleted 30 days after the session (deleted copies are purged from our storage within one further day); kept longer only while a report, dispute, investigation, legal hold or legal process requires it. You may request a copy or early deletion through Support (Terms §15.9).
• Logs: 30 days default, or longer for legal holds/investigations.
• Anonymized aggregate analytics: Indefinitely, as it contains no Personal Information. De-identification uses techniques like aggregation, small-group suppression and removal of identifiers (hashing alone is not relied on), pseudonymization, and aggregation to prevent re-identification.

5.4 For EU users, retention complies with GDPR storage limitation; statistical data under Article 89 includes safeguards like data minimization and access controls.

5.5 Automatic deletion schedule (active accounts): Older records are deleted automatically by a daily job — nobody has to remember to do it.

• Sign-in records (IP address, network provider, device, user agent): 18 months.
• Activity feed and page-visit analytics: 18 months and 90 days.
• One-time verification codes: 1 day. Session invitation records (client name and email): 30 days after the session ends.
• Call metadata (who joined, how long): 24 months, for dispute and chargeback windows.
• Records of who at NexProLink viewed a phone number, security-setting changes and account-deletion audits: 6 years (HIPAA documentation period).
• Payment audit trail: 7 years. Aggregated, k-anonymous insights: daily figures 2 years, weekly figures 5 years.

Anything under a legal hold, report, dispute or legal process is kept until that matter ends. We do not sell personal information, and IP-address, phone-number and location data are never sold or shared with data brokers.

6.1 When creating aggregate analytics, we: (a) remove direct identifiers (e.g., names, emails, IDs); (b) apply irreversible transformations (e.g., hashing with salting); (c) aggregate data points (e.g., combine into group statistics); and (d) implement technical/organizational measures to prevent re-identification.

6.2 Examples: "Average session time: 45 minutes" from all users, not tied to individuals. Audits ensure compliance; no mapping back to Personal Information.

7.1 You have rights to: (a) access, correct, or update your Personal Information; (b) delete (subject to retention exceptions); (c) restrict or object to processing; (d) data portability (in machine-readable format); and (e) withdraw consent (where applicable, without affecting prior processing).

7.2 To exercise: Contact support@nexprolink.com or via App settings. We respond within 30 days (extendable under law). For deletions conflicting with retention (e.g., tax records), we segregate and restrict access.

7.3 EU/EEA: Full GDPR rights; lodge complaints with supervisory authorities. California: CCPA rights (e.g., opt-out of sales—note: we do not sell Personal Information).

7.4 Cookies: Manage via browser settings; some are essential.

9.1 We implement industry-standard security measures to protect Personal Information, including encryption at rest and in transit (TLS/SSL), access controls, regular security audits, and employee training.

9.2 However, no method is 100% secure. We cannot guarantee absolute security against unauthorized access, breaches, or cyber-attacks.

10.1 Data is stored and processed in the United States via secure providers (e.g., AWS us-east-1 region).

10.2 For transfers from EU/EEA/UK, we use Standard Contractual Clauses (SCCs), adequacy decisions, or other GDPR-approved mechanisms to ensure equivalent protection levels.

10.3 By using the Platform, you consent to the transfer of your information to the United States and other countries that may have different data protection laws than your jurisdiction.

11.1 Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you.

11.2 Right to Delete: You may request deletion of your personal information, subject to certain exceptions.

11.3 Right to Correct: You may request correction of inaccurate personal information.

11.4 Right to Opt-Out: You have the right to opt out of the "sale" or "sharing" of personal information. NOTE: We do not sell your personal information.

11.5 Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

11.6 Do Not Track: We currently do not respond to Do Not Track browser signals as there is no industry standard for compliance.

11.7 Financial Incentives: We do not offer financial incentives related to the collection of personal information.

11.8 To exercise your rights, contact support@nexprolink.com. We will respond within 45 days as required by law.

12.1 Legal Basis: We process your data under: (a) Contract performance (providing services); (b) Legitimate interests (security, fraud prevention); (c) Legal obligations (tax records); (d) Your consent (marketing).

12.2 Your Rights (Articles 15-22):

• Access (Art. 15): Request a copy of your personal data
• Rectification (Art. 16): Correct inaccurate data
• Erasure (Art. 17): Request deletion ("right to be forgotten")
• Restriction (Art. 18): Limit processing of your data
• Portability (Art. 20): Receive data in machine-readable format
• Object (Art. 21): Object to processing based on legitimate interests
• Automated Decisions (Art. 22): Not be subject to solely automated decisions

12.3 Supervisory Authority: You have the right to lodge a complaint with your local data protection authority.

12.4 International Transfers: We use Standard Contractual Clauses (SCCs) for data transfers outside the EU/EEA.

Residents of the following states have additional privacy rights under their respective state laws. To exercise any of these rights, contact support@nexprolink.com with your name, state of residence, and the specific right you wish to exercise. We will respond within the timeframe required by your state's law.

