Privacy Policy

This review draft describes NVL Autism Network at nvlautismnetwork.com, its public educational pages, member accounts, Community and Groups, private Messages, and My Progress caregiver tools. The site identifies NVL Therapeutics as the organization behind the network. Its full legal entity name, business address, jurisdiction, and privacy contact have not been confirmed and must be supplied before this policy is approved.

Review status: prepared October 26, 2026; version 2026-10-26-review. Effective date: not yet established. This draft is not an adopted policy and does not retroactively change existing members’ agreements. Unconfirmed practices are identified below rather than presented as guarantees.

Account registration collects an email address, password, optional display name, and an acceptance-version value. Authentication maintains account identifiers, registration and confirmation information, and session credentials. Member records include an NVL member number, account status, role assignments, and membership-status fields. Passwords are handled by the authentication service; the member Administration screen does not expose passwords or authentication secrets.

Profiles may include a display name, avatar URL, biography, interests, and privacy preferences. Community and Groups store group participation and join requests, posts, comments, reactions, reports, and related timestamps. Messages store participants, message text, timestamps and status, read state, reactions, and file-attachment information. Notifications may contain message previews. Reports may include the reporter’s explanation and moderation information. Do not include unnecessary sensitive information in report reasons.

My Progress stores caregiver-entered family profiles (name, relationship, birth year, notes), dated observations (category, rating, notes, routines, therapies, diet notes, products used, product-use status, tags, and additional notes), and product-use events (product name, date, status, notes, and family-profile association). These fields may contain sensitive information about a child or family member, including behavior, sleep, symptoms, diagnoses, treatment, providers, diet, or supplements, even where there is no dedicated field for that information. My Progress currently provides text-based entry, not a child-document upload feature. The separate Journal page is currently marked as in development, although journal, goals, and milestones tables exist with owner-scoped access.

Email-update forms store your email and signup source. This is separate from creating a member account. Technical services receive connection and usage information as explained in section 7. Information supplied voluntarily in messages, community posts, or attachments is also stored and transmitted to provide those features.

The application uses information to create and authenticate accounts, show profiles under member privacy settings, provide discussions and messaging, maintain private caregiver observations, deliver in-app notifications, support blocking and reporting, and administer account status. Email-update signups are stored for NVL updates; an operational mailing provider, delivery process, unsubscribe process, and retention schedule have not been confirmed.

Membership acceptance, optional marketing signup, and any future research authorization are separate purposes. Joining the network is not consent to research. No research-sharing or AI-processing workflow for caregiver records was found in the reviewed application. This is not a guarantee about independently managed business operations, which the owner must confirm.

My Progress is a caregiver-controlled observation tool, not a child-facing social account or a medical-records system. Only enter information you have authority to provide, use initials or a nickname where appropriate, and avoid unnecessary identifying details. We cannot verify caregiving authority from the existing registration flow. There is no verified age-check or parental-consent mechanism; the operator must determine and document eligibility and children’s-privacy requirements before adoption.

Live database policies limit family profiles, progress observations, product-use events, journal entries, goals, and milestones to the owning signed-in account. Other ordinary members and signed-in administrators or moderators have no routine access under these policies. These records are not included in public site search or the sitemap. Database service privileges and infrastructure operators can technically access stored records; these are not end-to-end encrypted records and ‘private’ does not mean inaccessible to all infrastructure personnel.

The app does not automatically publish caregiver records or provide a direct journal-sharing feature. If you copy information into a community post, a message, or an attachment, that copy follows the access and retention rules of the destination. Do not post identifying child information to a discussion unless you have authority and understand its audience.

No research data-sharing functionality is activated. Any future use of identifiable child or caregiver information for research would require a separately explained, explicit, specific, optional, revocable authorization and an appropriate legal basis. The authorization would need to describe recipients, purpose, information, duration, withdrawal, and limits on withdrawal for information already lawfully used. No such consent or sharing mechanism is currently implemented.

Private conversations are with other NVL Network members. The messaging interface does not automatically disclose account email addresses, phone numbers, or NVL member numbers to other members. You may voluntarily include your own contact information in a message; a profile biography or attachment you supply may also disclose information you choose to put there. Recipients can retain, copy, or disclose what they receive.

Database policies allow conversation participants to read messages. Authorized moderators and administrators may also read an individual message linked to an open or reviewing report. A role alone does not give blanket access to unrelated private messages. Infrastructure service privileges and database operators can technically access stored data outside ordinary member policies; messaging is not end-to-end encrypted.

The application’s reported-message review requires an access reason and writes an audit record before returning the message to the review screen. The log records actor, action, references, timestamp, and reason without deliberately copying the message body. Ordinary app users cannot update or delete these records. Important unresolved limitation: the database’s reported-message policy permits eligible privileged reads without requiring the application’s logging workflow, so not every possible privileged read is guaranteed to be logged. Database owners also have powers beyond ordinary application accounts. This gap must be resolved before making a universal auditability promise.

