Privacy Policy

Licenva is a product and service operated by Folay Healthcare Technologies LLC ("Licenva," "we," "us," or "our"). We are committed to protecting the privacy of our users. This Privacy Policy explains what information we collect, how we use it, how we store and protect it, and your rights with respect to your personal information when you use the Licenva mobile application (the "Application").

By creating an account and using the Application, you agree to the collection and use of your information as described in this Privacy Policy. If you do not agree, please do not use the Application.

This Privacy Policy applies to the Licenva mobile application for iOS and Android and the Licenva web application (collectively, the "Application"). It also describes the analytics information collected when you visit our public website, www.licenva.com (the "Website"), as set out in Section 2.6. It does not apply to any third-party websites, services, or applications that may be linked from within the Application or the Website.

We use the information we collect solely to provide and improve the Licenva service. Specifically, we use your information to:

• Create and manage your account.
• Process and store uploaded documents securely.
• Extract credential-relevant data from your documents using OCR.
• Generate your Credential Readiness Dashboard, status indicators, and Career Readiness Score.
• Send you reminders and alerts about license, DEA, board certification, and CME expirations and other renewal deadlines.
• Authenticate your identity, verify your email address, and send password-reset, security, and other account communications to your registered email address.
• Maintain session security and application performance.
• Understand, in aggregate, how the Website and the Application are used, using Google Analytics, so that we can find problems and improve them, as described in Section 2.6.
• Find and fix crashes and errors in the mobile applications, as described in Section 2.7.
• Answer the questions you ask Licenva AI, as described in Section 2.8.
• Generate credential readiness packets at your request, for your own use in employment, privileging, or licensure applications.
• Send email-confirmation, account-security, recovery, and packet-access communications.
• Deliver one-time packet access codes and record delivery, expiration, revocation, and access events.

Confirming an email address, whether personal or professional, confirms control of that mailbox. It does not independently verify your identity, employment, licensure, certification, or professional standing, and Licenva does not represent that it does.

We do not use your information for advertising, third-party profiling, credit decisions, insurance underwriting, employment decisions, credentialing determinations, or automated decisions that produce legal or similarly significant effects, or for any purpose other than providing you with the Licenva service. We do not use your uploaded documents, OCR-extracted fields, credential information, account data, or other personal data to train third-party AI models. Licenva does not guarantee that reminders, alerts, or notifications will be delivered, timely, accurate, or sufficient to prevent expiration, lapse, missed deadlines, or noncompliance.

Licenva is currently offered free of charge. We do not currently collect payment card information or billing information through the Application.

The Career Readiness Score is an internal, informational indicator calculated from credential and requirement information that you upload, enter, or confirm within Licenva. This may include credential status, expiration dates, completed requirements, and the requirements associated with your selected pathway. It is not primary-source verification, a licensure determination, or a certification of professional standing. The Career Readiness Score is:

• Not a credentialing determination, licensure status, or risk assessment of any kind.
• Not shared with any third party, including employers, hospitals, credentialing bodies, or licensing boards, unless you affirmatively choose to export and share a credential readiness packet.
• Not used or intended for any eligibility, privileging, underwriting, or employment determination by Licenva.
• Informational only and intended solely for your personal awareness and credential management.

Licenva does not operate as a credentials verification organization (CVO). The Application does not perform primary source verification and does not access official records from any state medical board, the DEA, ABMS or its member boards, or the NPDB.

Licenva does not sell your personal information, including your uploaded documents, OCR-extracted fields, credential information, and account data. We do not share your personal information with advertisers or data brokers. We do not share your licensure, certification, or credential information with employers, hospitals, insurers, credentialing bodies, or government agencies, except where you affirmatively initiate an export or share action within the Application.

We share limited information with the following service providers solely to operate the Application:

• Supabase: authentication, database (Postgres), file storage, and backend logic (Edge Functions). Supabase infrastructure is hosted on Amazon Web Services in the United States.
• Amazon Web Services (Amazon Textract): optical character recognition and document data extraction.
• Resend: delivery of authentication, email verification, password-reset, security, and other transactional emails, including secure packet notifications and one-time access codes.
• Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM): delivery of push notifications to iOS and Android devices, respectively.
• OneSignal: management and delivery of push notifications through APNs and FCM, using your device's push token, an internal Licenva account identifier, and basic device information such as model, operating system, language, and time zone.
• Google (Google Analytics, including Google Analytics for Firebase): measurement of Website and Application use, as described in Section 2.6.
• Google (Firebase Crashlytics): crash and error reports from the mobile applications, as described in Section 2.7.
• OpenRouter, Inc. and the AI model providers it routes to: generating Licenva AI answers, as described in Section 2.8.

Each of these providers processes data on our behalf to deliver the specific function described above, under contractual terms that restrict their use of your information, and none of them has independent rights to use your information for their own purposes. Google Analytics data is also processed under Google's own terms and privacy policy, as described in Section 2.6.

If you choose to export, download, or share a credential readiness packet, you are responsible for ensuring that the recipient is correct and authorized to receive the information. Licenva cannot control, retrieve, or delete copies of documents once they have been downloaded, saved, forwarded, or otherwise retained by a recipient.

