Effective Date: May 6th, 2026
Table of Contents
4. Important Notice About Education Records
5. Cookies
7. Our Use of Personal Information
8. Anonymized and Aggregated Data
9. Our Disclosure of Personal Information
10. Data Retention
12. Security
13. Additional Disclosures for Residents of California
14. Exercising Your Rights Under Applicable Privacy Laws
1. Scope of This Policy
Exxat, Inc. (“Exxat,” “we,” “us,” “our”) respects your privacy and values your trust. The purpose of this Privacy Policy is to inform you of the treatment and handling of personal information that we may learn about you from using our website at https://exxat.com (the “Site”), from using our mobile application (the “App”), from your engagement with any content and/or use of any of our services provided via: (i) the Exxat One platform (“Exxat One”); (ii) the Exxat Prism product for management of healthcare services education programs (“Exxat Prism”), which includes the Preceptor module for supervision of students in clinical practice and healthcare education programs (“Preceptor”);(iii) the Exxat Approve product for management of compliance records, including background checks, drug screens, and vaccination records (“Exxat Approve”); and (iv) the Exxat Jobs product for career management and professional development ("Exxat Jobs") (collectively, the “Products”), from purchasing products and services from us or engaging with our content, or by use of any of our other services (the Site, the App, the Products, content, and other services are referred to, collectively, as the “Service”).
In many cases, we provide the Service to educational institutions, clinical programs, and other organizations that use the Products (each, a “Customer” and, collectively, “Customers”), and we process personal information on their behalf. In those circumstances, the Customer determines how personal information is processed and the purpose of such processing.
If you have any questions regarding this information or our privacy practices, please contact us via the methods set out in the How to Contact Us section at the end of this Privacy Policy.
2. Agreement to Terms
By using or accessing the Service, you acknowledge that you agree to be bound by this Privacy Policy and our Terms of Use, which together govern your access to and use of the Service. If you do not agree with the terms of this Privacy Policy and our Terms of Use, then you should immediately discontinue use of the Service without providing us with any personal information.
3. Information We Collect
We may collect the following categories of personal information: (i) directly from you (such as when you register for or use the Service, upload documents to your profile, or contact us); (ii) from third parties, such as your employer, the health professional school you attend, social media networks, and background report and drug screening providers; (iii) from the device and browser that you use to access the Service; and (iv) from cookies and other digital trackers as described in this Privacy Policy.
In many cases, we collect and process personal information on behalf of Customers, and such information may be provided to us by or at the direction of those organizations.
Identifiers
We may collect your first name, last name, email address, account username and password, current and permanent residential and/or mailing addresses, billing address, cell and home phone numbers, emergency contact information (including your contact’s name, phone number, email address, and mailing address), pronouns, Social Security number, student ID number, Single Sign-On (SSO) credentials, National Provider Identifier (NPI), cohort and group assignments, and signature.
Professional and/or Employment Information
We may collect your resume, employment history (including employer names, job titles, employment dates, and descriptions of responsibilities), the name of your employer, your work contact information (such as email and phone number), professional membership information (including organization names, membership numbers, positions held, and membership dates), and professional license information (including license title, type of license, issuing state, license number, and license issuance and expiration dates).
Education Records
We may collect education information such as the name of the educational institution you attend (including prior institutions and degrees earned), your academic records (including course registration information, grades and competency scores and assessments), and records of trainings in which you participated.
Clinical Placement and Academic Program Information
We may collect detailed information about your clinical placements and fieldwork, including placement locations and settings, placement dates and schedules, names and contact information of your assigned preceptors and advisors, and documentation of your progress and performance during placements.
Communication Records
We may collect records of communications between you and faculty, advisors, or administrators. These records may include the date and nature of the communication, the name and role of the person who initiated or documented the interaction, notes or summaries of the discussion, and any related documents or action plans. This information is maintained by your educational institution for academic advising, student support, and program compliance purposes.
Health Information
We may collect information relating to your health and wellbeing, such as vaccination records and immunization histories, physical exam results, health insurance details and proof of coverage, and drug screening results. This information is used by your health professional school for its own compliance and recordkeeping purposes. We will not use your health information for our own marketing purposes.
Background Checks and Drug Screenings
We may receive the results of any background checks, fingerprinting, and/or drug screenings that you obtain through our Exxat Approve service, as well as other verification and identity documents required for clinical placement eligibility. We use this information to advise your school about whether you may be eligible for certain clinical placements that require background checks and/or drug screenings. We may disclose your background check or drug screening reports to your school if your school requests access to such reports.
