Privacy Policy

01WHAT THIS POLICY COVERS

This Privacy Policy applies to:

• ▸Our website at www.medsevainnovationhub.org and all associated web portals and platforms
• ▸Services provided through our platforms that do not have their own separate privacy policy
• ▸How we collect, use, protect, and share personal information — any data that can identify you as an individual

02WHO WE ARE

MedSeva Innovation Hub is a wholly-owned subsidiary of MedSeva Digital, based in San Francisco, California, United States. We are committed to responsible data practices and full compliance with applicable privacy laws, including the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), and, where applicable, HIPAA.

For privacy-related enquiries, please contact our Privacy Officer at privacy@MedSevaInnovationHub.org.

03OUR SERVICES AND HOW WE HANDLE DATA

3.1 IT Consulting & Advisory

When you engage MedSeva Innovation Hub for IT consulting, technology assessments, or strategic advisory services, we collect information about your organisation, its technology environment, and the personnel involved in your engagement. This information is used solely to deliver the agreed services and is handled in accordance with any applicable confidentiality agreements.

3.2 Implementation Services

During EHR/EMR implementation, system integration, or other IT implementation projects, MedSeva Innovation Hub may require access to your organisation's systems and data. Access to Protected Health Information (PHI) is only undertaken where a HIPAA Business Associate Agreement (BAA) is in place. MedSeva Innovation Hub staff access only the minimum data necessary to perform agreed services.

3.3 Governance Advisory

Our governance services involve reviewing your organisation's policies, procedures, and compliance posture. Information you share with MedSeva Innovation Hub for governance purposes is treated as confidential and is not used for any purpose beyond the scope of the engagement.

3.4 HIPAA Business Associate Obligations

Where MedSeva Innovation Hub acts as a Business Associate under HIPAA, our obligations regarding PHI are governed exclusively by the executed Business Associate Agreement (BAA) between MedSeva Innovation Hub and your organisation, and by applicable HIPAA regulations. If you are a healthcare organisation engaging MedSeva Innovation Hub, please contact legal@MedSevaInnovationHub.org to ensure a BAA is in place before sharing any PHI.

04WHAT INFORMATION WE COLLECT

Information You Provide Directly

• ▸Contact information (name, job title, organisation name, email address, phone number)
• ▸Enquiry and project information submitted via our website contact forms
• ▸Organisational and technical information shared in the course of service delivery
• ▸Any personal information included in documents, communications, or materials you provide to MedSeva Innovation Hub during an engagement

Information We Collect Automatically

• ▸Website usage data (pages visited, time spent, features used)
• ▸Device and browser information (IP address, browser type, operating system)
• ▸Analytics data collected through tools such as Google Analytics

05HOW WE USE YOUR INFORMATION

We use your information to:

• ▸Respond to enquiries and communicate about our services
• ▸Deliver contracted IT consulting, implementation, and governance services
• ▸Manage and administer client engagements and project communications
• ▸Improve and develop our service offerings and methodologies
• ▸Meet our legal, regulatory, and contractual obligations
• ▸Protect against fraud, security incidents, and misuse
• ▸Send relevant updates, thought leadership, and marketing communications (you can opt out at any time)

06HOW WE SHARE YOUR INFORMATION

MedSeva Digital and Affiliates

• ▸MedSeva Digital (our parent company) and affiliated entities, subject to appropriate data sharing agreements

Service Providers

• ▸Cloud hosting providers (including AWS, Microsoft Azure, and Google Cloud Platform)
• ▸IT tools and project management platforms used to deliver services
• ▸Analytics providers (such as Google Analytics)

Legal and Regulatory

• ▸Law enforcement, regulators, or government bodies when required by law
• ▸To protect our rights, property, or the safety of our staff or clients
• ▸To comply with HIPAA reporting obligations where applicable

Business Transfers

If MedSeva Innovation Hub is involved in a merger, acquisition, or sale of assets, your information may be transferred to the new entity with appropriate protections.

07INTERNATIONAL DATA TRANSFERS

MedSeva Innovation Hub is based in California, United States. Your information may be transferred to, stored in, and processed in the United States or other countries where our service providers operate. These countries may have different privacy laws than your home country. By using our services, you consent to these international transfers. Where required, we implement appropriate safeguards such as Standard Contractual Clauses.