State privacy laws continue to evolve rapidly. We monitor and update our practices as new laws take effect. Contact support@nexprolink.com to exercise rights under any applicable law not listed here.

13b.1 What Consumer Health Data We Collect: For Washington State residents, "consumer health data" under the Act may include: health conditions voluntarily disclosed in profile descriptions or booking notes; the fact of booking appointments with healthcare providers; appointment categories (e.g., telehealth, medical consultation); and payment records for healthcare services.

13b.2 Your Rights Under MHMDA:

• Right to Consent: We will not collect or share health-related data beyond what is disclosed in this Policy without your affirmative consent.
• Right to Access: You may request a list of the categories of consumer health data we have collected, the sources, and sharing practices.
• Right to Delete: You may request deletion of your consumer health data. Requests will be honored within 30 days, subject to retention obligations (e.g., 7-year financial record retention).
• Right Against Sale: We do not sell consumer health data. We will not sell your consumer health data without your valid, signed authorization.
• No Geofencing: We do not use geofences around healthcare facilities to collect, use, or share consumer health data.

13b.3 To Exercise Rights: Washington residents may submit requests under the MHMDA to support@nexprolink.com. Please include "MHMDA Request" in the subject line, your name, state of residence, and the specific right you wish to exercise.

• Notify affected users within 72 hours (per GDPR) or as required by applicable law
• Notify relevant regulatory authorities as required
• Provide details about the nature of the breach
• Describe the likely consequences
• Explain measures taken or proposed to address the breach
• Offer guidance on steps you can take to protect yourself

• Protected Health Information (PHI) — Clinical Content & Non-Healthcare Users: NexProLink does not store, record, or access the audio or video content of any session, nor clinical notes, diagnoses, prescriptions, lab results, or medical records of any kind. For non-healthcare users, NexProLink does not process PHI in any form. For licensed healthcare providers using our Healthcare Provider Subscription Plans, NexProLink acts as a Business Associate under HIPAA and handles only limited scheduling and payment data (see Section 16 for full details).
• Social Security Numbers
• Government ID Numbers (except for optional consultant verification)
• Biometric Data (fingerprints, facial recognition data)
• Precise Geolocation (without explicit consent)
• Genetic Information
• Criminal History
• Union Membership

16.1 What PHI NexProLink May Access as Business Associate: In our role as Business Associate, NexProLink may create, receive, maintain, or transmit the following categories of PHI on behalf of Covered Entity healthcare providers:

• Booking records linking a patient's name, contact information, and appointment details to a specific healthcare provider
• Session metadata (appointment date/time, duration, session type) linked to patient and provider identifiers
• Payment records for healthcare services rendered (amount, date, provider identity)
• Intake form responses submitted by patients prior to telehealth appointments

What NexProLink Does NOT Store: We do NOT store, record, transcribe, or access the audio or video content of any telehealth session. Video is routed via Amazon Chime SDK with end-to-end encryption and is not recorded or retained by NexProLink. Session notes, diagnoses, prescriptions, or clinical documentation remain the exclusive property and responsibility of the provider.

16.2 Business Associate Agreement — Incorporated Terms: In accordance with 45 C.F.R. § 164.504(e), the following BAA terms are incorporated into our Terms of Service and govern NexProLink's handling of PHI on behalf of healthcare provider Covered Entities:

• Permitted Uses: NexProLink may use and disclose PHI only as necessary to provide the Services described in the Terms of Service, as required by law, for proper management and administration of NexProLink, or as otherwise permitted by 45 C.F.R. § 164.504(e)(2)(i).
• Prohibition on Impermissible Use: NexProLink will not use or disclose PHI in a manner that would violate the HIPAA Privacy Rule if done by the Covered Entity, except as permitted herein or by law.
• Safeguards: NexProLink will implement administrative, physical, and technical safeguards in accordance with the HIPAA Security Rule (45 C.F.R. Part 164, Subpart C), including AES-256 encryption at rest, TLS in transit, role-based access controls, and regular security assessments.
• Breach Reporting: NexProLink will report to the Covered Entity any Security Incident or Breach of Unsecured PHI within 60 days of discovery, as required by 45 C.F.R. § 164.410.
• Subcontractors: NexProLink will enter into BAAs with all subcontractors who create, receive, maintain, or transmit PHI on NexProLink's behalf (including AWS, which holds a BAA with NexProLink). NexProLink has executed a BAA with Amazon Web Services.
• Patient Rights: NexProLink will, to the extent practicable, make PHI available in accordance with the Covered Entity's obligations to patients under 45 C.F.R. §§ 164.524, 164.526, and 164.528 (access, amendment, accounting of disclosures).
• Termination: Upon termination of the healthcare provider subscription, NexProLink will, where feasible, return or destroy PHI. Where return or destruction is infeasible, NexProLink will extend the protections of this BAA to the PHI and limit further use and disclosure to those purposes that make return or destruction infeasible.
• HITECH Compliance: This BAA incorporates the obligations imposed on Business Associates by the Health Information Technology for Economic and Clinical Health (HITECH) Act, including the obligation to comply directly with applicable provisions of the HIPAA Privacy and Security Rules.

