Privacy Policy

Noxvra provides AI-powered patient communication, enquiry management, and appointment automation services for clinics. Noxvra operates from Georgia and provides services to clinics internationally, including clinics in Saudi Arabia and the United Arab Emirates.

This Privacy Policy explains how Noxvra collects, uses, protects, and processes personal data in connection with our website, services, and business operations.

Where Noxvra processes patient personal data on behalf of a clinic, the clinic will generally determine the purposes and lawful basis for that processing, and Noxvra will process the data as a processor or service provider in accordance with the clinic's documented instructions and applicable law.

1. Information We Process

Depending on how the Services are configured and used, Noxvra may process:

• Patient names and contact details
• WhatsApp, Instagram, Facebook Messenger, Telegram, or other messaging identifiers
• Patient enquiries and conversation messages
• Appointment requests and preferences
• Requested services and other information provided during an enquiry
• Clinic information, including services, operating hours, FAQs, pricing, and booking information
• Account, billing, technical, and operational information
• Information required to provide customer support, maintain security, and operate the Services

Health and Sensitive Information

Noxvra's Services are designed primarily for communication, enquiry management, and administrative automation rather than medical record management.

Noxvra does not intentionally require patients to provide medical histories, diagnoses, treatment records, prescriptions, insurance information, or other unnecessary clinical information through standard workflows.

However, patients may voluntarily include health-related or other sensitive information in free-text messages. Where this occurs, Noxvra may process such information incidentally as necessary to provide the Services, subject to applicable law and the clinic's instructions.

Clinics are responsible for configuring their use of the Services to minimise unnecessary collection and processing of sensitive information.

2. How We Use Personal Data

Noxvra may process personal data to:

• Provide, operate, maintain, and support the Services
• Respond to patient enquiries and assist with appointment requests
• Capture and qualify leads according to the clinic's configuration
• Provide summaries, reporting, and operational information to clinics
• Configure and maintain clinic-specific AI knowledge and workflows
• Monitor, troubleshoot, secure, and improve the reliability and performance of the Services
• Detect fraud, misuse, security incidents, or unauthorised activity
• Communicate with customers regarding their accounts and Services
• Comply with applicable legal and regulatory obligations

Noxvra does not sell patient personal data.

Noxvra does not use patient personal data for unrelated advertising or marketing purposes.

3. AI and Automated Processing

Noxvra uses artificial intelligence and automated technologies to assist with patient communication, enquiry handling, lead qualification, appointment-related requests, and administrative workflows.

AI-generated responses are intended to assist communication and administrative processes. Noxvra's standard Services are not designed to provide medical diagnosis, prescribe medication, determine treatment, or make independent clinical decisions.

Clinics are responsible for configuring the Services appropriately and reviewing the information and workflows used by their AI systems.

Where a patient raises a matter requiring professional medical judgement, the clinic remains responsible for providing appropriate human clinical assistance.

Noxvra may use third-party technology providers to support AI, automation, messaging, infrastructure, security, and related functions. Specific provider information may be provided to clinics through applicable contractual or data-processing documentation.

4. Controller and Processor Responsibilities

Depending on the nature of the processing, Noxvra may act as:

• A processor or service provider when processing patient personal data on behalf of a clinic; or
• An independent controller for certain Noxvra business activities, such as account management, billing, security, fraud prevention, legal compliance, and certain operational activities.

Where the clinic is the controller, the clinic is generally responsible for determining the appropriate legal basis for processing patient personal data, providing required privacy notices, obtaining required consents or permissions, and responding to applicable data-subject requests.

Noxvra processes patient data in accordance with applicable law, the clinic's documented instructions, and the contractual arrangements applicable to the Services.

5. Third-Party Providers and Subprocessors

Noxvra may use trusted third-party providers to deliver and support the Services, including providers of:

• Messaging and communication infrastructure
• AI and machine-learning services
• Automation and workflow infrastructure
• Cloud hosting and technical infrastructure
• Security and monitoring services
• Customer support and operational services
• Payment and billing services

Such providers may process personal data only as necessary to perform their relevant services and are subject to appropriate contractual, confidentiality, and security requirements.

Where required by applicable law or contract, Noxvra will provide customers with additional information regarding relevant subprocessors.

6. International Data Processing and Transfers

Noxvra operates from Georgia and may use service providers located in different countries.

As a result, personal data may be processed or accessed outside the country in which the relevant clinic or patient is located.

Where applicable, Noxvra will implement appropriate safeguards and contractual or other mechanisms required by applicable data-protection laws for international transfers.

