.svg)
NVOX INC Washington Consumer Health Data Privacy Policy
Effective Date: May 28, 2026
Last Updated: May 28, 2026
Version: 1.0
This Washington Consumer Health Data Privacy Policy applies only to consumer health data governed by the Washington My Health My Data Act.
This policy does not apply to information that is exempt from the Washington My Health My Data Act, including protected health information governed by HIPAA or other information exempt under applicable law.
NVOX does not assume that all health related information processed through its website, registration flows, intake tools, scheduling workflows, payment workflows, support channels, companion style features, or other non clinical or pre service workflows is exempt from the Washington My Health My Data Act. Where information is not exempt and Washington law applies, NVOX handles it in accordance with this policy.
This policy supplements, and does not replace, the NVOX Privacy Policy and Notice of Privacy Practices, Where Applicable.
NVOX INC is a Delaware corporation located at 254 Chapman Rd, Ste 208, Newark, DE 19702, United States.
1. Scope of This Policy
NVOX provides an AI assisted clinical decision support platform designed to support structured evaluation of ADHD, learning disabilities, and related conditions.
NVOX may collect information through its website, registration flows, intake tools, schedulingworkflows, payment workflows, support channels, companion style features, recordedassessment sessions, and platform services.
Some information collected or processed by NVOX may be protected health informationgoverned by HIPAA. Where information is protected health information governed by HIPAA orotherwise exempt from the Washington My Health My Data Act, this Washington policy does notapply to that information.
However, NVOX does not assume that all health related information processed through itswebsite, registration flows, intake tools, scheduling workflows, payment workflows, supportchannels, companion style features, or other non clinical or pre service workflows is exempt
from the Washington My Health My Data Act. Where such information is not exempt andWashington law applies, NVOX handles it in accordance with this policy.
Where the Washington My Health My Data Act applies, this policy explains how NVOX collects,uses, discloses, shares, protects, and retains consumer health data.
For purposes of this policy, a consumer means a natural person who is a Washington residentor a natural person whose consumer health data is collected in Washington, acting in anindividual or household context.
2. Categories of Consumer Health Data We May Collect
Depending on how you interact with NVOX, we may collect the following categories ofconsumer health data where such information is governed by the Washington My Health MyData Act:
.svg)
Information about ADHD, learning disabilities, attention, executive functioning, cognitivefunctioning, behavioral functioning, academic functioning, developmental history, educationalhistory, or related concerns.
Information submitted through intake forms, questionnaires, registration flows, assessmentworkflows, support requests, or companion style features.
Information about symptoms, behaviors, functional challenges, school concerns, workplaceconcerns, accommodations, educational needs, or health related service interests.
Information about a user’s request for, interest in, eligibility for, or use of NVOX services.
Assessment performance data, structured responses, service status information, and reportrelated information where applicable and not exempt under HIPAA or other applicable law.
Video, audio, behavioral, facial visibility, gaze related, movement related, technical, device,display, and environmental information collected during an assessment session, where suchinformation is governed by the Washington My Health My Data Act and not exempt underHIPAA or other applicable law.
Behavioral biomarkers or assessment related indicators derived from video, audio, screenbased activity, technical environment data, response behavior, gaze related behavior,movement, facial visibility, or other assessment activity.
Information relating to scheduling, account status, customer support, incomplete registration,incomplete booking, payment process status, or service follow up where the informationidentifies or can reasonably be associated with a person’s past, present, or future physical ormental health status, health service interest, or health related service use.
Information that may be derived or inferred from a person’s interaction with NVOX services,including service interest, assessment participation, support needs, health related servicecontext, assessment related indicators, or health related inferences.
3. Sources of Consumer Health Data
NVOX may collect consumer health data from:
You directly.
A parent or legal guardian.
A teacher, counselor, school staff member, educational institution, employer, or other authorizedthird party where applicable and legally permitted.
A clinician or independent licensed professional involved in the service.
Scheduling, communications, support, identity verification, or payment systems.
Device, browser, camera, microphone, display, security, and platform systems used to accessNVOX.
Assessment activity and recorded assessment sessions.
Interactions with NVOX Companion or another AI support feature.
Other authorized sources where you or applicable law permit such collection.
4. Purposes for Collecting and Using Consumer Health Data
NVOX may collect and use consumer health data for the following purposes:
To provide requested services.
To create and manage accounts.
To verify identity and user authority.
