Privacy Policy

Last Updated: June 7, 2026

1. Introduction. NavPoint Health, Inc. (“NavPoint,” “we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, store, and protect your personal information when you access or use our patient navigation services, our website located at navigationondemand.com and all related services, features, content, and applications (collectively, the “Services” or “NavigationOnDemand”). By accessing or using the Services, submitting the intake form, or otherwise providing information to us, you consent to the collection, use, and disclosure of your information as described in this Privacy Policy. IF YOU DO NOT AGREE TO THIS PRIVACY POLICY, PLEASE DO NOT USE THE SERVICES.

Our processing of personal information, such as your name, address, e-mail address, or telephone number, will be undertaken consistent with the requirements of applicable privacy laws, including, but not limited to, the California Consumer Privacy Act, the California Privacy Rights Act, the Virginia Consumer Data Protection Act of 2021, the Colorado Privacy Act of 2021, and the Utah Consumer Privacy Act of 2022, the Connecticut Data Privacy Act of 2022, the Texas Data Privacy and Security Act, the Oregon Consumer Privacy Act, the Montana Consumer Data Privacy Act, the Tennessee Information Protection Act of 2023, the Iowa Consumer Data Protection Act of 2023, the Delaware Personal Data Privacy Act of 2023, the Nebraska Data Privacy Act of 2024, the New Hampshire Privacy Act of 2024, and the New Jersey Data Privacy Act of 2024, the EU General Data Protection Regulation (“GDPR”), the UK General Data Protection Regulation (UK GDPR), and the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA). 

2. Definitions

2.1 “Cookies” are small computer files transferred to your device that contain information such as user ID, user preferences, lists of pages visited and activities conducted while using the Services. We use Cookies to: (i) improve and tailor the Services, (ii) customize advertisements, (iii) measure performance, (iv) store authentication so re-entering credentials is not required, (v) customize user experiences, and for (vi) analytics and fraud prevention. For more information on Cookies, including how to control your Cookie settings and preferences, visit http://www.allaboutCookies.org. You can also manage Cookies in your web browser (for example, Edge, Explorer, Chrome, Safari). If you choose to change your settings, you may find that certain functions or features of the Services will not work as intended. The following details the types of Cookies we use and why we use them:

(a) Absolutely Necessary Cookies. These Cookies are essential to enable you to move around a website and use its features. Without these Cookies, services you have asked for, like adding items to an online order, cannot be provided.

(b) Performance Cookies. These Cookies collect information about how you use the Services. Information collected includes the Internet browsers and operating systems used, the domain name of the website previously visited, the number of visits, average duration of visit, and pages viewed. These Cookies do not collect information that personally identifies you and only collect aggregated and anonymous information. Performance Cookies are used to improve the user-friendliness of a website and enhance your experience.

(c) Functionality Cookies. These Cookies allow the Services to remember choices you make (such as your username, language preference, or the area or region you are in) and provide enhanced, more personal features. These Cookies can also be used to remember changes you have made to text size, fonts, and other customizable parts of the Services. The information these Cookies collect may be anonymized, and they cannot track your browsing activity on other websites.

2.2 Data Controller. Data Controller means the natural or legal person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any Personal Data are, or are to be, processed. For the purpose of this Privacy Policy, we are a Data Controller of your Personal Data.

2.3 Data Processors (or Services Providers). Data Processor (or Services Provider) means any natural or legal person who processes the data on behalf of the Data Controller. We may use the service of various Services Providers in order to process your data more effectively.

2.4 Data Subject (or User). Data Subject is any living individual who is using our Services and is the subject of Personal Data. For the purpose of this Privacy Policy, you are a Data Subject.

2.5 Personal Data. Personal Data means information about a living individual who can be reasonably identified from such information (or from that and other information either in our possession or likely to come into our possession).

2.6 Usage Data. Usage Data includes tracking technologies and consists of data that is collected automatically by the use of the Services itself (for example, dates and times of Services visits or usage, the duration of a web page visit or the use of a mobile app, IP addresses, browser characteristics, device characteristics, operating system, language preferences, referring URLs and information on actions taken on our Service).

