Privacy Policy

I. Scope and Application

1. Identity and scope

Rigel Networks LLC, a California limited liability company (“Rigel,” “we,” “us” or “our”), owns and provides the proprietary CLYNYX software and brand. This Privacy Policy (“Policy”) describes the processing of personal information in connection with clynyx.com, product inquiries, demonstrations, business communications and the administration of customer and user relationships. CLYNYX is a product brand and not a separate legal entity.

Patient records processed on behalf of a healthcare organization are governed by that organization’s instructions, the applicable customer agreement and Business Associate Agreement (“BAA”), and applicable healthcare privacy law. This Policy does not constitute a healthcare provider’s Notice of Privacy Practices, a patient authorization, an executed BAA or consent to disclose substance use disorder records. Section 6 addresses the processing of customer patient records.

Rigel’s offerings are currently intended for U.S. healthcare organizations. Patient records, medical details, Social Security numbers, passwords and other sensitive information must not be submitted through ordinary website contact email. Requests for medical care or access to a medical record should ordinarily be directed to the relevant healthcare organization. Emergency assistance is available by calling 911.

II. Collection and Use of Information

2. Categories of information collected

Information provided directly. Rigel receives information supplied in connection with inquiries, requests for information, demonstrations and business dealings. Such information may include a name, business email address, telephone number, employer, job title, business address, correspondence, product interests and implementation requirements. Customer administration may also involve account identifiers, authorized contacts, and contract, billing, support and training records. Product-evaluation inquiries must not include patient information.

Authorized-user and support information. Where the agreed services include administration or support of a customer deployment, Rigel may process authorized-user account details, organization and role information, authentication events, relevant device or network information, support communications, and activity or audit records necessary for those services. Processing and access are subject to the applicable agreements, configured permissions and law. Clinical information contained in such records remains subject to applicable healthcare protections. This Policy does not independently authorize undisclosed employee surveillance, biometric collection or recording.

Technical information. Website operation involves processing browser requests, including an IP address, requested URL, date and time, browser or device information, and referring page where supplied by the browser. Infrastructure and security systems may record such information for content delivery, error diagnosis and misuse prevention. Cookies or similar technologies may support necessary functionality, preferences or authenticated administration. External resources, including fonts, may cause a browser to transmit technical information to the relevant resource provider.

Other business sources. Rigel may receive professional contact information from an individual’s organization, an authorized Technology Delivery Partner or other business representative, or a person making an introduction in connection with an inquiry or customer relationship. Such information is used for that relationship and the purposes described in this Policy, subject to applicable law. Rigel does not request patient information for marketing inquiries.

3. Purposes of processing

Rigel uses personal information as reasonably necessary to respond to inquiries; arrange demonstrations and requested communications; evaluate, enter into and administer business relationships; provide agreed implementation, licensing, hosting and support services; manage authorized accounts; issue invoices and maintain business records; diagnose website or service problems; protect systems and prevent fraud or misuse; comply with law; and establish, exercise or defend legal rights.

Where an individual inquires about CLYNYX or requests a demonstration, Rigel may use the business contact information and product interests supplied to respond and provide relevant follow-up concerning CLYNYX and related Rigel services, to the extent permitted by law. Such follow-up may include email and telephone communications. Recipients may opt out of promotional email through the unsubscribe method provided or by emailing contact@clynyx.com, and may request cessation of promotional calls. Rigel honors applicable opt-out and do-not-call requirements and may retain limited suppression information to implement those choices. Necessary account, transaction, security and legal communications may continue.

A website visit or inquiry does not independently constitute any separate consent required by law for automated or prerecorded marketing calls, marketing text messages or the recording of a communication. Rigel does not use customer patient records, clinical support content, clinical account activity or information revealing or inferred about an individual’s health to create marketing lists or conduct these promotional activities.

4. Cookies, external resources and browser signals

The public website uses WordPress and associated presentation resources. Website functionality and authenticated administration may use cookies or comparable browser features. Cookies may be managed through browser settings; disabling them may impair dependent functionality. A browser setting does not, by itself, delete information previously received.

