Privacy.

Aevox is a product of Funspan LLC (“Aevox,” “we,” “us”). This policy explains what we collect, why, and what your options are. It applies to aevox.health and the Aevox interpretation pipeline.

1. What we collect

• Contact information you submit. If you email us or fill in a form (pilot application, sample-report request, FAQ question), we receive your email address and whatever you put in the message.
• Athlete test data, in pilot deployments.When a clinical partner uses Aevox in production, we process the breath-by-breath CSV and any athlete identifiers the cart writes into it. We treat this as sensitive health information: research analytics are de-identified to the HIPAA Safe Harbor standard before storage, and identified report data is stored separately, encrypted, and shared onward only at the athlete's direction with recorded consent.
• Anonymous site analytics. We use Vercel Analytics (cookieless, IP-anonymized) to understand which pages visitors read and to find broken links. No personally identifiable information is stored.

2. What we do not collect

• No tracking cookies, no third-party advertising pixels, no session-replay tools.
• No fingerprinting (browser, hardware, IP geolocation beyond country-level for analytics).
• No selling, renting, or sharing of personal data with third parties for marketing.

3. How we use information

• To respond to you when you contact us.
• To produce CPET interpretation reports for our clinical partners.
• To improve the product (aggregate, de-identified usage patterns only).

4. Health-data handling for clinical partners

Athlete test data is processed in-region (US-based infrastructure), encrypted in transit and at rest, and is never used to train shared models or improve other partners' output. Each partner's data is logically isolated.

Business Associate Agreements.We do not currently operate under BAAs with our infrastructure subprocessors. Our architecture is designed to minimize the identified data we hold: research analytics are de-identified (HIPAA Safe Harbor) with server-side enforcement, and identified reports move to athletes only by the athlete's own authorized action. Partners whose compliance program requires a formal BAA chain should contact us before onboarding — we'll walk through the current posture and the BAA-ready deployment roadmap.

5. Data retention

• Marketing-site contact submissions: 24 months, then deleted unless an active relationship exists.
• Athlete test data (clinical pilots): retained per the partner's data-retention policy and our written agreement with the clinic.
• Anonymous analytics: aggregated; raw events expire within 30 days.

6. Your rights

You can request a copy of any personal data we hold about you, or ask us to delete it, by emailing jack@aevox.health. We respond within 30 days. Athletes whose test data we process on behalf of a clinic should direct requests to the clinic — we are a downstream processor.

7. Subprocessors

We use the minimum-viable set of trusted infrastructure:

• Vercel — hosting and edge compute
• Vercel Analytics — anonymous site analytics
• Neon (via Vercel Postgres) — encrypted database storage for the interpretation pipeline
• Clerk — clinician authentication
• Anthropic — AI-assisted threshold detection on de-identified physiological payloads

Subprocessor changes are announced at least 30 days in advance to clinical partners.

8. Children

The marketing site is not directed at children under 13. Pediatric athlete test data may be processed on behalf of a partner clinic — handling is governed by the clinic's policies and applicable law.

9. Changes

We'll post a changelog at the top of this page when we update material terms, and notify clinical partners directly.

10. Contact

Questions or requests: jack@aevox.health. Funspan LLC operates Aevox; the registered entity is reachable at the same address.