Privacy Policy

1. Introduction

This Privacy Policy describes how LiaisonIQ by NexReach ("Company," "we," "our," or "us") collects, uses, processes, and shares personal information through the LiaisonIQ Physician Relationship Management (PRM) platform (the "Platform" or "Service").

LiaisonIQ is a product of NexReach, LLC, the parent company operating the LiaisonIQ platform. LiaisonIQ is a specialized enterprise tool designed for Physician Liaisons and healthcare outreach organizations. We are committed to protecting the privacy and security of your professional data and ensuring compliance with applicable data protection laws.

2. Role of the Company

When you use liaisonIQ as part of a Team Workspace, your organization is the Data Controller, and liaisonIQ is the Data Processor. We process your data according to the instructions provided by your organization (the Workspace Owner). For individual "Solo" users, liaisonIQ acts as the Data Controller.

3. Information We Collect

3.1. Account Information

We collect information necessary to create and manage your account, including your full name, professional email address, job title, and organization name. We also store the phone number, office address, and other profile details you provide.

3.2. Professional Outreach Data

The Service is designed to store and process data related to your professional outreach activities, including:

• Clinic and provider target lists.
• Visit logs, meeting notes, and relationship history.
• Aggregate referral counts (monthly totals by referring practice or physician) and clinical specialty mappings. Patient-level referral data is not accepted.
• Expense records, mileage logs, and professional tasks.

3.3. Location and GPS Data

To provide core features like route optimization, we use your device location while the app is in use. While you use live route navigation, the app sends your current coordinates and remaining stops to our API and Google Maps to calculate traffic-aware arrival times and route updates. This is separate from saving visit check-in and check-out locations. If your Workspace Owner asks reps to share location at check-in (it is off by default), each rep chooses whether to share. If you choose to share, the app records your device location when you check in to and check out of a visit, together with time on site and a status showing whether location was captured, denied, unavailable, or not shared by choice. Workspace owners and admins can see these records and a location-compliance summary for their workspace. Workspace Owners are responsible for giving their team any notice, and obtaining any consent, that applicable law requires for this kind of monitoring. Workspace owners must confirm this before they can turn visit location tracking on, each rep is shown a notice and chooses whether to share (and can change that at any time in Profile), and we keep a record of both. We do not track your location in the background or sell your movement history to third parties.

3.4. AI and Voice Processing Data

If you utilize our Speech-to-Text feature, audio is sent to speech-to-text sub-processors (currently Groq and Google Gemini) for transcription; depending on your device and browser, recognition may instead run in your browser. We do not retain raw audio files after the transcript has been generated. If you dictate in a language other than English and use optional auto-translation, we retain both the English translation and the original-language transcript (encrypted at rest) so the original wording is preserved. AI-powered features (like Visit Prep, Coaching, and the AI Territory Agent) process the professional notes and data you provide to generate insights. The AI Territory Agent additionally runs on a daily schedule per workspace, sending competitor names and general region information to our AI and news-search sub-processors to generate opportunity, relationship-risk, and news findings. AI output is advisory only and may be inaccurate; see our Terms of Service for full AI disclaimer terms.

3.5. NPI Registry Data

When you use provider search or NPI enrichment features, liaisonIQ queries the NPPES National Provider Identifier Registry, a publicly available federal database maintained by CMS. NPI data displayed in the Platform is sourced from NPPES and is not independently verified by liaisonIQ. We do not store full NPPES records beyond the provider profile information you choose to save to your workspace. Fuzzy matching for NPI-1 (individual providers) may return approximate results; always verify provider data independently. For authoritative NPI data, consult nppes.cms.gov.

3.6. Referral Data and Confirmations

liaisonIQ does not accept patient-level referral data. Workspaces share aggregate monthly counts (for example, referrals by referring practice or physician, receiving location, and month), typed into the app or imported from a spreadsheet you connect. Before referral data can be shared, a workspace owner or admin must confirm in writing that no patient-identifying information will be sent. We keep a record of that confirmation (who confirmed, when, the exact wording, IP address, and browser) as compliance evidence, and we do not delete it when you delete an account or workspace.

3.7. Team-Shared Content

Notes and activity you add to a target in a team workspace (including the Target Chatter team timeline), your visit activity, and, where your workspace enables them, team standings and leaderboards can be seen by other members of that workspace according to their role and access level.

3.8. Website and Form Submissions

If you join our waitlist, book a demo, or send an in-app bug report, we collect what you enter, such as your name, email, clinic, and message. Demo bookings may create a calendar invite through Google Calendar or by email. Please do not include patient information in any form.

