The Neurodivergent Nexus ("Nexus," "we," "our") is a neuroaffirming wellness and support platform operated by Next Steps to Thrive, LLC. We provide tools for self-advocacy, wellness tracking, document analysis, and community connection for neurodivergent individuals and their families.
Contact: info@NDNexus.com
We collect only the information you choose to provide. Nothing is collected automatically except basic analytics (if you consent).
Account Information
Email address, phone number (for OTP login), and display name. We support OAuth login via Google, Apple, Facebook, and Microsoft. We receive only your name and email from these providers.
Health & Wellness Data (Voluntary)
If you use our wellness features (Radar Scan, Beacon, Prism), you may voluntarily provide: mood/energy check-ins, self-assessment responses, therapy tracking notes, IEP/insurance/waiver information, and crisis support intake data. This data is considered protected and is handled with HIPAA-level safeguards.
AI Interaction Data
When you use AI features (Beacon chat, Prism document analysis, Radar Constellation), your inputs are sent to Google Gemini for processing. We do not store AI conversation history beyond what you explicitly save to your Orbit vault.
Usage Analytics
With your consent, we use HubSpot analytics to understand how the platform is used. This data is anonymized and does not include health information.
Your data is used to:
Provide personalized wellness insights and recommendations; generate AI-powered document analysis and action plans; track your therapy, IEP, and insurance progress; connect you with relevant experts and resources in our directory; improve platform functionality (with anonymized analytics only); and communicate platform updates if you opt in.
We never sell your data. We never use your health data for advertising. We never share identifiable health information with third parties except as described below.
We use the following services to operate the platform. Each processes only the minimum data required for their function:
Supabase (Database & Authentication)
Stores all user data with Row-Level Security. Data is encrypted in transit (TLS 1.2+) and at rest. Based in the US. We are pursuing a Business Associate Agreement (BAA) with Supabase.
Google Gemini AI (AI Processing)
Processes your queries and documents when you use AI features. Google's API terms state that data sent via API is not used to train their models. Data is encrypted in transit.
HubSpot (CRM & Analytics)
If you consent to analytics, basic usage data and contact information may be synced to HubSpot for customer relationship management.
Vercel (Hosting)
Our application is hosted on Vercel. They process requests and may log IP addresses for security. Data is encrypted in transit via HTTPS.
Google Maps (Location Services)
If you use our expert/location finder, your search area (not exact location) is sent to Google Maps to display results.
We implement the following safeguards to protect your data:
All data transmitted over HTTPS with TLS 1.2+ encryption; Row-Level Security (RLS) ensuring you can only access your own records; 15-minute idle session timeout with automatic logout; comprehensive audit logging of all health data access; Content Security Policy headers preventing cross-site scripting; IP address masking in logs; and regular security reviews.
You have the right to:
Access: Download all your data at any time via Settings → Export My Data. Delete: Request deletion of some or all of your data. We will process requests within 30 days. Consent: Grant or revoke consent for specific types of data processing at any time via the consent preferences in Settings. Portability: Export your data in JSON format for use with other services. Correct: Update or correct any information in your profile at any time.
To exercise any of these rights, go to Settings in your dashboard or email us at info@NDNexus.com.
We retain your data for as long as your account is active. If you request deletion, we will permanently remove all identifiable data within 30 days. Anonymized, aggregated data may be retained for platform improvement. Audit logs are retained for a minimum of 6 years per HIPAA requirements.
We take extra precautions with data from users under 18. Our Signal Flare crisis support feature requires explicit parental/guardian consent for users under 13 (COPPA compliance). We do not knowingly collect data from children under 13 without guardian consent.
In the event of a data breach involving your health information, we will notify affected users within 72 hours via email and in-app notification, consistent with HIPAA breach notification requirements (§164.404).
We may update this policy as our practices evolve. Significant changes will be communicated via in-app notification and will require re-consent for any new data processing activities. The "Effective" date at the top indicates the latest revision.
For privacy questions, data requests, or concerns:
Next Steps to Thrive, LLC
Email: info@NDNexus.com