Blocking hides member discovery under profile policies and the application checks blocking and direct-message preferences when starting conversations. Settings allows you to see and unblock accounts you blocked. Blocking does not erase earlier messages, recall files or copies, guarantee that a person cannot contact you outside NVL, or by itself guarantee enforcement on every direct database access path. The complete blocking boundary requires further security verification.

When a message’s status is changed to hidden or removed, a live trigger replaces its linked in-app notification preview with generic removal text. Moderation changes status rather than permanently erasing the stored message. Earlier copies, screenshots, cached content, and any historical notifications without a source-message link are not guaranteed to be recalled or erased.

Approved members can discover visible member profiles subject to profile visibility and blocking rules. The application’s member search uses display names, not email addresses, phone numbers, or member numbers. Publicly entered profile text is your responsibility; do not place contact details or sensitive child information in it if you do not want other permitted viewers to see it.

Community posts, comments, and group discussions are shared with the audience permitted by their policies, which can differ from private Messages and My Progress. Group visibility and membership affect access. Moderators may access reported or moderatable community content and administer groups. A private group is not a confidential clinical service. The public educational research library is not a search of private caregiver records.

The website uses Lovable for hosting, application runtime, platform analytics, and error-reporting facilities, with Lovable Cloud backed by Supabase for database, authentication, file storage, and real-time services. Cloudflare infrastructure may process network/edge traffic. The exact contractual processor and subprocessor roster, service locations, operator-access procedures, and international-transfer arrangements require owner and vendor confirmation.

The site loads Google Fonts, which can receive an IP address and browser/request information. Embedded YouTube videos or external links may send request information to Google/YouTube or the destination when loaded or followed; those providers apply their own policies. No new trackers have been added for these drafts.

Platform analytics can receive page paths, referrers, device/browser and approximate-location information, and request metadata. Selective disabling of analytics on sensitive member paths has not been verified. Application event helpers push named events and properties into a browser data layer and custom events; no separately configured tag manager, advertising tracker, session-replay service, or AI workflow was found in the reviewed source. The full platform-injected payload, identifiers, recipients, IP retention, and retention duration have not been independently confirmed.

Error reporting can receive an exception, technical stack, route, and context. The application redacts original error message text on specified sensitive member paths, but preserves the original stack and accepts caller context, while other error/console paths exist. Therefore complete removal of sensitive free text from all logs and platform telemetry is not verified. No guarantee that logs can never contain user information is made in this draft.

Infrastructure providers process information to operate the service. The reviewed code has no sale-of-data, targeted-advertising, or researcher-export integration; the owner must confirm any activities outside the app. Authentication emails use the configured auth service; its sender, underlying delivery vendors, and operational retention require confirmation. No billing processor is connected to membership in the reviewed implementation.

The application uses authenticated server functions, user-scoped database access policies, and server-side role checks. The public origin uses HTTPS and backend requests use HTTPS endpoints. Sessions are persisted in browser storage and refreshed by the authentication client; use a trusted device and sign out on shared devices. The member-upload bucket is private, limited to 25 MB per file, with participant/owner access rules and time-limited signed download URLs. A valid signed link may be usable by anyone who obtains it until it expires.

Application code alone does not verify encryption-at-rest configuration, key management, internal staff access, incident response, infrastructure audit coverage, or data location. Current backup inventory and deletion propagation to backups have not been inspected. Lovable Cloud documentation describes daily database backups with roughly 14-day retention and excludes storage files; actual project backup availability remains unconfirmed. Security measures reduce risk but do not eliminate it. We do not claim HIPAA compliance or any security certification.

You can change profile privacy and messaging preferences and unblock members through Settings. My Progress provides deletion for individual family profiles, observations, and product-use events. Deleting a family profile is not a promise that every linked observation is erased. Message moderation is not permanent deletion. Copies held by recipients are outside these controls.

No verified account-wide self-service deletion or personal-data export workflow is available. Settings refers to requesting deletion, but a confirmed request contact and operational handling process are missing. Retention periods for accounts, caregiver data, messages, uploads, newsletter signups, reports, access logs, technical logs, and backups have not been approved. We cannot promise immediate or complete deletion, a fixed retention period, or an operational response deadline from the current implementation.

Depending on applicable law, you may have rights to access, correct, delete, restrict, object to, or obtain a copy of information, withdraw optional consent, or complain to a competent authority. Which rights and exceptions apply depends on location and legal basis. The owner must provide a verified contact and request process before this notice is adopted. Do not send sensitive records to an unverified contact. Browser tracking preferences are not a verified in-app opt-out mechanism.

Material changes should be explained through an appropriate notice before becoming effective, with renewed consent where required. This draft does not require existing members to accept revised Terms. There is no implemented reacceptance process for these draft documents.

Required before adoption: verified legal operator name and address; privacy contact email; effective date; retention schedule; lawful-basis and jurisdiction review; children’s eligibility/consent review; vendor, transfer and incident-response review; request and newsletter-unsubscribe processes; and remediation of the audit and telemetry gaps above. Read the accompanying Terms of Use for proposed rules governing the service.