3.9. Pilot Request Form

If you submit the pilot request form, we collect your name, work email, phone number (optional), clinic name, website, role, specialty, number of locations and team size (optional), and the free-text description of what you want from the pilot. We also record your confirmation of the pilot ground rules: the statements you confirmed, the form version, the date and time, your IP address, and your browser's user agent. We use this to evaluate your request, contact you about the pilot, and keep a record of what you agreed to. Platform administrators at NexReach, LLC can see these records; workspace owners and other customers cannot. We do not sell this information.

Please do not include patient information in the form. We scan the free-text field and may delete suspected patient information without notice; if we do, we keep the rest of your request.

4. Data Sub-Processors

We utilize trusted third-party sub-processors to maintain the Service. These include:

• Google Cloud & Firebase: Secure data hosting, authentication, email verification, and password reset.
• RevenueCat & Stripe: Subscription and entitlement management. Solo and individual plans are billed via App Store / Google Play (RevenueCat). Team workspace owners are billed via Stripe web checkout; that subscription covers all member seats.
• Resend: Transactional email delivery (account verification, welcome emails, invite notifications). Resend processes your email address solely to deliver these messages.
• Loops.so: Lifecycle marketing email automation. If you opt in to marketing communications at sign-up or in Profile settings, your name, email address, role, subscription status, and account type may be shared with Loops.so to trigger relevant email sequences. You can unsubscribe at any time via the link in any marketing email.
• Google Maps & Places API: Map display, geocoding, Street View building thumbnails, route optimization, and nearby-place lookups used for territory and competitive proximity features. Business details Google returns for a target you add (such as place name and place ID) may be saved with that target.
• Google Gemini (AI): AI-powered intelligence features (visit prep, coaching, route planning, chat, and the AI Territory Agent). Data sent to AI providers is governed by enterprise-grade data privacy agreements. Google states that API input/output data is not used to train its models by default. Do not submit patient-identifiable or Protected Health Information (PHI) to AI features.
• Tavily: A news search API used by the AI Territory Agent's News & Market feature to scan publicly available news for signals relevant to your competitors or region. Only competitor names and general region information are sent.
• Groq: Speech-to-text (Whisper) for voice notes. Audio you dictate is sent to Groq for transcription and is not stored by us.
• Public data sources: U.S. Census Bureau (ACS) demographics and local-event data (PredictHQ) are queried with area-level information such as city, state, ZIP, or census tract, not personal data.
• Google Calendar & Resend (demo bookings): If you book a demo on our website, your name, email, and notes are used to create a calendar invite.
• AI Observability Tooling (e.g., Arize Phoenix): An internal tool that captures AI prompts, responses, and performance metadata for quality monitoring and debugging, separate from processing by the AI provider itself, and access-restricted to authorized staff.
• Google Sheets (optional): If you connect your Google account for referral or visit log sync, Google processes spreadsheet metadata and content on your behalf.
• Cloud Hosting: Storage and processing of your data in secure cloud infrastructure.

4a. Legal Bases for Processing (EEA / UK)

If you are in the European Economic Area or United Kingdom, we process personal data only where we have a legal basis to do so:

• Contract: to create and run your account, provide the Service, and manage your subscription (see Information We Collect and How We Use Your Information)
• Legitimate interests: to secure the Service, prevent fraud and abuse, monitor AI quality, provide team analytics to your Workspace Owner, and improve our features, where those interests are not overridden by your rights
• Consent: for optional items such as marketing emails, sharing your device location at check-in, and voice dictation. You can withdraw consent at any time (for example in Profile settings or by unsubscribing) without affecting earlier processing
• Legal obligation: to keep financial, audit, and compliance records and to respond to lawful requests

5a. Our Role: Controller and Processor

For account, billing, security, and website data, NexReach, LLC is the controller (or, under California law, the "business").

For the business data a workspace puts into the Service, such as targets, visits, notes, tasks, and referral counts, the Workspace Owner's organization decides what is entered and why, and we process it on that organization's behalf as a processor (or "service provider"). Requests about that data may be referred to the Workspace Owner.

5b. No Sale, No Targeted Advertising

We do not sell personal information and we do not share it for cross-context behavioral (targeted) advertising. We do not use your personal information or the content you enter to build advertising profiles. We do not knowingly sell or share the personal information of anyone under 18.

