Prep Navigator
Legal

Privacy Policy

How PrepX Medical collects, uses, and safeguards your information.

Introduction

PrepX Medical, Inc. ("PrepX Medical", "we", "us", "our") operates PrepNavigator (prepnavigator.ai), a medical procedure preparation management platform ("Service"). This Privacy Policy describes how we collect, use, disclose, and safeguard your information. By using our Service, you agree to this policy.

Section 1 — Definitions

  • "Protected Health Information (PHI)" means individually identifiable health information as defined under HIPAA.
  • "Personal Information" means information that identifies you personally, excluding PHI which is governed separately under HIPAA.
  • "Provider" means the gastroenterology or endoscopy center using PrepNavigator.
  • "Patient" means an individual receiving care from a Provider.
  • "Platform" means the PrepNavigator web application and patient portal.

Section 2 — Information We Collect

For Healthcare Providers and Staff:

  • Name, email address, role/title
  • Authentication credentials (stored encrypted)
  • Usage logs and activity within the platform

For Patients (via Provider):

  • First name, last name, date of birth
  • Email address and phone number
  • Procedure date, procedure type, and preparation protocol
  • Medication information relevant to procedure preparation
  • Preparation compliance activity within the patient portal

We do NOT collect:

  • Social Security Numbers
  • Financial or payment information
  • Full medical history beyond what is necessary for procedure preparation
  • Biometric data

Section 3 — How We Use Your Information

We use collected information solely to:

  • Deliver personalized procedure preparation instructions
  • Send automated preparation reminders via email and SMS
  • Enable patient portal access and AI-powered preparation guidance
  • Track preparation compliance to support care team coordination
  • Maintain audit logs as required by HIPAA
  • Improve the platform's functionality and performance

We do NOT:

  • Sell, rent, or license your information to any third party
  • Use your information for marketing or advertising purposes
  • Share your information with any party not covered by a Business Associate Agreement (BAA)
  • Use your PHI to train AI models outside of HIPAA-compliant services

Section 4 — Protected Health Information (PHI) and HIPAA

PrepX Medical operates as a Business Associate under HIPAA. PHI collected through PrepNavigator is governed by:

  • Our Business Associate Agreements with covered entities (healthcare providers)
  • The HIPAA Privacy Rule (45 CFR Part 164)
  • The HIPAA Security Rule (45 CFR Part 164)

Patient rights under HIPAA include the right to access, amend, and request restrictions on their PHI. To exercise these rights, contact your healthcare provider directly.

Section 5 — Information Sharing and Disclosure

We share information only with:

  • Your healthcare provider and their authorized staff
  • AWS (Amazon Web Services) — cloud infrastructure, BAA executed
  • Mailgun — HIPAA-compliant email delivery, BAA executed
  • Amazon Bedrock — HIPAA-compliant AI services, covered under AWS BAA

We may disclose information as required by law, court order, or to protect the safety of patients or the public.

Section 6 — Data Security

We implement industry-standard security measures including:

  • End-to-end TLS encryption for all data in transit
  • AES-256 encryption for data at rest (Aurora PostgreSQL)
  • Two-factor authentication (2FA) for all staff accounts
  • One-time passcode (OTP) verification for patient portal access
  • Role-based access controls
  • Automatic session timeout after 15 minutes of inactivity
  • Rate limiting on authentication attempts
  • Regular security monitoring via AWS CloudWatch

Section 7 — Data Retention

  • Patient PHI: Retained for a minimum of 6 years per HIPAA requirements
  • Audit logs: Retained for 6 years
  • Email delivery logs: 1 day (no PHI content retained)
  • Patient portal sessions: Expire 30 days after procedure date

Section 8 — SMS Communications

With your explicit consent, we may send SMS messages including:

  • Procedure preparation reminders
  • One-time verification codes for portal access

Message frequency varies. Standard message and data rates may apply.

Reply STOP to opt out. Reply HELP for assistance.

SMS content never contains Protected Health Information.

Section 9 — Patient Portal

The PrepNavigator patient portal provides secure access to your procedure preparation instructions. Access requires identity verification via email OTP. Session data is stored in browser session storage and automatically cleared when the browser is closed or the session expires.

Section 10 — Children's Privacy

Our Service is not directed to children under 13. We do not knowingly collect information from children under 13. If a minor requires access, it must be facilitated through their healthcare provider and authorized guardian.

Section 11 — Changes to This Policy

We may update this Privacy Policy at any time. Changes are effective immediately upon posting. Continued use of the Service constitutes acceptance of the updated policy. We will notify healthcare providers of material changes via email.

Section 12 — Contact Us

For privacy-related questions or to report a concern:

PrepX Medical, Inc.

Email: support@prepnavigator.ai

Website: prepnavigator.ai

For HIPAA-related requests, please contact your healthcare provider directly.

Effective Date: April 18, 2026

Last Updated: April 18, 2026