3. How We Collect Information

3.1 Personal Data You Provide Directly. We collect Personal Data that you voluntarily provide to us, including: 

(a) Intake Form Information: your first name, last name, email address, phone number, age, zip code of residence, preferred contact times, your relationship to the cancer diagnosis (patient, caregiver, or loved one), and any additional information that may be required to perform services or that you choose to provide; 

(b) Session Information: information you share during navigation sessions, including details about your cancer diagnosis, treatment history, healthcare providers, appointments, concerns, and questions; 

(c) Payment Information: credit card or other payment details when you purchase paid services; and 

(d) Communications: any information contained in emails, messages, or other communications you send to us. 

3.2 Information Collected Automatically. When you access our website, we may automatically collect certain Usage Data, including: 

(a) Device and Browser Information: your IP address, browser type, operating system, device identifiers, and referring URLs; 

(b) Usage Data: pages visited, time spent on pages, links clicked, and other interactions with the Services; and 

(c) Cookies and Similar Technologies: we use Cookies to analyze website traffic and optimize your website experience. By accepting our use of Cookies, your data will be aggregated with all other user data. 

3.3 Session Recordings. All navigation sessions conducted via Zoom or other video/audio platform are audio and video recorded for recordkeeping, quality assurance, continuity of care, and service improvement purposes. These recordings may contain Personal Data and health-related information you share during the session. By participating in a navigation session, you consent to the audio and video recording of that session. If you do not wish to be recorded, please notify your navigator before the session begins. Note- objection to recording may limit the ability to perform some or all services.

3.4 NACI Care™ Platform Data. NavPoint uses its proprietary NACI Care™ platform to document navigation services, track care events, and maintain records related to your navigation sessions. Personal Data entered into NACI Care™ may include session notes, action items, referral information, and other details relevant to your navigation support. 

4. How We Process and Use Your Personal Data and Usage Data. We use your Personal Data and Usage Data for the following purposes: 

(a) Providing the Services: to match you with a navigator, conduct navigation sessions, document services, and provide ongoing support; 

(b) Communication: to contact you regarding your sessions, respond to inquiries, and provide service-related notifications; 

(c) Payment Processing: to process payments for services; 

(d) Services Improvement: to analyze and improve the quality, effectiveness, and delivery of our Services; 

(e) De-Identified Data and Analytics: to generate de-identified, aggregated data for research, benchmarking, analytics, product development, and educational content, provided that such data does not identify you individually; 

(f) Legal Compliance: to comply with applicable laws, regulations, legal processes, or governmental requests; 

(g) Safety and Security: to detect, prevent, or address fraud, security issues, or technical problems; and 

(h) Community Support: to facilitate access to the private Facebook support group monitored by our navigator team. 

5. How We Share Your Personal Data. We do not sell your Personal Data. We may share your Personal Data in the following limited circumstances:

(a) Services Providers: with third-party Data Processors and Services Providers who assist us in operating the Services, including Zoom (for videoconferencing), payment processors, hosting providers, and analytics services. These providers are contractually obligated to protect your information and use it only for the purposes for which it was disclosed. 

(b) De-Identified Data: we may share de-identified, aggregated data that does not identify you individually with third parties for research, analytics, publications (including white papers, journal publications, and conference presentations), and marketing or educational content. All such data is de-identified in accordance with applicable legal standards. 

(c) Legal Requirements: we may disclose your information when required by law, subpoena, court order, or government authority, or when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request. 

(d) Business Transfers: in connection with a merger, acquisition, reorganization, sale of assets, or bankruptcy, your information may be transferred as part of such transaction.

(e) With Your Consent: we may share your information with third parties when you have given us express consent to do so.

6. Data Security. No method of transmission over the Internet, or method of electronic storage is 100% secure. NavPoint implements industry-standard administrative, technical, and physical safeguards designed to protect your Personal Data against unauthorized access, use, alteration, or disclosure. Specifically:

(a) The NACI Care™ platform is SOC 2 compliant;

(b) All data transmitted through or stored within the Services is encrypted both in transit and at rest; 

(c) We maintain administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of your data; 

(d) We regularly test and update our security measures.

