Privacy Policy

Navaryn ("we," "our," or "us") is operated by Jeskel Group. This Privacy Policy describes how we collect, use, disclose, and protect information when you use the Navaryn platform (the "Service").

We are designed for use by healthcare organizations and their staff. When a covered entity uses Navaryn, Navaryn acts as a Business Associate under HIPAA: we receive, encrypt, store, and process Protected Health Information (PHI) on that organization's behalf, and we execute a Business Associate Agreement before any PHI is transmitted to the platform. Section 8 sets this out in full.

Inside the platform, patient identifiers are replaced with opaque tokens before any content is sent to an AI model. The original values stay in an encrypted vault inside Navaryn's own database. Those values are PHI, we protect them as PHI, and they are never sent to an AI provider.

Account and Organization Information: When you register, we collect your name, work email address, organization name, and role. For billing purposes, we collect payment information, which is processed by our payment processor and not stored on Navaryn servers.

Usage Data: We collect logs of how you interact with the Service - pages visited, agent interactions initiated, documents created, approvals made, and timestamps. This data is used for audit trail generation, service improvement, and security monitoring.

Device and Technical Data: We collect standard technical information including IP address, browser type, operating system, and session identifiers for security and fraud prevention purposes.

Communications: If you contact us, we retain records of that communication.

Patient Health Information (PHI): This section is about information we collect about YOU, our customer's workforce user - not about patient data. Navaryn does receive and store PHI on behalf of covered-entity customers, under a Business Associate Agreement. How that PHI is handled, tokenized, encrypted and audited is described in Sections 7 and 8 below.

Personal Health Data: We do not collect health information about our users.

We use the information we collect to:

- Provide, operate, and improve the Service - Authenticate users and enforce access controls - Generate and maintain immutable audit trails required for compliance operations - Send transactional communications (account confirmations, billing receipts, security alerts) - Respond to support requests and inquiries - Detect and prevent fraud, abuse, and security incidents - Comply with legal obligations

We do not use your information for behavioral advertising or sell it to third parties.

We share information only in the following circumstances:

Service Providers: We use third-party vendors for infrastructure (cloud hosting and managed database), payment processing, and email delivery, and they may only use data to provide those services to us. Where a vendor could handle PHI, HIPAA requires a business associate agreement with that vendor as well as with us. Those subcontractor agreements are being put in place ahead of our first production customer, and we do not transmit production PHI to a subcontractor before the agreement covering it is executed.

Our subprocessors, by name: Amazon Web Services (application servers, storage, and outbound email, all in United States regions); Supabase (managed PostgreSQL database, United States region); Alibaba Cloud DashScope (the AI model, United States endpoint) - which receives only tokenized text and never receives PHI, and which the patient-matching path does not call at all; UptimeRobot and healthchecks.io (availability monitoring, no customer data); Slack (internal alerting, no PHI); GitHub (source code, no customer data). We will update this list before adding a subprocessor that could handle PHI.

Legal Requirements: We may disclose information if required by law, regulation, court order, or in response to lawful requests by government authorities.

Business Transfers: If Navaryn or Jeskel Group is involved in a merger, acquisition, or sale of assets, customer information may be transferred as part of that transaction. We will notify you via email and/or prominent notice on the Service before your information becomes subject to a different privacy policy.

With Your Consent: We may share information for any other purpose with your explicit consent.

We do not sell, rent, or share your personal information with third parties for their own marketing purposes.

We retain account and organization data for the duration of your subscription and for 7 years following account termination, consistent with standard healthcare records retention guidance.

Audit logs are retained for a minimum of 6 years from the date of the logged action, in alignment with HIPAA documentation requirements under 45 CFR §164.530(j).

You may request deletion of your account data at any time. We will fulfill deletion requests subject to our legal retention obligations. Audit logs cannot be deleted while in the legally required retention period.

We implement technical and organizational measures designed to protect your information, including:

- AES-256-GCM encryption of stored patient identifiers, in a vault table readable only by the server-side service role - TLS encryption for all data in transit - Organization-scoped row-level security enforced in the database, in addition to application-layer access checks - An append-only, hash-chained audit log; inserts are restricted to a dedicated database writer role, and UPDATE and DELETE are denied to every application role - Uploaded files are virus-scanned before any parser or extractor reads them - Patient identifiers are tokenized before any content reaches an AI model

What we do NOT yet have, stated plainly: no SOC 2 report, no completed third-party penetration test, and no multi-factor authentication. These are planned; our Security page tracks the status of each and we will not describe them as in place before they are.

No transmission over the internet is completely secure. While we use commercially reasonable security practices, we cannot guarantee absolute security.

Navaryn is a Business Associate under HIPAA. We receive, encrypt, and store PHI on behalf of covered entities, and we execute a Business Associate Agreement with every customer organization before any PHI is transmitted to the platform. A BAA is part of onboarding for every customer. It is not an add-on and it is not tied to a plan tier.

Within the platform, patient identifiers are tokenized before any content is sent to an AI model, and the patient-matching path makes no AI-model call at all. No PHI is disclosed to an AI provider.

Our BAA template is in final legal review. The version you sign will be the reviewed version, and you are welcome to redline it.

Customers are responsible for ensuring their own use of the Service complies with applicable healthcare privacy laws, including HIPAA, state privacy laws, and applicable international regulations.

Depending on your jurisdiction, you may have the following rights with respect to your personal information:

• Access::Request a copy of the personal information we hold about you
• Correction::Request correction of inaccurate or incomplete information
• Deletion::Request deletion of your personal information (subject to legal retention requirements)
• Portability::Request a machine-readable export of your data
• Objection::Object to certain processing activities

To exercise these rights, contact us at privacy@navaryn.com. We will respond within 30 days.

We use strictly necessary cookies to maintain your authenticated session. We do not use advertising cookies or cross-site tracking cookies.

We use first-party analytics to understand how users interact with the Service. This data is aggregated and anonymized and is not used to identify individual users.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a prominent notice in the Service at least 30 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

If you have questions or concerns about this Privacy Policy or our data practices, contact us at:

**Jeskel Group - Navaryn Privacy** privacy@navaryn.com

For security-related inquiries: security@navaryn.com