Skip to main content

Privacy Policy

Last Updated: March 1st, 2026

1. INTRODUCTION

Welcome to NEO Innovations LLC (“Company,” “NEO,” “we,” “us,” or “our“). We operate a cloud-based electronic health record platform (the “Platform“) and the website located at [neoplatform.com] (the “Site“). 

We are committed to respecting your privacy and protecting the sensitive data entrusted to us. This Privacy Policy explains how we collect, use, and share information from: 

  1. Subscribers: Healthcare clinics, providers, and administrative staff who subscribe to our Platform. 
  1. Visitors: Individuals who visit our Site to learn about our services. 

IMPORTANT NOTE REGARDING PATIENT DATA (HIPAA): If you are a patient of one of our Subscribers, please note that our processing of your Protected Health Information (“PHI“) is governed by the Health Insurance Portability and Accountability Act (“HIPAA“) and the specific Business Associate Agreement (“BAA“) we have in place with your healthcare provider. In the event of a conflict between this Privacy Policy and the BAA, the BAA controls regarding PHI. If you have questions about your medical records, please contact your healthcare provider directly.

2. INFORMATION WE COLLECT

We collect information in three primary ways: (1) directly from you; (2) automatically through your use of the Services; and (3) from third-party sources. 

  1. Information You Provide to Us
  • Account Information: When you register for the Platform (as a provider or staff), we collect professional identifiers such as names, email addresses, phone numbers, NPI numbers, and practice locations. 
  • Billing Information: We collect payment details and billing addresses. Note that we utilize a third-party payment processor and do not store raw credit card numbers. 
  • Support Data: Any information you provide when you contact our customer support team. 
  1. Information We Collect Automatically

When you access the Site or Platform, we may log usage data to ensure security and improve performance. This includes: 