Some pages load fonts from Google Fonts and Google’s font-delivery infrastructure. These requests may disclose an IP address, browser or request information and, depending on browser settings, a referring page to the resource provider. Accessing a third-party link or externally hosted material may also disclose technical information to that provider. The provider’s practices are governed by its own policies; Rigel does not control tracking on third-party sites accessed by visitors. External-resource requests do not constitute a representation that Rigel sells information or conducts targeted advertising.

Rigel does not sell personal information, share it for cross-context behavioral advertising or use it for targeted advertising. Rigel does not authorize advertising networks to track visitors across websites for those purposes through the public CLYNYX website. The website does not alter its operation in response to a browser’s legacy Do Not Track signal. Because Rigel does not undertake sale or advertising sharing, a Global Privacy Control signal has no such activity to disable. Rigel will honor legally applicable opt-out signals and requests where required. Any change to these practices will be subject to the required notice and implementation of required choices before the relevant processing begins.

III. Disclosures and Healthcare Information

5. Disclosure of information

Rigel may disclose relevant personal information to service providers supporting hosting, infrastructure, communications, business administration, security and professional services, subject to appropriate contractual or professional obligations; to the relevant organization or its authorized Technology Delivery Partner as necessary to administer an account or requested services; and to recipients authorized by the individual concerned. Providers processing customer protected health information (“PHI”) on Rigel’s behalf are subject to applicable healthcare contractual requirements.

Where service providers manage business inquiries or deliver Rigel’s own promotional communications, Rigel limits the information supplied to what is appropriate for those purposes and requires appropriate restrictions on its use. These arrangements do not authorize providers to use customer patient records or to market their own products independently using Rigel’s inquiry lists.

Rigel may also disclose information when lawfully required by legal process or a regulator; when reasonably necessary and legally permitted to protect rights, safety or system security, prevent unlawful activity or pursue a legal claim; or in connection with a proposed or completed reorganization, financing, merger or asset transfer, subject to appropriate confidentiality protections and applicable law. These provisions do not override restrictions applicable to PHI, records protected by 42 CFR Part 2 (“Part 2 Records”) or other specially protected information. Disclosure of such information is evaluated under its governing legal and contractual requirements.

6. Customer patient records and dedicated deployments

Where Rigel contracts directly with a healthcare organization, Rigel may license CLYNYX and provide dedicated hosting in Rigel-controlled U.S. Azure infrastructure as specified in the customer agreement. Where an authorized Technology Delivery Partner contracts with the healthcare organization and hosts CLYNYX in the Technology Delivery Partner’s Azure environment, the Technology Delivery Partner administers the hosting responsibilities assigned to it. Rigel may provide separately agreed software, implementation or support services and act as a business associate subcontractor where those services involve PHI. The parties’ duties are determined by the actual services and data flows, rather than the invoicing arrangement or ownership of the server alone.

Rigel processes customer patient information only pursuant to applicable lawful instructions, executed agreements and legal requirements. This Policy neither grants Rigel ownership of patient information nor authorizes its use for advertising, sale, independent research or general-purpose AI training. Applicable requirements of 42 CFR Part 2 and more protective state confidentiality laws remain in force. A BAA does not, by itself, constitute patient consent.

Patient access, correction and related requests should ordinarily be directed to the healthcare organization responsible for the record. Where Rigel receives a request concerning customer-controlled records, Rigel will route the request appropriately and provide the assistance required by its role, contract and applicable law. The underlying patient record and additional sensitive information must not be transmitted by email unless an approved secure method has been arranged.

Dedicated U.S. hosting commitments apply to the deployment and data locations specified in the relevant agreement. Such commitments do not constitute a representation that public website resources, ordinary business correspondence, every vendor operation or all support access are located exclusively in the United States. Hosting and backup regions, support-access locations, vendors and permitted international access must be established for each customer arrangement.

Where Rigel processes personal information other than PHI on behalf of a customer, solely for that customer’s purposes and on its documented lawful instructions, the processing is governed by the applicable customer agreement, applicable personal-data processing terms and law. This may include authorized-user information and nonclinical support information. Information that Rigel processes for its own website, business communications, billing, security and relationship administration is addressed separately in this Policy. The applicable role depends on the actual processing; this distinction does not reduce protections applicable to PHI, Part 2 Records or other specially protected information.