To facilitate registration, intake, scheduling, payment, and report delivery.
To support structured assessment workflows.
To record, document, review, and analyze assessment sessions where recording is part of theservice.
To support clinician review and report issuance.
To generate reports and include clinically relevant descriptions, excerpts, screenshots, imageexcerpts, or visual documentation where appropriate.
To operate AI assisted decision support tools.
To operate informational or support features, including NVOX Companion or another companionstyle feature.
To maintain records.
To provide customer support.
To communicate with users about requested services.
To conduct quality assurance, supervision, safety review, and compliance review.
To maintain platform security and investigate misuse.
To detect fraud, abuse, unauthorized access, technical interference, assessment integrityissues, or service integrity issues.
To comply with legal, regulatory, contractual, audit, and compliance obligations.
To respond to user requests, complaints, and privacy rights requests.
To conduct permitted internal model improvement, platform validation, reliability monitoring,quality assurance, safety review, bias monitoring, model drift monitoring, technical validation,and error analysis where allowed by law and where any required consent or other lawful basisapplies.
NVOX may not collect, use, or share additional categories of consumer health data or processconsumer health data for additional purposes not disclosed in this policy without first updatingthe disclosure and obtaining affirmative consent where required by law.
5. Assessment Recordings, Visual Documentation, and Reports
Where audio capture, video capture, screen based assessment activity, microphone input,camera input, or session recording forms part of the service, NVOX may record, collect,transmit, process, analyze, store, and review such data for assessment administration,diagnostic documentation, clinician review, quality assurance, safety review, technical validation,platform integrity, troubleshooting, security, compliance, and report generation purposes.
The final report may include descriptions, references, screenshots, image excerpts, visualdocumentation, or other report elements derived from the recorded assessment session whereNVOX determines that such information is clinically relevant, useful for documentation, necessary to support interpretation of the assessment process, or relevant to describingassessment related behavioral biomarkers.
Where facial image excerpts, screenshots, or visual documentation are included in a report,NVOX will seek to minimize unnecessary facial exposure and may blur, crop, mask, redact, orotherwise reduce facial visibility where doing so does not materially impair the clinical,documentation, quality assurance, evidentiary, or interpretive value of the report.
Because certain facial visibility, gaze behavior, expression, positioning, or movement informationmay be clinically or technically relevant, NVOX cannot guarantee that all facial features will befully blurred, masked, cropped, or removed from the final report.
NVOX does not use such data to identify individuals through facial recognition, biometric identityverification, cross database biometric matching, or surveillance.
6. Categories of Consumer Health Data We May Share
NVOX may share the categories of consumer health data described in Section 2 only wherelegally permitted and reasonably necessary for the purposes described in this policy and theNVOX Privacy Policy.
Categories of consumer health data that may be shared include:
Contact, account, registration, scheduling, and support information.
Intake, questionnaire, and assessment workflow information.
Assessment performance data and service status information.
Report related information and clinically relevant report materials.
Video, audio, behavioral, facial visibility, gaze related, movement related, technical, device,display, and environmental information where necessary to provide or support the requestedservice.
Behavioral biomarkers or assessment related indicators where necessary to provide or supportthe requested service.
Security, fraud prevention, audit, access, and compliance records.
NVOX may share consumer health data only as permitted by law, including where necessary toprovide a product or service requested by the consumer, where the consumer has providedrequired consent, where required or permitted by law, or where an exemption applies.
7. Categories of Third Parties With Whom Consumer Health Data May Be Shared
NVOX may share consumer health data with the following categories of recipients where legallypermitted and reasonably necessary:
Licensed clinicians and clinical reviewers.
Independent contracted professionals.
Cloud hosting and infrastructure providers.
AI, GPU, and compute infrastructure providers.
Communications and scheduling vendors.
Payment processors.
Customer support and operational vendors.
Security, compliance, audit, and monitoring vendors.
Engineering, troubleshooting, and technical operations vendors.
External AI or technology providers where permitted and appropriately safeguarded.
Legal, regulatory, or governmental authorities where required or permitted by law.
Other persons or organizations where you direct NVOX to share information or where youprovide legally valid consent.
8. Specific Affiliates With Whom Consumer Health Data May Be Shared
As of the Effective Date, NVOX does not share consumer health data with any corporateaffiliate.
NVOX Foundation Inc. is legally separate from NVOX INC and does not collect, receive, orprocess NVOX consumer health data.