  • Device Data: IP address, browser type, operating system, and unique device identifiers. 
  • Activity Data: Login timestamps, pages viewed, features used, and session duration. 
  • Cookies: We use cookies and similar technologies to authenticate users and analyze site traffic. You can control cookie preferences through your browser settings. 
  • The Cookies Notice in the paragraphs below describes the various technologies the integrated academic health system of each Practice and its subsidiaries and affiliates use when you access and use our online services and any subdomains, as well as any other Practice-related websites or mobile applications. Please read this Cookies Notice carefully, as it describes how we collect, store, and share information, including through cookies, pixel tags, web beacons, embedded scripts, local objects, and other tracking technologies (collectively referred to in this notice as “Cookies”) on our online services, the reasons we use these Cookies, and how you can disable them. This notice applies to any online service where this notice is placed or that references this notice. 
  • A Cookie is a small text or other file, including a unique reference code, that is stored in your device by your web browser when you visit or use the online service, and that your browser provides to us each time you return to the online service. Almost every website uses these files. Cookies may store certain information such as your internet protocol (“IP”) address, operating system, device information, browser type and language, referring URLs, access times, pages viewed, links clicked, search queries and results, and other information about your activities or use of the online service. These are used to identify the content you view, the content you provide so that you do not have to re-enter it each time you visit our online services, and your preferences and settings. Cookies also help us provide you with customized content, speed navigation through our online services, allow us to learn about your visit and use of our online services, and to market our products and services to you on our online services and non- Practice websites based on your interests and preferences. Cookies vary in duration. Session Cookies, for example, last for as long as your internet browser is open. Once the browser closes, the session Cookie disappears. Persistent Cookies are stored on your device for longer periods. Both types of Cookies can create an identification that is unique to your device. 
  • We may use different types of Cookies, depending on the online service. The main categories of Cookies are Strictly Necessary Cookies, Performance Cookies, Functional Cookies, Analytics Cookies, and Marketing Cookies. We do not use the same Cookies in every online service.  
  • Strictly Necessary Cookies are essential in order to enable you to move around the online service and use its features. These are temporary Cookies that last only as long as your web browser or application is open, and are used for technical purposes such as enabling better navigation on the online service. 
  • Performance Cookies are stored on your device for longer periods and are used for various performance purposes including tracking the number of visitors to the online service and information such as the number of views a page gets, how much time a user spends on a page, and other pertinent web statistics. The collected information is collected and stored in aggregate form. These Cookies are used to improve the performance of the online services and the user experience. 
  • Functional Cookies enable the website to save information which has already been entered (such as user names, language choices, and your location), so that it can offer you improved and more personalized functions. Functional Cookies are also used to enable features you request, such as playing videos. 
  • Analytics Cookies are used with our web analytics services from third parties, such as those from hosting services like Amazon Web Services. These services use Cookies to collect information such as IP address, device ID, browser information, geolocation, content viewed, or other similar information for the purpose of analyzing and measuring how visitors use the online services and specific functions and features. 
  • We may also place Cookies of third parties, such as Google, Facebook (now known as Meta), or Microsoft’s Bing, in the online services that track your interactions with our online services and that third party’s websites, content, advertisements, website links, and/or other online services. Such third-party Cookies are often managed by third-party service providers that also provide NEO with statistical, analytical, or other information and help us provide you with advertisements or other content that we believe would be relevant for you. The information collection and use practices by such third parties are described in the third party’s privacy policies and Cookies notices, not this Cookies Notice. 
  • You can manage or disable Cookies at any time by adjusting your browser or device settings. Browsers and devices are different, so refer to the settings menu of your browser or device control settings for instructions on how to change your Cookie preferences. If you choose not to receive Cookies, our online services, or portions of our online services, may not function properly or be available to you. 
  • You may also manage and disable Cookies placed by third parties such as Google, Facebook (or Meta), and Microsoft’s Bing, by following the instructions provided by the third parties in their Cookie policies and notices. You can find out how to do this, and find more information on Cookies, at www.allaboutcookies.org. To learn more about the use of Cookies by Google for analytics and to exercise choice regarding those Cookies, please visit the Google Analytics Opt-out Browser Add-on. For information about Cookies used by other third parties, visit: 
  • You also may be able to opt-out from having certain of our third-party marketing partners use Cookies on our online services to collect data for marketing purposes. Some of these advertising partners are members of the Network Advertising Initiative (“NAI”). To remove yourself from some or all NAI member advertising programs, as further described on the NAI Opt-Out Page, please visit the NAI Opt-Out Page, https://optout.networkadvertising.org, and follow the relevant instructions. Please note that if you delete, block, or otherwise restrict Cookies on your computer, or if you use a different computer or Internet browser, you may need to renew your NAI opt-out choice. 
  • PLEASE NOTE THAT IF YOU TURN OFF ESSENTIAL COOKIES, CERTAIN ASPECTS OF THE PLATFORM WILL BE INOPERABLE, AND YOU EXPLICITLY AGREE THAT NEO AND PRACTICE SHALL NOT BE LIABLE FOR ANY RESULTING DAMAGES CAUSED BY ANY ESSENTIAL COOKIES THAT ARE DISABLED BY YOU. 
  • New services and specific Cookies may be added from time to time without prior notice to you. Accordingly, this Cookies Notice may be updated and posted online. Any updated Cookie Notice will become effective when posted. Please review this Cookies Notice periodically. 
  1. Patient Data (PHI)

As a Subscriber, you input PHI into the Platform. We process this data solely as a Business Associate on your behalf. We do not own this data, nor do we use it for our own independent marketing purposes.

3. HOW WE USE YOUR INFORMATION

We use the information we collect for the following business purposes: 

  • Service Delivery: To provide, maintain, and authenticate access to the Platform. 
  • R&D and Improvement: To analyze usage trends to fix bugs and improve the user experience. 
  • Security & Compliance: To detect fraud, prevent unauthorized access, and comply with legal obligations (including HIPAA security rule requirements). 
  • Communication: To send transactional emails (e.g., password resets, updates to terms) and, where permitted, marketing communications regarding our products.

