Privacy Policy

This policy explains how the Nexus program (Windows) and the Nexus app (Android) collect, use and protect data. Nexus is a system for managing medical equipment, calibration results and repair requests for hospitals and public-health organizations that are customers of CPM Medical Support.

User accounts

All accounts are created by CPM Medical Support or your organization's administrator. There is no self-registration in the app. You sign in with the username and password you were given.

Data we collect

• Account data: username, display name, profile picture (if set), role, organization, and your password stored only as a one-way hash (it cannot be read back).
• Data you enter: medical equipment registry (name, brand, model, serial number, department, purchase and warranty details), calibration results, repair requests and attached photos.
• Chat messages: messages and images sent in the system's chat rooms.
• Device notification token: used to deliver chat and repair notifications to your device through Google Firebase Cloud Messaging.
• Security data: login session identifiers and a counter of failed sign-in attempts (used to temporarily lock an account under password guessing).

The app does not collect your location or contacts, shows no ads, and does not sell your data.

AI assistant in the app

If you use the in-app AI assistant, the text you type and the equipment data relevant to your question are sent through our server to our AI provider (Anthropic) solely to generate a reply. We do not use this data for advertising. Please do not enter sensitive personal information or unrelated data in the assistant.

Permissions and why

• Camera: to scan equipment QR codes/barcodes and take photos for records. Codes are read on your device; photos you do not send are not uploaded.
• Notifications: to alert you about new chat messages and repair requests.
• Background service: keeps a connection open to receive messages in real time while the app is in the background (Android shows a persistent notification icon).
• Internet: to sync data with the server.

Storage and service providers

• Data is stored in the cloud on Supabase (database and sync). Data in transit between your device and the server is encrypted with HTTPS.
• Notifications are delivered through Google Firebase Cloud Messaging.
• Access rules limit each user to their own organization's data (authorized CPM staff can see the organizations they support).
• Deleted equipment is kept in the system trash for 90 days before permanent deletion. Other data is kept while your account and organization use the service, or as needed under your agreement with CPM.

Your rights and deletion

You may request access to, correction of, or deletion of your account and related data by contacting your organization's administrator or CPM Medical Support using the details below. We will act within a reasonable time, unless we are required by law or contract to retain the data.

Children

This system is intended for staff use and is not directed at children.

Changes to this policy

If we make material changes, we will update the effective date on this page.

Contact