Last updated: [pending, supplied by counsel]
This Privacy Policy explains how Naveon collects, uses, and protects information in connection with the Grace platform and our website. It applies to the organizations we serve, the people who use Grace on their behalf, and visitors to our site.
Because Grace operates in healthcare, much of the data it handles is protected health information governed by HIPAA. How we treat that information is described in the HIPAA section below.
We collect information your organization provides when it configures and uses Grace, including protocols, escalation rules, and staff contact details. In the course of delivering the service, Grace also processes information from the calls and interactions it handles on your behalf.
On our website, we collect limited technical information needed to operate the site and understand general usage. We keep this to a minimum.
We use information to provide, maintain, and improve the platform; to route and document interactions according to your protocols; and to support your team. Protected health information is used only to deliver the services your organization has asked us to perform.
We do not sell personal or health information.
Grace is built to handle protected health information (PHI) in line with HIPAA. Naveon acts as a Business Associate to the covered entities we serve, and PHI is processed only to provide the contracted services.
Our separate notice of privacy practices provides further detail on how PHI is handled.
Protected health information is handled only under a signed Business Associate Agreement and used solely to deliver the services your organization has configured. Naveon never sells protected health information and never uses it for marketing or advertising.
Before any protected health information is processed, Naveon enters into a Business Associate Agreement (BAA) with the covered entity. The BAA sets out our obligations to safeguard PHI, the permitted uses and disclosures, and the responsibilities of each party.
Where a subcontractor supports our services and may encounter PHI, we put equivalent agreements in place with that subcontractor.
We protect information using administrative, physical, and technical safeguards appropriate to healthcare data. Information is encrypted in transit and at rest, and access is restricted to those who need it to deliver the service.
Specific security controls and certifications will be detailed here as they are finalized.
We retain information for as long as needed to provide the service and to meet the legal, regulatory, and contractual obligations that apply to healthcare records. Retention periods for protected health information follow your organization's requirements and the terms of the BAA.
When information is no longer needed, it is deleted or de-identified in line with those requirements.
Individuals with questions about their protected health information should contact the healthcare organization responsible for their care, which controls that information. Naveon supports those organizations in responding to such requests.
For information we hold about website visitors, you can contact us to ask what we hold and to request its deletion where applicable.
Grace relies on a small number of vetted service providers to operate, such as infrastructure and communications providers. We share information with them only as needed to deliver the service, and under agreements that require appropriate protection.
We do not allow these providers to use protected health information for their own purposes.
We may update this policy as our services, or the laws that apply to them, change. When we make material changes, we will update the "last updated" date above and, where appropriate, notify the organizations we serve.
We encourage you to review this page periodically.
Questions about this policy or your data can be directed to Naveon by phone at 575‑587‑7776 or through the contact page.
If you are a patient or family member, your care organization is the best first point of contact for questions about your health information.
