Privacy notice

Effective and last updated Nov 3, 2026

Who we are and what this notice covers

Nuvory is a revenue intelligence software-as-a-service (SaaS) product for healthcare practices, operated by HealthArc LLC ("HealthArc", "Nuvory", "we", "us"). This notice explains how we handle personal information when you:

• visit nuvory.ai or other sites that link to this notice (the "Website");
• request a demo, sign up, subscribe to emails, use our calculator or contact us;
• are a business contact at a customer, prospect, partner or vendor; or
• sign in to or administer a customer's Nuvory account (the "Platform").

Patient information is handled differently. When a healthcare provider (a "covered entity") uses the Platform, any protected health information (PHI) we receive is processed on that customer's behalf as its HIPAA business associate. Our use and disclosure of PHI is governed by HIPAA and by the business associate agreement (BAA) we sign with every customer, not by the marketing and Website sections of this notice. If you are a patient, the privacy practices of your healthcare provider apply; please contact them about your health information. Section 4 describes how we protect PHI.

1. Information we collect

Information you give us

• Contact and business details: name, work email, phone, organization, job title, specialty, EHR system, number of locations and providers, and the plan and number of licenses you choose.
• Requests and messages: what you write in forms, emails or demo bookings, and meeting details when you schedule a demo.
• Account information: for Platform users, name, work email, role, credentials and settings, managed by your organization's administrator.
• Payment information: when you subscribe online, payment is processed by Stripe. We receive the plan, quantity, billing contact, billing address and payment status, but not your full card number.

Information collected automatically

• Device and usage data: IP address, browser and device type, pages viewed, referring site, links clicked and approximate location from IP address.
• Cookies and similar technologies: see section 6.
• Platform logs: sign-ins, actions taken and audit logs, used for security, support and compliance.

Information from others

• Business contact details from event organizers, partners, public professional sources and our CRM, combined with information you give us.
• PHI and practice data from a customer's EHR, clearinghouse or other systems that the customer authorizes us to connect (section 4).

We do not knowingly collect information from children under 16 through the Website.

2. How we use information

We use personal information (other than PHI) to:

• respond to requests, run demos and provide quotes;
• create and manage accounts, process subscriptions and payments, and provide support;
• provide, secure, maintain and improve the Website and Platform, including fraud prevention and security monitoring;
• send service, billing and security notices;
• send marketing emails and measure our marketing, including advertising, where the law allows (you can opt out at any time);
• comply with law, enforce our agreements and protect our rights and users.

We do not use PHI for marketing, advertising or to train models for anyone other than the customer it belongs to (section 4).

3. How we share information

We do not sell personal information for money. We share it only:

• With service providers who work for us under contract and confidentiality obligations, including:
• HubSpot: CRM, forms, email and demo scheduling;
• Stripe: payments and billing;
• Microsoft: email and Teams video calls;
• Google: advertising measurement and web fonts;
• our cloud hosting and security providers.
• Within HealthArc, which operates Nuvory and our other healthcare products, for the purposes in this notice.
• With your organization: if you use the Platform through your employer, the administrator can see your account and activity.
• For legal reasons: to comply with law, valid legal process or government requests, or to protect the rights, property or safety of our customers, users, patients or others.
• In a business transaction such as a merger, acquisition or sale of assets, subject to this notice and to our BAA obligations.
• With your consent or at your direction.

Some Website advertising cookies may count as "selling" or "sharing" for targeted advertising under certain US state laws. Section 7 explains how to opt out.

