Privacy Policy

• Operate, secure, monitor, and improve the HavenOPS platform and website.
• Provision accounts, deliver customer support, onboard customers, and manage the commercial relationship.
• Meet contractual, audit, and legal obligations, including HIPAA obligations where applicable.
• Send service, security, and administrative communications. Marketing emails require opt-in and include unsubscribe controls.
• Detect, investigate, and prevent security incidents, fraud, and abuse.

Where GDPR/UK GDPR applies, we rely on contract performance, our legitimate interests (security, fraud prevention, service improvement, direct communications with existing customers), legal obligation, and — where required — consent. You have the right to access, rectify, delete, restrict, port, or object to the processing of your personal data. Requests can be submitted to privacy@havenops.io. You may also lodge a complaint with your local supervisory authority.

We share personal information only with vetted sub-processors that support hosting, infrastructure, database services, email delivery, error monitoring, analytics, and customer support. Sub-processors are contractually bound to protect the data they process and to use it only for the purposes we authorize. A current sub-processor list is available on request via legal@havenops.io, and a public Subprocessor page is in preparation. We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

We apply defense-in-depth controls including tenant-isolated row-level security, append-only audit trails, encryption in transit (TLS 1.2+) and at rest (AES-256 or provider-managed equivalent), principle-of-least-privilege access, multi-factor authentication for administrative access, continuous monitoring, and documented incident response. See the Security overview and the Security Trust Packet for details.

Customer Data is retained for the term of the subscription plus a defined wind-down period documented in the DPA (typically thirty (30) days), after which we delete or de-identify it in accordance with the DPA and applicable law. Marketing website submissions are retained for the period required to respond to the inquiry and, where consented, to send follow-up communications. Security, audit, and diagnostic logs are retained per our records-retention schedule.

• Request access to, correction of, or deletion of personal data we control about you.
• Restrict or object to certain processing, including direct marketing.
• Withdraw consent where processing is based on consent, without affecting prior processing.
• Receive a portable copy of personal data you provided to us, where technically feasible.
• Appeal a decision on your request through our internal review process.

When a customer uses HavenOPS to process PHI, HavenOPS acts as a business associate and executes a Business Associate Agreement (BAA) with that customer. Under the BAA, HavenOPS uses and discloses PHI only as permitted by the BAA and HIPAA, applies required administrative, physical, and technical safeguards, reports incidents involving PHI in accordance with the BAA, and returns or destroys PHI at termination. HIPAA privacy rights (access, amendment, accounting of disclosures, restrictions) are exercised through the covered-entity customer, not directly with HavenOPS.

• HavenOPS uses AI-assisted features to support training generation, workflow recommendations, compliance readiness signals, summaries, and operational guidance.
• Human review is required before any AI output is used for operational, clinical, compliance, billing, or workforce decisions.
• Customer PHI and Customer Confidential Data are not used to train foundation models operated by HavenOPS or its sub-processors.
• Where AI features send data to sub-processors, that transfer is governed by written data-protection terms, sub-processor lists, and, where applicable, the BAA.
• Additional detail is available in the AI Transparency and Responsible AI Statement in the Legal & Trust Center.

Where personal data leaves its origin region, we use Standard Contractual Clauses, the UK International Data Transfer Addendum, or equivalent safeguards. EU/UK/Swiss addenda are available on request via legal@havenops.io.

HavenOPS is a business-to-business platform and is not directed to children under sixteen (16). We do not knowingly collect personal information from children through the platform or marketing website.

Material changes will be announced at least thirty (30) days in advance to subscription administrators via email and posted here with an updated effective date and version number. Continued use of the platform or website after the effective date constitutes acceptance of the updated policy.

Privacy inquiries: privacy@havenops.io. Legal correspondence: legal@havenops.io. Security reports: security@havenops.io.