Privacy policy

This Privacy Policy explains how Rekall Industries Limited ("Rekall", "we", "us" or "our") collects, uses, shares and protects personal information through the VAKT Enterprise service and the website at vaktenterprise.com.

1. Scope

In this policy:

• "Service" means VAKT Enterprise, including VAKT nodes and hubs, the VAKT cloud platform, the VAKT Enterprise mobile apps, and related support.
• "Website" means vaktenterprise.com and its pages.
• "Customer" means a hospital, senior living community, long-term care provider or other organization that has an agreement with us to use the Service.
• "Authorized User" means a member of a Customer's staff who has been invited to use the Service.

This policy does not cover the privacy practices of our Customers. Each Customer is responsible for its own notices to residents, patients, families and staff about how it uses the Service.

2. Our role

When a Customer uses the Service, the Customer decides what information is collected about its residents, patients and staff and how that information is used. We process that information on the Customer's behalf and in line with our agreement with the Customer. In that role we act as a service provider (and, where HIPAA applies, as a business associate) to the Customer.

If you are a resident, patient or family member and have a question or request about information held in the Service, please contact the facility first. We will support the facility in responding.

For information collected through the Website, and for the business contact details of people who deal with us, Rekall decides how that information is used.

3. Information we collect through the Website

• Information you submit in our request form: your name, job title, organization, work email, phone number, state, facility type, approximate number of rooms, the topic of your enquiry and your message.
• Information you send us by email or provide in calls and meetings, such as your contact details and the content of your communications.
• Technical information that our hosting provider records automatically when you visit, such as your IP address, browser type, device type, the pages you request and the date and time of your visit. This is used to deliver, secure and troubleshoot the Website.

The Website does not use advertising cookies, analytics cookies or third-party tracking technologies.

4. Information processed by the Service

The Service processes the following information on behalf of Customers:

• Authorized User account information: name, email address, sign-in credentials, the organization and facilities the user belongs to, and the user's role.
• Organization and facility information: organization and facility names, room identifiers and the location of each node within a facility.
• Room-level activity information: alerts, events, presence and movement status, periods of inactivity, and breathing and heart rate readings, each linked to a room rather than to a named person.
• Calls for help: records of physical and voice calls for help raised through the Service.
• Alert handling records: when an alert was raised, delivered, acknowledged, escalated and resolved, and by which Authorized User.
• Device and system information: node and hub identifiers, firmware versions, connection status, signal quality, diagnostic logs and error reports.
• Resident or patient names, only where a Customer chooses to enter them into the Service.
• Questions and requests that Authorized Users submit through the Insights add-on, and the summaries generated in response.
• Support communications between Customers or Authorized Users and our team.

5. Information we do not collect

• The Service does not capture or record video or images.
• The Service does not record or store the audio of a room. Where a voice call for help is supported, it is used only to raise the call.
• Raw wireless signal data is processed within the Customer's facility and is not sent to our cloud platform.
• The Service does not track the location of individuals and does not require residents or patients to wear or carry any device.

6. How we use information

We use information to:

• provide, operate and maintain the Service, including detecting events and delivering alerts and notifications to Authorized Users;
• produce the dashboards, reports and Insights that a Customer has subscribed to;
• monitor device and system health, diagnose faults, and deliver firmware and software updates;
• keep the Service and the Website secure, and detect, investigate and prevent fraud, misuse and security incidents;
• provide customer support and communicate with Customers and Authorized Users about the Service;
• improve the accuracy and reliability of the Service, using data that has been de-identified or aggregated where practicable and always within the limits of our agreements with Customers;
• respond to Website enquiries and arrange demonstrations and pilots;
• comply with legal obligations and enforce our agreements.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use information from the Service for advertising of any kind.

7. Insights add-on

If a Customer subscribes to Insights, the Service uses AI models to analyze the Customer's alert and event records and to answer questions and write summaries for Authorized Users. Insights works from room-level records and does not require resident or patient names.

Insights is processed by us or by service providers acting on our behalf under contract. We do not permit those service providers to use Customer information to train their own models. Confirm where Insights processing runs and update this paragraph if needed.

Insights output is provided to support operational review. It is not clinical advice and should not be relied on for diagnosis or treatment decisions.

