Application Privacy Policy

1. Who we are and who this policy covers

Nebraska operates the Service as a data processor on behalf of healthcare organizations (hospitals, clinics, pharmacies, research organizations). Your organization is the controller (or business associate / data custodian) of the patient data it enters into the Service; Nebraska processes that data only on its documented instructions and under a written data processing agreement, including HIPAA business associate terms where applicable.

This policy covers: (a) organization staff who register for accounts; and (b) patients whose data is entered by an organization, or who access the patient portal, sign consent forms or submit questionnaires.

2. Information we collect

• •Account data: name, email address, organization, role, and authentication records of authorized staff.
• •Health data entered by your care team: patient identifiers (name, medical record number, date of birth), diagnoses, problems, medications, prescriptions, allergies, laboratory and imaging results, treatment plans, dental, dermatology and maternity records, vaccination history and clinical notes.
• •Patient-submitted data: consent signatures, symptom and outcome questionnaires, portal access logs, and any documents, photos or device readings (e.g. vitals imported from FHIR or health devices) your organization connects.
• •Pharmaceutical R&D data: research briefs, dossiers, manufacturing and testing plans created on the platform.
• •Usage data: device type, IP address, approximate location derived from IP, pages and features used, and in-app analytics events.
• •Communications: support inquiries and correspondence you send us.

3. How we use information and our legal bases

• •To provide the Service: storing, displaying and processing clinical records, generating AI-assisted drafts, alerts and analytics for the treating organization.
• •Legal bases (GDPR): performance of a contract with your organization; compliance with legal obligations; and explicit consent where required — for example, consent captured in the patient portal for treatment and portal access.
• •Patient health data (HIPAA): used only for treatment, payment and healthcare operations of the covered entity, as permitted by the business associate agreement and any patient authorizations.
• •Under the UAE PDPL: processed on the basis of applicable legal permissions for medical care, or the data subject's consent obtained by the controller.
• •We do not sell personal or health information, and we do not use patient health information for advertising.

4. AI processing, explained

Certain features (treatment plan drafts, prescribing checks, imaging screening, research dossiers) use AI models to analyze data your organization provides. AI outputs are decision-support drafts only: a qualified clinician must review and approve them before any clinical action.

Where AI is used on personal data, we maintain transparency about the categories of data processed, keep outputs within your organization's tenancy, and log AI-assisted actions to the tamper-evident audit chain.

5. Sharing and disclosure

• •Within your organization only: data is segregated by organization, and access is limited by role.
• •Sub-processors: vetted infrastructure and service providers bound by written confidentiality and data protection terms; we list material sub-processors and update the list on request.
• •Patient portal links: time-limited, code-based access your organization sends to a patient; no patient accounts are created.
• •Legal requirements: we may disclose information when required by law, court order, or a regulator, or to protect the vital interests of a person.
• •We never disclose patient health data for marketing or to third parties for their own purposes.

6. Data security

• •Encryption in transit (TLS) and at rest for stored data and uploaded documents.
• •Role-based access control, organization-level data isolation, and enforced separation between tenants.
• •A tamper-evident, SHA-256 audit chain recording every material change, aligned with 21 CFR Part 11 expectations.
• •Documented incident response; in the event of a personal data breach we notify affected organizations and, where required by law, the competent supervisory authority and affected individuals within statutory timeframes.

7. Data retention

We retain clinical data for as long as your organization's contract is active. When your organization closes its account or the retention period required by healthcare record laws expires, data is deleted or anonymized in line with the data processing agreement, except where longer retention is required by law.

8. Your rights

• •Patients: access to the data your organization holds about you, correction of inaccurate data, a copy of your data (portability), restriction of processing, withdrawal of consent, and the right to lodge a complaint with your data protection authority.
• •Organization staff: access, correction, export and deletion of your account data, and objection to processing where applicable.
• •Requests are best made through the treating organization (as controller), or directly to us at the contact address below; we respond within the statutory period and may verify identity before acting.
• •You have the right to complain to a supervisory authority — for example the UAE Data Office (PDPL), a EU/UK supervisory authority, or the US Secretary of Health and Human Services.

9. International data transfers

The Service may process data in data centers outside your country. Where personal data leaves its jurisdiction, transfers are protected by appropriate safeguards such as adequacy decisions or standard contractual clauses, and, for HIPAA, only to business associates bound by a business associate agreement.

10. Children

Pediatric records are entered by the treating organization, which is responsible for obtaining guardian consent where required. We do not knowingly collect personal information directly from children; portal participation by a minor requires an invitation sent by the treating organization to the guardian.

11. Cookies and analytics

We use strictly necessary cookies for sign-in and security, and privacy-respecting analytics to understand feature usage. You can control or refuse non-essential cookies through your browser settings without losing access to core functionality.

12. Changes and contact

We may update this policy to reflect changes in law or the Service; material changes are announced within the app before they take effect.

Questions or requests: contact your organization's administrator, or write to us at info@nebraskaaihelth.com, referencing "Data Protection". Where a Data Protection Officer is required for your deployment, we will identify the contact in your agreement.