Privacy.

Aevox is a product of Funspan LLC (“Aevox,” “we,” “us”). This policy explains what we collect, why, and what your options are. It applies to aevox.health and the Aevox interpretation pipeline.

1. What we collect

• Contact information you submit. If you email us or fill in a form (pilot application, sample-report request, FAQ question), we receive your email address and whatever you put in the message.
• Athlete test data, in pilot deployments. When a clinical partner uses Aevox in production, we process the breath-by-breath CSV and any athlete identifiers the cart writes into it. This is Protected Health Information (PHI) and is handled under a signed Business Associate Agreement (BAA).
• Anonymous site analytics. We use Vercel Analytics (cookieless, IP-anonymized) to understand which pages visitors read and to find broken links. No personally identifiable information is stored.

2. What we do not collect

• No tracking cookies, no third-party advertising pixels, no session-replay tools.
• No fingerprinting (browser, hardware, IP geolocation beyond country-level for analytics).
• No selling, renting, or sharing of personal data with third parties for marketing.

3. How we use information

• To respond to you when you contact us.
• To produce CPET interpretation reports for our clinical partners.
• To improve the product (aggregate, de-identified usage patterns only).

4. PHI handling for clinical partners

Athlete test data is processed in-region (US-based infrastructure), encrypted in transit (TLS 1.3) and at rest (AES-256), and is never used to train shared models or improve other partners' output. Each partner's data is logically isolated. Backups are encrypted and retained per the BAA terms.

5. Data retention

• Marketing-site contact submissions: 24 months, then deleted unless an active relationship exists.
• Athlete test data (clinical pilots): retained per the partner's data-retention policy and the signed BAA.
• Anonymous analytics: aggregated; raw events expire within 30 days.

6. Your rights

You can request a copy of any personal data we hold about you, or ask us to delete it, by emailing jack@aevox.health. We respond within 30 days. Athletes whose test data is processed under a clinical BAA should direct requests to the clinic — we are a downstream processor.

7. Subprocessors

We use the minimum-viable set of trusted infrastructure:

• Vercel — hosting and edge compute
• Vercel Analytics — anonymous site analytics

Subprocessor changes are announced at least 30 days in advance to clinical partners.

8. Children

The marketing site is not directed at children under 13. Pediatric athlete test data may be processed under a clinical BAA — handling is governed by the partner clinic's policies and applicable law.

9. Changes

We'll post a changelog at the top of this page when we update material terms, and notify clinical partners directly.

10. Contact

Questions or requests: jack@aevox.health. Funspan LLC operates Aevox; the registered entity is reachable at the same address.