5. Data Security & Compliance

We implement robust technical and organizational measures to protect your data:

• Encryption: Data is encrypted in transit using HTTPS/TLS, and sensitive fields such as visit notes receive additional application-level encryption. See our Security page.
• Audit Logging: We maintain detailed audit logs of all Workspace activity, including data access, modifications, and team interactions, to support organizational oversight and compliance.
• Access Controls: We implement strict Role-Based Access Control (RBAC) to ensure team members can only access the data authorized by their Workspace Owner.

6. Data Retention and Deletion

We retain your data while your account is active or as needed to provide services. Specific retention periods by data type:

• Account and profile data: Retained while your account is active; deleted within 30 days of an account deletion request.
• Visit logs and clinic data: Personal records are deleted upon account deletion. Targets, visits, referrals, tasks and expenses logged in a team workspace belong to that workspace and are retained for the Workspace Owner after a member deletes their account.
• AI interaction logs: Your AI chat conversations are saved in your account so you can revisit them. Our access-restricted AI observability tool may also capture prompts, responses, and performance metadata for quality monitoring and debugging, and AI providers may retain data per their own policies. We retain structured metadata about each AI call (feature used, model, latency, token counts, success/failure, and redaction counts) for up to 2 years for quality monitoring, abuse prevention, and audit purposes.
• Visit check-in and check-out locations: The coordinates are removed from a visit 12 months after it takes place; the visit itself and whether location was captured are kept.
• Audit logs and security records: Retained for up to 2 years for compliance and security purposes, even after account deletion.
• Pilot request records: Your request and the record of your confirmations are kept as compliance records for as long as needed to evaluate your request, operate the pilot, and show what you agreed to. They are not removed when you delete a Workspace or account.
• Pilot Workspace data: After a pilot ends, a Workspace Owner may request an export within 30 days. After that, we delete the Workspace data and it may not be recoverable.
• Payment records: Retained as required by applicable financial regulations (typically 7 years).
• Compliance confirmation records: Records of confirmations you make (for example the no-patient-information confirmation for referral data, visit-location notice acknowledgements, and pilot request confirmations) are retained as compliance evidence and are not removed when you delete an account or workspace.
• Pilot workspaces: After a pilot ends, a Workspace Owner may request an export within 30 days; after that we delete the workspace data.

Cancelling a subscription or letting it lapse does not by itself delete your account or data. Workspace Owners may request a complete export or deletion of their Workspace data at any time. You may also delete your account via Profile → Delete Account in the app. Contact support@liaisoniq.app with any data deletion requests.

7. HIPAA & PHI Statement

liaisonIQ is a B2B relationship management tool and is not an electronic health record. It is not designed to store patient-level Protected Health Information (PHI) as defined under HIPAA, and liaisonIQ is not a HIPAA business associate. No Business Associate Agreement (BAA) is in place for standard plans or pilots.

Users are prohibited from entering, uploading, connecting, pasting, or attaching patient names, dates of birth, contact details, medical record or insurance numbers, diagnoses, Social Security numbers, or any other patient-identifying information anywhere in the Service, including free-text fields, notes, imports, files, photos or screenshots, and AI prompts. We may delete suspected PHI without notice. If you submit patient information by mistake, tell us promptly at support@liaisoniq.app. See also Section 9 of our Terms of Service. For enterprise clients requiring a BAA, please contact our legal team.

8. Rights Under GDPR and CCPA

Depending on your location, you may have the following rights:

• Access your data: Profile → Export My Data (JSON export of your profile, clinics, visits, chat history, referrals, expenses, route plans, tasks, and related activity).
• Delete your account and data: Profile → Delete Account (type "DELETE" to confirm; permanent and irreversible).
• Correct inaccurate information: Update in Profile settings at any time.
• Opt out of marketing emails: Unsubscribe link in any marketing email, or update preferences in Profile settings.
• CCPA (California residents): We do not sell personal information. You have the right to know what categories of personal information we collect and how they are used. We do not discriminate against you for exercising any of these rights.
• GDPR (EU/UK residents): You have the right to data portability, the right to restrict processing, and the right to object to processing based on legitimate interests. You may lodge a complaint with your local supervisory authority.

To exercise your rights, contact us at support@liaisoniq.app or use Profile → Contact Support in the app.

