NVOX INC Washington Consumer Health Data Privacy Policy
Effective Date: May 28, 2026
Last Updated: May 28, 2026
Version: 1.0
This Washington Consumer Health Data Privacy Policy applies only to consumer health data governed by the Washington My Health My Data Act.
This policy does not apply to information that is exempt from the Washington My Health My Data Act, including protected health information governed by HIPAA or other information exempt under applicable law.
NVOX does not assume that all health related information processed through its website, registration flows, intake tools, scheduling workflows, payment workflows, support channels, companion style features, or other non clinical or pre service workflows is exempt from the Washington My Health My Data Act. Where information is not exempt and Washington law applies, NVOX handles it in accordance with this policy.
This policy supplements, and does not replace, the NVOX Privacy Policy and Notice of Privacy Practices, where applicable.
NVOX INC is a Delaware corporation located at 254 Chapman Rd, Ste 208, Newark, DE 19702, United States.
1. Scope of This Policy
NVOX provides an AI-assisted clinical decision support platform designed to support structured evaluation of ADHD, learning disabilities, and related conditions.
NVOX may collect information through its website, registration flows, intake tools, scheduling workflows, payment workflows, support channels, companion style features, recorded assessment sessions, and platform services.
Some information collected or processed by NVOX may be protected health information governed by HIPAA. Where information is protected health information governed by HIPAA or otherwise exempt from the Washington My Health My Data Act, this Washington policy does not apply to that information.
However, NVOX does not assume that all health related information processed through its website, registration flows, intake tools, scheduling workflows, payment workflows, support channels, companion style features, or other non clinical or pre service workflows is exempt from the Washington My Health My Data Act. Where such information is not exempt and Washington law applies, NVOX handles it in accordance with this policy.
Where the Washington My Health My Data Act applies, this policy explains how NVOX collects, uses, discloses, shares, protects, and retains consumer health data.
For purposes of this policy, a consumer means a natural person who is a Washington resident or a natural person whose consumer health data is collected in Washington, acting in an individual or household context.
2. Categories of Consumer Health Data We May Collect
Depending on how you interact with NVOX, we may collect the following categories of consumer health data where such information is governed by the Washington My Health My Data Act:
.svg)
Information about ADHD, learning disabilities, attention, executive functioning, cognitive functioning, behavioral functioning, academic functioning, developmental history, educational history, or related concerns.
Information submitted through intake forms, questionnaires, registration flows, assessment workflows, support requests, or companion style features.
Information about symptoms, behaviors, functional challenges, school concerns, workplace concerns, accommodations, educational needs, or health related service interests.
Information about a user’s request for, interest in, eligibility for, or use of NVOX services.
Assessment performance data, structured responses, service status information, and report related information where applicable and not exempt under HIPAA or other applicable law.
Video, audio, behavioral, facial visibility, gaze related, movement related, technical, device, display, and environmental information collected during an assessment session, where such information is governed by the Washington My Health My Data Act and not exempt under HIPAA or other applicable law.
Behavioral biomarkers or assessment related indicators derived from video, audio, screen based activity, technical environment data, response behavior, gaze related behavior, movement, facial visibility, or other assessment activity.
Information relating to scheduling, account status, customer support, incomplete registration, incomplete booking, payment process status, or service follow up where the information identifies or can reasonably be associated with a person’s past, present, or future physical or mental health status, health service interest, or health related service use.
Information that may be derived or inferred from a person’s interaction with NVOX services, including service interest, assessment participation, support needs, health related service context, assessment related indicators, or health related inferences.
3. Sources of Consumer Health Data
NVOX may collect consumer health data from:
You directly.
A parent or legal guardian.
A teacher, counselor, school staff member, educational institution, employer, or other authorized third party where applicable and legally permitted.
A clinician or independent licensed professional involved in the service.
Scheduling, communications, support, identity verification, or payment systems.
Device, browser, camera, microphone, display, security, and platform systems used to access NVOX.
Assessment activity and recorded assessment sessions.
Interactions with NVOX Companion or another AI support feature.
Other authorized sources where you or applicable law permit such collection.
4. Purposes for Collecting and Using Consumer Health Data
NVOX may collect and use consumer health data for the following purposes:
To provide requested services.
To create and manage accounts.
To verify identity and user authority.
