Privacy policy.

Who this policy is from, and what it covers

This policy is published by [LEGAL ENTITY] (“NaveaCare”, “we”, “us”). It covers this website, naveacare.com, and the NaveaCare application at app.naveacare.com.

It does not cover what a staffing company, an agency or a clinician does with information inside their own account. Where we hold information on a customer’s behalf, that customer decides what is collected and why, and their own privacy notice governs it. We act on their instructions.

Health information is the one category this policy does not govern at all. Where a staffing company’s workspace contains protected health information, our handling of it is governed by the Business Associate Agreement made with that customer, which controls over this policy. An agency workspace is not intended to receive protected health information and forms no Business Associate Agreement.

What this website collects

This site sets no cookies, runs no analytics, embeds no advertising or social pixels, and loads no third-party scripts. Its typefaces are served from this domain rather than fetched from a font host. Reading it leaves nothing on your device and tells us nothing about you individually.

If you submit the “Book a demo” or Enterprise quote form, we receive what you type into it: your name, work email, company, the type of organization you work for, your roster size, and your message. We use it to reply to you and to decide whether NaveaCare fits what you do. We do not sell it, and we do not add you to a marketing list you did not ask for.

Our hosting provider records ordinary server logs for the requests this site serves — IP address, timestamp, the page requested, and the browser’s user agent — which we use to keep the site up and to investigate abuse.

What the application collects

Account information: the name, email address and role of each person invited into an organization, the organization they belong to, and the record of which version of our Terms they accepted and when.

Information your organization enters: your clinician roster, agency details, contracts and the rates on them, compliance documents and their expiry dates, referrals, visit schedules, messages between parties, and invoices. Some of this is personal information about clinicians, and in a staffing company’s workspace some of it concerns patients.

Addresses, which are converted to coordinates so that a referral can be matched to the nearest clinician. The address is sent to our mapping provider for that purpose.

Billing information, if your organization subscribes. Card details are entered directly with our payment processor and never reach our servers; we hold the subscription status, plan, and the processor’s identifiers for your organization.

Technical records: session cookies that keep you signed in, and server logs as described above. The session cookie is strictly necessary — without it there is no way to stay signed in — and we set no advertising or analytics cookies in the application either.

Why we use it

To provide the product: to show each person the part of the work that is theirs, to match referrals to clinicians, to generate contracts and invoices, and to tell people when something needs their attention.

To send transactional email — invitations, notifications, and billing messages. These are part of the service rather than marketing, and they cannot be turned off without leaving the product.

To take payment, where a plan is paid for.

To keep the service secure and working: investigating faults and abuse, and keeping the audit trail that records who changed what.

To meet our legal obligations, and to establish or defend legal claims.

Who else sees it

Other parties in your organization’s workflow see what their role requires, and nothing else. A staffing company sees its own roster, agencies and referrals; a partner agency sees the clinicians, contracts and documents of its engagement with that staffing company; a clinician sees their own profile, their assignments and their pay. This separation is enforced on the server for every request, not by hiding links in the interface.

We use a small number of service providers, who process information only to provide their service to us and are bound by contract: Vercel (hosting and logs), Neon (database and document storage), Resend (email delivery), Stripe (payments and subscriptions), and Mapbox (converting addresses to coordinates, and displaying maps). This list is current as of the effective date above.

We may disclose information where the law requires it, and we will tell the affected customer unless we are prohibited from doing so.

If the business is sold or merges, information may transfer with it. The buyer would be bound by this policy until it gives notice of a replacement.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

How long we keep it

Information in an organization’s account is kept while that account is open, and for as long afterwards as the law or an unresolved dispute requires. A customer can ask us to delete their account data, subject to records we must keep — invoices and the audit trail that proves what an invoice was based on, in particular.

Enquiries sent through the contact form on this site are kept for as long as it takes to answer them and to keep a record of the conversation.

Server logs are kept for a short period and then rotate.

Where it is held

The application and its database run in the United States. Our providers may process limited information elsewhere in the course of delivering their service. If you are outside the United States, using NaveaCare means information about you is handled there.

How it is protected

Traffic is encrypted in transit. Access is scoped by role and tenant and checked on the server for every request. Documents are served only through an authorizing endpoint rather than from a public address, so a link alone does not grant access. Invoices are locked when generated and every lifecycle event is recorded.

No system is immune to compromise. We make no certification claim on this page: where a customer needs one, that belongs in a contract rather than in a marketing site’s footer.

Your choices

You can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Depending on where you live you may also have the right to object to or restrict how it is used, to receive it in a portable form, and to complain to your data protection authority.

Where the information is in a customer’s account — your clinician record, for instance — the customer controls it, and the fastest route is to ask them. Write to us at [NOTICE EMAIL] and we will pass the request on and help it along.

We will not discriminate against you for exercising any of these rights.

Not for children

NaveaCare is software for organizations. It is not directed at children, and we do not knowingly collect information from anyone under 18. If you believe a child’s information has reached us, write to [NOTICE EMAIL] and we will delete it.

Changes to this policy

When this policy changes we will update the effective date above. If a change materially affects how we use information about identifiable people, we will tell account holders by email before it takes effect.

Contact us

Write to [NOTICE EMAIL], or to [LEGAL ENTITY], [NOTICE ADDRESS].