7a. California Privacy Details

In the past 12 months we have collected the following categories of personal information, as described under Information We Collect: identifiers (name, email, IP address, device identifiers); customer and account records; commercial information (subscription status); internet and app activity (usage, AI interactions); professional information (company, role, territories); geolocation (approximate location from IP; precise device location while you use live route navigation; and visit check-in and check-out locations only if your Workspace Owner enables sharing and you choose to share); audio information (voice notes, transcribed and not stored); and inferences generated by AI features for your account.

Sensitive personal information: account log-in credentials and, where you choose to share it, precise geolocation. We use these only to provide the Service, secure it, and meet legal obligations, and not to infer characteristics about you.

We collect this information from you, from your Workspace Owner, from your devices, and from the third-party services listed under Third-Party Services. We disclose it for business purposes to the service providers listed there. We retain it as described under Data Retention.

To make a request to know, delete, or correct, email support@liaisoniq.app or use the in-app tools under Your Rights. We may need to verify your identity by matching information to your account. You may use an authorized agent, and we may ask for written proof of their authority. We respond within 45 days and may extend once by another 45 days, and we will tell you if we do. If we decline, you can appeal by replying to our response.

7b. Other U.S. State Privacy Rights

Residents of states with comprehensive privacy laws (such as Colorado, Connecticut, Virginia, Texas, Oregon, and others) may have the right to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of the sale of personal data, targeted advertising, and profiling that produces legal or similarly significant effects. We do none of those three. Use the contacts under Your Rights. If we deny a request, you may appeal by replying to our response; if the appeal is denied, you may contact your state attorney general.

7c. Canada

If you are in Canada, we handle personal information in line with applicable privacy law, including PIPEDA and provincial laws. Our purposes are described in this policy, you may access or correct your information and withdraw consent as described under Your Rights, and your information is processed in the United States, where it may be accessible to U.S. courts and authorities under local law. Questions or complaints can be sent to support@liaisoniq.app.

9. Data Breach Notification

In the event of a data breach that affects your personal information, we will notify you without undue delay — and in any case within 72 hours of becoming aware of the breach — to the extent required by applicable law (including GDPR Article 33 and applicable US state breach notification laws).

Notification will be provided via the email address associated with your account. The notification will include: the nature of the breach, the categories of data affected, the likely consequences, and the measures we are taking to address the breach. Some breach notifications may be delayed if required by law enforcement.

10. International Data Transfers

Your data may be processed in the United States or other regions where our service providers operate. By using the Service, you consent to such transfers.

For users in the European Economic Area (EEA) or United Kingdom: we transfer personal data to the US and other countries that may not provide the same level of data protection as your home country. Where required, we rely on adequacy decisions or Standard Contractual Clauses (SCCs) approved by the European Commission to safeguard such transfers.

11. Cookies and Analytics

The liaisonIQ mobile app does not use browser cookies, and we do not use third-party advertising or behavioral-analytics SDKs in the app. Firebase Authentication (Google) is used to sign you in. If you use the LiaisonIQ web app, it keeps your sign-in session and preferences in your browser's local storage, which is needed for the app to work. Our marketing website and web app do not use advertising or third-party analytics cookies or trackers. Usage and diagnostic information, such as audit logs and AI call metadata, is logged on our own servers as described in this policy.

9c. Do Not Track and Global Privacy Control

Our website and app do not use advertising or cross-site tracking technologies, so there is nothing to opt out of. Where our site receives a Global Privacy Control signal or a "Do Not Track" setting, we treat it as an opt-out request and our practices do not change.

12. Children

liaisonIQ is not intended for users under 18. We do not knowingly collect personal information from children under 18. If we learn that we have collected personal information from a child under 18, we will promptly delete it. If you believe we have collected information from a minor, please contact us at support@liaisoniq.app.

11a. Automated Decisions and Third-Party Links

AI features generate suggestions such as routes, visit prep, and summaries. We do not make decisions about you that have legal or similarly significant effects solely by automated means.

The Service may link to third-party websites, maps, and services. We do not control them and this policy does not apply to them. Review their privacy policies before using them. Use of Google Maps features is also subject to the Google Privacy Policy (https://policies.google.com/privacy).

13. Changes to this Policy

We may update this Privacy Policy to reflect changes in our practices or for legal reasons. For material changes, we will provide at least 30 days' advance notice via in-app notification or the email address associated with your account. Continued use after changes constitutes acceptance of the updated policy.

14. Contact

Questions or privacy requests? Contact us at support@liaisoniq.app or use Profile → Contact Support in the app.

NexReach, LLC d/b/a LiaisonIQ
2501 Chatham Rd # 6587
Springfield, IL 62704
Phone: 630-866-8260