To facilitate registration, intake, scheduling, payment, and report delivery.
To support structured assessment workflows.
To record, document, review, and analyze assessment sessions where recording is part of the service.
To support clinician review and report issuance.
To generate reports and include clinically relevant descriptions, excerpts, screenshots, image excerpts, or visual documentation where appropriate.
To operate AI-assisted decision support tools.
To operate informational or support features, including NVOX Companion or another companion style feature.
To maintain records.
To provide customer support.
To communicate with users about requested services.
To conduct quality assurance, supervision, safety review, and compliance review.
To maintain platform security and investigate misuse.
To detect fraud, abuse, unauthorized access, technical interference, assessment integrity issues, or service integrity issues.
To comply with legal, regulatory, contractual, audit, and compliance obligations.
To respond to user requests, complaints, and privacy rights requests.
To conduct permitted internal model improvement, platform validation, reliability monitoring, quality assurance, safety review, bias monitoring, model drift monitoring, technical validation, and error analysis where allowed by law and where any required consent or other lawful basis applies.
NVOX may not collect, use, or share additional categories of consumer health data or process consumer health data for additional purposes not disclosed in this policy without first updating the disclosure and obtaining affirmative consent where required by law.
5. Assessment Recordings, Visual Documentation, and Reports
Where audio capture, video capture, screen based assessment activity, microphone input, camera input, or session recording forms part of the service, NVOX may record, collect, transmit, process, analyze, store, and review such data for assessment administration, diagnostic documentation, clinician review, quality assurance, safety review, technical validation, platform integrity, troubleshooting, security, compliance, and report generation purposes.
The final report may include descriptions, references, screenshots, image excerpts, visual documentation, or other report elements derived from the recorded assessment session where NVOX determines that such information is clinically relevant, useful for documentation, necessary to support interpretation of the assessment process, or relevant to describing assessment related behavioral biomarkers.
Where facial image excerpts, screenshots, or visual documentation are included in a report, NVOX will seek to minimize unnecessary facial exposure and may blur, crop, mask, redact, or otherwise reduce facial visibility where doing so does not materially impair the clinical, documentation, quality assurance, evidentiary, or interpretive value of the report.
Because certain facial visibility, gaze behavior, expression, positioning, or movement information may be clinically or technically relevant, NVOX cannot guarantee that all facial features will be fully blurred, masked, cropped, or removed from the final report.
NVOX does not use such data to identify individuals through facial recognition, biometric identity verification, cross database biometric matching, or surveillance.
6. Categories of Consumer Health Data We May Share
NVOX may share the categories of consumer health data described in Section 2 only where legally permitted and reasonably necessary for the purposes described in this policy and the NVOX Privacy Policy.
Categories of consumer health data that may be shared include:
Contact, account, registration, scheduling, and support information.
Intake, questionnaire, and assessment workflow information.
Assessment performance data and service status information.
Report related information and clinically relevant report materials.
Video, audio, behavioral, facial visibility, gaze related, movement related, technical, device, display, and environmental information where necessary to provide or support the requested service.
Behavioral biomarkers or assessment related indicators where necessary to provide or support the requested service.
Security, fraud prevention, audit, access, and compliance records.
NVOX may share consumer health data only as permitted by law, including where necessary to provide a product or service requested by the consumer, where the consumer has provided required consent, where required or permitted by law, or where an exemption applies.
7. Categories of Third Parties With Whom Consumer Health Data May Be Shared
NVOX may share consumer health data with the following categories of recipients where legally permitted and reasonably necessary:
Licensed clinicians and clinical reviewers.
Independent contracted professionals.
Cloud hosting and infrastructure providers.
AI, GPU, and compute infrastructure providers.
Communications and scheduling vendors.
Payment processors.
Customer support and operational vendors.
Security, compliance, audit, and monitoring vendors.
Engineering, troubleshooting, and technical operations vendors.
External AI or technology providers where permitted and appropriately safeguarded.
Legal, regulatory, or governmental authorities where required or permitted by law.
Other persons or organizations where you direct NVOX to share information or where you provide legally valid consent.
8. Specific Affiliates With Whom Consumer Health Data May Be Shared
As of the Effective Date, NVOX does not share consumer health data with any corporate affiliate.
NVOX Foundation Inc. is legally separate from NVOX INC and does not collect, receive, or process NVOX consumer health data.