When you create a shared credential packet, you provide the intended recipient's email address. Licenva sends the packet notification and a time-limited, single-use access code to that address. The packet link alone is insufficient to obtain access. Only a person with access to the specified recipient mailbox can receive the code and complete the access process.

Licenva retains the recipient email address, email-delivery status, access-code validation and expiration information, access timestamps, hashed network address, and browser type for security and audit purposes. The sender may revoke access at any time. Expiration or revocation prevents future access through Licenva but cannot retrieve copies already downloaded or retained by an authorized recipient.

DEA registration information receives additional protection. Your DEA registration number and any DEA registration certificate are excluded from every shared credential packet and share link, in full and in masked form, and that exclusion cannot be overridden. In a general export of your own account data, your DEA registration number is masked rather than included, and it is likewise masked in the stored text extracted from your DEA certificate; the certificate document itself remains available to you, because it is your own record. The unmasked number can be revealed only to you, inside the Application, and each reveal is logged.

We may disclose your information if required to do so by law, court order, or valid legal process, or to protect the rights, safety, or property of Licenva or its users.

Your documents and account data are stored in the United States on infrastructure operated by the providers identified in Section 5, principally Supabase, whose platform is hosted on Amazon Web Services. The Application is intended for use in the United States. If you access the Application from outside the United States, you understand that your information will be processed and stored in the United States. We implement the following security controls:

• Encrypted storage for all documents and personal data.
• Secure API communications using industry-standard encryption protocols.
• Access controls limiting data access to authorized personnel.
• Account authentication managed through Supabase Auth, supporting email and password, required account-email confirmation, password-reset communications, and optional multi-factor authentication using an authenticator app, which we recommend. Passwords are not stored by Licenva in readable form.
• Automatic session timeout or re-authentication controls designed to protect account access.
• Authentication tokens with automatic expiry; refresh tokens are revoked upon logout.

Because sign-in, email verification, and password reset depend on your registered email address, and on any multi-factor authentication method you enable, you are responsible for maintaining control of them. If you lose access to your registered email address, or if it is compromised, the security of your account and your ability to access it may be affected. Notify us promptly if you lose control of your registered contact methods.

No security system is impenetrable. While we use commercially reasonable measures to protect your information, we cannot guarantee absolute security. In the event of a data breach that affects your personal information, we will notify you in accordance with applicable law.

We retain your account information and documents for as long as your account remains active. You may delete individual documents at any time through the Application.

When you delete your account, we will delete or de-identify your account data and uploaded documents from active systems within 30 days after account deletion, subject to backup retention, legal obligations, security, fraud prevention, and audit requirements. Data covered by account deletion includes:

• Your account record and all profile information.
• All uploaded documents, including all stored copies.
• All licensure, certification, and professional credential records and notification history.
• All authentication tokens and push notification tokens, and your push-notification profile with OneSignal.
• Your Licenva AI conversations.

Backup copies may remain in encrypted backups for a limited period after deletion and will be deleted or overwritten according to our normal backup cycle.

Certain technical records, such as server logs and diagnostic records, are retained for up to 90 days for operational and security purposes. These records do not contain your personal document data. Crash reports from the mobile applications are kept by Firebase Crashlytics for 90 days, as described in Section 2.7.

Google Analytics data about use of the Website and the Application is kept by Google for 2 months and then deleted automatically, as described in Section 2.6. Aggregated reports that do not identify a browser, a device, or a person may be kept longer. The 90-day period for our own server logs and diagnostic records does not apply to, or extend, Google Analytics data.

We may retain information for a longer period where required by applicable law or to fulfill a legal obligation. Where required by applicable law, we will provide notice regarding retention practices or user rights.

You have the following rights with respect to your personal information:

• Access: you may access and review the information stored in your account at any time through the Application.
• Correction: you may update or correct inaccurate information in your account profile.
• Deletion: you may delete individual documents or delete your entire account at any time through the Application (Profile → Edit Profile → Delete Account). Upon account deletion, we will delete or de-identify your account data and uploaded documents from active systems within 30 days, subject to the retention exceptions described in Section 7.
• Deactivation: if you wish to temporarily suspend access to your account without deleting your data, please contact us at the address below.
• Portability: you may request a copy of your personal data by contacting us.

To exercise any of these rights or to make a privacy-related inquiry, please contact us at support@licenva.com.

Other than the public NPPES record that you locate and confirm during onboarding, Licenva does not access, retrieve, or use information from any state medical board, the DEA's registration systems, ABMS or its member boards, the National Practitioner Data Bank (NPDB), or any other official licensing or credentialing database. All other information processed by Licenva is provided directly by you, the user, through document upload or details you enter or confirm. Licenva is not a credentials verification organization and does not operate as a source of primary source verification for any licensing board, hospital, or employer.

The Application is intended for physicians, physicians in training, and medical school graduates. It is not intended for children under 13 years of age. Account registration requires users to be at least 18 years of age. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will delete that information promptly. If you believe a child under 13 has created an account or has otherwise provided us with personal information, please contact us at support@licenva.com.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. When we make material changes, we will notify you through the Application or by email to your registered address at least 14 days before the changes take effect. Your continued use of the Application after the effective date of the updated Privacy Policy constitutes your acceptance of the changes.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at: Folay Healthcare Technologies LLC Attn: Privacy Officer support@licenva.com https://www.licenva.com