There are two different kinds of personal information in our world, and this policy treats them differently. There is information about you as a visitor or a customer contact. And there is health information that our devices record about patients, which we hold on behalf of the hospital, clinic or researcher who is responsible for it.
This website
This site does not use advertising cookies or third-party tracking. We keep standard server logs (the address a request came from, the page requested, the time, and the browser's description of itself) for 30 days, to keep the site running and secure.
The site sets no cookies for ordinary visitors. Signing in to the customer portal sets a session cookie, which is necessary for sign-in to work and expires when you sign out.
Customer and business contacts
When you work with us as a customer, partner, supplier or job applicant, we keep the contact details and correspondence needed for that relationship. We use them to provide products and support, send notices you need (including field safety notices and advisories), and, where you have agreed, send information about training and events.
We do not sell personal information. We share it only with service providers working on our behalf under contract, and where the law requires it.
Health data from our devices
When a hospital, clinic, agency or research institution uses our devices and Formcloud, the health data those devices record belongs to and is controlled by that organization. We process it on their instructions, under a written agreement, and for no other purpose.
- In the United States, we act as a business associate under HIPAA and sign a business associate agreement with each covered entity.
- In the EU and UK, we act as a processor under the GDPR and UK GDPR, under a data processing agreement.
- Data stays in the region chosen for each customer's tenancy: the United States, Canada, the EU or the United Kingdom.
- We never use patient data to market to patients, and we never sell it.
If you are a patient and want to see, correct or delete information a device recorded about you, the organization that gave you the device is the right place to start. We will help them answer your request.
Research and product improvement
We use device performance data (battery health, fault codes, signal quality statistics) to improve our products. This data is about the device, not the person wearing it. Using any patient-level data for research requires the controlling organization's agreement and, where the law requires it, the patient's consent.
How we protect information
Information is encrypted in transit and at rest, access is limited by role and logged, and our hosting environment is independently audited every year. Our security and compliance page has the detail.
Your choices and rights
Depending on where you live, you may have the right to access, correct, delete or port your personal information, or to object to certain uses. To make a request, write to privacy@nexaformlabs.com or to our Data Protection Officer at the Minneapolis address on our contact page. We respond within 30 days.
Changes to this policy
When we change this policy, we update the date at the top. If a change is significant, we tell customers directly before it takes effect.
Nexaform Labs is a fictional company and this page is demonstration content. It is not a real legal document and creates no obligations.