NVOX may share consumer health data with service providers, contractors, processors, clinicians, and other third parties as described in this policy, where legally permitted and reasonably necessary.
NVOX will update this policy if it shares consumer health data with any corporate affiliate in a manner that requires disclosure under the Washington My Health My Data Act.
9. Processors and Data Processing Agreements
Where NVOX engages processors to process consumer health data on NVOX’s behalf, NVOX uses binding contractual arrangements designed to set processing instructions, restrict the processor’s use of consumer health data, require assistance with applicable consumer rights, and limit processing to the purposes disclosed in this policy or otherwise permitted by law.
Processors may process consumer health data only in a manner consistent with NVOX’s instructions and applicable contractual obligations.
If a processor processes consumer health data outside the scope of NVOX’s instructions or applicable contract, the processor may become independently responsible for such processing under applicable law.
10. Consent, Sharing Consent, and Sale Authorization
NVOX may collect consumer health data without separate consent where the collection is necessary to provide a product or service requested by the consumer.
NVOX will obtain affirmative consent before collecting consumer health data for purposes that are not necessary to provide the requested product or service where required by law.
NVOX will obtain consent that is separate and distinct from collection consent before sharing consumer health data where such consent is required by law.
A request for consent will clearly and conspicuously disclose the categories of consumer health data collected or shared, the purpose of the collection or sharing, the specific ways in which the consumer health data will be used, the categories of entities with whom consumer health data is shared, and how the consumer may withdraw consent from future collection or sharing.
Consent may not be obtained through acceptance of a general or broad terms of use agreement that contains descriptions of unrelated processing, through passive interaction, or through deceptive design.
General acceptance of the NVOX Privacy Policy, Terms of Use, or Assessment Recording and Documentation Consent does not constitute consent to optional model improvement or optional model training where separate consent is required by law.
NVOX does not sell consumer health data.
If NVOX ever engages in a practice that constitutes a sale of consumer health data under Washington law, NVOX will obtain a valid authorization before doing so. Any such authorization will be separate and distinct from consent to collect or share consumer health data, will identify the consumer health data to be sold, the seller, the purchaser, the purpose of the sale, the consumer’s right to revoke authorization, the possibility of redisclosure, the expiration date, and any other information required by law.
Where required by law, NVOX and the purchaser will retain a copy of the authorization for the required retention period.
NVOX will not condition provision of goods or services on a consumer signing an authorization to sell consumer health data where prohibited by law.
11. External AI, Model Improvement, and Data Minimization
Where NVOX uses external AI or processing providers, NVOX limits transmitted consumer health data to what is reasonably necessary for the relevant processing task and applies contractual, technical, administrative, and compliance safeguards.
Unless expressly disclosed and permitted by applicable law, external AI providers and other technology providers are not permitted to use NVOX consumer health data, user data, personal information, or protected health information to train their own general purpose models.
Where model improvement, platform validation, reliability monitoring, safety review, bias monitoring, model drift monitoring, technical validation, or error analysis involves consumer health data governed by the Washington My Health My Data Act and is not necessary to provide a product or service requested by the consumer, NVOX will obtain affirmative consent where required by law.
12. Geofencing
NVOX does not use geofencing around entities that provide in person health care services to identify or track consumers seeking health care services, collect consumer health data from consumers, or send notifications, messages, or advertisements to consumers related to their consumer health data or health care services.
13. Washington Consumer Health Data Rights
Where the Washington My Health My Data Act applies, Washington consumers may have the right to:
Confirm whether NVOX collects, shares, or sells consumer health data concerning the consumer.
Access consumer health data concerning the consumer.
Receive a list of categories of consumer health data collected.
Receive a list of categories of sources from which consumer health data was collected.
Receive a list of categories of consumer health data shared.
Receive a list of all third parties and affiliates with whom NVOX has shared or sold the consumer’s consumer health data, together with an active email address or other online mechanism that the consumer may use to contact those recipients, where required by law.
Withdraw consent from NVOX’s collection or sharing of consumer health data concerning the consumer where consent is the basis for the processing.
Request deletion of consumer health data concerning the consumer, subject to applicable legal requirements and exemptions.
Appeal a refusal to take action on a request.
Not be unlawfully discriminated against for exercising rights under the Washington My Health My Data Act.
