Privacy, Security & Data Retention
Last updated: October 2026
NeuroVia is a personal organizing tool for families. It is not a medical provider and is not certified as HIPAA-compliant. Do not rely on it as your official medical record.
What we collect
- Your email, display name and password (stored securely by our sign-in service; we never see your password).
- Care records your team enters: appointments, medications and doses, clinic questions, equipment, the emergency card and symptom videos.
- Billing is handled by Stripe. We receive your subscription status, never your full card number.
Who can see it
- Only members of your care team. Every record and video is locked to the team at the database level.
- Team owners decide who joins, can set people to view-only, and can remove anyone at any time. Removing someone changes the invite code.
- Invite codes expire after 7 days and repeated wrong guesses are blocked.
- Video playback links expire after 5 minutes.
- The team's Recent activity list shows who added, changed or deleted records.
Who we share with
- We do not sell your data or use it for advertising.
- Service providers: our hosting and database provider (stores data encrypted in transit and at rest) and Stripe (payments). Clinical-trial searches go to ClinicalTrials.gov without any personal data.
How long we keep data
- Your records stay until you delete them. If a subscription ends, your team becomes read-only but you can still view and delete everything.
- When you delete a record, video, team or account it is removed from the live system right away. Backup copies roll off automatically within about 7 days.
- Payment records are kept by Stripe as required by tax law.
How to delete your data
- Delete any single item with its trash button.
- Team owners: Care Team page → Delete data. This erases every record and video for that patient (cancel the subscription first).
- Your account: Care Team page → Delete my account.
If something goes wrong (incident response)
- If we learn of unauthorized access to health information we will: contain it (revoke sessions and links, rotate keys) within 24 hours; investigate what was affected; notify affected users by email without unreasonable delay and within 60 days, as required by the FTC Health Breach Notification Rule; and notify regulators where required.
- To report a concern, email privacy@neurovia.space.