Effective October 27, 2026. This version replaces the version effective May 11, 2026. Prior versions are available on request.
This Policy covers information handled by National Cold Vault LLC (“NCV,” “we”), an Ohio limited liability company, 576 12th St NW, Carrollton, OH 44615, through nationalcoldvault.com, NCV monitoring Units, evaluation placements, and our monitoring platform (together, the “Service”).
The Service is sold to businesses and licensed professionals. Most information we hold is business information, not personal information about consumers.
2.1 Account and business information you give us: business name and address, the name, role, business email, and mobile number of your designated contacts, and shipping address.
2.2 Alert contact information: at least one mobile number able to receive voice calls and text messages. This is the only way the Service can function.
2.3 Payment information. If you pay by card or ACH, your card or bank details are entered with and held by our payment processor, Stripe. NCV does not receive, store, or transmit full card or bank account numbers. We retain invoices, payment confirmations, the last four digits of a card or account as returned by the processor, and, for checks, the check image and remittance details as part of our accounting records.
2.4 Telemetry Data from your Unit: temperature, humidity, battery and power state, cellular signal strength, device online/offline state, timestamps, device serial number, and network metadata such as cell identifiers that the cellular module reports. This is environmental data about equipment. It contains no information about any person. We do not use network metadata to determine or track location.
2.5 Form submissions: when you request a quote, an evaluation, or contact us, we collect the fields you enter and a tag indicating which link brought you to the form (for example, a brochure, a letter, or a web page).
2.6 Technical and usage data: IP address, browser type, pages viewed, and session timestamps.
2.7 Communications: emails, form submissions, text message replies, and support correspondence.
2.8 Business contact information from public sources. For business outreach, we may collect the name, professional role, organization, business address, and business phone of licensed professionals and practice decision-makers from public sources such as state licensing registries, the federal NPPES registry, professional networking sites, and organization websites. We use this information only to contact businesses about the Service. You may ask us to stop at any time under Section 9.
2.9 What we do not collect: Social Security numbers, financial account numbers, biometric data, precise geolocation of individuals, or information about anyone under 18. We do not knowingly collect information about your patients.
3.1 NCV monitors equipment environments. We do not create, receive, maintain, or transmit Protected Health Information as defined by HIPAA, and NCV is not a business associate.
3.2 Do not submit PHI to the Service. Do not use patient names or identifiers in device names, notes, or support messages.
3.3 If PHI is submitted despite Section 3.2, we will delete it promptly on discovery and notify your administrator. Inadvertent receipt of PHI does not make NCV a business associate.
3.4 A written HIPAA position statement is available on request.
We use information to: deliver the Service and generate your reports; send excursion, power-loss, probe-fault, and device-offline alerts by voice call and text message to the numbers you provide; invoice and process payments; respond to quote, evaluation, and support requests; contact businesses about the Service; secure the Service and investigate abuse; comply with law and resolve disputes; and improve the Service and publish aggregate statistics using de-identified data that cannot identify you or your facility.
We do not use your information for third-party advertising. We do not sell, rent, or trade it. We do not use your data to train artificial-intelligence models.
5.1 Your consent. By providing a mobile number for alerts, you expressly consent to receive automated and prerecorded voice calls and text messages from NCV at that number for device alerts and service notices. These are informational messages, not marketing. We record the date, time, and language of your consent.
5.2 Frequency. Alerts are event-driven. We apply a cooldown between repeated alerts of the same type for the same Unit and cap voice call attempts per Unit in any 24-hour period to prevent runaway messaging.
5.3 Withdrawing consent. You may withdraw consent by any reasonable method, including replying STOP, QUIT, END, REVOKE, OPT OUT, CANCEL, or UNSUBSCRIBE to any text message, or by emailing support@nationalcoldvault.com or calling (575) 448-2858. We honor withdrawal within ten (10) business days, and usually immediately. We may send one text message confirming your withdrawal.
5.4 WITHDRAWING CONSENT DISABLES ALERTS. IF YOU OPT OUT, THE SERVICE CAN NO LONGER NOTIFY YOU OF A REFRIGERATION FAILURE. NCV HAS NO LIABILITY FOR ANY LOSS OCCURRING AFTER YOU WITHDRAW CONSENT. To re-enable alerts, contact us and confirm your consent again.
