Privacy Policy

Last updated: [DATE] — Draft pending legal review

Kavera's Privacy Policy explains how Kavera, as a HIPAA business associate to the provider organizations it serves, collects, uses, and safeguards patient assessment data and provider account information across its concussion, mental health, cognitive health, and headache monitoring platform, and where patients and practices can direct privacy questions or requests.

Legal review by [Counsel Name] required before publish.

This Privacy Policy describes how Kavera collects, uses, discloses, and protects information when healthcare providers and their patients use the Kavera platform, including patient-reported outcome data collected through Kavera's concussion, mental health, cognitive health, and headache monitoring instruments, and it explains the rights available to patients and provider organizations under applicable privacy law.

Who This Policy Covers

Kavera is a clinical monitoring platform used by neurologists, neurosurgeons, orthopedists, sports-medicine physicians, nurse practitioners, and their care teams to deliver structured assessments to patients between office visits. This policy applies to:

• Provider organizations ("Covered Entities" or "Customers") that contract with Kavera to use the platform.
• Patients who complete assessments through a link, portal, or device provided by their treating clinician.
• Kavera staff, when acting under the Managed plan to assist with monitoring and documentation on behalf of a provider organization.

Where Kavera processes patient health information on behalf of a covered healthcare provider, Kavera generally acts as a business associate under the HIPAA Privacy Rule, and a separate Business Associate Agreement (BAA) between Kavera and the provider organization governs that relationship. Where this policy and a BAA conflict regarding protected health information (PHI), the BAA controls.

Information We Collect

From provider organizations:

• Account and practice information (practice name, NPI, billing contact, staff user accounts).
• Configuration data, such as which assessment modules (Concussion, Mental Health, Cognitive Health, Headache) and plan type (self-serve or Managed) the practice has enabled.

From patients, through assessment delivery:

• Responses to the assessment battery, which may include symptom scales, mood/anxiety/PTSD screening instruments, sleep questionnaires, and cognitive-domain tests assigned by the treating clinician.
• Identifying information needed to route results to the correct patient record (name, date of birth, contact information, and identifiers supplied by the provider's practice management or EHR workflow).
• Technical data such as device type, timestamps, and completion status, used to support monitoring documentation.

Automatically, through platform use:

• Standard web and application usage data (log data, session information, browser/device type) for security, troubleshooting, and platform reliability.

Kavera does not sell patient health information, and does not use patient-reported assessment data for advertising purposes.

How We Use Information

Kavera uses the information described above to:

• Deliver the assessment battery to patients on the schedule configured by their treating clinician.
• Score, organize, and present results to the provider's care team to support clinical decision-making.
• Generate the between-visit monitoring records and documentation that support the provider's own billing determinations, including documentation relevant to Remote Therapeutic Monitoring and neurocognitive testing codes the provider bills under their own clinical judgment.
• Where the Managed plan is in use, support Kavera staff in assisting the provider's monitoring and documentation workflow, under the scope defined in the applicable BAA and services agreement.
• Maintain, secure, and improve the platform, including troubleshooting and quality assurance.
• Meet legal, regulatory, and audit obligations.

Kavera does not make independent billing or diagnostic decisions; the treating clinician retains responsibility for clinical and coding decisions. See Kavera's billing guides for general educational information on how monitoring data can relate to billing documentation.

How We Disclose Information

Kavera discloses information only as necessary to operate the platform, including:

• To the treating provider organization, which is the primary custodian of the patient's health record.
• To subprocessors and service providers (such as hosting and infrastructure vendors) under contracts that include appropriate confidentiality and security obligations, and BAAs where PHI is involved.
• As required by law, such as in response to a valid subpoena, court order, or regulatory request.
• In connection with a business transaction (such as a merger or acquisition), subject to continued protection of the information under materially similar terms.

Kavera does not disclose patient health information for marketing purposes without the applicable authorization required by HIPAA and other applicable law.

Data Security

Kavera applies administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of health information consistent with the HIPAA Security Rule. These safeguards commonly include encryption of data in transit and at rest, access controls limiting data visibility to authorized users, audit logging, and workforce training. No system is completely secure, and Kavera will notify affected provider organizations in the event of a breach affecting PHI, consistent with HIPAA's breach notification requirements and the terms of the applicable BAA.

Further detail on Kavera's security program is available on the Security page.

Patient Rights

Patients whose information is processed through Kavera on behalf of their treating provider generally exercise their privacy rights — including rights to access, amend, or request an accounting of disclosures of their health information — through their treating provider, who remains the HIPAA-covered entity responsible for the patient's medical record. Patients with questions about their data should contact their treating clinician's office first. Kavera supports provider organizations in fulfilling these requests as required under the applicable BAA.

Residents of certain states may have additional rights under state consumer privacy or health data laws (for example, laws addressing consumer health data outside traditional HIPAA coverage). Provider organizations and patients with state-specific privacy questions should contact jma@nybrainspine.com.

