Privacy Policy

When you use Prevexium, you trust us with information about your work and, sometimes, about the facility you work in. This Privacy Policy explains what information we collect, why we collect it, and the choices you have over it.

Prevexium LLC (“Prevexium,” “we,” “us”) operates prevexium.com and associated products, Prevexia AI, Salvium, and Inspectus (together, the “Services”). We built Prevexium for infection prevention professionals, and we treat privacy as a clinical obligation, not an afterthought. We do not sell your data. We do not use it for advertising. We collect only what is necessary to operate and improve the Services.

1. Information we collect

Information you give us when you create an account:

• Email address (used for authentication and service communications)
• Profile details you choose to provide: your name, facility name, facility type, state and bed count, your role, and your accrediting body
• Authentication tokens (managed by Supabase; we do not store raw passwords)

Other information you give us:

• Contact-form submissions: your name, email address and message
• Photos you upload for analysis in Inspectus or Prevexia AI
• Documents you upload to a project in Prevexia AI
• Voice recordings, if you use the voice features in Prevexia AI
• Decisions and inputs you enter in Salvium

Information from your use of the Services:

• Chat messages you type to Prevexia AI, after automated PHI screening (see Section 3)
• Usage counts that measure your plan’s monthly allowance
• Session metadata: timestamp, mode (quick/detailed/teaching), persona
• Interaction signals: thumbs up/down, Deep Dive clicks, topic selections
• Device identifier: a random ID stored in your browser’s localStorage, which we do not use to identify you

Technical information collected automatically:

• Browser type and version, operating system
• IP address (used for rate limiting and security, and recorded in our security audit logs)
• Approximate location: the US state your IP address points to, used to show state-specific guidance
• Error and performance events via Sentry (application errors only)
• Cookie consent preference (pvx_cookie_consent in localStorage)

What we do not collect: payment card data (handled entirely by Paddle) or Social Security numbers. We do not ask for patient records or biometric data; see Section 3 for what to keep out of what you type, upload and record.

2. How we use information

We use the information we collect to:

• Run the Services: authenticate your account, persist your facility profile and preferences, maintain chat history
• Personalize guidance: Prevexia uses your facility type, state (or, if you have not set one, the approximate state derived from your IP address), and interaction history to tailor IPC guidance to your context. All personalization data is stored on your device or in your secured account, it is never sold or shared with third parties for profiling
• Keep the Services safe and secure: detect and block prompt injection attacks, enforce rate limits, audit anomalous access patterns
• Improve the Services: anonymized aggregate usage patterns (e.g., which IPC topics are most searched) may be used to improve Prevexia's knowledge base and response quality
• Meet legal obligations: maintain audit logs as required by applicable law and our HIPAA-alignment obligations

3. Health information (PHI) and HIPAA

Prevexium's Services are designed for workflow support, not for processing patient-identifiable data. Text you type (in Prevexia AI chat, Salvium, HAI tools, notes you add to a photo, project instructions, scheduled tasks and search) is automatically screened for PHI patterns (patient names, MRNs, dates of birth, addresses, and other HIPAA identifiers), and detected identifiers are removed before the message is processed or stored. Automated screening can miss things, so it is a backstop, not permission.

Photos and voice recordings are not automatically screened. Do not include patient-identifying information in a photo you upload or a recording you make: no faces, wristbands, charts, screens, names or room labels that identify a patient.

Do not enter PHI. Prevexium is designed so you never need to. Business Associate Agreements (BAAs) will be available to Facility & Enterprise customers that are HIPAA covered entities or business associates once our own agreements with our service providers are in place; ask us about status at hello@prevexium.com. A BAA sets out how we protect any PHI that reaches us despite the safeguards below; it does not change the rule above. Individual plans are not covered by a BAA.