5.5 Message and data rates may apply. Carriers are not liable for delayed or undelivered messages.
6.1 We do not sell, rent, or trade your information to anyone, for any purpose.
6.2 Service providers who process data on our instructions under written terms:
| Provider | Purpose | Data |
|---|---|---|
| Supabase | Database and authentication | Account and Telemetry Data |
| Vercel | Website and application hosting | Technical data |
| EMQX | Device message broker | Telemetry Data |
| Cellular connectivity provider | Unit connectivity | Device identifiers and network metadata |
| Twilio | Voice and text alerts | Alert contact numbers and alert content |
| Stripe | Card and ACH payments | Billing information |
| Healthchecks.io | Monitoring that our alert system is running | No customer data |
| Google Workspace | Business email and documents | Communications |
| AI-assisted productivity tools | Drafting and organizing our business correspondence | Business communications only; no Telemetry Data; no automated decisions about you |
An updated list is available on request. Data is stored primarily in the United States.
6.3 Regulators. NCV does not report, forward, or volunteer your Telemetry Data to any Board of Pharmacy, health department, accreditation body, the CDC, the FDA, or any other authority. Your records are yours. We disclose data only if compelled by valid legal process, and where legally permitted we will notify you before disclosing so you may object. We will provide your data to a third party at your written instruction.
6.4 Business transfer. If NCV is acquired or merges, your information may transfer as a business asset. The acquirer will be bound by this Policy for data collected under it, or we will give you notice and an opportunity to export and delete.
7.1 NCV maintains a written information security program that reasonably conforms to the CIS Critical Security Controls, Implementation Group 1, scaled to our size, as contemplated by Ohio Revised Code Chapter 1354.
7.2 Controls include: encryption in transit (TLS 1.2 or higher) and at rest (AES-256) as provided by our infrastructure providers; database-level row security enforcing tenant isolation so no customer can access another’s data; multi-factor authentication on administrative accounts; append-only alert logging with database-enforced immutability; and least-privilege access.
7.3 What we do not claim. NCV does not hold a SOC 2, ISO 27001, or HITRUST certification. Our infrastructure providers maintain their own certifications, available from them directly. We will state plainly when this changes.
7.4 No system is perfectly secure. We cannot guarantee absolute security.
7.5 Breach notification. We will notify affected customers in the most expedient time possible and no later than forty-five (45) days after discovering a breach of personal information, consistent with Ohio Revised Code 1349.19, and will notify authorities where required.
| Data | Retention |
|---|---|
| Telemetry Data | Subscription term plus 36 months, intended to support common 3-year record-retention requirements |
| Account and billing records | 7 years after termination (tax and legal) |
| Alert and consent logs | 7 years; append-only, cannot be altered or deleted |
| Quote, evaluation, and contact form submissions | 3 years |
| Business outreach contact information | Until you ask us to stop, or 3 years without contact |
| Technical and usage data | 24 months |
| Support communications | 3 years |
You remain responsible for your own recordkeeping. Export and retain your own copies. Use Section 9 to export at any time, including for 90 days after termination.
9.1 You may: access your data; export it as CSV and PDF at any time from your dashboard; correct inaccurate information; delete your account data; withdraw alert consent under Section 5.3; and ask us to stop business outreach to you.
9.2 To exercise these rights, email support@nationalcoldvault.com with your account or business email. We respond within 30 days. We may verify your identity and authority. If we decline, we explain why, and you may appeal by replying; we respond to appeals within 45 days.
9.3 DELETION AND YOUR COMPLIANCE OBLIGATIONS. DELETING TELEMETRY DATA MAY DESTROY RECORDS YOU ARE LEGALLY REQUIRED TO RETAIN. EXPORT YOUR DATA BEFORE REQUESTING DELETION. WE WILL CONFIRM YOU UNDERSTAND THIS BEFORE ACTING. WE MAY RETAIN RECORDS WE ARE INDEPENDENTLY REQUIRED TO KEEP.
9.4 We do not discriminate against you for exercising these rights.
9.5 State-specific rights. Residents of states with comprehensive privacy laws may have additional rights regarding personal information. Most information we hold is business information collected in a commercial context, which many of those laws exempt. Contact us and we will honor applicable rights.
9.6 You may use an authorized agent, with written proof of authority.
10.1 We use cookies strictly necessary for authentication, security, and session management.
10.2 We use no third-party analytics, advertising, or tracking technologies. We record a first-party tag indicating which link brought you to a form, and nothing else.
10.3 We honor Global Privacy Control signals.
The Service is for businesses. We do not knowingly collect information from anyone under 18.
Our site may link to third-party sites. We are not responsible for their privacy practices.
We will post any change here with a new effective date. For material changes we will email account holders at least 30 days in advance. Prior versions are available on request.
Privacy inquiries: support@nationalcoldvault.com Mail: National Cold Vault LLC, 576 12th St NW, Carrollton, OH 44615 Phone: (575) 448-2858 Response time: 5 business days for general inquiries; 30 days for formal rights requests.