NVOX may share consumer health data with service providers, contractors, processors,clinicians, and other third parties as described in this policy, where legally permitted andreasonably necessary.
NVOX will update this policy if it shares consumer health data with any corporate affiliate in amanner that requires disclosure under the Washington My Health My Data Act.
9. Processors and Data Processing Agreements
Where NVOX engages processors to process consumer health data on NVOX’s behalf, NVOXuses binding contractual arrangements designed to set processing instructions, restrict theprocessor’s use of consumer health data, require assistance with applicable consumer rights,and limit processing to the purposes disclosed in this policy or otherwise permitted by law.
Processors may process consumer health data only in a manner consistent with NVOX’sinstructions and applicable contractual obligations.
If a processor processes consumer health data outside the scope of NVOX’s instructions orapplicable contract, the processor may become independently responsible for such processingunder applicable law.
10. Consent, Sharing Consent, and Sale Authorization
NVOX may collect consumer health data without separate consent where the collection isnecessary to provide a product or service requested by the consumer.
NVOX will obtain affirmative consent before collecting consumer health data for purposes thatare not necessary to provide the requested product or service where required by law.
NVOX will obtain consent that is separate and distinct from collection consent before sharingconsumer health data where such consent is required by law.
A request for consent will clearly and conspicuously disclose the categories of consumer healthdata collected or shared, the purpose of the collection or sharing, the specific ways in which theconsumer health data will be used, the categories of entities with whom consumer health data isshared, and how the consumer may withdraw consent from future collection or sharing.
Consent may not be obtained through acceptance of a general or broad terms of use agreementthat contains descriptions of unrelated processing, through passive interaction, or throughdeceptive design.
General acceptance of the NVOX Privacy Policy, Terms of Use, or Assessment Recording andDocumentation Consent does not constitute consent to optional model improvement or optionalmodel training where separate consent is required by law.
NVOX does not sell consumer health data.
If NVOX ever engages in a practice that constitutes a sale of consumer health data underWashington law, NVOX will obtain a valid authorization before doing so. Any such authorizationwill be separate and distinct from consent to collect or share consumer health data, will identifythe consumer health data to be sold, the seller, the purchaser, the purpose of the sale, theconsumer’s right to revoke authorization, the possibility of redisclosure, the expiration date, andany other information required by law.
Where required by law, NVOX and the purchaser will retain a copy of the authorization for therequired retention period.
NVOX will not condition provision of goods or services on a consumer signing an authorizationto sell consumer health data where prohibited by law.
11. External AI, Model Improvement, and Data Minimization
Where NVOX uses external AI or processing providers, NVOX limits transmitted consumerhealth data to what is reasonably necessary for the relevant processing task and appliescontractual, technical, administrative, and compliance safeguards.
Unless expressly disclosed and permitted by applicable law, external AI providers and othertechnology providers are not permitted to use NVOX consumer health data, user data, personalinformation, or protected health information to train their own general purpose models.
Where model improvement, platform validation, reliability monitoring, safety review, biasmonitoring, model drift monitoring, technical validation, or error analysis involves consumerhealth data governed by the Washington My Health My Data Act and is not necessary to providea product or service requested by the consumer, NVOX will obtain affirmative consent whererequired by law.
12. Geofencing
NVOX does not use geofencing around entities that provide in person health care services toidentify or track consumers seeking health care services, collect consumer health data fromconsumers, or send notifications, messages, or advertisements to consumers related to theirconsumer health data or health care services.
13. Washington Consumer Health Data Rights
Where the Washington My Health My Data Act applies, Washington consumers may have theright to:
Confirm whether NVOX collects, shares, or sells consumer health data concerning theconsumer.
Access consumer health data concerning the consumer.
Receive a list of categories of consumer health data collected.
Receive a list of categories of sources from which consumer health data was collected.
Receive a list of categories of consumer health data shared.
Receive a list of all third parties and affiliates with whom NVOX has shared or sold theconsumer’s consumer health data, together with an active email address or other onlinemechanism that the consumer may use to contact those recipients, where required by law.
Withdraw consent from NVOX’s collection or sharing of consumer health data concerning theconsumer where consent is the basis for the processing.
Request deletion of consumer health data concerning the consumer, subject to applicable legalrequirements and exemptions.
Appeal a refusal to take action on a request.
Not be unlawfully discriminated against for exercising rights under the Washington My HealthMy Data Act.
