Privacy policy

Effective date: October 2, 2026
Last updated: October 2, 2026

Alpha Nodus, Inc. builds Gravity, an operations system for diagnostic imaging centers and radiology practices. Our Customers are healthcare providers, and much of the information that flows through Gravity is protected health information. This Privacy Policy explains what information we collect, how we use and share it, how we protect it, and the choices and rights you have.

1. Scope

This Privacy Policy applies to:

• The Services: the Gravity system and related applications, implementation, integration, and support services we provide to Customers.
• The Websites: alphanodus.com, jit.care, security.alphanodus.com, and other websites we operate that link to this policy.
• Other interactions with us: for example, sales and marketing communications, demos, events, support requests, and job applications.

What this policy does not cover

• Our Customers' own practices. Each Customer decides how it uses Gravity and the health information it puts into Gravity. To learn how your healthcare provider handles your information, see its Notice of Privacy Practices.
• Third-Party Services. Customers may connect Gravity to other products, such as a RIS, PACS, EHR, billing system, or payer portal. Information that a Customer sends to or receives from a Third-Party Service is subject to that provider's terms and privacy practices.
• Our contracts with Customers. Our Master Services Agreement or other written agreement with each Customer (the "MSA"), together with any BAA, governs how we process Customer Data. If this Privacy Policy conflicts with an MSA or BAA, the MSA or BAA controls for that Customer's data.

2. Key terms

• "Alpha Nodus," "we," "us," "our" means Alpha Nodus, Inc., a Delaware corporation.
• "Customer" means a healthcare provider or other organization that has an agreement with us to use the Services.
• "Authorized User" means a person a Customer allows to use the Services, such as an employee or contractor, through the Customer's account (the "Customer Instance").
• "Customer Data" means information that a Customer or its Authorized Users submit to the Services, or that the Services receive on the Customer's behalf (for example, through integrations or implementation services). Customer Data includes PHI.
• "PHI" means protected health information as defined by HIPAA.
• "Personal Data" means information that identifies, relates to, or can reasonably be linked to an individual or household.
• "Other Personal Data" means Personal Data that we collect or receive other than Customer Data. Examples include account details, website analytics, support communications, and business contact information. Alpha Nodus decides how Other Personal Data is used.

Our role: For Customer Data, we act on behalf of the Customer as a service provider (and, for PHI, as a business associate). For Other Personal Data, we decide how the information is used (we act as a "business" or "controller" under applicable state privacy laws).

3. Protected health information and HIPAA

Our role

Alpha Nodus, Inc. ("Alpha Nodus," "we," "us") provides Gravity, a system used by imaging centers, radiology practices, and other healthcare providers (each, a "Customer"). Our Customers are "covered entities" under the Health Insurance Portability and Accountability Act of 1996, the HITECH Act, and their implementing regulations (together, "HIPAA").

When Gravity creates, receives, maintains, or transmits protected health information ("PHI") on behalf of a Customer, Alpha Nodus acts as that Customer's business associate. We do so under a written Business Associate Agreement ("BAA") with each Customer.

What governs PHI

Our use and disclosure of PHI is governed by HIPAA and the applicable BAA. It is not governed by the general collection, use, and sharing provisions of this Privacy Policy. If anything in this Privacy Policy conflicts with a BAA or with HIPAA, the BAA and HIPAA control.

How we use and disclose PHI

We use and disclose PHI only as permitted or required by the BAA and HIPAA, including:

• To provide Gravity to the Customer. For example, to process referrals and orders, verify eligibility, prepare cost estimates and prior authorization requests, schedule and remind patients, and support check-in and registration.
• For our proper management and administration, and to carry out our legal responsibilities, where the BAA permits.
• For data aggregation services relating to the Customer's healthcare operations, where the BAA permits.
• To create de-identified data, only where the BAA permits, and only using HIPAA's de-identification standard (45 C.F.R. § 164.514(b)). See De-identified data below.
• As required by law.

We apply HIPAA's minimum necessary standard to our uses and disclosures of PHI.

