Privacy Policy

This Privacy Policy for VVY Technologies, Inc. (doing business as "Moxcares," "we," "us," or "our") describes how and why we may access, collect, store, use, and/or share ("process") your information when you use our services ("Services"), including when you:

• Visit our website at https://moxcares.com, or any website of ours that links to this Privacy Policy;
• Use Moxcares, our practice-management and electronic-health-record platform for ambulatory clinics;
• Register as a clinic, clinic owner, administrator, staff member, practitioner or billing user; or
• Engage with us in other related ways, including any sales, support, or marketing.

We make decisions about clinic-user and business-visitor information as a platform provider. Patient PHI is processed on the clinic’s behalf under the BAA, as explained below. Questions or concerns? Reading this Privacy Policy will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you have questions, contact us at legal@moxcares.com.

Summary of key points

What information do we process? We process information about the clinics and clinic users who use Moxcares, and — on behalf of those clinics — Protected Health Information (PHI) about their patients. Our role differs between these two categories.

Are we a Business Associate under HIPAA? Yes. When we process patient PHI on behalf of a clinic, the clinic is the Covered Entity and Moxcares is the clinic's Business Associate under HIPAA. We process patient PHI only as permitted by our Business Associate Agreement with the clinic.

Do we sell or share your mobile information? No. We do not share or sell mobile opt-in data or text-messaging consent information to any third party or affiliate for marketing or promotional purposes at any time.

How do we keep your information safe? We maintain administrative, technical, and physical safeguards consistent with the HIPAA Security Rule. However, no system can be guaranteed to be 100% secure.

What are your rights? Depending on where you are located, you may have rights regarding your personal information. Patient requests regarding PHI are handled through the clinic.

1. The two kinds of information we handle

In Short: Moxcares handles two distinct categories of information, and our role differs between them.

(a) Clinic-user information. Information about the clinics, clinic owners, administrators, staff, and practitioners who use Moxcares to operate their practice. For this information, Moxcares acts as the controller — we make decisions about how it is processed — and this Privacy Policy governs.

(b) Patient Protected Health Information (PHI). Health-related information about patients, processed by Moxcares on behalf of a clinic. For this information, the clinic is the Covered Entity and Moxcares is the Business Associate under the Health Insurance Portability and Accountability Act (HIPAA). We process patient PHI only as permitted by our Business Associate Agreement with the clinic and as directed by that clinic. The clinic's own Notice of Privacy Practices — not this Policy — governs the clinic's relationship with its patients.

2. What information do we collect?

In Short: We collect information that clinic users provide to us, and we process patient PHI on behalf of clinics.

Clinic-user information you disclose to us. When clinic users register, configure their clinic, or otherwise interact with the Services, we may collect:

• Names
• Email addresses
• Phone numbers
• Business (clinic) names and addresses
• Practitioner professional profile information (such as education, experience, biography, and specialty)
• Billing and subscription information
• Account credentials

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes.

Payment data. Payment-card credentials are collected and stored by Stripe, not Moxcares. Moxcares does not store full card numbers or card security codes. We may retain billing contact details, transaction identifiers, Stripe payment references, invoice amounts, payment status and limited payment-method details needed to operate subscriptions and clinic payment workflows. Stripe’s handling of payment information is described in its privacy notice. Clinical information must not be placed in payment descriptions or metadata.

Patient PHI processed on behalf of clinics. Depending on a clinic’s configuration, we process patient information on its behalf, including names, dates of birth and contact details; intake and screening answers; appointment and check-in information; clinical notes, problems, medications, allergies, vitals, immunizations and results; clinical scores; prescriptions and pharmacy details; insurance, eligibility and claims information; payment records, excluding raw card credentials held by Stripe; faxes, uploaded documents and imported records; and, where enabled, AI-receptionist call audio and ambient-scribing visit audio. Audio is used to complete the request or draft the note and is then purged. Resulting transcripts, drafts and clinical records are distinct from the source audio. The clinic determines the purposes for which this PHI is processed.

Information collected automatically. We automatically collect limited technical and usage information when you access the Services (such as device and log information) to operate, secure, and improve the Services.

