Built for Healthcare Security Standards

No Protected Health Information Is Ever Stored

NyxCodex is a staff training platform, not a clinical system. It does not collect, process, or store any patient data, medical records, or Protected Health Information (PHI) as defined under HIPAA 45 CFR §160.103.

The only personal data stored is staff user accounts: name, work email address, training progress scores, and completion timestamps. This data is isolated per organization and never shared across tenants.

Data Encrypted In Transit and At Rest

Role-Based Access with Org Isolation

NyxCodex implements a three-tier role model enforced at both the application and database levels:

• Staff — Access to training content, their own progress, and their own certificate only
• Admin — Access to org-level dashboards, completion reports, and staff management for their org only
• Owner — Full access including billing, settings, and white-label configuration

Firebase Security Rules enforce that no user can read or write data outside their organization's path (orgs/{orgId}/), regardless of role.

Regulatory Alignment

Security Incident Procedures

In the event of a security incident affecting training data, NyxCodex commits to:

• Notification of affected organizations within 72 hours of discovery
• Root cause analysis and written incident report within 14 days
• Immediate revocation of compromised access credentials
• Cooperation with organizational security and compliance teams

To report a suspected security issue: security@nyxcollectivellc.com

Third-Party Services Used