Demographics and Characteristics
We may collect your age, date of birth, race, ethnicity, gender identity, sex assignment at birth, health background, and military or veteran status. This information is used for industry-specific compliance requirements and to personalize the Service.
User-generated Content
We may collect the information and content of communications that you share through the Service, including any personal information that you choose to include in any prompts or other inputs that you submit to our artificial intelligence (AI) powered chatbot or other AI resources that we may make available, as well as notes, documents, and other content that you or other authorized users (such as faculty, advisors, or administrators) upload to your profile or associate with your account.
Audio-Visual Information
We may collect profile pictures.
Device Information
We may collect device information when you use the Service. Device information may include unique personal identifiers, IP address, browser type, device type, access times and general location information (such as approximate location derived from IP address).
Geolocation Data
We may collect precise geolocation information from your device when you use certain features of our mobile application, including when location services are enabled on your device and the application is authorized to access such information.
Internet Activity
We may collect information concerning your interaction with the Service, including when you access the Service and your browsing activity on the Service (such as which pages you visit, in what order, and for how long). This may also include “traffic data” or tracking information provided by the Service’s host or similar providers (e.g., Google Analytics) that may be helpful for marketing purposes or for improving the Service.
Other Identifying Information that You Voluntarily Choose to Provide
We may collect any personal information that you choose to include in emails, letters, texts, or other communications that you send to us.
Information We Collect from Faculty, School Administration, and Site Personnel Users
If you are a faculty member, school administrator, or clinical site personnel using the Service, we may collect the following categories of personal information about you:
- Identifiers: We may collect your first name, last name, Faculty ID or other professional identification number, email address, phone number, pronouns, date of birth, address information, Single Sign-On (SSO) credentials, and signature.
- Professional and Employment Information: We may collect your resume, faculty rank, administrative position, work experience details (including employer name, job title, and work dates), and educational history. We may also collect student evaluations that you complete as part of your teaching or supervisory responsibilities.
- Emergency Contact Information: We may collect emergency contact information, including the name, phone number, email address, and relationship of your emergency contact.
- Demographics and Characteristics: We may collect your gender, race, and ethnicity. This information is used for institutional reporting, compliance with applicable regulations, and to support diversity and inclusion initiatives within educational programs.
You are not required to provide all personal information identified in this Privacy Policy to use our Service or to interact with us, but certain functionality will not be available if you do not provide certain personal information. For example, if you do not provide certain personal information, we may not be able to register your account or respond to your requests.
4. Important Notice About Education Records
Exxat is a service provider to health professional schools, some of which may be subject to the Family Educational Rights and Privacy Act (“FERPA”). Exxat uses education records at the direction of our health professional school clients. You may have certain rights under FERPA with respect to your education records. To learn about these rights, please visit the FERPA site. To exercise any of your rights under FERPA, please contact the health professional school that you attend directly.
6. Children’s Privacy
The Service is not intended for users under the age of 13, and Exxat does not knowingly collect personal information from individuals under the age of 13. If you are aware of, or suspect that, someone under the age of 13 is using the Service without permission, please notify us immediately by contacting us as detailed in the How to Contact Us section below. If you have questions or concerns about the Internet and privacy for your child, we encourage you to check out the FTC Guidelines for protecting your child’s privacy online.
7. Our Use of Personal Information
We collect and use your personal information for the following purposes:
- Providing the Service to you and providing products or services requested by, or reasonably anticipated within the context of our relationship with, you, including processing personal information on behalf of our educational institution Customers in accordance with their instructions and applicable agreements;
- Managing our relationship with you, and responding to your inquiries or requests, and requesting feedback;
- Evaluating your eligibility for employment;
- Enabling and supporting location-based features of our App, where such features are enabled and authorized on your device;
- Analyzing use of the Service for our internal business operations, which may include the use of Anonymized and Aggregated Data (as defined below);
- Keeping track of login names and passwords;
- Personalizing the Service (e.g., displaying your name when you login) as directed by Customers or as part of our direct interactions with you;
- Tailoring advertisements to what we or our advertising partners believe will be of interest to you, solely in connection with our public-facing Site and not in connection with Products used by educational institutions;
- Improving the Service, including testing, research, internal analytics and product development. Where we use personal information for these purposes outside of our provision of the Service to Customers, we do so using Anonymized and Aggregated Data;
- Detecting security incidents and protecting against malicious, deceptive, fraudulent, or illegal activity, or prosecuting those responsible; and
- Complying with legal and regulatory obligations.
In many cases, we process personal information on behalf of Customers. In those circumstances, Customers determine the purposes and means of processing, and our use of personal information is limited to providing the Service in accordance with our agreements with Customers and applicable law.
