Privacy policy

1. Scope

This policy covers information we collect through this website and the account portal. Our handling of medical and health information specifically is described in more detail in our privacy practices for health information, which should be read alongside this policy.

2. Information we collect

• Account information: name, email address, phone number, password (stored only as a bcrypt hash, never in readable form).
• Service information: branch, service dates, discharge type, and — where you choose to provide it — the last four digits of a VA file number, used solely to match records you upload.
• Case information: the condition you select, your intake answers, and the documents you upload.
• Payment information: we receive a payment identifier, the card brand, and the last four digits from Stripe. We never receive or store your full card number.
• Technical information: IP address, browser user agent, and timestamps, recorded in our audit log for security purposes.

3. Why we use it

We do not use your information for behavioural advertising, and we do not sell it. Ever, to anyone.

• To create and administer your account.
• To enable a physician to review your records and prepare a medical opinion.
• To let your physician call you, for mental health opinions only, when they need to confirm details for the opinion.
• To take payment and issue receipts.
• To send you transactional updates about your case.
• To detect and investigate fraud, abuse, and unauthorised access.
• To comply with legal and regulatory obligations.

4. Who can see it

Access is restricted by role and enforced in the application, not merely by policy.

• You can see everything relating to your own account and cases.
• The physician assigned to your case can see that case, and only that case.
• Administrators can see cases in order to support them, under a minimum-necessary standard.
• Every access to a document is recorded in an audit log identifying who opened it and when.

5. Service providers

We use a small number of providers to run the service. Each receives only what it needs:

• Amazon Web Services — document storage and transactional email, hosted in the United States.
• MongoDB Atlas — database hosting.
• Stripe — payment processing. Stripe receives your name, email, and billing address; we receive no card data.
• Google — calendar connection for physicians who choose to link a Google Calendar, as described in the next section.

6. Google Calendar data (physicians)

Physicians may connect one or more Google accounts so that their existing commitments block consultation times and booked consultations appear on their own calendar. Connecting is optional; veterans are never asked to connect a Google account. This section describes exactly what we access through Google APIs and what we do with it.

When a physician connects an account, Google asks them to approve the following permissions:

• Basic account identity (openid and email address) — to show which Google account is connected and to tell accounts apart.
• View the list of calendars (calendar.calendarlist.readonly) — to show the physician their calendars, with names and colours, so they can choose which ones should block bookings.
• View free/busy availability (calendar.events.freebusy) — to learn when the physician is busy. This returns start and end times only. We cannot see event titles, descriptions, locations, attendees, or any other event details.
• Manage events on calendars the physician owns (calendar.events.owned) — to add each booked consultation to the one calendar the physician selects, and to update or remove that event if the consultation changes. We create and change only events that this service created. This permission is optional; if the physician declines it, calendar blocking still works and consultations are simply not added to their calendar.

7. How we use, store, and share Google data

Nexus Letter Direct's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Busy times are requested from Google at the moment a veteran views or confirms available times, used to hide times that conflict, and then discarded. They are not stored.
• We store the connected account's email address, the calendars' identifiers, names, and colours, the physician's choices about which calendars to check, and the identifier of each consultation event we create.
• Access and refresh tokens issued by Google are encrypted with AES-256-GCM before they are stored, and are used only by our servers to make the requests described above.
• Consultation events we create are marked private, invite no one, and send no notifications. They contain the case number, the veteran's first name and last initial, and a link to the case in our portal, which requires sign-in. No medical information is placed on the calendar.
• Google data is visible only to the physician who connected it. Our staff and administrators have no view of a physician's calendars or busy times.
• We do not sell Google user data, use it for advertising, use it to determine creditworthiness or for lending, or allow humans to read it except with the physician's permission, where required for security or to comply with law.
• We do not use Google user data to develop, improve, or train generalised or non-personalised artificial intelligence or machine learning models.
• We do not transfer Google user data to anyone except as necessary to provide the calendar features described here, to comply with applicable law, or as part of a merger or acquisition with notice to affected physicians.

8. Disconnecting Google

A physician can disconnect a Google account at any time from Availability & calendars in the physician portal. Disconnecting revokes our access with Google and immediately deletes the stored tokens, the calendar list, and the physician's calendar choices. Consultation events already added to the physician's calendar remain there, under the physician's control.

Access can also be removed from the Google side at myaccount.google.com/permissions. Our service detects this and stops using the connection. A physician may ask us to delete any remaining Google-derived records, such as stored event identifiers, by contacting our support address.

9. How we protect it

• Encryption in transit using TLS on every connection.
• Encryption at rest for all stored documents and database contents.
• A second layer of application-level AES-256-GCM encryption on intake narratives, clinical notes, and case messages, so that content is unreadable even with direct database access.
• Documents reachable only through short-lived signed links, never from a public URL.
• Role-based access control, enforced server-side on every request.
• Audit logging of every access to case data.
• Automatic account lockout after repeated failed sign-in attempts, and short session lifetimes.

10. How long we keep it

Your completed opinion remains available in your account for as long as your account is open. Supporting records are retained for the period appropriate to medical records retention standards and then securely destroyed.

Audit logs are retained for a minimum of six years, because their purpose is to allow investigation of access long after the fact.

You may ask us to delete your account and associated records. We will do so except where retention is required by law or necessary to resolve a dispute.

11. Your choices

Residents of certain states have additional statutory rights, including the right not to be discriminated against for exercising them. Contact us and we will honour any right that applies to you.

• Access a copy of the information we hold about you.
• Correct information that is inaccurate.
• Ask us to delete your account and records, subject to what we must retain.
• Opt out of non-transactional email. Transactional messages about your case cannot be turned off while a case is open.

12. Children

The service is not directed at anyone under 18 and we do not knowingly collect information from children. If we learn we have, we delete it.

13. Cookies

We use only the cookies necessary to keep you signed in and to protect against cross-site request forgery. We do not use advertising or cross-site tracking cookies, so there is no consent banner to dismiss.

14. Changes

We will post any update here and, where the change is material, notify account holders by email.