What we don't do with PHI:

• We do not sell PHI.
• We do not use or disclose PHI for marketing.
• We do not use identifiable PHI to train artificial intelligence models.
• We do not voluntarily disclose PHI to law enforcement or government agencies. If we receive a legal demand for PHI, we refer the requester to the Customer where the law allows, and we notify the Customer unless the law prohibits it.

Subcontractors

Any subcontractor that creates, receives, maintains, or transmits PHI for us (for example, cloud hosting, communications, or AI service providers) must first sign a business associate agreement. That agreement imposes restrictions and safeguards at least as protective as our BAA with the Customer. Our current list of subprocessors is available at security.alphanodus.com.

Artificial intelligence and PHI

Some Gravity features use artificial intelligence, including large language models, to process PHI for the Customer. When they do:

• AI processing is part of providing Gravity to the Customer and follows the BAA.
• Third-party AI providers that process PHI do so under business associate agreements. Those agreements prohibit them from using PHI to train or improve their models and limit how long they may keep it.
• We may use de-identified data to train and improve Gravity's AI features, but only where the BAA permits and only after de-identification under HIPAA (see below).

De-identified data

Where a Customer's BAA permits, we may de-identify PHI using HIPAA's Safe Harbor or Expert Determination method (45 C.F.R. § 164.514(b)). Once de-identified, the information is no longer PHI. We use de-identified data only to operate, secure, improve, and develop our services, including training Gravity's AI features, and to produce aggregate benchmarks and statistics. We:

• do not attempt to re-identify de-identified data
• contractually prohibit anyone we share it with from re-identifying it
• do not sell de-identified data derived from PHI

Safeguards

We maintain administrative, physical, and technical safeguards that meet the HIPAA Security Rule. These include encrypting PHI in transit (TLS) and at rest, managing encryption keys with AWS Key Management Service, role-based access controls, audit logging, workforce training, and regular third-party penetration testing. More detail is on our Trust Center.

Breach notification

If we discover a breach of unsecured PHI, we notify the affected Customer without unreasonable delay, as required by HIPAA (45 C.F.R. § 164.410) and within any shorter period set out in the BAA. The Customer, as the covered entity, is responsible for notifying affected individuals, regulators, and the media where required. We support the Customer in doing so.

When a Customer relationship ends

When a BAA ends, we return or destroy the Customer's PHI as the BAA requires. If return or destruction isn't feasible (for example, for data in backups that expire on a fixed schedule), we keep protecting that PHI under the BAA and limit any further use or disclosure.

Information for patients

If you are a patient, your healthcare provider controls your health information, not Alpha Nodus. Gravity screens, forms, emails, and text messages you receive about your appointment, estimate, or registration are sent on behalf of your healthcare provider.

• To access, correct, or get a copy of your health information, to ask for restrictions or confidential communications, or to request an accounting of disclosures, please contact your healthcare provider directly.
• Your provider's Notice of Privacy Practices explains how your health information may be used and shared, and the rights you have.
• If you contact us about your health information, we will verify the request where appropriate and forward it to your provider. We will also assist your provider in responding, as our BAA requires.

Minors

Customers may use Gravity to process PHI about patients of any age, including minors. That information is protected under HIPAA and the applicable BAA in the same way as all other PHI.

Questions

Questions about how we handle PHI can be sent to the contacts in Section 18.

4. Information we collect

This section describes Other Personal Data. Customer Data, including PHI, is described in Section 3 and in our agreements with Customers.

Information you provide

• Account information. When an account is created for you, by you or by your organization, we collect your name, work email address, phone number, job title, organization, and login credentials.
• Billing information. When a Customer purchases Services, we (or our payment processors) collect billing contact details, billing address, and payment information. We do not store full payment card numbers.
• Communications and support. When you contact us, request a demo, attend an event, or submit a support ticket, we collect the information you provide and our correspondence with you. With notice, we may record sales, implementation, or support calls.
• Text message preferences. These are your mobile number and your opt-in and opt-out choices (see Section 9).

