Data Protection

Effective Date: September 25, 2026

1. Current Status

NOUS is a research platform. Beverly Index does not currently accept identifiable patient information for clinical use. Any research or clinical pilot involving identifiable information will begin only after the safeguards in Section 3 are in place and a Business Associate Agreement or data use agreement has been signed with the partner organization.

Public demonstrations are not clinical

The public DreamWeaver, Memoria Sonata and Empyrean demonstrations on beverly-index.com do not collect or store health information. Narratives entered in those demonstrations are processed and then discarded.

2. Safeguards in Place Today

• Encryption in transit: all connections to the platform use HTTPS with TLS.
• Controlled access: the platform is available only with an issued access code. Authentication is rate limited and access codes expire.
• Integrity: the scoring code is protected by a checksum lock, and a build containing a modified scoring file cannot be deployed.
• Hosting: the platform is hosted on commercial cloud infrastructure in the United States.

3. Safeguards Being Completed Before Clinical Use

The following are built or specified and will be in place before any clinical use of identifiable information:

• Field-level AES-256 encryption of patient records at rest.
• Audit logging of every access to patient information, with a defined retention period.
• Multi-factor authentication for practitioner and administrator accounts.
• HTTP Strict Transport Security.
• A formal HIPAA risk assessment, designated privacy and security responsibilities, and Business Associate Agreements with hosting and service providers.

4. Separation of Pathways

Clinical assessment data and forensic assessment data are handled in separate pathways.

5. Patient Rights

Patients have the right to access their assessment records, request corrections, and obtain an accounting of disclosures, as required by HIPAA. These rights are exercised through the treating practitioner's organization, which maintains the treatment relationship.

6. Breach Notification

In the event of a breach of unsecured PHI, Beverly Index LLC will notify affected covered entities within 60 days as required by the HIPAA Breach Notification Rule. We will cooperate fully with covered entities in fulfilling their notification obligations to affected individuals and the Department of Health and Human Services.

7. Contact

For data protection inquiries, contact Beverly Index LLC at rrbjr@beverlyindexai.com or +1 (307) 204-6354. Beverly Index LLC.