1.1 Information you provide directly

Plexa collects:

• Contact information (name, email, phone)
• Company or organization details
• Messages or inquiries sent through the contact form
• Account information for API access

1.2 Information from integrations and API use

Through API usage, collection may include:

• Integration metadata
• API request logs
• System configuration details
• Consent status associated with patient authorization

Plexa does not store or retain patient health data unless explicitly required for technical processing.

We use information for:

• Operating and improving the website and platform
• Responding to inquiries and support
• Facilitating API onboarding
• Monitoring system performance and security
• Communicating service notices
• Ensuring regulatory compliance

We do not sell your personal information.

Plexa functions as a secure data routing layer, not a long-term data storage platform. Health data processed through the API is:

• Handled only with patient authorization
• Transmitted securely and encrypted
• Used solely for requested purposes
• Never sold, shared, or retained unnecessarily

Our practices align with HIPAA, NDPR, and GDPR-inspired standards.

We process information under:

• Consent
• Legitimate interest (service improvement, security)
• Contractual necessity (API use)
• Compliance with legal obligations

Our security measures include:

• Encryption in transit and at rest
• Access control and authentication
• API key security
• Logging and monitoring
• Regular system audits
• Secure data centers and cloud providers

Information may be shared with:

• Service providers and vendors
• Healthcare partners or EMRs for authorized integrations
• Regulators or authorities when legally required
• Internal team members with appropriate access

We do not sell personal information.

Cookies support:

• Site performance improvement
• Understanding visitor behavior
• Login and API dashboard features

You can disable cookies in your browser settings.

We retain personal information for:

• Service provision
• Technical and security needs
• Legal and regulatory requirements

API logs are kept for limited troubleshooting and compliance periods.

Depending on your location, you may:

• Access personal information
• Correct inaccurate data
• Request deletion
• Object to certain uses
• Withdraw consent
• Request a data export

To exercise these rights, contact privacy@plexahealth.com.

Plexa is not responsible for third-party content or privacy practices.

Plexa does not knowingly collect personal information from individuals under 16.

Updates will be posted here with a revised date.

Questions about this policy: privacy@plexahealth.com.