Information collected automatically

• Services usage information. This is how Authorized Users interact with the Services, such as features used, actions taken, timestamps, and settings. It does not include the contents of Customer Data.
• Log and device information. This covers IP address, browser type and settings, operating system, device type, referring and exit pages, dates and times of access, language preferences, and crash and diagnostic data.
• Approximate location. This is a general location (city, state, or country) inferred from IP address or a business address. We do not collect precise geolocation.
• Cookies and similar technologies. See Section 10.

Information from other sources

• Your organization. A Customer may give us your information so we can set up your account.
• Public sources and business data providers. We collect business contact and professional information about healthcare professionals and organizations, for example from the NPPES National Provider Identifier (NPI) Registry, state licensing records, company websites, and commercial business-data vendors. We use this for B2B sales and marketing and to help Customers identify referring providers. This may include name, credentials, specialty, NPI, practice locations, affiliations, and business contact details. We do not sell this information.
• Partners. Channel and integration partners may refer prospects to us or share information about joint Customers. They do so according to their own privacy practices and our agreements with them.

5. How we use information

We use Other Personal Data to:

• Provide and support the Services. This includes creating and managing accounts, authenticating users, delivering features, responding to support requests, and providing implementation services.
• Maintain, secure, and improve the Services and Websites. This includes monitoring performance, diagnosing problems, preventing fraud and abuse, investigating security incidents, and understanding how features are used so we can improve them.
• Communicate with you. We send service, security, billing, and administrative messages. These are part of the Services, so you can't opt out of them while you have an account.
• Market our Services. We send newsletters, product updates, and event invitations to business contacts. Every marketing email includes an unsubscribe link, and you can also opt out by emailing privacy@alphanodus.com.
• Run our business. This includes billing, account management, accounting, audits, and corporate transactions.
• Comply with law and protect rights. We use information to meet legal obligations, respond to lawful requests, enforce our agreements, and protect the rights, property, and safety of Alpha Nodus, our Customers, patients, and others.
• For other purposes with your consent, or that we describe to you when we collect the information.

We use Customer Data only as described in Section 3 and our agreements with the Customer.

6. Artificial intelligence

Gravity uses artificial intelligence (AI), including machine learning and large language models, to help Customers do operational work. Examples include reading and classifying faxed and scanned documents, extracting order and insurance details, checking eligibility, preparing cost estimates and prior authorization requests, and scheduling and communicating with patients.

Our commitments

• AI works for the Customer. AI features process Customer Data only to provide the Services to that Customer, as the MSA and BAA permit.
• No training on identifiable patient data. We do not use identifiable PHI to train or fine-tune AI models, ours or anyone else's.
• Training only on de-identified data, and only where permitted. We may use data that has been de-identified under HIPAA's standard to train and improve Gravity's AI features. We do so only where the Customer's BAA permits (see Section 3).
• AI providers are bound by contract. Third-party AI providers that process Customer Data do so under business associate agreements and contracts that prohibit them from using our Customers' data to train or improve their models, and that limit how long they may keep it. These providers are on our subprocessor list.
• People stay in charge. Gravity's AI features support, but do not replace, the professional judgment of Customer staff. Customers configure how much each workflow is automated and when a person must review AI output. Customers remain responsible for clinical, coverage, billing, and scheduling decisions.
• Transparency for patients. Some laws require healthcare providers to tell patients when AI is used in their care or in communications with them. Where those laws apply, Gravity lets Customers label AI-generated patient communications and provide AI-use notices.
• No significant automated decisions about you. We do not use Other Personal Data to make decisions about individuals, based solely on automated processing, that produce legal or similarly significant effects.

7. De-identified and aggregated information

For PHI: De-identification of PHI is governed by Section 3. It is done only where the BAA permits and only under HIPAA's de-identification standard.

For Other Personal Data: We may de-identify or aggregate information so that it can no longer reasonably be linked to an individual. We use it to operate, analyze, secure, and improve our Services, to train and improve our AI features, and to produce aggregate statistics. An example is a report on industry-wide document processing volumes that identifies no Customer or individual.

