1. Introduction

​

Welcome to HealthRec1, a professional health record management service operated by Maven Innovations ("we," "our," "us," or "the Service"). We respect your privacy and are committed to protecting your personal health information. This Privacy Policy explains how we handle information when you use our platform at https://www.healthrec1.com.

Key Principle: HealthRec1 is designed as a zero-knowledge, patient-controlled platform. Maven Innovations does not access, view, or control your individual health records while they are stored at rest. As described in Section 2.5 below, certain AI-powered features require temporary, user-initiated processing of your data.

2. Information We Collect

2.1 Account Information (Minimal Collection)
When you create an account, we collect: Email address, Username, Password (encrypted and never stored in plain text), Account creation date, and Last login timestamp.

2.2 Technical Information
We automatically collect: IP address, Device type, browser profile, Operating system, and system usage metrics to ensure service stability.

2.3 Health Records (Zero-Access at Rest)
IMPORTANT: Your health records are encrypted on your local device before transmission and stored in a fully encrypted state. They are only accessible with your unique encryption key. HealthRec1 staff and Maven Innovations systems cannot read or access this data while it is at rest. This zero-access design applies to your records at rest. Section 2.5 describes the limited circumstances under which data is temporarily processed at your request.

2.4 Information We Do NOT Collect
We strictly do not collect Social Security Numbers, Driver's license numbers, or Biometric data. Your physical location is never tracked beyond general IP region for security compliance.

2.5 AI-Powered Features and Data Processing
When you use an AI-powered feature — such as AI Health Chat or Appointment Transcription — you are directing HealthRec1 to temporarily decrypt and process the specific data needed to fulfill that request. This may involve HealthRec1's own systems and/or third-party AI or transcription service providers. [Fill in: whether these providers retain or train on submitted data] Resulting content (chat responses, transcripts, summaries) is encrypted and stored like your other records unless you delete it. These features are optional, and declining to use them does not affect your ability to use core platform functionality. AI-generated content is not medical advice.

3. How We Use Your Information

3.1 Account Information
We use your account details to authenticate your identity, provide secure access, send critical service notifications, and prevent unauthorized usage or fraud.

3.2 Technical Information
Technical data is analyzed in an anonymized format to monitor system performance, detect security threats, and troubleshoot technical issues within the Service.

3.3 Health Records
Except as necessary to provide AI-powered features you affirmatively initiate, as described in Section 2.5, we do NOT use your health records for any internal or commercial purpose. Your data resides on our servers strictly for your retrieval and remains encrypted at rest.

4. How We Share Your Information

4.1 Non-Commercial Policy
Maven Innovations does not sell, lease, or trade your personal information or health data to third parties.

4.2 Service Providers
We involve trusted infrastructure partners (e.g., AWS for storage, Stripe for payments) who are contractually bound to maintain strict confidentiality and security protocols. They have zero access to your decrypted health records. This includes AI and transcription service providers used to power features like AI Health Chat and Appointment Transcription, who are contractually bound to confidentiality and security obligations consistent with Section 2.5.

4.3 Legal Disclosure
We may disclose account metadata if required by a valid legal order. This applies to your records at rest. It does not affect our ability to comply with valid legal process regarding data you have submitted for AI processing under Section 2.5, or account metadata described elsewhere in this Policy.

5. Data Security

5.1 Technical Safeguards
We employ industry-leading security practices, including AES-256 encryption at rest and TLS/SSL 1.3 for data in transit. Regular security audits and penetration tests are conducted to maintain platform integrity.

5.2 End-to-End Encryption
Your records are encrypted using keys derived through secure hashing from your password. If you lose your credentials, your encrypted health records cannot be recovered by Maven Innovations, as we do not store your plain-text password or encryption keys.

6. Your Privacy Rights

6.1 Control & Access
You retain full ownership and control of your data. You may export your records, update your profile information, or delete your account at any time.

6.2 California & State Rights
Residents of California, Virginia, Colorado, Washington, and other states with applicable consumer privacy or health data laws (including CCPA/CPRA and Washington's My Health My Data Act) may have specific rights regarding their personal and health information. Please contact our privacy team for specific requests regarding these regulations.

7. Cookies and Tracking
We use session and essential cookies to maintain your login state and provide a secure environment. We also utilize anonymized analytics to monitor service performance. You can manage your cookie preferences through our dedicated preference center or your browser settings.

8. Children's Privacy
The Service does not permit individuals under 18 to independently create an account or interact directly with the Service. This section addresses direct collection of personal data from children, consistent with the Children's Online Privacy Protection Act (COPPA). It does not restrict a parent or legal guardian from submitting a minor dependent's health information through their own account, as described in Terms of Service Section 3.7. We do not knowingly collect personal data directly from a child through independent use of the Service. If you become aware that a child has independently provided us with personal information, please notify our privacy office immediately.

9. International Users
Maven Innovations is headquartered in the United States. By using our Service, you acknowledge that your information may be processed and stored in the U.S. We implement Standard Contractual Clauses (SCCs) and high-level encryption to satisfy global data protection standards, including GDPR for European users.

10. Data Retention
We retain your account data as long as your account remains active. Encrypted health records are permanently purged within 30 days of account deletion, with secondary backups clearing within 90 days. Basic technical logs are kept for 90 days for troubleshooting and security forensics. This retention schedule applies equally to AI-generated content, including chat history, transcripts, and summaries.

11. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices or regulatory requirements. Significant modifications will be notified via email and through a notice on our platform. The effective date of the most recent version will always be prominently displayed at the conclusion of this document.

12. Third-Party Links
The Service may provide links to external websites that are not operated by Maven Innovations. We advise you to review the privacy policies of any third-party sites you visit, as we do not maintain control over their dedicated privacy practices.

13. Contact Us
If you have any questions, concerns, or specific requests regarding this Privacy Policy or how Maven Innovations handles your data, please reach out to our privacy office at: support@healthrec1.com.

14. Complaints and Disputes
If you believe your privacy rights have been violated, we encourage you to contact us first. If unresolved, you may file a complaint with the Oklahoma Attorney General's Office, the Federal Trade Commission (FTC), or your respective state's consumer protection agency. EU residents may contact their local data protection authority (DPA).

15. Electronic Communications
By using the Service, you consent to receive electronic communications from Maven Innovations. These communications may include notices about your account and information concerning or related to our Service.

16. Severability
If any part of this Privacy Policy is held invalid or unenforceable, that part will be construed to reflect the parties' original intent, and the remaining portions will remain in full force and effect.

17. Assignment
Maven Innovations may assign its rights and obligations under this Privacy Policy at any time without notice to you. You may not assign these rights without our prior written consent.

18. Entire Agreement
This Privacy Policy constitutes the entire agreement between Maven Innovations and you concerning the subject matter hereof, and they may only be modified by a written amendment signed by an authorized executive of Maven Innovations.

19. Governing Law
This Policy shall be governed by and construed in accordance with the laws of the State of Oklahoma, United States, without reference to its conflict of law provisions.

20. California Privacy Rights
If you are a California resident, you may have the right to request information regarding the disclosure of your personal information to third parties for their direct marketing purposes.

​

21. Final Acknowledgement

By submitting health records to our platform, you confirm that you have read, understood, and agree to be bound by the terms detailed across all 21 sections of this Privacy Policy.

By using our Service, you acknowledge that you have read and understood this Privacy Policy. This policy was last updated on August 8, 2026. Empowered by HealthRec1. Your data, your control.