For clinic customers requiring more detailed information regarding processing locations, transfer mechanisms, subprocessors, or related safeguards, such information may be provided through the applicable Data Processing Agreement or other customer-specific documentation.

7. Data Retention and Deletion

Noxvra retains personal data only for as long as reasonably necessary to provide the Services, maintain security, meet contractual and operational requirements, comply with applicable law, or establish, exercise, or defend legal claims.

Specific retention periods may depend on the type of information, the configuration of the Services, the clinic's instructions, applicable contractual requirements, and legal obligations.

Where applicable, customer-specific retention and deletion requirements may be established in the Data Processing Agreement or other written agreement with the clinic.

When personal data is no longer required, Noxvra will take reasonable steps to delete, anonymise, or securely dispose of it, subject to applicable legal, security, backup, and record-keeping requirements.

8. Data Security

Noxvra maintains reasonable technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss, misuse, or destruction.

Depending on the relevant system and service, such measures may include:

• Access controls and authentication
• Role-based access restrictions
• Encryption in transit and, where appropriate, at rest
• Secure infrastructure and system configuration
• Monitoring and logging
• Backup and recovery procedures
• Incident-response procedures
• Confidentiality obligations for authorised personnel and service providers
• Data minimisation and access controls

No method of transmission, storage, or processing can be guaranteed to be completely secure.

9. Sensitive and Health-Related Data

Noxvra recognises that communications between patients and clinics may sometimes contain health-related or other sensitive information.

The Services are designed to minimise unnecessary processing of such information and are not intended to replace medical records systems.

Clinics must not intentionally configure Noxvra workflows to collect unnecessary health information or use the Services for diagnosis, treatment decisions, prescriptions, or other clinical functions unless separately assessed, legally permitted, and expressly agreed.

Where applicable, additional safeguards may apply to sensitive or health-related personal data under the laws of the relevant jurisdiction.

10. Data Subject Rights

Depending on applicable law, individuals may have rights relating to their personal data, including rights to:

• Access personal data
• Request correction of inaccurate information
• Request deletion
• Request restriction of processing
• Request a copy or transfer of personal data where applicable
• Withdraw consent where processing is based on consent
• Object to certain processing
• Lodge a complaint with the relevant supervisory authority

Where Noxvra processes patient data on behalf of a clinic, the clinic will generally be responsible for handling patient requests.

Noxvra will provide reasonable assistance to the clinic where required by applicable law or contractual arrangements.

Noxvra may require reasonable information to verify the identity of a person making a request.

11. Data Breach and Security Incidents

Noxvra maintains procedures for identifying, investigating, containing, and responding to personal-data and security incidents.

Where Noxvra becomes aware of a personal-data breach affecting personal data processed on behalf of a clinic, Noxvra will notify the clinic without undue delay in accordance with applicable law and the applicable contractual arrangements.

Where required, Noxvra will provide reasonably available information regarding the incident and cooperate with the clinic in responding to applicable legal and regulatory requirements.

The clinic remains responsible for fulfilling controller-specific notification and reporting obligations where applicable.

12. Children and Minors

Noxvra's Services may be used by clinics that provide services to minors.

Noxvra does not independently determine whether a patient is a minor or whether a person has appropriate parental or guardian authority.

Clinics are responsible for implementing appropriate age, consent, guardian, and safeguarding procedures required by applicable law.

13. Data Protection Assessments and Compliance

Depending on the nature, scope, and sensitivity of processing, a clinic may be required to conduct a data protection impact assessment or other compliance assessment.

Noxvra may provide reasonable information and assistance where required under applicable law or contractual arrangements.

The clinic remains responsible for determining its own legal and regulatory obligations as the controller of patient data.

14. Changes to This Privacy Policy

Noxvra may update this Privacy Policy from time to time to reflect changes to:

• The Services
• Our technology or processing activities
• Applicable laws or regulations
• Security or operational practices

Where appropriate, Noxvra will provide reasonable notice of material changes.

The updated version will be made available through the Noxvra website and will indicate its effective date.

15. Contact Us

If you have questions about this Privacy Policy or Noxvra's privacy practices, you may contact us at:

Noxvra
Email: Info@noxvra.com
Website: noxvra.com

This Privacy Policy should be read together with Noxvra's Terms of Service.

Informational Notice: This Privacy Policy is provided for general informational purposes and describes Noxvra's current data-processing practices. It does not constitute legal advice or create legal rights or obligations beyond those required by applicable law.