1. Information We Collect

• Personal Information – Includes name, email, phone number, organization details, and credentials during registration and user profile setup.
• Protected Health Information (PHI) – Collected, stored, and transmitted in compliance with HIPAA when authorized users input patient data into the system.
• Usage Data – Automatically collected data on how the Service is accessed and used, including IP address, browser type, access times, and viewed pages.
• Cookies and Tracking Technologies – Used to enhance user experience and perform analytics; users can control cookie preferences through their browser settings.

2. Use of Information

• Deliver and improve our Services.
• Facilitate secure messaging, call logging, email, and SMS communication.
• Manage patient and physician profiles, referrals, and interactions.
• Enable appointment scheduling and automated reminders.
• Monitor platform performance, conduct audits, and ensure compliance.
• Provide customer support and service communications.
• Analyze usage patterns and trends to enhance user experience.

3. Legal Basis for Processing

• User consent
• Contractual obligations
• Legal compliance (including HIPAA and CCPA)
• Legitimate interests such as improving services

4. Data Sharing and Disclosure

• Authorized system users (e.g., DME providers, physicians) as per access controls.
• Service providers under binding agreements supporting hosting, analytics, or communication.
• Legal entities or government authorities when required by law.

5. Data Security and Compliance

• Encryption in transit and at rest for PHI and sensitive data.
• Role-based access control (RBAC) and multi-factor authentication.
• Regular vulnerability scans and HIPAA audit trails.
• Secure communication tools adhering to 45 CFR § 164.312(e)(1) standards.

6. Patient Rights and Access

• Access their medical history and communication logs.
• Receive appointment and medication reminders.
• Communicate securely with their care team.
• Request updates to personal information.

7. Data Retention

We retain user and PHI data for the duration of the account's active use and as required by law. Audit logs and system activity records are retained in accordance with HIPAA audit requirements.

8. Your Privacy Rights (CCPA/Applicable Law)

• Request access to your personal data.
• Request deletion of your data, subject to exceptions.
• Opt-out of data sharing (if applicable).

To exercise these rights, email us at: privacy@wonderws.com

9. Third-Party Services and Integrations

Our system may integrate with third-party tools. These services are contractually obligated to follow applicable data protection laws and cannot use your information for unrelated purposes.

10. Children’s Privacy

WWS Nexus does not knowingly collect or solicit personal information from individuals under the age of 13.

11. Updates to This Policy

We may update this policy periodically. Any material changes will be communicated via email or platform notification.

12. Contact Us

• Privacy Officer
• Wonder Worth Solutions LLC
• Email: privacy@wonderws.com
• Phone: (320) 207-8050
• Address: 1007 N Orange St. 4th Floor 504, Wilmington, DE 19801

13. Artificial Intelligence (AI) Usage

• Purpose of AI Integration – Suggest appointment times, auto-generate reminders, flag inconsistencies, and support documentation and compliance.
• Data Handling and Privacy – AI systems are trained on anonymized datasets unless explicitly authorized. PHI is never used for training without consent. All AI interactions are logged and auditable.
• User Control and Transparency – Users are informed when interacting with AI-driven features. Users may opt out of AI-generated suggestions unless core to compliance or safety.
• Compliance with Ethical Standards – AI use is aligned with HIPAA, NIST AI RMF, and OECD AI Principles. Future AI capabilities will be implemented with transparency and safeguards.