Privacy and data handling

Last reviewed: 2026-07-24 · privacy-v2026-07-03

Privacy Policy

This policy explains how information moves through account access, private case preparation, human review, and case-specific coordination. It does not authorize a new use of medical records by itself.

Information covered

Account and identity details, contact preferences, submitted health information, medical records, consent choices, and case communications.
Technical and security records needed for authentication, fraud prevention, access control, audit, and service reliability.

Why information is used

To create and protect an account, organize a case, check record readiness, coordinate requested services, and provide reviewed updates.
AI may assist with extraction, translation, organization, and draft summaries; patient-facing or clinical use remains subject to the required human review.

Access and external sharing

Access is role-based, case-scoped, and recorded. A user must be authorized for the relevant patient, case, or assigned review task.
Selected records are shared with a doctor, hospital, or care partner only for the requested purpose and after the required sharing authorization.

Private files and safety checks

Original files use private object storage and permission-checked, time-limited transfer links rather than public file URLs.
Uploaded material must pass malware scanning and the required extraction or de-identification stage before it becomes eligible for AI-assisted processing.

Cross-border processing and choices

Cross-border processing for international coordination requires a separate service authorization. External recipients and disclosures remain case-specific.
Optional de-identified model-improvement permission is separate from the core service and can be declined without preventing basic case coordination.

Retention, requests, and incidents

Information is retained according to the applicable record schedule, active service needs, security requirements, and legal holds. Deletion or access requests may be limited where records must be preserved. Use the authenticated patient portal for case, access, correction, deletion, withdrawal, and other privacy-rights requests; never send medical records through an unverified public channel. This website does not provide a public privacy intake contact.

Official reference register

Traceable, not a certification claim.

These official sources identify legal principles considered in the policy design. They do not certify Navelia, provide legal advice, or establish compliance in every jurisdiction. Qualified counsel must still review the verified entity, processing locations, data flows, and service contracts before launch.

Supreme People’s Procuratorate of the PRC — English publication

Personal Information Protection Law of the People’s Republic of China

Articles 28–30 address sensitive personal information, including medical and health information, separate consent, necessity, and heightened protection.

Cyberspace Administration of China

Personal Information Protection Law — official Chinese text

Primary Chinese-language reference for purpose limitation, transparency, sensitive information, individual rights, and cross-border processing obligations.

European Commission

What personal data is considered sensitive?

Official EU guidance identifies health data as a special category and summarizes the stricter Article 9 processing conditions.

Medical disclaimer Privacy policy Consent

Cross-border processing and choices

Cross-border processing for international coordination requires a separate service authorization. External recipients and disclosures remain case-specific.

Optional de-identified model-improvement permission is separate from the core service and can be declined without preventing basic case coordination.

Retention, requests, and incidents

Traceable, not a certification claim.