Privacy Policy

1. Information we collect

We collect information you provide directly: account credentials, business profile, billing details, staff records, client records, appointments, transactions, and content you upload. We also collect usage data (feature interactions, device, IP address) and diagnostic data to operate and secure the platform.

2. Health information (medical verticals)

Tenants in medical and IV-clinic verticals may store Protected Health Information (PHI) such as intake forms, clinical notes, and treatment records. For these tenants, Aventra acts as a Business Associate under HIPAA. Our handling of PHI is governed by our Business Associate Agreement and the safeguards described below. Tenants are the Controllers of their client data and are responsible for lawful collection and consent.

3. How we use information

• To provision and operate your isolated workspace and its modules.
• To process payments and manage subscriptions (via our payment partners).
• To provide support, communicate about your account, and send service notices.
• To secure the platform, detect abuse, and comply with legal obligations.
• To improve and develop features, using aggregated or de-identified data.

4. Third-party processors

We use vetted sub-processors to deliver the service, including cloud hosting infrastructure, payment processing (Base44 Payments / Wix, and Stripe where configured), transactional email, and analytics. PHI is processed only by infrastructure covered by our BAA. Sub-processors are bound by data-protection terms and flow-down obligations. A current list is available on request.

5. Data security

Data is encrypted in transit (TLS) and at rest. Access is role-based and least-privilege, with audit logging on administrative actions. Each tenant's data is logically isolated. We maintain administrative, physical, and technical safeguards appropriate to the sensitivity of the data, consistent with HIPAA Security Rule requirements for tenants covered by a BAA.

6. Data retention and deletion

We retain your data for as long as your workspace is active. Upon subscription cancellation, you may export your data for a limited period, after which it is deleted in accordance with our retention schedule. You can request deletion of your workspace data at any time from Settings or by contacting us. Some data may be retained where required by law or to resolve disputes.

7. Your rights

Depending on your jurisdiction, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Workspace owners can manage much of this from their Settings page. For requests involving personal data of identifiable individuals, contact us and we will respond within the timeframe required by applicable law.

8. International data transfers

Your data may be processed in regions other than your own. For transfers outside the applicable jurisdiction, we rely on appropriate safeguards such as Standard Contractual Clauses and processor commitments.

9. Cookies and analytics

We use essential cookies to operate the app and optional analytics cookies to understand usage. You can control non-essential cookies in your browser. We do not sell personal data to third parties.

10. Children

The platform is not directed to children under 16, and we do not knowingly collect their data. Medical verticals serving minors must obtain guardian consent as required by law.

11. Changes to this policy

We may update this policy from time to time. Material changes will be communicated through the app or by email. Continued use after changes takes effect constitutes acceptance.