While we strive to protect your Personal Data, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security. Please note that despite our best efforts, no one can guarantee the security of Personal Data. Unauthorized entry or use, hardware or software failure, and other factors may compromise the security of Personal Data at any time.

7. Data Retention. We retain your Personal Data for as long as necessary to provide you with the Services, fulfill the purposes described in this Privacy Policy, comply with our legal obligations, resolve disputes, and enforce our agreements. Session recordings and NACI Care™ records will be retained in accordance with applicable recordkeeping requirements. When your information is no longer required, we will securely delete or de-identify it. We will also retain Usage Data for internal analysis purposes.  Usage Data is generally retained for a shorter period of time, except when this data is used to strengthen the security or to improve the functionality of our Services, or we are legally obligated to retain this data for longer time periods.  We may retain reviews to preserve transparency and service integrity even after account closure, to the extent permitted by law; support tickets are retained per our retention policy. Criteria for retention include legal requirements, security, and product needs.

8. Security Incidents. In the event of confirmed unauthorized access, use, disclosure, or breach of security involving your Personal Data, NavPoint will notify you without unreasonable delay and in no event later than the time period required by applicable law. Such notice will include, to the extent known, a description of the nature of the incident, the categories of data affected, and the remedial actions taken or proposed to be taken. 

9. Your Rights and Choices. We aim to take reasonable steps to allow you to correct, amend, delete, or limit the use of your Personal Data. If you wish to be informed what Personal Data we hold about you and if you want it to be removed from our systems, please contact us using the details set out below. You may have the right to:[TP1] 

9.1 Access or update the information we have on you. Find out if we use your Personal Data, access your Personal Data and have it corrected or amended if it is inaccurate or incomplete.

9.2 Withdraw consent. Withdraw any express consent that you have provided to the processing of your Personal Data at any time without penalty.

9.3 Object. You have the right to object to our processing of your Personal Data.

9.4 Data portability. Obtain a transferable copy of some of your Personal Data which can be transferred to another provider when the Personal Data is processed based on your consent.

9.5 Restriction of Processing. If you believe your Personal Data is inaccurate, no longer necessary for our business purposes, or if you object to our processing of your Personal Data, you may also have the right to request that we restrict the processing of your data pending our investigation and/or verification of your claim.

9.6 Deletion or restriction. Request your Personal Data be deleted or restricted under certain circumstances. For example, if NavigationOnDemand is using your Personal Data on the basis of your consent and has no other legal basis to use such, you may request your Personal Data be deleted when you withdraw your consent.

9.7 Opt-out of targeted or behavioral advertising. You may have the right to opt out of cross-context behavioral / targeted advertising, which is based on the Personal Data you share with our Services, as well as data collected from third party websites. 

U.S. state privacy rights may include access, deletion, correction, portability, and the right to opt out of targeted advertising and certain profiling. We provide an appeal process for denied requests as required by law. If you wish to exercise any of these rights or raise a complaint about how we have handled your Personal Data, please contact us using the information in Section 16 below.

You additionally have choices regarding the collection, use, and sharing of your Personal Data.

9.8 You have a right at any time to stop us from contacting you for promotional marketing purposes. If now or in the future you receive promotional or electronic newsletter communications from us, you may indicate a preference to stop receiving such communications from us, and you will have the opportunity to “opt-out” by clicking the “Unsubscribe” hyperlink at the bottom of all such communications. Notwithstanding your indicated email marketing preferences, we may continue to send you administrative emails regarding the Services, including, for example, order confirmations or updates to our Privacy Policy or the Terms.

9.9 You may be able to configure your browser to accept or reject all or some Cookies or notify you when a Cookie is set — all browsers are different, so check the “Help” menu of your particular browser to learn how to change your Cookie preferences. Please note that if you have set your browser to refuse Cookies, you will not be able to be authenticated and thereby you will not be able to use the Services - you will only be able to browse public portions of our website. Users can control the use of Cookies at the individual browser level. Various browsers may offer their own management tools for removing HTML5 LSOs.

