Privacy Policy

Effective Date: October 2026 Last Updated: October 2026

Nesting Path LLC ("Nesting Path LLC," "we," "us," or "our") provides health navigation, care transition, and legacy administration services, [including our Nesting Path Digital Estate Organizer]. This Privacy Policy explains what personal information we collect, how we use and share it, how we protect it, and the choices and rights available to you.

This Policy applies to our website at Nestingpath.com (the "Site"), our digital products, and the services we provide by phone, email, text message, video, and in person (together, the "Services"). It applies to clients, family members and authorized representatives, website visitors, and anyone else who contacts us.

By using the Site or Services, you acknowledge that you have read this Policy. If you do not agree with it, please do not use the Site or Services.

Important: We are an administrative and care-coordination service. We are not a healthcare provider, law firm, financial advisor, insurance company, or real estate professional. We do not provide medical, legal, tax, or financial advice.

1. How This Policy Relates to HIPAA

Some of our health navigation work is performed on behalf of physicians, practices, hospitals, or other healthcare organizations that are "covered entities" under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA").

  • When we act as a Business Associate. If your healthcare provider refers you to us or engages us to coordinate your care, we may receive your Protected Health Information ("PHI") as that provider's business associate. In that case, we use and disclose your PHI only as permitted by our Business Associate Agreement with the provider and by HIPAA. Your provider's Notice of Privacy Practices describes your rights over that information, and requests to access or amend it may be directed to your provider or to us, and we will coordinate with your provider.

  • When you engage us directly. If you hire us directly (for example, for private navigation, hospice or discharge coordination, or legacy administration), HIPAA may not apply to the information you give us. We nonetheless protect health information we receive with safeguards modeled on HIPAA standards, and this Policy, along with applicable state law, governs how we handle it.

If you are unsure which applies to you, contact us using the information in Section 15.

2. Information We Collect

The information we collect depends on the Services you use. We collect only what we reasonably need to deliver the Services you request.

A. Contact and Identity Information

Name, email address, phone number, mailing address, date of birth, preferred language, and preferred contact methods.

B. Health and Care Information

Referral details, diagnoses or reasons for referral, treating providers, appointment history and preferences, medications, care needs, discharge instructions, hospice or facility information, and other health details you or your providers share with us.

C. Insurance and Payment Information

Health insurance carrier, plan, and member information needed to coordinate appointments and referrals. Payments for our Services are processed by third-party payment processors; we do not store full payment card numbers on our systems.

D. Legacy Administration and Estate Information

When you use our care transition, digital estate planning, or death administration Services, we may collect:

  • Information about the client and, where applicable, a deceased individual, including date of death and death certificate information;

  • Government identifiers such as Social Security numbers, where needed to notify agencies or institutions;

  • Lists of financial, utility, subscription, social media, and other accounts, and the institutions that hold them;

  • Names and contact information of family members, beneficiaries, executors, personal representatives, agents under a power of attorney, and other involved parties; and

  • Copies of documents you provide, such as letters of administration, powers of attorney, advance directives, or account statements.

Passwords and credentials. Our digital estate products help you organize where your accounts are and who should handle them. We recommend that you do not send us account passwords, PINs, or security answers. Where you choose to record credentials in one of our organizer tools, you are responsible for storing that tool securely. If our Services ever require access to an account, we will request it through a secure method and only with appropriate authorization.

E. Information About Other People

You may give us information about other people, such as a family member you are helping or a person who has died. By doing so, you confirm that you have the authority to share it (for example, as a patient's authorized representative, health care surrogate, agent under a power of attorney, or personal representative of an estate) or that sharing it is otherwise lawful.

F. Information Collected Automatically

When you visit the Site, we and our service providers may automatically collect your IP address, browser and device type, operating system, referring pages, pages viewed, and time spent on the Site, using cookies and similar technologies. See Section 7.

G. Communications

Records of calls, emails, text messages, forms, and other communications with us, including notes our staff make while providing Services.