3. How do we process your information?

In Short: We process clinic-user information to provide, improve, secure, and administer the Services, and we process patient PHI solely to provide the Services to clinics.

We process clinic-user information to:

• Facilitate account creation, authentication, and account management;
• Deliver and operate the Services;
• Communicate with you, including for support, billing, and service updates;
• Maintain security and prevent fraud; and
• Comply with legal obligations.

We process patient PHI solely to provide the Services to the clinic, as permitted by the Business Associate Agreement and HIPAA, and as directed by the clinic. We do not use patient PHI for our own marketing or for purposes the clinic has not authorized.

4. What legal bases do we rely on?

In Short: We process information only when we have a valid reason to do so.

We process clinic-user personal information where it is necessary to perform our contract with you, where you have given consent, where processing is in our legitimate business interests (such as security and service improvement) and not overridden by your rights, or where we must comply with law. Where we rely on consent, you may withdraw it at any time by contacting us.

Patient PHI is processed under our Business Associate Agreement with the clinic and the clinic's authority as a Covered Entity.

5. When and with whom do we share your information?

In Short: We share information with service providers ("sub-processors") under written contracts, and — where PHI is involved — under Business Associate Agreements.

We engage service providers to operate the Services. Vendors that create, receive, maintain or transmit PHI on our behalf are bound by Business Associate Agreements. Other services operate within a documented non-PHI boundary. Our dated vendor register lists vendor names and BAA status.

PHI-handling vendors include Google Cloud Platform, Google, Anthropic, Twilio, Stedi, Documo and MDToolbox. Stripe, Firebase Authentication and Postmark operate within their non-PHI service scope. Marketing-site analytics and advertising providers are described separately in Section 9; they are not part of the clinical PHI workflow.

We may also share information:

• In a business transfer — in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business; and
• To comply with law — where required by applicable law, regulation, legal process, or governmental request.

We maintain and update this sub-processor list as our providers change.

6. Do we offer artificial intelligence–based products?

In Short: Yes. AI supports clinical preparation and authorized administrative workflows. Clinical proposals require review; no Moxcares AI diagnoses, prescribes, orders, refers or signs.

Conversational intake asks the clinic’s questions in plain language and organizes answers attributed to the patient or caregiver. The AI receptionist identifies itself as AI, answers administrative questions, books appointments and offers callbacks or waitlist places. Requests outside its scope are passed to staff. The clinic may choose its receptionist’s name and voice.

Mox, the AI staff member, supports scheduling confirmations, reminders, recalls and rebooking under clinic rules, patient consent and quiet hours. It does not provide clinical advice or collect payments. Ambient scribing creates a draft from a consented conversation; the clinician reviews, edits and signs, and source audio is purged after processing.

The Coding Companion proposes billing and diagnosis codes cited to the clinician’s documentation. It does not infer an undocumented diagnosis or automatically apply a code; the clinician accepts or dismisses proposals. Ask the Chart provides record-based answers with citations. Clinical scores calculate published instruments from stated inputs and are offered, not run automatically. Care Pack attention rules surface cited work items and prepare next steps for the assigned person to review.

Rule-based crisis-language checks in supported phone, text and chat workflows can provide the 988 Suicide & Crisis Lifeline and notify the clinic. Detection is not guaranteed. These features do not replace clinical assessment, the clinic’s crisis procedures or emergency services. Call 911 for immediate danger.

Anthropic and Google (Gemini) process applicable patient content under BAAs and contractual no-training terms. Patient data is shared for providing the Services, not for training their models. Clinical judgment remains with the clinic’s practitioners.

7. Text messaging and your mobile information

In Short: With consent, we send text messages on behalf of clinics. We never share, sell, or otherwise provide your mobile phone number to anyone for marketing purposes.

Mobile Messaging Privacy

We respect your privacy. We do not share, sell, or otherwise provide your mobile phone number or messaging consent information to any third parties or affiliates for marketing or promotional purposes.

Message frequency varies. Message and data rates may apply. Reply STOP to unsubscribe at any time. Reply HELP for assistance.

For more information about how we collect, use, and protect your information, please review the rest of this privacy policy.