NVOX may require information reasonably necessary to verify your identity and authority before responding to a request.
Consumers are not required to create a new account to exercise rights, but NVOX may require a consumer to use an existing account where permitted by law.
NVOX will not unlawfully discriminate against a consumer for exercising rights under the Washington My Health My Data Act.
14. Response Timing and Appeals
Where the Washington My Health My Data Act applies, NVOX will respond to verified consumer health data requests without undue delay and in all cases within 45 days of receipt of the request.
NVOX may extend the response period once by 45 additional days where reasonably necessary, taking into account the complexity and number of requests, provided that NVOX informs the consumer of the extension and the reason for the extension within the initial 45 day response period.
If NVOX refuses to take action on a request, NVOX will provide an explanation where required by law.
NVOX will respond to an appeal within 45 days of receipt of the appeal where required by law and will provide a written explanation of the action taken or not taken.
If an appeal is denied, NVOX will provide the consumer with an online mechanism, if available, or other method through which the consumer may contact the Washington Attorney General to submit a complaint.
15. Deletion Requests
Where a verified deletion request is granted, NVOX will delete covered consumer health data from its records as required by law and will notify affiliates, processors, contractors, and other third parties with whom NVOX has shared the consumer health data of the deletion request where required by law.
All affiliates, processors, contractors, and other third parties that receive notice of a deletion request are expected to honor the deletion request as required by law.
If covered consumer health data is stored in archived or backup systems, deletion from those systems may be delayed as permitted by law, but such delay will not exceed six months from authentication of the deletion request where the Washington My Health My Data Act applies.
Deletion may be limited only where an applicable exemption or legal requirement permits or requires continued retention.
16. Data Security
NVOX uses administrative, physical, and technical safeguards designed to protect consumer health data.
These safeguards may include encryption, access controls, least privilege principles, authentication controls, access logging, vendor controls, security monitoring, workforce confidentiality obligations, incident response procedures, and other security measures appropriate to the nature and volume of the data and the service.
NVOX restricts access to consumer health data to personnel, contractors, processors, and service providers for which access is necessary to further the purposes for which the consumer provided consent or to provide a product or service requested by the consumer.
No security measure is perfect, and NVOX cannot guarantee absolute security.
17. Retention
NVOX retains consumer health data for as long as reasonably necessary for the purposes disclosed in this policy, to provide requested services, and as required or permitted by applicable law.
Retention periods may vary depending on the type of information, the service relationship, legal obligations, clinical documentation requirements, audit needs, security needs, and compliance requirements.
Where consumer health data is also protected health information, medical record information, education record information, or other information subject to a separate legal retention requirement or exemption, NVOX will retain and delete such information in accordance with applicable law.
18. Children and Minors
NVOX may process information in connection with assessments involving minors.
For individuals under eighteen years of age, a parent or legal guardian must provide legally valid consent before services are initiated, except where applicable law permits or requires a different consent process.
If an assessment involves a minor, the parent or legal guardian is responsible for ensuring that legally valid consent has been provided and that the minor participates in an appropriate private environment.
Parent or guardian access to a minor’s information may be limited where required or permitted by applicable law.
19. No Sale of Consumer Health Data
NVOX does not sell consumer health data.
NVOX does not share consumer health data for third party advertising.
NVOX does not permit external AI providers or other technology providers to use consumer health data to train their own general purpose models unless expressly disclosed and permitted by applicable law.
20. Website Posting and Availability
Where required by law, NVOX will make this Washington Consumer Health Data Privacy Policy available through a separate and prominent link on its website or through another legally permitted method.
21. Changes to This Policy
NVOX may update this Washington Consumer Health Data Privacy Policy from time to time.
Material changes will be posted with an updated effective date.
Where required by law, NVOX may provide additional notice or obtain additional consent before collecting, using, or sharing additional categories of consumer health data or before processing consumer health data for additional purposes.
22. Contact Information
Questions, requests, appeals, or complaints about this policy may be directed to:
NVOX INC

254 Chapman Rd, Ste 208

Newark, DE 19702

United States
Privacy Officer: Gil Cohen

Telephone: +1 464 249 6688

Privacy Contact: privacy@nvox.com

Data Requests: datarequests@nvox.com
General Support: support@nvox.com
.svg)