In all cases, we:

• keep de-identified information in de-identified form
• do not attempt to re-identify it, except to test our de-identification methods
• contractually require anyone we share it with not to re-identify it

8. How we share information

This section applies to Other Personal Data. We disclose Customer Data, including PHI, only as permitted by the applicable MSA, BAA, and HIPAA (see Section 3).

We share Other Personal Data with:

• Your organization. If you are an Authorized User, your organization's administrators can see account and usage information about you within the Customer Instance.
• Service providers. These are vendors that act on our behalf and under our instructions, such as cloud hosting (Amazon Web Services), communications, AI, analytics, customer support, payment processing, and professional advisers. They are contractually required to use the information only to provide services to us, to protect it, and to meet applicable privacy-law requirements. A service provider that handles PHI must also sign a business associate agreement. Our current subprocessor list is at security.alphanodus.com.
• Corporate affiliates. These are companies under common control with Alpha Nodus. They must use the information consistently with this Privacy Policy.
• In a business transaction. In a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be disclosed during due diligence (under confidentiality agreements) and transferred to the successor. The successor must honor this Privacy Policy, or give you notice and any choices required by law. PHI may be transferred only as HIPAA and the BAA permit.
• For legal reasons. We share information where we believe in good faith that the law, a court order, or legal process requires it, or that it is necessary to protect the rights, property, or safety of Alpha Nodus, our Customers, patients, or others, including to prevent fraud or address security issues.
• With your consent or at your direction, for example when you ask us to connect a Third-Party Service.

Government and law enforcement requests for Customer information. If a government or law enforcement agency asks us for a Customer's information, we try to redirect the agency to the Customer. We may give the agency the Customer's basic contact information for that purpose. If we are legally compelled to disclose Customer information, we notify the Customer in advance and cooperate with any effort to seek a protective order, unless the law prohibits notice. We do not voluntarily disclose Customer information to government or law enforcement agencies, except where needed to prevent an emergency involving danger of death or serious physical injury, and then only as permitted by law and the BAA.

We do not sell Personal Data, and we do not share it for cross-context behavioral (targeted) advertising.

9. Text messaging

Gravity can send text messages to patients on behalf of Customers, for example appointment reminders, scheduling and check-in links, cost estimates, and registration requests. We may also text Authorized Users, for example sign-in verification codes.

• Consent. Patients receive messages from their healthcare provider through Gravity. The provider is responsible for obtaining any required consent.
• Frequency and charges. Message frequency varies. Message and data rates may apply.
• Opt out. Reply STOP to any message to stop receiving texts from that sender. Reply HELP for help, or contact us at 1-888-625-7420 or support@alphanodus.com.
• Mobile information is not shared for marketing. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, except service providers that help us deliver messages.
• Health information in texts. Text messages to patients may contain PHI. They are handled as described in Section 3.

10. Cookies, analytics, and your choices

We use cookies and similar technologies, such as local storage and pixels, on our Websites and in the Services. We do not use advertising or cross-site tracking cookies.

No third-party analytics or advertising tags run on authenticated Gravity pages, or on pages where patients enter information.

Your choices

• Browser settings: Most browsers let you block or delete cookies. Blocking strictly necessary cookies may stop parts of the Websites or Services from working.
• Google Analytics opt-out: You can install the Google Analytics Opt-out Browser Add-on.
• Global Privacy Control: We treat a Global Privacy Control (GPC) signal as a valid request to opt out of the sale or sharing of Personal Data and of targeted advertising for that browser. We don't do these things, but we honor the signal anyway.
• Do Not Track: Because there is no common standard for "Do Not Track" browser signals, we don't respond to them separately. We honor GPC as described above.

11. Data retention

We keep Personal Data only as long as needed for the purposes in this Privacy Policy, to meet legal, accounting, and reporting obligations, to resolve disputes, and to enforce our agreements. When we no longer need it, we delete it or de-identify it.

