Privacy Policy

The Neurodivergent Nexus ("Nexus," "we," "our") is a neuroaffirming wellness and support platform operated by Next Steps to Thrive, LLC. We provide tools for self-advocacy, wellness tracking, document analysis, and community connection for neurodivergent individuals and their families.

Contact: info@NDNexus.com

We collect only the information you choose to provide. Nothing is collected automatically except basic analytics (if you consent).

Your data is used to:

Provide personalized wellness insights and recommendations; generate AI-powered document analysis and action plans; track your therapy, IEP, and insurance progress; connect you with relevant experts and resources in our directory; improve platform functionality (with anonymized analytics only); and communicate platform updates if you opt in.

We never sell your data. We never use your health data for advertising. We never share identifiable health information with third parties except as described below.

We use the following services to operate the platform. Each processes only the minimum data required for their function:

We implement the following safeguards to protect your data:

All data transmitted over HTTPS with TLS 1.2+ encryption; Row-Level Security (RLS) ensuring you can only access your own records; 15-minute idle session timeout with automatic logout; comprehensive audit logging of all health data access; Content Security Policy headers preventing cross-site scripting; IP address masking in logs; and regular security reviews.

You have the right to:

Access: Download all your data at any time via Settings → Export My Data. Delete: Request deletion of some or all of your data. We will process requests within 30 days. Consent: Grant or revoke consent for specific types of data processing at any time via the consent preferences in Settings. Portability: Export your data in JSON format for use with other services. Correct: Update or correct any information in your profile at any time.

To exercise any of these rights, go to Settings in your dashboard or email us at info@NDNexus.com.

We retain your data for as long as your account is active. If you request deletion, we will permanently remove all identifiable data within 30 days. Anonymized, aggregated data may be retained for platform improvement. Audit logs are retained for a minimum of 6 years per HIPAA requirements.

We take extra precautions with data from users under 18. Children under 13 do not get their own Neurodivergent Nexus accounts and cannot sign up by themselves. Instead, a parent or guardian with an adult account can add them as a child profile, consistent with the Children's Online Privacy Protection Act (COPPA).

How child profiles work.A child profile belongs to the parent's account and has no email address, phone number, password or username of its own. The parent chooses a first name or nickname, a preset picture avatar, an age range (4 to 6, 7 to 9 or 10 to 12) and which features the child can use. The child uses their profile only on the parent's own signed-in device in "kid mode," which the parent starts and which keeps the app inside a separate kid space until the parent types their PIN. Child profiles cannot send or receive direct messages and cannot contact teens or adults.

What we store for a child profile.The name or nickname, avatar, age range and feature choices the parent set; what the child saves in the kid tools (for example routines, schedules, games, calm-corner and feelings check-ins); if the parent turns them on, the child's conversations with Beacon in kid-safe mode (including any messages Beacon flags for the parent), the preset replies the child picks in the moderated kids-only community area (children cannot type free text there), and the child's "My IEP voice" answers, which appear in the parent's IEP Meeting Prep; and an activity log (such as when kid mode started and ended). Everything is stored under the parent's account and the parent can see it, except that we may withhold specific messages during a child-safety review when a concern may involve a caregiver (see "Child safety" below). The parent's kid-mode PIN is stored only as a scrambled (hashed) value. We do not use a child's information for advertising, and we do not share it except with the service providers that run the platform (and, for Beacon, the AI provider that generates replies) and, when we suspect a child is being abused or neglected, with child protective services or law enforcement as described below.

Earlier consent records.Before child profiles, a user under 13 could ask a parent to approve their own account by email. We no longer accept new requests. For requests already on file we keep the parent's email address, whether consent was approved or declined, the date and time, and the IP address and browser (user agent) used for the decision, plus only a scrambled (hashed) version of the link code. If a request was declined or expired, we remove the parent's email address from it after 30 days.

Parent permission for direct messages.Members under 18 can only send direct messages to people whose birthday is within 3 years of theirs. A member aged 13 to 17 (never a younger child, and never the other person) can ask a parent or guardian to allow messaging one specific member anyway. We email the parent a single-use link that expires after 72 hours, showing the other member's display name and username and roughly how far apart their ages are (never a date of birth). If the parent approves, we send a confirmation with a link to withdraw permission at any time. For each request we store the two members involved, the parent's email address, the status (pending, approved, declined, withdrawn or expired), when the request was made and the IP address it came from, the time, IP address and browser used for the parent's decision, and only scrambled (hashed) versions of the link codes.

Parent rights. A parent can review everything saved for a child profile, change which features it can use, and delete the profile and all of its data at any time from Settings, then Kids. A parent or guardian can also review the information we hold about their child, ask us to delete it, or withdraw consent at any time by emailing info@NDNexus.com. Signal Flare crisis support also requires explicit parent or guardian consent for users under 13. If we learn that we have collected information from a child under 13 without parental consent, we will delete it.

Safety screening. Messages a child sends to Beacon in kid-safe mode, and posts that are reported in the kids-only community area, are screened automatically for signs that a child may be unsafe, such as talk of self-harm, abuse, someone hurting them, feeling unsafe at home, or an adult asking for secrets, meet-ups or pictures. When a concern is found, Beacon stops the conversation and gently tells the child to talk to a trusted grown-up, such as a parent, teacher or school counselor.

Urgent safety messages.If a child says something that suggests they may be in danger, such as talking about hurting themself or someone hurting them, Beacon directs them to emergency help (911, the 988 Suicide & Crisis Lifeline or the Childhelp hotline) and to a trusted grown-up right away, and we alert the parent in the app and by email. Alerts to the parent do not quote the child's words.

Concerns that may involve a caregiver.When a child's message suggests that a parent, caregiver or another adult in their home may be harming them, we do not notify the parent. Instead, we withhold those specific messages (and Beacon's reply to them) from the parent and our trust & safety team reviews them, usually within one business day. The team includes a licensed child psychologist who is a mandated reporter. Reviewers see only what they need to assess the concern: the flagged messages and the conversation around them, the child's nickname and age range, and the parent account's email address. Every review action is logged, and alerts sent to the team do not include the child's words or name. After review, the team may release the messages to the parent with the usual notice, or keep them withheld. Posts reported in the kids-only community area are also reviewed by the team.

Reporting. We report suspected child abuse or neglect to the appropriate child protective services agency or law enforcement as required by law (for example, the Georgia Division of Family and Children Services, DFCS), and we may share the relevant messages and account information with them.

Optional trusted adult.A parent may add one other trusted adult for each child (their name, relationship to the child and email address). We email that person a single-use link that expires after 72 hours to confirm. If our team is reviewing a concern, it may email a confirmed trusted adult asking them to contact our team; that email never includes the child's messages. The parent can remove the trusted adult at any time from Settings, then Kids.

Questions or concerns about a child's safety: trustandsafety@ndnexus.com. If a child is in immediate danger, call 911.

In the event of a data breach involving your health information, we will notify affected users within 72 hours via email and in-app notification, consistent with HIPAA breach notification requirements (§164.404).

We may update this policy as our practices evolve. Significant changes will be communicated via in-app notification and will require re-consent for any new data processing activities. The "Effective" date at the top indicates the latest revision.

For privacy questions, data requests, or concerns:

Next Steps to Thrive, LLC
Email: info@NDNexus.com