Requests may be submitted to:
NVOX may require information reasonably necessary to verify your identity and authority beforeresponding to a request.
Consumers are not required to create a new account to exercise rights, but NVOX may requirea consumer to use an existing account where permitted by law.
NVOX will not unlawfully discriminate against a consumer for exercising rights under theWashington My Health My Data Act.
14. Response Timing and Appeals
Where the Washington My Health My Data Act applies, NVOX will respond to verified consumerhealth data requests without undue delay and in all cases within 45 days of receipt of therequest.
NVOX may extend the response period once by 45 additional days where reasonablynecessary, taking into account the complexity and number of requests, provided that NVOXinforms the consumer of the extension and the reason for the extension within the initial 45 dayresponse period.
If NVOX refuses to take action on a request, NVOX will provide an explanation where requiredby law.
NVOX will respond to an appeal within 45 days of receipt of the appeal where required by lawand will provide a written explanation of the action taken or not taken.
If an appeal is denied, NVOX will provide the consumer with an online mechanism, if available,or other method through which the consumer may contact the Washington Attorney General tosubmit a complaint.
15. Deletion Requests
Where a verified deletion request is granted, NVOX will delete covered consumer health datafrom its records as required by law and will notify affiliates, processors, contractors, and otherthird parties with whom NVOX has shared the consumer health data of the deletion requestwhere required by law.
All affiliates, processors, contractors, and other third parties that receive notice of a deletionrequest are expected to honor the deletion request as required by law.
If covered consumer health data is stored in archived or backup systems, deletion from thosesystems may be delayed as permitted by law, but such delay will not exceed six months fromauthentication of the deletion request where the Washington My Health My Data Act applies.
Deletion may be limited only where an applicable exemption or legal requirement permits orrequires continued retention.
16. Data Security
NVOX uses administrative, physical, and technical safeguards designed to protect consumerhealth data.
These safeguards may include encryption, access controls, least privilege principles,authentication controls, access logging, vendor controls, security monitoring, workforceconfidentiality obligations, incident response procedures, and other security measuresappropriate to the nature and volume of the data and the service.
NVOX restricts access to consumer health data to personnel, contractors, processors, andservice providers for which access is necessary to further the purposes for which the consumerprovided consent or to provide a product or service requested by the consumer.
No security measure is perfect, and NVOX cannot guarantee absolute security.
17. Retention
NVOX retains consumer health data for as long as reasonably necessary for the purposesdisclosed in this policy, to provide requested services, and as required or permitted byapplicable law.
Retention periods may vary depending on the type of information, the service relationship, legalobligations, clinical documentation requirements, audit needs, security needs, and compliancerequirements.
Where consumer health data is also protected health information, medical record information,education record information, or other information subject to a separate legal retentionrequirement or exemption, NVOX will retain and delete such information in accordance withapplicable law.
18. Children and Minors
NVOX may process information in connection with assessments involving minors.
For individuals under eighteen years of age, a parent or legal guardian must provide legallyvalid consent before services are initiated, except where applicable law permits or requires adifferent consent process.
If an assessment involves a minor, the parent or legal guardian is responsible for ensuring thatlegally valid consent has been provided and that the minor participates in an appropriate privateenvironment.
Parent or guardian access to a minor’s information may be limited where required or permittedby applicable law.
19. No Sale of Consumer Health Data
NVOX does not sell consumer health data.
NVOX does not share consumer health data for third party advertising.
NVOX does not permit external AI providers or other technology providers to use consumerhealth data to train their own general purpose models unless expressly disclosed and permittedby applicable law.
20. Website Posting and Availability
Where required by law, NVOX will make this Washington Consumer Health Data Privacy Policyavailable through a separate and prominent link on its website or through another legallypermitted method.
21. Changes to This Policy
NVOX may update this Washington Consumer Health Data Privacy Policy from time to time.
Material changes will be posted with an updated effective date.
Where required by law, NVOX may provide additional notice or obtain additional consent beforecollecting, using, or sharing additional categories of consumer health data or before processingconsumer health data for additional purposes.
22. Contact Information
Questions, requests, appeals, or complaints about this policy may be directed to:
NVOX INC
254 Chapman Rd, Ste 208
Newark, DE 19702
United States
Privacy Officer: Gil Cohen
Telephone: +1 464 249 6688
Privacy Contact: privacy@nvox.com
Data Requests: datarequests@nvox.com
General Support: support@nvox.com
.svg)