4. SHARING AND DISCLOSURE OF INFORMATION

We do not sell your personal information or patient PHI. We disclose information only as follows: 

  • Subprocessors: We share data with trusted third-party vendors who assist in operating our infrastructure (e.g., cloud hosting providers like AWS/Azure, email delivery services). These vendors are bound by strict confidentiality obligations and, where such vendors create, receive, maintain, or transmit PHI on our behalf, by executed Business Associate Agreements. We maintain a current list of PHI subprocessors, which is available to Subscribers upon written request. We remain liable for our subprocessors’ compliance with applicable HIPAA requirements to the extent required by law. 
  • Legal Requirements: We may disclose information if required by law, subpoena, or court order, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of the Company, our users, or the public. 
  • Business Transfers: If the Company is involved in a merger, acquisition, or sale of assets, user information and PHI may be transferred as part of that transaction, subject to the buyer assuming the obligations of the BAA and this Policy.

5. DATA SECURITY

We implement administrative, physical, and technical safeguards designed to protect your data and PHI. These measures include: 

  • Encryption of data in transit (TLS 1.2+) and at rest (AES-256). 
  • Role-based access controls. 
  • Regular security audits and vulnerability assessments. 

However, no method of transmission over the Internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. In the event of a Breach of Unsecured PHI, we will notify the affected Covered Entity (i.e., the Subscriber) without unreasonable delay and in no case later than sixty (60) calendar days after our discovery of the Breach, consistent with our obligations as a Business Associate. Such notification will include, to the extent reasonably available: (a) a description of the Breach; (b) the types of Unsecured PHI involved; (c) the number of individuals affected; (d) the steps taken or underway to mitigate the Breach; and (e) the contact information of our Privacy Officer. We will also maintain and make available to Subscribers upon request our written Breach Notification Policies and Procedures. 

6. YOUR PRIVACY RIGHTS (STATE LAWS)

  1. Consumer Privacy Laws 

Depending on your residency, you may have rights under state privacy laws, such as the right to access, correct, or delete your “Personal Information.” These rights may include, without limitation: (a) the right to know what Personal Information we collect, use, disclose, or sell; (b) the right to request deletion of Personal Information, subject to applicable exceptions; (c) the right to correct inaccurate Personal Information; (d) the right to opt out of the sale or sharing of Personal Information for cross-context behavioral advertising; and (e) the right to non-discrimination for exercising any of the foregoing rights. We will acknowledge verified consumer requests within ten (10) business days of receipt and respond substantively within forty-five (45) calendar days, which period may be extended by an additional forty-five (45) calendar days where reasonably necessary, provided we notify you of the extension within the initial response period. To verify your identity, we may require you to provide information sufficient to match against our records. Applicable state laws may impose obligations on consumer health data that may extend beyond HIPAA’s scope; we will comply with those obligations to the extent they apply to non-PHI data processed through the Platform. 

Exemption for PHI: Please note that information governed by HIPAA (including all patient records stored on the Platform) is generally exempt from these state consumer privacy laws. 

For non-PHI data (such as marketing data or business contact info of Subscribers), you may exercise your rights by contacting us at Privacy@neoinnovations.com We will not discriminate against you for exercising these rights.

Do Not Track Signals

Our Site does not currently respond to “Do Not Track” signals sent by browsers.

SMS / Text Messaging & Two-Way Communication

NEO Innovations, in partnership with Twilio, offers two-way SMS text messaging as part of the NEO Platform to facilitate communication between healthcare offices and their patients. By providing your mobile phone number and opting in to receive text messages, you consent to the collection and use of your phone number and message content as described below.

Information We Collect: When you engage with our SMS messaging program, we may collect your mobile phone number, the content of messages sent and received, message timestamps, and delivery status information.

How We Use Your Information: The information collected through our SMS program is used solely to deliver appointment reminders, missed appointment notifications, office alerts, and relevant promotional communications. We do not sell or share your mobile phone number or message content with third parties for their own marketing purposes.

Two-Way Messaging: Our platform supports two-way communication, meaning you may receive messages from and send replies to NEO Platform. Inbound messages you send (including opt-out requests and support inquiries) are received and processed by our system and may be reviewed by authorized staff to respond to your needs.

Data Retention: Message content and related metadata are retained for a period necessary to fulfill the purpose of communication and to comply with applicable legal and regulatory requirements, after which they are securely deleted.