3. How We Use Your Information

We use personal information to:

  • Provide, coordinate, and manage the Services you request, including scheduling appointments, communicating with providers, coordinating care transitions, and completing administrative tasks;

  • Verify identity and authority, including confirming that a person acting on someone's behalf is authorized to do so;

  • Communicate with you about your Services, appointments, account, and requests;

  • Process payments and maintain business and billing records;

  • Deliver and support our digital products;

  • Maintain the security and integrity of our Site, systems, and records, and prevent fraud;

  • Improve our Services and Site, using de-identified or aggregated information where possible;

  • Send marketing communications, only with your consent where the law requires it (see Section 8); and

  • Comply with law, respond to lawful requests, and establish, exercise, or defend legal claims.

We do not use health information or legacy administration information for advertising or marketing, and we do not use it to build advertising profiles.

4. How We Share Your Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share personal information only as described below.

  • Healthcare providers and facilities. Physicians, specialists, hospitals, hospice organizations, home health agencies, and care facilities involved in your care, to schedule and coordinate that care.

  • Referring providers. When we act for a referring provider, we report back to that provider on the status of the referral and appointment.

  • Institutions you ask us to contact. Government agencies, financial institutions, insurers, employers, utilities, online platforms, and other organizations you direct us to notify or work with, including for death notifications and account closures.

  • People you authorize. Family members, caregivers, executors, attorneys, or others you designate in writing or who are legally authorized to act for you or for an estate.

  • Service providers. Vendors who help us operate, such as secure CRM and records systems, cloud hosting, e-fax and secure messaging, payment processing, e-signature, scheduling, and email delivery. These vendors may use your information only to provide services to us, under confidentiality obligations and, where they handle PHI, Business Associate Agreements.

  • Legal and safety reasons. When required by law, subpoena, court order, or other legal process; to protect the rights, property, or safety of you, us, or others; or to report suspected abuse, neglect, or exploitation where required by law.

  • Business transfers. In connection with a merger, acquisition, financing, or sale of all or part of our business, subject to the protections in this Policy.

We may share information that has been de-identified or aggregated so that it cannot reasonably be used to identify you.

5. How We Protect Your Information

We maintain administrative, technical, and physical safeguards designed to protect personal information, including:

  • Encryption of data in transit (TLS/SSL) and, where supported by our systems, at rest;

  • HIPAA-compliant platforms for storing and managing health information;

  • Role-based access limited to staff and contractors who need the information to do their work;

  • Multi-factor authentication on systems containing sensitive information;

  • Confidentiality agreements and privacy and security training for our team; and

  • Secure methods for receiving and sending documents, including secure fax and encrypted messaging.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please avoid sending Social Security numbers, health information, or account details by regular email or text; ask us for a secure method instead.

Security incidents. If a breach affects your personal information, we will notify you and any required authorities as required by applicable federal and state law.

6. How Long We Keep Your Information

We keep personal information only as long as needed for the purposes described in this Policy, including to provide Services, meet contractual obligations to healthcare partners, maintain business and tax records, resolve disputes, and comply with law. Retention periods depend on the type of information and the Service. When information is no longer needed, we securely delete, destroy, or de-identify it.

7. Cookies, Analytics, and Tracking Technologies

We use cookies and similar technologies to operate the Site and understand how it is used.

  • Essential cookies are required for the Site to function, for example to keep forms and checkout working.

  • Analytics cookies help us understand site traffic and improve the Site. Where possible, we configure analytics to limit the data collected.

  • Functionality cookies remember preferences such as language.

We do not use advertising pixels or tracking technologies on pages where you enter health information, request services, or access client materials, and we do not disclose health information to advertising or social media platforms.

You can control cookies through your browser settings. Some Site features may not work if cookies are disabled. Where required by law, we honor Global Privacy Control (GPC) and similar browser-based opt-out signals.

8. Communications, Text Messages, and Marketing

  • Service communications. We will contact you about your appointments, requests, and Services by phone, email, or text message using the contact information you provide.

  • Text messages. If you provide a mobile number and agree to receive texts, we may send service-related text messages. Message and data rates may apply. Reply STOP to opt out or HELP for help. Consent to marketing texts is never a condition of purchasing our Services.

  • Marketing emails. With your consent, we may send newsletters and information about our Services and products. You can unsubscribe at any time using the link in any marketing email or by contacting us.