Data Retention

Kavera retains assessment data and related records for the period necessary to support the clinical and billing documentation purposes described above, consistent with the retention terms set out in the applicable services agreement and BAA, and applicable medical recordkeeping requirements. Retention periods may vary by data type and by contractual terms with each provider organization.

Children's Information

Kavera's assessment instruments may be used with pediatric patients when assigned by a treating clinician as part of that patient's care. Kavera collects pediatric information only through and at the direction of the treating provider, not directly from minors outside a clinical relationship.

This Website

This section covers kaverasoft.com, the public marketing website. It is separate from the Kavera clinical platform described above. No protected health information is collected through this website, and nothing here is covered by a BAA. Please do not submit patient information through any form on this site.

Pending review by counsel. It describes the site's behaviour accurately as of the date below; the operative terms for any practice are those in its signed agreement.

What the forms collect

Two forms on this site collect information, and both are for business contact only:

• Request a demo — your work email, and optionally your name, practice, specialty and phone number.
• Newsletter signup — your email address.

We also record which page you were on when you submitted, so we know what prompted the enquiry.

What we do with it

Submissions are stored in our own Amazon Web Services account in the United States (US East region) and emailed to the Kavera team so someone can respond. We use this information to reply to you, to run the demo you asked for, and — if you subscribed — to send the newsletter. We do not sell it, and we do not share it with third parties for their own marketing.

Page views

This site counts its own page views. When you arrive, a random identifier is generated and held in your browser's sessionStorage. It lets us see which pages a visit moved through, and it is erased when you close the tab. It is not shared with any other website and cannot be used to recognise you on a return visit.

We record the page address, the referring address if there is one, and the time. We do not record your IP address, and we do not fingerprint your device. These page-view records are deleted automatically after 90 days.

Cookies

This website does not set any cookies. There is no advertising network, no cross-site tracking, and no consent banner because there is nothing to consent to. The only cookie the domain ever sets is a sign-in cookie for Kavera staff using the site's own admin area; it is never set for ordinary visitors.

We use Vercel Analytics for aggregate traffic measurement, which operates without cookies.

How long we keep things

• Demo requests and enquiries — for as long as we are in contact with you about Kavera, and afterwards as a business record.
• Newsletter subscriptions — until you unsubscribe.
• Page-view records — 90 days, deleted automatically.

Your choices

• Unsubscribe using the link in the footer of any newsletter we send. It works immediately and needs no reply from us.
• Ask us to delete your information by calling (914) 705-6830 or using the contact page. Tell us which address you used and we will remove it.
• Opt out of page-view counting by enabling Do Not Track or Global Privacy Control in your browser — we check for both and skip counting entirely — or by blocking JavaScript. Nothing on this site depends on being counted.

Where this data lives

Form submissions and page-view records are held in Amazon DynamoDB in our own AWS account in the United States. Email is sent through Amazon SES. The site itself is hosted by Vercel. If you are contacting us from outside the United States, your information will be transferred to and stored in the United States.

Changes to This Policy

Kavera may update this Privacy Policy from time to time. Material changes will be communicated to provider organizations consistent with the terms of the applicable services agreement. The "Last updated" date at the top of this page reflects the most recent revision.

Contact Us

Questions about this Privacy Policy, or requests related to data handling, can be directed to jma@nybrainspine.com or through the Contact page.

How Kavera Handles This

Privacy and data governance are built into how Kavera structures its assessment delivery, scoring, and documentation workflow: patient-reported data collected through the 14-instrument battery flows to the treating provider's care team, is organized by module (Concussion, Mental Health, Cognitive Health, Headache), and — on the Managed plan — is handled with Kavera staff assistance under the scope defined by each practice's BAA and services agreement. Provider organizations evaluating Kavera can review the Security page and the Platform overview for more detail on how data moves through the system, and can compare Kavera's approach against other monitoring approaches on the Compare pages.

Frequently Asked Questions

Is Kavera a HIPAA business associate?

Yes, in most configurations. Where Kavera processes protected health information on behalf of a covered healthcare provider, Kavera generally enters into a Business Associate Agreement with that provider consistent with HIPAA requirements. Specific terms are set out in each provider's BAA.

Does Kavera sell patient data?

No. Kavera does not sell patient health information, and does not use patient-reported assessment responses for advertising purposes.

Who owns the assessment data collected through Kavera?

The treating provider organization is the primary custodian of the patient's health record. Kavera processes and stores assessment data on the provider's behalf under the terms of the applicable services agreement and BAA.

How do patients request access to their own data?

Patients should contact their treating provider's office directly, since the provider remains the HIPAA-covered entity responsible for the medical record. Kavera supports providers in fulfilling patient access requests as required under the applicable BAA.

Where can I find Kavera's security practices?

General information on Kavera's security safeguards is available on the Security page. Provider-specific security documentation (such as SOC 2 reports, if applicable) is available under NDA on request.