We will not collect additional categories of personal information, or use the personal information that we have collected, for materially different, unrelated or incompatible purposes without providing you with notice.
8. Anonymized and Aggregated Data
This Privacy Policy relates to your personal information (i.e., information about you, an individual, from which you can be identified). This Privacy Policy does not apply to any information insofar as it is held, processed, disclosed, or published in a form which cannot be linked to a living individual (such as information that has been de-identified, aggregated, or otherwise processed such that it cannot reasonably be used to identify you, directly or indirectly) (“Anonymized and Aggregated Data”). We may generate or extract Anonymized and Aggregated Data from data that includes your personal information, and we may make use of any such Anonymized and Aggregated Data for our lawful business purposes provided that we will not make any attempt to reidentify such data.
9. Our Disclosure of Personal Information
We may share your personal information with the following third parties, and in many cases, we do so on behalf of and at the direction of Customers in connection with providing the Service:
- Service providers, including artificial intelligence and machine learning service providers, IT outsourcing and hosting providers, communication management providers, customer relationship managers, web analytics providers, and background check and drug screening vendors. In some instances, service providers will be directly responsible to you for their use of your personal information. They may be obliged by law to provide you with additional information regarding the personal information that they hold about you and how and why they process that information. Further information may be provided to you in a separate notice or may be obtained from such service providers directly via their websites.
- Health professional schools, in connection with these entities management of clinical internship placement and clinical education management. If you obtain a background check and/or drug screening through our Exxat Approve service, we will review the results and, if no “records” or “hits” are found, we will notify your school only that you have been “Approved.” If the background check and/or drug screening does identify any “records” or “hits,” we will notify your school that you are “Not Approved.” We do not assess the severity or accuracy of any item appearing in your results, but we may share your background check and/or drug screening reports with your school upon your school’s request.
- Advertising networks to provide you with relevant marketing in connection with our public-facing Site. Please note that we will not disclose or otherwise use your Social Security number or health information for marketing purposes.
- Advisers and financial institutions, including auditors, notaries, business continuity support service providers, and legal, tax, and risk and compliance advisors.
- With third parties in connection with a change to the control or financial status of Exxat, including a corporate restructuring, sale, acquisition, financing, reorganization, bankruptcy, receivership, transfer, assignment of assets, or business merger or divestiture. Personal information and other information may be shared in the diligence process with counterparties and others assisting with the transaction and transferred to a successor or affiliate as part of that transaction.
- Government bodies, dispute resolution organizations, law enforcement agencies, or third parties in connection with: (i) responding to a subpoena, search warrant, or other lawful request for information that we receive; (ii) cooperating in a law enforcement or similar investigation; or (iii) otherwise protecting our rights, as applicable.
10. Data Retention
We retain personal information about you only for so long as reasonably necessary to provide you with the Service and to fulfill the purposes described in this Privacy Policy, or to perform our business or commercial purposes for collecting your personal information.
When establishing a retention period for specific categories of data, we consider a variety of factors, including the nature of the information, our need for the information, why we collected the information, and the sensitivity of the information.
In some cases, we retain personal information for longer, if doing so is necessary to comply with our legal obligations, resolve disputes, enforce our agreements, or is otherwise permitted or required by applicable law, rule or regulation. We may further retain information in an anonymous or aggregated form where that information would not identify you personally.
For example:
- We retain your profile information and credentials for as long as you have an account with us.
- We retain your device information and IP address for as long as necessary to ensure that our systems operate properly, securely, and efficiently.
- We retain records of your communications with us (such as support requests or inquiries) for as long as necessary to respond to your request and maintain appropriate records of our interactions.
- We retain certain system logs and usage records for as long as necessary to maintain the security, stability, performance, and improvement of our Services.
We periodically review the personal information we hold and delete or anonymize it when it is no longer reasonably necessary for the purposes described above.
11. Your Privacy Choices
If you no longer want to receive our newsletter, emails, or other marketing communications from us in connection with our direct interactions with you, you may unsubscribe at any time by choosing “Unsubscribe” from the email itself or sending us a request to unsubscribe at the contact information provided below under How to Contact Us.
If you receive communications through your educational institution or other organization that uses the Service, please contact that organization directly to manage your communication preferences, as we process such communications on their behalf.
Please note that you cannot unsubscribe from certain correspondence from us, including messages relating directly to your account or communications that are necessary for the provision of the Service.