How messaging works on Moxcares

With the patient's consent, Moxcares sends text messages on behalf of clinics, including appointment confirmations, intake links, appointment reminders, and clinic-authored follow-up messages. Message frequency varies based on the patient's appointment activity. Consent is obtained at the time a phone number is collected (for example, during appointment booking) through an affirmative opt-in, and providing consent is not a condition of booking or receiving care.

Mobile information is used only to deliver the messages the patient has consented to receive, through our messaging provider acting on our behalf.

We honor opt-out requests and will stop sending messages to a number that has opted out.

Voice calls

A clinic may route calls to its AI receptionist, which identifies itself as AI at the start of the call. Calls are transcribed to complete the caller’s request. The transcript and outcome, such as a booking or message, are recorded in the clinic’s account; source audio is purged after processing. Caller phone numbers support record matching or creation. A spoken opt-in to receive texts is recorded as consent. Callers may ask for a person, and requests the receptionist cannot complete are handed to clinic staff.

8. Calendar integrations

In Short: If a practitioner connects a calendar, we access the minimum information needed to coordinate scheduling.

If a practitioner connects a Google or Microsoft calendar, Moxcares accesses only the calendar information needed to coordinate scheduling:

• Availability (free/busy) information — to avoid double-booking. For Google, this uses a free/busy permission that returns only busy and free time windows, and not the content, subject, attendees, or location of the practitioner's other events.
• Moxcares-created appointment events — Moxcares creates and manages only the appointment events it places on the practitioner's calendar. For Google, Moxcares uses a permission limited to the events it creates, and does not access, read, or modify the practitioner's existing or other calendar events.

A practitioner may disconnect a connected calendar at any time, after which we will no longer access that calendar.

9. Do we use cookies and other tracking technologies?

In Short: Essential technologies support the Services. Our public marketing website also uses analytics and advertising measurement; those uses are separate from clinical PHI workflows.

Essential cookies and similar technologies maintain security, sign-in and preferences. On the marketing website, Google Analytics and Google Ads, Microsoft Advertising (UET), Meta, LinkedIn and OpenAI advertising tools may process browser and device information, page activity, ad identifiers and business-inquiry conversion events to measure and improve campaigns. Where required, these tools are enabled after consent. We do not use advertising or cross-site tracking cookies on patient-facing or PHI-bearing surfaces, or send clinical PHI to advertising platforms.

Please do not enter patient or clinical information in marketing-site forms. Marketing measurement and inquiry attribution are distinct from patient records. You can use the website’s consent controls where presented, adjust browser cookie settings or contact legal@moxcares.com about privacy choices. Blocking essential cookies may affect functionality.

Microsoft UET receives permitted marketing-site activity and successful business-inquiry events for ad measurement. Microsoft Clarity provides website usage insights. Microsoft may use this information to provide and improve its services and advertising. See the Microsoft Privacy Statement. We do not include names, email addresses, phone numbers or message contents in our UET conversion event.

10. How do we handle account authentication?

In Short: We use secure email-and-password authentication with multi-factor authentication.

Account access uses email-and-password credentials with multi-factor authentication, provided through our identity infrastructure. We do not offer social-media login for the Services. You are responsible for keeping your credentials confidential.

11. How long do we keep your information?

In Short: We keep clinic-user information while the account is active, and we retain patient records consistent with healthcare recordkeeping requirements.

We keep clinic-user information for as long as the account is active and as needed to provide the Services, and thereafter as required for tax, accounting, legal, or legitimate business purposes.

We retain patient records for seven (7) years after the clinic’s subscription ends, or longer where applicable state or federal law requires, and then securely delete them subject to the BAA’s provisions where destruction is infeasible. This is our stated retention policy, not a universal medical-record retention period imposed by HIPAA. BAA protections continue while we retain PHI. Clinics may request C-CDA records and documents on exit.

Some transient data has a shorter lifecycle: raw eligibility responses are purged 90 days after the check while coverage summaries and verdicts remain; call and visit audio is purged after processing. A patient-facing prescription record document is generated on request rather than retained as a separate stored document; underlying prescription entries remain part of the clinical record. Application logs contain identifiers and reasons, not clinical text, transcripts or audio.

