Privacy Policy

Overview

Nave Origyn Limited Liability Company, a Texas limited liability company doing business as Stramesis ("Stramesis," "we," "us," or "our"), operates the Stramesis website and platform. This Privacy Policy describes how we collect, use, store, and protect information when you visit stramesis.com or use the Stramesis platform at app.stramesis.com (collectively, the "Service").

This policy covers the clinic staff who use the Service and the visitors to our website. Patient information that a clinic enters into the Service is treated as protected health information, which we process on the clinic's behalf as its business associate. Our use and disclosure of that information is governed by the clinic's Business Associate Agreement with us, and patients exercise their rights in that information through their clinic. Where this policy differs from a clinic's Business Associate Agreement or Subscription Agreement, that agreement controls.

The Plain English summaries in this policy are provided for convenience. The full text of each section controls.

Data We Collect

When clinic staff create an account and use the Stramesis dashboard, we collect:

• Name and work email address
• Role within the clinic
• For the clinic owner, a phone number provided when the clinic account is set up
• Login credentials (passwords are hashed and never stored in plaintext)
• Usage data including pages visited, actions taken, and session timestamps
• IP address and device information for security purposes

Stramesis stores the patient data the retention intelligence model needs. We do not collect patient names, but this information relates to identifiable patients and is treated as protected health information under HIPAA. Specifically, we store:

• A clinic-assigned patient reference identifier (not a name)
• Medication start date, medication type, current dose, treatment phase, and the history of dose and medication changes
• Weight measurements and dates, and baseline and goal weights (clinic-supplied)
• Refill timing data (last refill date and expected next refill)
• Visit timing data (last visit date and follow-up schedule)
• Notes entered by clinic staff
• Dropout risk scores and contributing factors
• Intervention records logged by clinic staff

The Service is not designed to collect patient names, dates of birth, Social Security numbers, insurance information, detailed medical records, or any clinical data beyond what is listed above, and clinics are asked not to enter that information, including in notes. Detailed clinical records remain in the clinic's Electronic Health Record system.

When you submit a demo request on our website, we collect your name, work email, clinic name, title, and approximate patient panel size. We use this information to schedule and conduct your demo and to follow up with you about Stramesis. The form also records the consents you give and the time you gave them, and uses Cloudflare Turnstile to filter out automated submissions. If you use our contact form, we collect your name, email address, and message, and use them to respond to you.

We collect business contact information for clinics we may contact about Stramesis, such as the clinic's name and business phone number, from public sources. We use it to introduce our services to those clinics.

How We Use Your Data

We use the data we collect for the following purposes:

• Platform operation: Authenticating users, displaying the dashboard, and generating risk scores
• Model improvement and product development: Where a clinic's agreements permit it, patient data may be de-identified in accordance with HIPAA and used, alone or combined with data from other clinics, to operate, improve, and develop our products, including the dropout risk scoring model and cross-clinic benchmarks. Identifiable patient records are used for these purposes only as the clinic's Business Associate Agreement permits
• Communications: Sending account notifications, product updates, and demo follow-ups to clinic staff, and contacting clinics about our services
• Security: Detecting and preventing unauthorized access, fraud, and abuse
• Legal compliance: Meeting our obligations under applicable law including HIPAA

HIPAA and Protected Health Information

As a Business Associate under the Health Insurance Portability and Accountability Act (HIPAA), Stramesis maintains safeguards for any Protected Health Information (PHI) processed through the platform, including the following:

• All data at rest is encrypted by our database provider
• All data in transit is encrypted using TLS
• Access rules are enforced on our servers, not only in the browser, and are designed to prevent one clinic from accessing another clinic's patient data
• Access to patient data is limited to authorized clinic staff and to Stramesis personnel and service providers who need it to operate the Service, as the Business Associate Agreement permits. Stramesis personnel view patient-level data only to resolve a clinic's support request, correct a defect, or respond to a security incident, and each such access is logged
• Sign-ins and user actions are logged with user ID and timestamp
• We maintain a documented incident response plan for potential data breaches
• In the event of a breach of unsecured PHI, we will notify affected clinics as required by the HIPAA Breach Notification Rule and our Business Associate Agreement

