NexavateAI Trust Center
Privacy Policy
This policy describes how NexavateAI collects, processes, stores, and protects information across the platform — including data categories, legal bases, processor relationships, retention schedules, and patient rights.
Scope & Overview
Who this policy applies to and what services it covers
NexavateAI ("we", "us", "our") provides AI-assisted healthcare operations software for clinics, doctors, and hospitals. The platform includes SYRA (patient-facing assistant for appointment booking and clinic information) and NEXA (internal copilot for clinic staff workflows).
This Privacy Policy applies to interactions with healthcare.nexavateai.com, booking APIs, AI chat features, and related services. It does not apply to third-party websites linked from our platform.
Controller and processor roles
In most deployments, the healthcare customer (clinic or hospital) acts as the data controller for patient and clinical operational data. NexavateAI acts as a data processor, processing data on the customer's instructions to deliver platform services. NexavateAI may act as an independent controller only for limited purposes such as platform security logging and service improvement analytics.
Data We Collect
A complete inventory of information processed by the platform
| Category | Examples | Source | Required? |
|---|---|---|---|
| Appointment booking | Patient name, phone, email, preferred date & time, reason for visit | Patient via booking form or SYRA chat | Required |
| OTP verification | Email address, hashed OTP code, session identifier, expiry timestamp | Generated server-side | Required |
| AI chat interactions | Messages sent to SYRA or NEXA, session context | User input during chat | Functional |
| Clinic account info | Doctor name, clinic name, services offered, timings | Clinic administrator via site.json / config | Configuration |
| Prescription data | Patient name, medication, dosage, diagnosis (where uploaded) | Authorized clinic users via NEXA | Optional |
| Technical logs | API request logs, error traces, session IDs, server timestamps | Automatically by system | System |
How We Use Data
Purpose and legal basis for each type of processing
| Purpose | Data used | Basis |
|---|---|---|
| Appointment scheduling | Name, phone, email, date, time, reason | Legitimate interest / service delivery |
| Email OTP verification | Email, hashed OTP, session ID | Legitimate interest / security |
| AI assistant responses | Chat messages, session context, clinic knowledge base | Service delivery |
| Clinic workflow automation | Appointment records, patient info, slot availability | Service delivery |
| Security monitoring | Request logs, failed attempts, session activity | Legitimate interest / security |
| Service improvement | Anonymised usage patterns, error logs | Legitimate interest |
Data Flow
How information travels through the system for appointment booking & OTP
OTP Verification & Appointment Booking Flow
Email OTP pipeline
Third-Party Processors
Sub-processors that handle data on our behalf to deliver the service
We engage subprocessors to deliver platform functionality. Each processes data only as required for its designated role. See the full Subprocessors page for category, requirement status, and deployment notes.
| Processor | Purpose | Data shared | Processing location |
|---|---|---|---|
| MongoDB Atlas | Database hosting — appointments, patients, prescriptions | Appointment records, patient information | Cloud — region depends on deployment configuration |
| OpenAI | AI language model for SYRA and NEXA; text embeddings for knowledge retrieval | Chat messages, clinic knowledge context | OpenAI API services — region depends on provider configuration |
| Resend | Transactional email — OTP verification codes | Recipient email address, message content during delivery | Depends on email provider configuration |
| Qdrant | Vector database for AI knowledge retrieval (RAG) | Text embeddings derived from clinic documentation | Cloud or self-hosted — region depends on deployment configuration |
| Groq | Speech-to-text transcription (optional voice feature) | Audio input when voice feature is enabled | Depends on provider configuration |
| Hosting provider | Application and static site hosting | Application runtime; secrets via environment variables only | Depends on deployment model (platform-managed or customer-managed) |
Data Sharing
When and with whom data may be shared
Core commitment
We do not sell personal information. Ever.
Data may be shared only in these circumstances:
- Sub-processors listed above, strictly to deliver the service
- The clinic/customer accessing their own patient and appointment data through the platform
- Legal process — in response to a valid court order, warrant, or legally binding government request
- Safety & security — when necessary to protect users or the platform from harm or fraud
Data Storage & Ownership
Where data lives and who controls it
Managed SaaS
NexavateAI operates and secures the platform on managed cloud infrastructure. Standard customers receive the same baseline security controls.
Customer-Managed
Enterprise customers may deploy the platform within their own cloud environment, maintaining full control over data residency and infrastructure access.
Data ownership
Patient and clinic operational data belongs to the clinic or healthcare customer. NexavateAI acts as a processor — not the controller of your patients' data.
Data Retention
How long different categories of data are kept
| Data type | Default retention | Notes |
|---|---|---|
| OTP session data | 10 minutes (active) / cleared on completion | In-memory only, expires automatically |
| Appointment records | Duration of clinic relationship + legal minimum | Clinic may request deletion |
| AI chat messages | Session duration (not persisted beyond session) | SYRA conversations are not stored long-term |
| System logs | 30–90 days rolling | Used for monitoring and incident response |
| Prescription data | Per customer instructions or legal requirements | Controlled by clinic |
| Demo environment data | Reset periodically | Demo data is not retained long-term |
Security
Controls protecting the data described in this policy
See our full Security Overview for detailed controls. Key protections include:
TLS encryption
All data in transit protected by HTTPS/TLS.
OTP hashing
OTP codes stored as SHA-256 hashes, never plain text.
Secret management
API keys stored in environment variables, not source code.
Your Rights
Rights available to patients and clinic users
Depending on your jurisdiction and relationship to the clinic, rights may include:
- Access — request a copy of personal data we process
- Correction — request correction of inaccurate data
- Deletion — request deletion where applicable and legally permitted
- Portability — receive data in a structured format where applicable
- Objection — object to certain processing based on legitimate interests
To exercise rights, contact info@nexavateai.com. For live clinical records, patients should also contact their healthcare provider directly, as the clinic is typically the data controller for medical records.
Policy Updates
We may update this policy to reflect platform changes, new services, or legal requirements. The "Last updated" date at the top indicates the most recent revision. Material changes will be communicated via the platform or email where applicable.
Contact — Privacy
For privacy questions, data requests, or concerns:
NexavateAI — Privacy & Trust
Email: info@nexavateai.com
We aim to respond to privacy requests within 5 business days.