We do not share your phone number or text messaging consent with third parties for their marketing purposes.

9. Your Privacy Choices and Rights

Depending on where you live and which Services you use, you may have the right to:

  • Know and access the personal information we have about you and how we use and share it;

  • Correct inaccurate personal information;

  • Delete personal information, subject to legal and contractual exceptions (for example, records we must keep for healthcare partners or by law);

  • Obtain a copy of your personal information in a portable format;

  • Opt out of marketing communications, and of any sale, targeted advertising, or profiling (we do not engage in these activities);

  • Limit the use of sensitive personal information; and

  • Withdraw consent where we rely on it, without affecting prior processing.

These rights apply as provided by applicable law, including the comprehensive consumer privacy laws of California and other states. For information we hold as a HIPAA business associate, your rights are governed by HIPAA and may be exercised through your healthcare provider; we will assist the provider in responding.

How to Submit a Request

Email Help@nestingpath.com with the subject line "Privacy Request." We will verify your identity before responding, which may require confirming information we already have on file. You may use an authorized agent, and we may ask for proof of the agent's authority.

Requests about a deceased person. A personal representative, executor, or other person with legal authority may make requests regarding a deceased individual's information by providing documentation of that authority.

Appeals

If we deny your request, you may appeal by replying to our decision or emailing Help@nestingpath.com with the subject line "Privacy Appeal." We will respond within the time required by law. If you are not satisfied with the result of your appeal, you may contact your state Attorney General.

We will not discriminate against you for exercising your privacy rights.

10. Consumer Health Data Notice (Washington, Nevada, Connecticut, and Similar State Laws)

Certain states, including Washington (My Health My Data Act), Nevada, and Connecticut, provide additional protections for "consumer health data," meaning personal information that identifies your past, present, or future physical or mental health status.

  • Categories collected: health conditions, reasons for referral, treating providers, appointments, medications, care needs, and related information described in Section 2(B).

  • Sources: you, your authorized representatives, and your healthcare providers.

  • Purposes: to provide and coordinate the Services you request, as described in Section 3.

  • Sharing: only with the categories of recipients described in Section 4, and only as necessary to provide the Services you request or as required by law.

  • Consent: where required, we obtain your consent before collecting or sharing consumer health data beyond what is necessary to provide the Services you request. We do not sell consumer health data.

  • Your rights: you may confirm whether we collect, share, or sell your consumer health data; access it, including a list of third parties and affiliates with whom we have shared it; withdraw consent; and request deletion. Submit requests as described in Section 9.

11. State-Specific Disclosures

California residents. In the past 12 months, we have collected the categories of personal information described in Section 2 (identifiers; customer records; protected classification characteristics such as age; commercial information; internet or network activity; sensitive personal information including health, government identifiers, and account information; and professional information where relevant) from the sources described in this Policy, for the business purposes described in Section 3, and disclosed them to the categories of recipients described in Section 4. We do not sell or share personal information as those terms are defined under California law, and we do not use sensitive personal information for purposes beyond those permitted by law. California's "Shine the Light" law also permits you to request information about disclosures for direct marketing purposes; we do not make such disclosures.

Other states. Residents of other states with consumer privacy laws may have rights similar to those described in Section 9, and may exercise them in the same way.

12. Children's Privacy

Our Site is not directed to children under 13, and we do not knowingly collect personal information online from children under 13. When our Services involve a minor (for example, coordinating care for a child), we collect that information only from the minor's parent or legal guardian. If you believe a child under 13 has provided us information through the Site, please contact us so we can delete it.

13. Third-Party Websites and Services

The Site may link to websites, portals, and services we do not control, including those of healthcare providers, government agencies, and financial institutions. This Policy does not apply to them. Please review their privacy policies before providing personal information.

14. Changes to This Policy

We may update this Policy from time to time. We will post the updated version on this page and change the "Last Updated" date above. If we make material changes, including to how we use health information, we will provide additional notice and obtain consent where required by law.

15. Contact Us

If you have questions about this Policy or our privacy practices, or wish to exercise your rights, contact us at:

Email: Help@nestingpath.com Phone: (754) 704-4032