7. Included and optional integrations and AI

Prescribing, secure messaging, clearinghouse and AI-assisted features, whether included in the purchased package or separately ordered, are activated only pursuant to the applicable service arrangements and approved configuration. Before patient information is transmitted, the parties must establish the provider’s role, permitted data flows, required agreements and any necessary permissions. A customer’s provision of an API key or selection of a model does not eliminate Rigel’s or the customer’s legal responsibilities. This Policy does not authorize an external provider to train a general-purpose model on patient information. The customer’s healthcare notices and the applicable service terms govern its clinical workflows. Licensing or activating an AI module does not itself approve a provider, model, data flow or clinical use. A material change to the approved provider, model, purpose, information categories, retention or training settings requires documented reassessment and any required authorization before the affected processing begins.

IV. Retention, Rights and Administration

8. Retention and security

Rigel retains personal information for as long as reasonably necessary for the purpose for which it was collected, the active customer or business relationship, applicable recordkeeping requirements, security and dispute-resolution needs, and the establishment or defense of legal claims. Retention periods depend on the information involved: inquiry information may be retained during response and follow-up; account, contract and billing records may be required throughout the relationship and applicable legal retention periods; technical records may be required for diagnosis and security; and limited suppression records may be retained to honor an opt-out. Rigel assesses continuing need rather than retaining information indefinitely for an unspecified future purpose.

Patient-record retention, export, return and deletion are governed separately by customer agreements, BAAs and applicable law. Required preservation or a documented inability to delete a particular backup immediately may affect timing but does not authorize unrelated use. Retained PHI remains subject to applicable protections.

Rigel applies safeguards appropriate to the information and its applicable legal and contractual obligations. No internet transmission, storage system or software is entirely risk-free. This statement does not waive required safeguards, breach-reporting duties or express contractual obligations. Privacy and security concerns may be reported to contact@clynyx.com without including passwords or patient records. Customers should also use their agreed urgent incident escalation channel.

9. Individual requests and choices

Individuals may contact contact@clynyx.com to inquire about personal information Rigel holds concerning them, request access or a copy, seek correction or deletion, or raise a privacy concern. Depending on applicable law and Rigel’s role, additional rights may include portability, limits on sensitive-information use, an opt-out, an authorized-agent request or an appeal. Rights are subject to lawful exceptions and do not apply identically to every record or jurisdiction. This Policy does not represent that every state comprehensive privacy statute applies to every interaction.

A request should identify its nature and the individual’s relationship to CLYNYX without including unnecessary sensitive information. Before disclosing information or acting on a request, Rigel may proportionately verify identity and authority, including an authorized agent’s authority. Rigel will respond within legally applicable periods, explain applicable limitations and provide an appeal process where required. An appeal may be submitted to the same email address with the subject “Privacy Appeal” and identification of the relevant request. Where applicable, Rigel will explain further rights to contact a regulator. Rigel will not unlawfully discriminate or retaliate against an individual for exercising a protected right.

Promotional email preferences do not govern essential service communications. Browser privacy settings are administered through the browser. Requests concerning customer patient records are addressed in section 6. An accessible version of this Policy or another accessible means of submitting a request may be requested through the contact address above.

10. Children

The public marketing website is directed to business audiences and not to children under 13. Rigel does not knowingly seek children’s personal information through the website. Concerns that a child has submitted personal information through the website may be directed to Rigel at the contact address below. This provision does not preclude an authorized healthcare organization from using its separately governed clinical deployment to provide care to minors in compliance with law.

11. Amendments and contact

Updates to this Policy are identified by the effective date above. Material changes will be communicated through a prominent website notice or another notice appropriate to the relationship. Rigel will obtain consent where required before applying a new use that requires such consent. A Policy update does not retroactively authorize incompatible processing or amend an executed customer agreement or BAA. Changes to customer contracts are subject to the applicable agreed procedures.

Business, privacy, legal and security inquiries may be directed to Rigel Networks LLC at contact@clynyx.com. PHI and credentials must not be included in ordinary email.