8. How we share information

We share information only as follows:

• With service providers who host and operate our systems on our behalf, under contracts that limit their use of the information to providing services to us. These include Google Cloud (Service hosting and data storage), Apple and Google (delivery of push notifications to the VAKT Enterprise apps) and Netlify (Website hosting and form handling).
• With the Customer whose facility or account the information relates to.
• With third parties that a Customer directs us to connect the Service to, such as a messaging, paging or notification provider.
• With our professional advisers, such as lawyers, auditors and insurers, under duties of confidentiality.
• Where required by law, regulation, subpoena or court order, or where we believe disclosure is necessary to protect the safety of any person.
• With a buyer or successor in connection with a merger, acquisition, financing or sale of all or part of our business, subject to this policy and our agreements with Customers.
• With your consent or at your direction.

9. Health information and HIPAA

Some information processed by the Service, such as breathing and heart rate readings linked to a room, may be protected health information when it is held by a Customer that is subject to HIPAA. Where a Customer is a covered entity or business associate under HIPAA, we will enter into a business associate agreement with the Customer and handle protected health information in accordance with that agreement and applicable law.

VAKT is a wellness and activity monitoring system. It is not a medical device and is not intended to diagnose, treat or prevent any condition, or to replace clinical judgment.

10. Where information is stored

Service information is stored and processed on Google Cloud in the United States. Where a Customer chooses a fully on-site deployment, Service information is stored and processed on systems within the Customer's own facility, and the Customer controls the infrastructure that stores it.

The Service and Website are intended for use in the United States. If you access the Website from outside the United States, your information will be processed in the United States.

11. How we protect information

We use administrative, technical and physical safeguards designed to protect information appropriately for its sensitivity. These include:

• processing raw signal data on site so that it never leaves the facility;
• a private network for VAKT nodes that is separate from the Customer's own network;
• cryptographically signed firmware that nodes verify before installing;
• encryption of information in transit and at rest;
• separation of each Customer's data and access controls that limit Authorized Users to their own organization and facilities;
• invitation-only access to the Service; and
• an information security management system designed in line with ISO 27001.

No system is completely secure. If we become aware of a security incident affecting personal information, we will notify affected Customers and, where required, individuals and regulators, as required by law and by our agreements.

12. How long we keep information

• Website enquiries and business contact information: for as long as needed to respond and maintain our business relationship, and generally no more than 24 months after our last contact with you.
• Authorized User account information: for as long as the account is active, and deleted within 90 days after the account is closed, unless the Customer asks us to keep it longer.
• Service information: for the term of our agreement with the Customer. At the end of the agreement, we delete or return Service information within 90 days, as the agreement provides.
• Technical and security logs: for up to 12 months, unless needed longer to investigate an incident.
• Backups: deleted information is removed from backups as they are overwritten in the normal cycle.

We may keep information longer where the law requires it or where it is needed to resolve a dispute or enforce our agreements.

13. Your choices and rights

Depending on the state where you live, you may have rights under state privacy laws to:

• know what personal information we hold about you and obtain a copy;
• correct inaccurate personal information;
• delete personal information;
• opt out of the sale of personal information, targeted advertising or certain profiling (we do not do any of these); and
• appeal a decision we make about your request.

To make a request about information collected through the Website or in our business dealings with you, email office@rekallindustries.com. We will verify your request before acting on it and respond within the time required by law. You may use an authorized agent to make a request on your behalf, and we may ask the agent for proof of authority. If we decline your request, you may appeal by replying to our decision, and we will respond to your appeal in writing.

For information held in the Service on behalf of a Customer, please contact the facility. If we receive a request directly, we will refer it to the Customer and help the Customer respond.

We will not discriminate against you for exercising your privacy rights.

You can opt out of marketing emails at any time by using the unsubscribe link in the email or by contacting us. We will still send messages needed to provide the Service.

14. Cookies and browser signals

The Website does not use advertising or analytics cookies. Because we do not sell personal information or use it for targeted advertising, there is nothing for a Global Privacy Control or Do Not Track signal to switch off, but we honor Global Privacy Control signals as an opt-out request where the law requires.

15. Children

The Website and the VAKT Enterprise apps are intended for businesses and their staff, and are not directed to children under 13. We do not knowingly collect personal information from children through the Website or apps. Information about residents or patients of any age that a Customer processes through the Service is handled as described in this policy and in our agreement with the Customer.

16. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page with a new effective date. If we make material changes, we will notify Customers in advance by email or through the Service.

17. Contact us

If you have questions about this policy or our privacy practices, contact us at:

Rekall Industries Limited
Attn: Privacy
1442 Pottstown Pike #3135
West Chester, PA 19380
office@rekallindustries.com