08HOW WE PROTECT YOUR INFORMATION

We take your security seriously and implement industry-standard administrative, technical, and physical safeguards to protect your personal information, including:

• ▸Encryption for data in transit and at rest
• ▸Secure servers, firewalls, and role-based access controls
• ▸Regular security assessments and vulnerability testing
• ▸Contractual data protection obligations with all service providers

However, no internet transmission is 100% secure. Please protect your account credentials and exercise caution when sharing personal information online.

09HOW LONG WE KEEP YOUR INFORMATION

We retain personal information only as long as necessary for the purposes described in this policy:

• ▸Contact and enquiry data: Retained for up to 3 years after last interaction
• ▸Client engagement records: Retained for 7 years following project completion, or as required by applicable law or professional standards
• ▸Website analytics data: Retained for up to 26 months
• ▸Legal and compliance records: Retained as required by applicable law

After applicable retention periods, information is securely deleted or anonymised.

10YOUR PRIVACY RIGHTS

Depending on your location, you may have the following rights regarding your personal information:

• ▸Access: Request a copy of the personal information we hold about you
• ▸Correction: Update or correct inaccurate personal information
• ▸Deletion: Request deletion of your personal information, subject to legal requirements
• ▸Opt-out: Opt out of marketing communications or the sale/sharing of your personal information
• ▸Portability: Request your data in a portable, machine-readable format
• ▸Objection: Object to certain types of processing in applicable circumstances
• ▸Non-discrimination: Exercise your privacy rights without being discriminated against for doing so

To exercise any of these rights, contact us at privacy@MedSevaInnovationHub.org. We may request verification of your identity before processing your request. We will respond within the timeframes required by applicable law (45 days for CCPA requests).

11CALIFORNIA PRIVACY RIGHTS (CCPA / CPRA)

As a California-based company, MedSeva Innovation Hub complies with the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). California residents have the right to:

• ▸Know what personal information we collect, use, disclose, and sell
• ▸Delete personal information we have collected, subject to exceptions
• ▸Correct inaccurate personal information
• ▸Opt out of the sale or sharing of personal information for cross-context behavioural advertising
• ▸Limit the use of sensitive personal information
• ▸Non-discrimination for exercising CCPA/CPRA rights

To submit a California privacy request, contact us at privacy@MedSevaInnovationHub.org or visit www.medsevainnovationhub.org/privacy.

11AHIPAA & HEALTHCARE DATA

MedSeva Innovation Hub recognises the heightened sensitivity of healthcare data. Our HIPAA compliance commitments include:

• ▸We will not access, process, or receive PHI without an executed BAA in place
• ▸Access to PHI during engagements is strictly limited to the minimum necessary for service delivery
• ▸MedSeva Innovation Hub staff who handle PHI receive regular HIPAA training
• ▸Any suspected PHI breach is handled in accordance with HIPAA Breach Notification Rule requirements

For HIPAA-related privacy enquiries, contact privacy@MedSevaInnovationHub.org.

12COOKIES AND TRACKING TECHNOLOGIES

We use cookies, web beacons, and similar tracking technologies to improve your experience, analyse usage patterns, and personalise content. Types of cookies we use include:

• ▸Essential cookies: Required for the website and portals to function correctly
• ▸Analytics cookies: Help us understand how users interact with our platform (e.g., Google Analytics)
• ▸Marketing cookies: Used to deliver relevant advertising and measure campaign effectiveness

You can control cookie preferences through your browser settings or our Cookie Settings tool on the website. Disabling certain cookies may affect some platform features.

13CHILDREN'S PRIVACY

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a minor, please contact us immediately at privacy@MedSevaInnovationHub.org and we will delete it promptly.

14CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make changes, we will update the Effective Date at the top of this policy and post the revised version on our website. We will notify you of material changes by email or a prominent notice on the website. Your continued use of our services after changes take effect constitutes acceptance of the updated policy.

15CONTACT US

If you have questions, concerns, or complaints about this Privacy Policy or our privacy practices, please contact our Privacy Officer:

• ▸Email: privacy@MedSevaInnovationHub.org
• ▸Website: www.medsevainnovationhub.org/privacy
• ▸Mail: MedSeva Innovation Hub, Attn: Privacy Officer, United States