Privacy Policy
Compass (product of Aurora Vicci LLC)
Last Updated: October 2026
This Privacy Policy explains how Compass collects, uses and protects information when you visit the Compass website or use the Compass platform and related services ("Services").
By using our Services, you agree to this Privacy Policy. If you do not agree, you should not use Compass.
We process personal data in line with applicable data protection laws, including HIPAA in the United States and GDPR where it applies. For information about visitors to our website, the data controller is Aurora Vicci LLC, 8 The Green, STE B, Dover, Delaware, USA.
1. Data Governance Roles
- Your organization (the Customer): the data controller. It decides which systems Compass connects to and why.
- Compass: the data processor. We process customer data only to provide the Services, under the customer's instructions and our agreement with them.
- Protected health information: where Compass processes protected health information for a HIPAA covered entity, we do so as a business associate under a Business Associate Agreement.
2. Information We Collect
- Customer data: records from the systems a customer connects, such as their EHR (for example Epic), staffing, scheduling, finance and claims sources. Compass reads this data; it does not write back to those systems.
- Account data: the name, work email, role and organization of each user, so we can sign them in and apply the right permissions.
- Activity data: which records users view and change inside Compass, kept as an audit trail for the customer.
- Website data: information you send us (for example when booking a demo) and basic usage data about our website.
3. How We Use Information
- To compute metrics, briefings, predictions and suggested follow-ups for the customer that owns the data.
- To keep the Services secure, including access control, audit logging and incident response.
- To support users and improve the Services.
We do not sell customer data or personal information. We do not use one customer's data to make predictions for another customer. Predictive models are trained for each customer on that customer's own data, and every model decision is logged so it can be reviewed.
4. Security
- In transit: data is transmitted using TLS 1.2 or higher.
- Read-only connections: Compass connects to source systems with read-only access.
- Access: access is role-based and scoped to the customer's organization, sites and teams.
- Audit trail: views, changes and model decisions are logged and can be exported by the customer.
- Our staff: Compass employees do not access identifiable health information without the customer's authorization, and only for as long as needed to provide support.
5. Data Retention and Deletion
Customer control: customer data is kept for as long as the customer's agreement requires. When an agreement ends, or when a customer asks, we delete or return customer data as set out in that agreement.
Your rights: where GDPR or similar laws apply, you may ask to access, correct, export or delete your personal data. If your data reached Compass through your organization, we will pass your request to them as the data controller.
6. Breach Notification
If we suspect a security incident affecting customer data, we will notify the affected customer without undue delay, and within the time required by law and their agreement. Our notice will cover:
- The nature of the incident.
- The steps taken to contain and fix it.
- A point of contact for the customer's privacy or security officer.
7. Cookies and Tracking
Our website may use cookies (with your consent where required) to understand usage and improve performance. You can disable cookies in your browser, but some features may not work properly.
8. Changes to This Policy
We may update this Privacy Policy from time to time. We will tell customers about significant changes by email or in the product.
9. Contact Us
If you have any questions, contact us at aurora@heylixir.com or write to: Aurora Vicci LLC, 8 The Green, STE B, Dover, Delaware, USA.