12. How do we keep your information safe?

In Short: We use organizational and technical safeguards consistent with the HIPAA Security Rule.

We maintain administrative, physical and technical safeguards consistent with our HIPAA Business Associate obligations: clinic-user MFA, role-based access and clinical designations, a recorded reason for administrative chart access, immutable patient-record access logs, encryption in transit and at rest, and BAAs for PHI-handling vendors. Our Trust Center describes these safeguards. No electronic transmission or storage technology can be guaranteed 100% secure. Use the Services from a secure environment.

13. Do we collect information from minors?

In Short: The Moxcares platform is for clinic users 18 and older. Clinics may, under their own authority, treat patients who are minors.

The Moxcares platform is intended for use by clinic users who are at least 18 years old, and we do not knowingly create clinic-user accounts for minors.

Clinics that use Moxcares may treat patients who are minors and may process those patients' PHI through the Services on the clinic's behalf, under the clinic's authority and applicable law (including any parental or guardian consent obtained by the clinic). In that context, a minor patient's PHI is handled under the clinic's Notice of Privacy Practices and our Business Associate Agreement — not as direct collection from a minor by Moxcares.

14. What are your privacy rights?

In Short: Depending on your location, you may have rights regarding your personal information. Patient PHI requests are handled through the clinic.

Depending on where you are located, you may have rights to request access to, correction of, a copy of, or deletion of your personal information, and to withdraw consent where we rely on it. To exercise these rights regarding clinic-user information, contact us at legal@moxcares.com. We will consider and act upon requests in accordance with applicable data protection laws.

Patient PHI. Requests by patients to access, amend, or delete their PHI are directed to and handled by the clinic (the Covered Entity), consistent with HIPAA. Moxcares supports clinics in fulfilling these requests as their Business Associate.

Withdrawing consent. If we are relying on your consent, you may withdraw it at any time by contacting us. Withdrawal does not affect the lawfulness of processing before withdrawal.

15. Controls for Do-Not-Track features

Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") feature. No uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals. If a standard is adopted that we must follow, we will inform you in a revised version of this Policy.

16. Do United States residents have specific privacy rights?

In Short: If you are a resident of certain US states, you may have specific rights regarding your personal information.

If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right, subject to applicable law, to:

• Request to know whether we are processing your personal data;
• Access your personal data and request a copy;
• Correct inaccuracies in your personal data;
• Request deletion of your personal data;
• Obtain a list of categories of third parties to which we have disclosed personal data; and
• Not be discriminated against for exercising these rights.

These rights apply principally to clinic-user information. Patient PHI is governed by HIPAA, and patient requests are routed through the clinic as Covered Entity.

We do not sell patient PHI or use it for targeted advertising. Public marketing-site disclosures to advertising providers, described in Section 9, may constitute “sharing” or targeted advertising under some state laws. Where applicable, you may opt out of those activities, in addition to exercising access, correction and deletion rights. Contact legal@moxcares.com for assistance. Mobile opt-in and messaging-consent information is not shared for third-party marketing.

How to exercise your rights. Submit a request to legal@moxcares.com. We will verify your identity before acting on your request. You may designate an authorized agent to act on your behalf, subject to proof of authorization. If we decline a request, you may appeal by contacting legal@moxcares.com; if your appeal is denied, you may contact your state attorney general.

17. Do we make updates to this Policy?

In Short: Yes, we update this Policy as necessary to stay compliant with relevant laws.

We may update this Privacy Policy from time to time. The updated version will be indicated by an updated "Last Updated" date. If we make material changes, we will notify you either by prominently posting a notice or by directly sending you a notification. We encourage you to review this Policy regularly.

18. How can you contact us?

If you have questions or comments about this Policy, email us at legal@moxcares.com, or write to:

VVY Technologies, Inc. (d/b/a Moxcares)
131 Continental Dr, Suite 305
Newark, DE 19713

19. How can you review, update, or delete your data?

Subject to applicable law, you may have the right to request access to the personal information we collect from you, to correct inaccuracies, or to request deletion. To make such a request regarding clinic-user information, contact us at legal@moxcares.com. Patient PHI requests are handled through the clinic, as described above.