Technical safeguards in place:

• PHI screening on typed text before AI processing
• Screened message text (not raw input) stored in audit logs
• A PHI filter on application error events before they reach Sentry
• Signing out of the Prevexium website clears in-progress EOC Audit drafts from your browser
• Service worker cache excludes all POST /chat and /api/* requests
• All data encrypted in transit (TLS) and at rest (AES-256 via Supabase)

4. Cookies and local storage

We use the following browser storage:

Analytics are optional and off until you accept them. We use Google Analytics to count visits and understand which pages are useful. Google Analytics loads only after you choose “Accept” on the cookie banner. Separately, our pages load fonts from Google Fonts, so Google receives your IP address when a page loads, whatever you choose on the banner.

The Prevexia app also stores your recent conversations and preferences in your browser so they are there when you return. You can remove them by clearing this site’s data in your browser settings.

We do not use advertising cookies, retargeting pixels, or cross-site tracking, and we never send your clinical questions, uploads or any identifiable information to an analytics provider. You can change your choice at any time by clearing your browser storage, which brings the banner back.

5. Who we share information with

We do not sell, rent, or trade your personal data. We share data only with the following subprocessors that are necessary to operate the Services:

Voice dictation in your browser. By default, voice dictation uses your browser’s built-in speech recognition, not one of our providers. Chrome sends that audio to Google, and Safari sends it to Apple, under their own privacy terms.

We may also disclose data if required by law, court order, or to protect the rights, safety, or property of Prevexium or our users.

6. Your rights and choices

Depending on your location, you may have the following rights over your personal data:

• Access and portability (GDPR Art. 15 and 20): download your data from your Account page using Download my data. The file is structured JSON and includes your profile, chat sessions and messages. For anything else we hold about you, email us.
• Erasure (GDPR Art. 17 / “Right to be Forgotten”): delete your account from your Account page using Delete my account, or email us. If you have an active subscription, cancel it first. Deletion removes your sign-in and your account data; security and payment audit records are kept but disconnected from your identity (see Section 7).
• Opt-out of sale (CCPA §1798.120): we do not sell data; you can still record an explicit opt-out preference by emailing us
• Correction: to correct your name or email, email hello@prevexium.com
• Restriction: pause Prevexia's memory/learning at any time using the Pause Learning button in the Memory panel

US state privacy rights. If you live in California or another US state with a consumer privacy law, the rights above are how you access, delete, correct, or download your information. We do not sell personal information, and you can still record an opt-out of sale as described above.

To exercise any of these rights, email hello@prevexium.com. We will respond within 30 days.

7. How long we keep information

• Account data: retained until you delete your account
• Chat history: retained in your account while active; deleted when you delete your account
• Security and access audit logs: retained for up to 7 years to meet healthcare security record-keeping expectations; when you delete your account they are disconnected from your identity
• Contact-form messages: kept until you ask us to delete them, and deleted when you delete your account
• Error events (Sentry): retained for a limited period set by our error-monitoring provider
• Browser storage: EOC Audit drafts older than 24 hours are automatically cleared; other data stored in your browser stays there until you clear this site’s data

8. How we protect information

We implement industry-standard security measures including:

• TLS encryption for all data in transit
• AES-256 encryption for data at rest (Supabase)
• Database row-level security, plus access checks in our application servers
• Automatic 30-minute timeout for inactive sessions on the Prevexium website (HIPAA §164.312)
• Rate limiting on all AI and API endpoints
• Prompt injection detection blocking adversarial inputs
• Automated security scanning (CodeQL) on code changes and weekly

In the event of a data breach, we will notify affected users and relevant authorities in accordance with applicable law (including HIPAA §164.404 and applicable state breach notification statutes).

9. Children

The Services are intended for licensed healthcare professionals and are not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us immediately at hello@prevexium.com.

10. Changes to this policy

We may update this Privacy Policy to reflect changes in our practices or applicable law. We will notify you of material changes via email or a prominent notice within the Services at least 14 days before they take effect. The “Last reviewed” date at the top reflects the most recent update.

11. Contact and privacy requests

For privacy questions, data requests, or breach reporting:

Prevexium LLC: Privacy
hello@prevexium.com

Related policies

• Terms of Service
• Refund Policy
• Disclaimers & Notices