12. Security

We protect information with administrative, technical, and physical safeguards appropriate to its sensitivity. These include encryption in transit (TLS) and at rest, key management with AWS Key Management Service, role-based access controls, threat detection, vulnerability scanning, and regular third-party penetration testing. For PHI, our safeguards are designed to meet the HIPAA Security Rule.

More detail is available on our Trust Center. To report a vulnerability, email security@alphanodus.com.

No system is completely secure, so we can't guarantee absolute security. If a security incident affects Customer Data, we notify affected Customers as required by law and our agreements. If an incident affects Other Personal Data, we notify affected individuals as required by law.

13. Children

Our Websites and Services are intended for businesses and their staff. They are not directed to children under 16, and we do not knowingly collect Other Personal Data from children under 16. If you believe a child has given us Other Personal Data, contact privacy@alphanodus.com and we will delete it.

Customers may use Gravity to process PHI about patients of any age, including minors. That information is protected under HIPAA and the applicable BAA (Section 3).

14. Your US state privacy rights

Depending on where you live, you may have the right to:

• Know and access the Personal Data we hold about you, and get a copy in a portable format
• Correct inaccurate Personal Data
• Delete Personal Data
• Opt out of the sale of Personal Data, targeted advertising, and profiling that produces legal or similarly significant effects (we don't do these things)
• Not be discriminated against for exercising your rights

Exceptions. These rights apply to Other Personal Data. They generally don't apply to PHI, which HIPAA governs. If your request concerns information we process for a Customer (for example, patient information in Gravity), we will refer you to that Customer and help the Customer respond.

How to make a request

• Email privacy@alphanodus.com with the subject line "Privacy Request."
• Verification. We will verify your identity by matching information you give us with information we hold, for example by confirming control of the email address on file. We'll only ask for what we need to verify you.
• Authorized agents. You can use an authorized agent to make a request for you. We may ask the agent for proof of your signed permission, and we may ask you to verify your identity directly.
• Timing. We will respond within 45 days. If we need more time (up to another 45 days, where the law allows), we will tell you why.

Appeals. If we deny your request, you can appeal by emailing privacy@alphanodus.com with the subject line "Privacy Request Appeal" within a reasonable time after our decision. We will respond in writing within the time required by your state's law (generally 45 or 60 days) and explain our decision. If you disagree with the outcome, you can contact your state attorney general.

15. Additional information for California residents

This section gives California residents the additional disclosures required by the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA). It applies to Other Personal Data. PHI governed by HIPAA is exempt from the CCPA.

Personal information we collected in the past 12 months

We do not use or disclose sensitive personal information for any purpose other than those the CCPA permits (for example, providing the Services and keeping accounts secure). For this reason, we do not offer a separate "right to limit." We do not use sensitive personal information to infer characteristics about you.

Sale and sharing. In the past 12 months, we have not sold or shared (for cross-context behavioral advertising) personal information. That includes personal information of consumers under 16.

Retention. See Section 11.

Your rights. California residents have the rights described in Section 14: to know, access, correct, and delete personal information, and not to be discriminated against for exercising these rights. You can make requests as described in Section 14.

Shine the Light. We do not share personal information with third parties for their own direct marketing purposes.

16. Users outside the United States

Our Services are designed for healthcare organizations in the United States, and we store and process information in the United States. If you access our Websites from outside the United States, your information will be transferred to, stored, and processed in the United States. If you are located outside the US and have a question about your information, contact privacy@alphanodus.com.

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our Services, our practices, or the law. We will post the updated policy on this page and change the "Last updated" date. If we make material changes, we will give additional notice, such as by email or a notice in the Services, before the changes take effect. We review this Privacy Policy at least once a year.

18. Contact us

If you have questions about this Privacy Policy or our privacy practices, or want to exercise your rights, contact us at:

Email: privacy@alphanodus.com
Mail:
Alpha Nodus, Inc.
Attn: Data Privacy Officer
1351 Sawgrass Corporate Pkwy, Suite 104
Sunrise, FL 33323

Security issues: security@alphanodus.com
Patients: For questions about your health information, please contact your healthcare provider first (see Section 3).