Data Sharing

We do not sell, rent, or trade any data, whether clinic staff data or patient data, to any third party. We share data only with the following categories of service providers, solely to operate the Stramesis platform:

• Supabase: Database and authentication infrastructure. Patient and clinic data is stored here
• Cloudflare: Application hosting, content delivery, API security, DDoS protection, and bot protection for our website forms. Patient data passes through and is processed on Cloudflare to run the service
• Resend: Account emails to clinic staff, such as invitations and password resets, notices to our team of demo and contact form submissions, and support ticket confirmations, which carry only the ticket number, topic, and date. Does not receive patient data
• Stripe: Invoicing and payment processing for clinic subscriptions. Receives billing contact and payment details only. Does not receive patient data
• Proton Mail: Hosts our stramesis.com email, including notices of demo and contact form submissions. Proton has signed a Business Associate Agreement with us. Clinics are asked to raise patient issues through the in-app support tickets rather than by email, and to identify patients only by the clinic patient ID

We may disclose data if required by law, court order, or to protect the rights and safety of Stramesis, our users, or the public. If we are involved in a merger, acquisition, or sale of assets, data may be transferred to the successor, subject to this policy and each clinic's Business Associate Agreement. Any disclosure of patient data is limited to what HIPAA and the clinic's Business Associate Agreement permit.

Data Retention

When a clinic's subscription ends:

• Clinic staff accounts are deactivated immediately
• Patient data is retained for 30 days after the subscription ends to allow for data export requests
• Patient data is then deleted, or de-identified where the clinic's Business Associate Agreement permits, within 60 days, as the clinic's agreement provides. Copies in routine backups are deleted as those backups expire and remain protected under the Business Associate Agreement until then
• Data that has been de-identified in accordance with HIPAA, as the clinic's Business Associate Agreement permits, may be retained and used as described under How We Use Your Data

Security

Stramesis implements a defense-in-depth security architecture designed to enforce protections at three independent layers:

• Edge layer: Cloudflare handles DDoS mitigation, rate limiting, and bot filtering before any request reaches our infrastructure
• API layer: Every request is authenticated via JWT before reaching the database. Invalid tokens are rejected at the edge
• Access layer: Each clinic's data is scoped to that clinic, and the scoping is enforced on our servers rather than only in application screens, so that authenticated users are designed to reach only data belonging to their own clinic

Despite these measures, no method of electronic transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately at [email protected].

Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• The right to access the personal data we hold about you
• The right to correct inaccurate or incomplete data
• The right to request deletion of your personal data
• The right to object to or restrict certain processing of your data
• The right to data portability

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. Requests about patient data are referred to the relevant clinic, which responds to them under HIPAA, and we assist the clinic as our Business Associate Agreement requires.

Cookies and Browser Storage

The Stramesis website and platform use the following:

• Sign-in storage: Kept in your browser's local storage and required to maintain your login session in the dashboard. Cannot be disabled without losing access to the platform
• Analytics: Cloudflare Web Analytics, which we use to measure basic site traffic and which does not track you across other sites. It does not set cookies or store any data in your browser.
• Bot protection: Our website forms use Cloudflare Turnstile, which stores an identifier in your browser's local storage, under Cloudflare's domain, to tell people apart from automated traffic. It is used only for security, not for advertising or tracking

We do not use advertising, retargeting, or third-party tracking cookies of any kind.

Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page with a new date, and where a change is material we will also notify clinic administrators by email before it takes effect.

Contact for Privacy Inquiries

If you have any questions about this Privacy Policy or our data practices, please contact us:

We will respond to all privacy inquiries within 30 days. For urgent security concerns, email [email protected].