4. Protected health information in the Platform

• Role: for PHI, we act as a business associate (or subcontractor) of our customers. Each customer signs a BAA with us before PHI is processed.
• Permitted uses: we use and disclose PHI only to provide the Platform to that customer, as the BAA allows or as required by law. This includes identifying care gaps and revenue opportunities, supporting the customer's staff and reporting.
• Minimum necessary: we limit access to PHI to what is needed. Our workforce is trained on HIPAA, and access is role-based and audited.
• No sale or advertising: we never sell PHI, and never use it for marketing, advertising or tracking pixels.
• Clinical decisions: these stay with the customer's clinicians. The Platform supports, and does not replace, clinical judgment.
• Subcontractors: subcontractors that handle PHI sign business associate agreements with us.
• De-identified data: we use de-identified data only as the BAA permits, and we de-identify it under HIPAA's standards.
• Breach notification: we notify affected customers of a breach of unsecured PHI without unreasonable delay, and no later than 5 days after we discover it or a subcontractor notifies us of it, as our business associate agreement requires.
• Patient rights: patients exercise their HIPAA rights (access, amendment, accounting of disclosures and so on) through their healthcare provider. We help our customers respond as the BAA requires.

5. How we protect information

We use administrative, technical and physical safeguards designed for healthcare data:

• encryption in transit and at rest;
• data isolated per customer;
• role-based access control and audit logging;
• vulnerability management and security monitoring;
• workforce training, and incident response and business continuity procedures.

The Platform runs on HealthArc's infrastructure in the United States, which is covered by a SOC 2 Type II report (covering May 1 to July 31, 2026, issued October 19, 2026 by ZeroDayCPA, an independent auditor). No system is perfectly secure, so please use strong, unique passwords and tell us right away about any suspected unauthorized access.

6. Cookies, analytics and advertising

The Website uses cookies and similar technologies to:

• Operate the site: remember preferences and protect forms from spam.
• Measure and improve it: HubSpot analytics and Google tools.
• Advertise Nuvory to healthcare businesses: HubSpot ad tracking and Google Ads conversion measurement.

These tools collect device and usage data, not health information. We do not put advertising or third-party tracking technologies on the Platform, and we do not use them to collect PHI.

You can block or delete cookies in your browser settings. We honor Global Privacy Control (GPC) signals as an opt-out of targeted advertising where the law requires. Blocking some cookies may affect how the Website works.

7. Your choices and rights

• Marketing emails: use the unsubscribe link in any email, or contact us. We will still send service and billing messages.
• Targeted advertising: turn on GPC in your browser, or email privacy@nuvory.ai with the subject "Do not sell or share".
• Access, correction, deletion and portability: depending on where you live (for example California, Colorado, Connecticut, Virginia, Texas, Oregon or other US states), you may have the right to:
• know what we hold about you;
• access, correct or delete it;
• get a copy;
• opt out of targeted advertising, sale or profiling;
• appeal our decision.

To make a request, email privacy@nuvory.ai. We will verify your identity before acting and respond within the time the law requires. You may use an authorized agent. We won't discriminate against you for exercising your rights.

If you use the Platform through your employer, or your information is PHI, we may refer your request to the customer that controls the data, as our agreements and the law require.

8. How long we keep information

We keep personal information only as long as needed for the purposes above:

• Prospect and marketing records: while there is an active business interest or until you opt out.
• Account and billing records: for the life of the account plus the period that tax, accounting and legal requirements call for.
• PHI: as the customer's agreement and BAA specify. On termination, it is returned or destroyed as the BAA requires.

9. Where information is processed

We are based in the United States, and we store and process information in the United States. If you contact us from outside the US, your information will be transferred to and processed in the US.

10. Children

The Website and Platform are designed for healthcare businesses and their staff. They are not directed to children, and we do not knowingly collect personal information from children under 16 through them. Any information about minor patients is PHI, handled under section 4.

11. Changes to this notice

We may update this notice as our services or the law change. We will post the new version here and update the date at the top. For material changes, we will give additional notice, such as an email to account administrators.

12. Contact us

• Email: privacy@nuvory.ai
• Mail: HealthArc LLC, Attn: Privacy, 2 University Plaza Dr, Suite 100, Hackensack, NJ 07601, United States
• Or use our contact page.

Customers with questions about PHI or their BAA should contact their account team or privacy@nuvory.ai.