Third-Party Service Provider: SMS messaging is facilitated through Twilio, a third-party communications platform. Your phone number and message data may be processed by Twilio in accordance with their Privacy Policy, available at www.twilio.com/en-us/legal/privacy.

Opt-Out & Contact: You may opt out of SMS communications at any time by replying STOP to any message. For questions regarding your data or this policy, contact us at support@neoinnovations.com.

7. DATA RETENTION

We retain Personal Information for as long as your account is active or as needed to provide the Services. We retain PHI in accordance with the terms of the BAA and applicable medical record retention laws. Upon termination of a subscription, we will return or destroy PHI as required by the BAA.

8. INTERNATIONAL TRANSFERS

The Platform is hosted in the United States. If you access the Services from outside the U.S., you acknowledge that your data will be transferred to and processed in the U.S., where data protection laws may differ from those in your jurisdiction. The Company does not intend to processes personal data of individuals located in the European Economic Area (“EEA”), the United Kingdom, or Switzerland, where such transfers shall be governed by the applicable Standard Contractual Clauses adopted by the European Commission (“SCCs”) or, for UK transfers, the International Data Transfer Addendum issued by the UK Information Commissioner’s Office, each of which is incorporated by reference into the applicable Data Processing Addendum (“DPA”). Subscribers that process personal data subject to the GDPR or UK GDPR must execute a DPA with the Company prior to using the Platform, and failing to execute a DPA shall be a material breach of Subscriber’s obligations to Company. 

9. CHILDREN’S PRIVACY

The Platform is a professional tool intended for healthcare providers. We do not knowingly collect personal information from children under 13 via the Site. If we discover we have collected such information without parental consent, we will delete it. Notwithstanding the foregoing, PHI of minor patients may be input into the Platform by Subscribers in their capacity as HIPAA Covered Entities. The Company processes such PHI solely as a Business Associate pursuant to the applicable BAA and does not independently collect, use, or disclose it for its own purposes. The rights of minors with respect to their own health records are governed by applicable state law and must be addressed by the Subscriber as the Covered Entity. Subscribers are responsible for ensuring that their use of the Platform with respect to minor patients complies with applicable state minor consent laws and HIPAA.

10. CHANGES TO THIS POLICY

We may update this Privacy Policy periodically to reflect changes in law or our data practices. If we make material changes, we will notify Subscribers via email or a prominent notice on the Platform.

11. CONTACT US

If you have questions about this Policy or our privacy practices, please contact our Privacy Officer: 

NEO Innovations LLC 

Attn: Privacy Officer  

Email: Privacy@neoinnovations.com 

12. MINIMUM NECESSARY STANDARD

Consistent with the HIPAA Privacy Rule’s minimum necessary standard and the Company’s obligations as a Business Associate, the Company shall make reasonable efforts to limit its access to, use of, and disclosure of PHI to the minimum amount necessary to accomplish the permitted purpose. Platform access controls are configured to enforce role-based minimum necessary access. The Company shall maintain and implement written policies and procedures governing its application of the minimum necessary standard, available to Subscribers upon written request. 

13. AUDIT LOGS AND ACCESS RECORDS

The Platform maintains audit logs of all access to, modification of, and disclosure of PHI. Audit logs are retained for a minimum of six (6) years from the date of creation or the date when the log was last in effect, whichever is later. Subscribers may request audit log reports relating to their own data by submitting a written request to the Privacy Officer. The Company will provide such reports within a commercially reasonable time and subject to applicable law.

14. GOVERNING LAW AND DISPUTE RESOLUTION

This Privacy Policy and any disputes arising out of or related to it shall be governed by and construed in accordance with the laws of the State of Wisconsin, without regard to its conflict-of-law principles, except to the extent preempted by applicable federal law (including HIPAA and HITECH). Nothing in this Privacy Policy limits the rights of any individual under HIPAA, HITECH, or applicable state health privacy law. To the extent this Privacy Policy applies to data subjects in states with health privacy laws that impose obligations beyond HIPAA, the Company shall comply with those state-specific obligations to the extent they are applicable and not preempted.