9.10 Do Not Track Signals. Our website does not currently respond to “Do Not Track” (DNT) browser signals or similar mechanisms. For more information about Do Not Track, please visit https://allaboutdnt.com.

9.11 Right to Lodge a Complaint. If you are located in the European Economic Area or the United Kingdom, you have the right to lodge a complaint with your local data protection supervisory authority if you believe that our processing of your Personal Data violates applicable data protection laws.

Visiting our Services from outside the United States:

Our Services is intended for users within the U.S. We store and process all Personal Data within the U.S. 

If you are visiting our Services from outside the United States, please be aware that your information will typically be transferred to, stored, and processed in the United States where our servers are located and our central database is operated. The data protection and other laws of the United States and other countries might not be as comprehensive as those in your country. We take reasonable steps to ensure that your Personal Data is protected. If you are located outside United States and choose to provide information to us, please note that we transfer the data, including Personal Data, to United States and process it there. Your consent to this Privacy Policy followed by your submission of such information represents your agreement to that transfer.

Where the GDPR or UK GDPR applies, our lawful bases for processing your Personal Data include: (a) your consent; (b) the performance of a contract with you or to take steps at your request prior to entering into a contract; (c) compliance with a legal obligation to which we are subject; and (d) our legitimate interests in operating, improving, and securing the Services, provided that such interests are not overridden by your data protection rights. Where we rely on consent as the lawful basis, you may withdraw your consent at any time as described in Section 9.2 above.

Where your Personal Data is transferred from the European Economic Area or the United Kingdom to the United States, we rely on appropriate safeguards, including Standard Contractual Clauses approved by the European Commission or the UK Information Commissioner’s Office, as applicable, to ensure that your Personal Data receives an adequate level of protection.

10. California Privacy Rights. If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including the right to know what Personal Data is collected, used, and disclosed; the right to request deletion of Personal Data; the right to correct inaccurate Personal Data; and the right to opt out of the sale or sharing of Personal Data. We do not sell Personal Data. To submit a request, please contact us using the information in Section 16 below.

11. Health Information. NavigationOnDemand is a non-clinical navigation support service and is not a covered entity under the Health Insurance Portability and Accountability Act (HIPAA). However, we recognize the sensitive nature of health-related information you may share with us during navigation sessions. We treat all health-related information with the highest level of care and confidentiality, applying security safeguards consistent with healthcare industry standards, including encryption, access controls, and SOC 2 compliant systems. We will never use your health-related information for marketing purposes without your express consent.

12. Services Providers. We may employ Services Providers, to process Service-related data on our behalf, to perform Service-related service or to assist us in analyzing how our Services is used. Each of these Services Providers is contractually obligated to provide services to us in a manner consistent with this Privacy Policy. These third parties have access to your Personal Data only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose and must comply with the requirements for third party processors set forth in this Privacy Policy. For an example of this, you may reach out to us via the contact information below to request a example list of these categories. 

13. Third-Party Links and Services. The Services may contain links to or integrations with third-party websites, platforms, or services, including Zoom (for videoconferencing) and Facebook (for community support groups). These third-party services are governed by their own privacy policies, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party services before providing personal information to them.

14. Children’s Privacy. The Services are not intended for individuals under the age of eighteen (18). We do not knowingly collect Personal Data from individuals under 18. If we learn that we have collected Personal Data from a child under 18, we will take steps to promptly delete such information.

15. Changes to This Privacy Policy. We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting the updated Privacy Policy on our website with a revised “Last Updated” date, and where required by law, we will obtain your consent. Your continued use of the Services after any changes indicates your acceptance of the updated Privacy Policy.

Contact Information. If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: NavPoint Health, Inc. Email: hello@navigationondemand.com Website: https://navigationondemand.com      

[TP1]For all the points here, is this initiated via email? We should have someone own this.