Privacy Policy

1. Scope & Relationship to Client Service Agreements

This Privacy Policy applies to personal and commercial data collected directly through discovery forms, inquiry emails, phone interactions, and RPO recruitment campaigns.

• Website & Corporate Inquiries: Naxape serves as the Data Controller for information submitted by website visitors, business representatives requesting consultations, and candidates applying for placement.
• Client BPO Engagements & PHI Carve-Out: When Naxape personnel perform operational back-office tasks (e.g., patient intake, scheduling in EMR/EHR software, NEMT route dispatching, vet clinic records, security logs, or bookkeeping in QuickBooks/Xero), we act strictly as a Data Processor / Service Provider.
• Precedence of MSAs & BAAs: Operational data, patient health data, and client confidential information are governed exclusively by standalone Master Services Agreements (MSAs), Data Processing Agreements (DPAs), and Business Associate Agreements (BAAs) executed with each client agency. This public website does not store, transmit, or process client patient health records.

2. Information We Collect

We collect information across three primary categories:

• Commercial Inquiries & Account Data: When a business schedules a discovery call or enters into a service contract, we collect company names, authorized representative contact information (name, work email, business phone number), billing addresses, and payment processing details (ACH/credit card).
• Talent Sourcing & Applicant Data (RPO): When candidates apply for client roles (e.g., Caregivers, CNAs, HHAs, Registered Nurses, NEMT Drivers, Vet Techs, or Security Guards), we collect resumes, contact details, work history, references, state licenses, active security guard cards, MVR driving checks, and background screening authorizations.
• Automated Website Diagnostics: Standard technical usage data including IP addresses, browser types, device identifiers, referring URLs, and essential site cookies to maintain system performance and security.

3. Purpose & Legal Basis of Processing

We process data solely for legitimate commercial and operational purposes:

• Service Delivery & Consultation: Responding to agency inquiries, preparing operational proposals, and onboarding new client accounts.
• Workforce Recruitment & Credentialing: Sourcing, screening, verifying professional licenses, running compliance checks, and matching qualified talent with hiring partner agencies.
• Operational Execution: Fulfilling contracted BPO workflows, including dispatch routing, intake follow-ups, shift coverage, and billing reconciliation.
• Administrative & Billing: Invoicing corporate clients, maintaining accounts payable/receivable, and managing enterprise IT provisioning (Google Workspace, Microsoft 365, VoIP).

4. SMS & Mobile Communications (A2P 10DLC & TCPA Compliance)

When you submit a business inquiry form, request candidate updates, or opt in to SMS messaging through Naxape:

• Strict Prohibition on Mobile Data Sharing: No mobile information, phone numbers, or SMS opt-in consent will be shared, sold, rented, or transferred to third parties or affiliates for marketing or promotional purposes under any circumstances.
• Message Purpose: Text messages are sent strictly for transactional, operational, or inquiry-related purposes (e.g., discovery call confirmations, interview scheduling, or emergency operational alerts).
• Opt-Out & Support: You may opt out of SMS communications at any time by replying STOP to any message. For assistance, reply HELP or contact us at privacy@naxape.com. Message and data rates may apply, and message frequency varies based on engagement.

5. Healthcare Compliance & Confidentiality (HIPAA)

• Business Associate Obligations: In our healthcare (Home Care and Home Health) and NEMT verticals, our personnel operate in strict adherence to HIPAA Privacy and Security Rules. All team members undergo HIPAA compliance training before accessing client accounts.
• Proprietary Business Data: All client trade secrets, pricing schedules, caregiver lists, patient directories, and financial books are treated as strictly confidential under binding Non-Disclosure Agreements (NDAs).
• No Commercialization of Data: Naxape does not monetize, sell, or rent any corporate, operational, or candidate records to third-party advertisers or data brokers.

6. Disclosures to Authorized Subprocessors

We disclose information only to authorized third parties strictly required to deliver our services:

• Enterprise Cloud & ATS Providers: Secure hosting infrastructure, applicant tracking systems, and communication vendors bound by rigorous data processing agreements.
• Screening & Payroll Partners: Authorized third-party background screening companies and multi-state payroll processors.
• Legal Requirements: Public regulatory or judicial authorities only when mandated by valid legal process, subpoena, or applicable state and federal laws.

7. Data Security & Storage

We implement enterprise-grade administrative, technical, and physical safeguards:

• Access Control: Role-Based Access Control (RBAC) following the principle of least privilege, ensuring personnel only access files necessary for their specific client account.
• Authentication & Encryption: Mandatory Multi-Factor Authentication (MFA) across all workstations, email accounts, and portals, with AES 256-bit encryption for data in transit and at rest.
• Immediate De-Provisioning: Immediate, audited revocation of all software credentials and client portal access whenever team members are reassigned or offboarded.

8. Data Retention & Individual Rights

• Retention Periods: Commercial inquiry and contract records are retained for the duration of the client relationship plus statutory tax/accounting periods. Candidate profiles are retained in our active talent pool (typically 2–3 years) or until an applicant requests removal.
• Your Privacy Rights: Depending on your jurisdiction (including rights under CCPA/CPRA), you have the right to request access to, correction of, or deletion of your personal data, or to opt out of non-essential communications. We do not discriminate against individuals for exercising their legal privacy rights.

9. Contact Us

For questions regarding this Privacy Policy, Business Associate Agreements, or data security verification, please contact:

Naxape

• Email: privacy@naxape.com
• Contact No.: 00000000000

10. Changes to Our Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our operational practices, service offerings, industry regulations, or applicable legal standards.

When modifications are made:

• The "Last Updated" date at the top of this page will be revised accordingly.
• Any material updates affecting how we handle corporate client data, SMS terms, or candidate compliance records will be highlighted prominently on our website or communicated directly to active client accounts via email.
• Continued use of our website, communication channels, or managed services following the publication of an updated policy constitutes acceptance of the revised terms.

We encourage corporate clients, partners, and job applicants to review this page periodically to remain informed about our data protection and governance practices.