Google Limited Use Compliance

What Google Data Nurevo Accesses

• Gmail: Message subjects, sender, date, and body text/attachments — but only from messages identified as potentially healthcare-related (medical bills, insurance claims, EOBs, pharmacy receipts, healthcare invoices, and healthcare correspondence).
• Google Calendar: Calendar name and the appointment details you ask nurevo to create, view, update, or remove.

Access occurs only after you explicitly connect Google and grant the requested OAuth permission. Nurevo does not scan Gmail for unrelated purposes and does not access Calendar data you did not request a feature for.

Why & How It Is Processed

Google data is processed solely to provide the feature you requested — for example, detecting a medical bill in Gmail and adding it to your bills, or syncing an appointment to your calendar. Gmail content that is not healthcare-related is never sent for processing. Google-derived records are tagged (data_source = gmail_import) so they can be isolated, audited, and deleted on disconnect.

Third-Party AI Services

When a feature requires AI (such as classifying an email or extracting charges), Google User Data is sent to a third-party AI provider only if that provider has been explicitly approved in nurevo’s internal AI provider registry and its applicable terms disable training on submitted data. Every transfer of Google User Data to an AI provider is recorded in an internal audit log. If a provider has not been approved, the data is blocked from reaching it and the blocked attempt is logged (without storing the sensitive content).

The current list of approved AI providers, their plan/tier, training-status, retention, and the date their terms were reviewed is maintained in nurevo’s admin “AI Providers” console. We do not claim a provider is compliant unless its terms and configuration have actually been verified.

What We Never Do With Google Data

• Use it to train, fine-tune, evaluate, or improve generalized or foundational AI/ML models.
• Use it to build advertising profiles or sell information to advertisers.
• Sell or transfer Google User Data to third parties.
• Include it in development, test, prompt, or product-improvement datasets.
• Automatically include Gmail/Calendar contents in error reports, logs, or general analytics.

Internal logs and error monitoring use redacted identifiers and metadata, not message or document contents. Test and development data is synthetic or manually created — never real Google user data.

Retention & Deletion

Google User Data is retained only as long as needed to provide the active feature you requested. When you disconnect Google, nurevo stops all future Google API access, revokes your OAuth token, deletes the Google-derived data it no longer needs, and ensures queued background jobs cannot continue processing your Google data. An internal audit trail records when access was granted, when it was disconnected, and when associated data was deleted. To fully revoke access, also remove nurevo from your Google account permissions at any time.

Your Controls

• Disconnect: Revoke Google access and delete Google-derived data from your account settings.
• Request deletion: Use the Data Deletion Request page to remove your entire account and all associated data.
• Privacy details: See our Privacy Policy for the full data handling disclosure.

Data Flow

Google API → Nurevo (isolated, medical-relevance gate) → optional approved AI service (training disabled) → Nurevo result → You

Nurevo is not self-hosted and does not process Google data locally. We do not claim local processing or self-hosting. This statement reflects the actual implementation.

Contact

Questions about our Google data handling? Email support@nurevo.org.