16.3 Healthcare Providers' Retained Obligations: Notwithstanding NexProLink's BAA obligations, each healthcare provider (Covered Entity) remains solely responsible for:

• Publishing and distributing their own Notice of Privacy Practices to patients
• Obtaining patient consent and authorization as required by applicable law
• Maintaining clinical documentation, session notes, and medical records
• Complying with state-specific telehealth laws and licensing requirements
• Ensuring their use of NexProLink is appropriate under their professional licensing board rules

16.4 For Non-Healthcare Users: If you are not a licensed healthcare professional using a Healthcare Provider Subscription Plan, NexProLink does not process Protected Health Information on your behalf. Any health-related information you voluntarily share with a healthcare consultant is shared between you as a patient and that individual provider — NexProLink's role is limited to routing the connection and facilitating payment.

16.5 Security Infrastructure:

• Encryption in transit: TLS 1.2+ for all data transmission
• Encryption at rest: AES-256 via AWS DynamoDB and S3
• Video sessions: Encrypted in transit via Amazon Chime SDK. Telehealth sessions are never recorded; general-consulting sessions are recorded for trust & safety and deleted after 30 days (Terms §15)
• Access controls: Role-based, least-privilege access to all systems
• Infrastructure: AWS us-east-1 (SOC 2 Type II, ISO 27001, HIPAA-eligible services)
• AWS BAA: Executed with Amazon Web Services covering HIPAA-eligible services

NexProLink adheres to PIPEDA's 10 Fair Information Principles:

• Accountability: We have designated support@nexprolink.com as responsible for privacy compliance.
• Identifying Purposes: We identify why we collect personal information before or at the time of collection.
• Consent: We obtain your consent for the collection, use, and disclosure of personal information.
• Limiting Collection: We collect only the information necessary for identified purposes.
• Limiting Use, Disclosure, and Retention: We use information only for stated purposes and retain it only as long as necessary.
• Accuracy: We keep personal information accurate, complete, and up-to-date.
• Safeguards: We protect personal information with appropriate security measures.
• Openness: Our privacy policies are readily available and understandable.
• Individual Access: You can access and request correction of your personal information.
• Challenging Compliance: You may contact us with privacy concerns at support@nexprolink.com.

Note: Provincial privacy laws (such as Alberta's PIPA, British Columbia's PIPA, or Quebec's Law 25) may also apply. If there is any conflict, the stricter standard applies.

18.1 We use automated systems for:

• Content moderation and spam detection
• Fraud prevention
• Search results and recommendations
• Account security monitoring

18.2 We do NOT use fully automated decision-making that produces legal effects or similarly significant effects without human review.

18.3 You have the right to request human review of automated decisions and to contest automated decisions.

19.1 We minimize collection of sensitive personal information. If we do collect any sensitive data, we:

• Only collect what is necessary for the stated purpose
• Apply additional security measures to protect sensitive data
• Do not use sensitive data for purposes beyond what is disclosed
• Allow you to limit use of sensitive personal information

20.1 We use the following types of cookies:

• Essential Cookies: Required for basic functionality (authentication, security)
• Analytics Cookies: Help us understand how users interact with the Platform
• Preference Cookies: Remember your settings and preferences

20.2 We do NOT use third-party advertising cookies or sell data to advertisers.

20.3 You can manage cookies through your browser settings. Disabling essential cookies may affect Platform functionality.

21.1 iOS/Android Permissions:

• Camera: Profile photos and video calling
• Microphone: Video calling and voice messages
• Photos/Storage: Uploading images to posts and profile
• Notifications: Push notifications for messages and updates
• Location (Optional): General location for consultant matching

21.2 You can revoke permissions at any time through your device settings. Some features may not work without certain permissions.

Our Platform integrates with third-party services. We encourage you to review their privacy policies:

• Stripe: Payment processing (stripe.com/privacy)
• Amazon Web Services: Cloud hosting (aws.amazon.com/privacy)
• Amazon Chime SDK: Video communication
• Google: OAuth authentication (policies.google.com/privacy)

We are not responsible for the privacy practices of third-party services.

23.1 We may update this Privacy Policy periodically. When we make changes:

• We will update the "Effective Date" at the bottom of this policy
• For material changes, we will notify you via email or prominent notice in the App
• We will provide at least 30 days' notice for significant changes
• Your continued use of the Platform after changes become effective constitutes acceptance

23.2 We encourage you to review this Privacy Policy periodically.