12. Security
We maintain reasonable technical and organizational measures to protect personal information from loss, misuse, alteration, or unintentional destruction. We have implemented various security measures to protect both the personal information and the general information that we receive from you through the Service. Whenever you give out personal information online there is a risk that third parties may intercept and use that information. Although we seek to protect your personal information and privacy, we cannot guarantee the security of any information you disclose online. To the extent permitted under applicable law, we assume no liability or responsibility for disclosure of your information due to errors in transmission, unauthorized access by third parties, or other causes beyond our control.
You play an important role in keeping your information secure. You should not share your username or password with anyone. If you have reason to believe that your account is no longer secure, please contact us immediately at the contact information in the How to Contact Us section below.
13. Additional Disclosures for Residents of California
For residents of California, this section describes how we collect, use, disclose, “sell,” and/or “share” (as defined under California law) the personal information of California residents, and the rights you may have under California law. These disclosures are intended to supplement this Privacy Policy with information required by California law.
To understand what personal information we may have collected about you in the past 12 months, and from where we collected it, please see the section titled Information We Collect above.
We collect this personal information, as further described in the section titled Our Use of Personal Information above, to operate, manage, and maintain our business, to provide our products and services, and to accomplish our business purposes and objectives.
We may disclose personal information to the categories of third parties listed above in the section titled Our Disclosure of Personal Information. Below, we have provided more detail regarding the two ways we may disclose your personal information: (i) “sales” of personal information or “sharing” personal information for purposes of cross-context behavioral advertising; and (ii) general disclosures of personal information for a business purpose.
“Sales” and “Sharing” of Personal Information
We have marked “sales” and "sharing" in quotation marks because these terms have broader meanings under California law than in their everyday use. A "sale" includes any disclosure of personal information to a third party in return for anything of value, not just money. "Sharing" refers to disclosing personal information to third parties for cross-context behavioral advertising, such as showing you ads based on your activity across different websites. Exxat does not receive monetary compensation in exchange for personal information. However, the Site's use of standard third-party cookies and digital trackers (such as those used by advertising networks and analytics providers) may constitute a "sale" or "sharing" of personal information under the California Consumer Privacy Act (“CCPA”). For example, when we use cookies to help advertising partners promote our services, those partners may be able to use the cookie data for their own purposes beyond our direct business relationship. This triggers your right to opt out of such activities, which is described in detail under Your Rights at the end of this Section.
In the past 12 months, we may have “sold” or “shared” the following categories of personal information to the following categories of third parties:
Identifiers- Advertising Networks
Device Information- Advertising Networks
Internet Activity- Advertising Networks
Disclosures of Personal Information for a Business Purpose
To manage our business and provide services to you, we sometimes disclose personal information to third-party service providers. These Service Providers cannot further collect, sell, or use the personal information that we disclose to them except as necessary for them to provide the contracted services to us, and in accordance with our instructions. Please note that we only use or disclose your sensitive personal information for the permitted purposes set forth in Section 7027(m) of the CCPA regulations and we do not collect or process sensitive personal information with the purpose of inferring any characteristics about California residents.
In the past 12 months, we may have disclosed the following categories of personal information to the following third parties for our operational business purposes:
Identifiers
- Service Providers
- Health Professional Schools
- Advisers and Financial Institutions
- Third Parties in Connection with Corporate Transactions
- Government Bodies, Dispute Resolution Organizations, Law Enforcement Agencies and Third Parties
Professional and/or Employment Information
- Service Providers
- Health Professional Schools
- Advisers and Financial Institutions
- Third Parties in Connection with Corporate Transactions
- Government Bodies, Dispute Resolution Organizations, Law Enforcement Agencies and Third Parties
Education Records
- Service Providers
- Health Professional Schools
- Advisers and Financial Institutions
- Third Parties in Connection with Corporate Transactions
- Government Bodies, Dispute Resolution Organizations, Law Enforcement Agencies and Third Parties
Health Information
- Service Providers
- Health Professional Schools
- Advisers and Financial Institutions
- Third Parties in Connection with Corporate Transactions
- Government Bodies, Dispute Resolution Organizations, Law Enforcement Agencies and Third Parties
Background Checks and Drug Screenings
- Service Providers
- Health Professional Schools
- Advisers and Financial Institutions
- Third Parties in Connection with Corporate Transactions
- Government Bodies, Dispute Resolution Organizations, Law Enforcement Agencies and Third Parties
Demographics and Characteristics
- Service Providers
- Health Professional Schools
- Advisers and Financial Institutions
- Third Parties in Connection with Corporate Transactions
- Government Bodies, Dispute Resolution Organizations, Law Enforcement Agencies and Third Parties
User-generated Content
- Service Providers
- Health Professional Schools
- Advisers and Financial Institutions
- Third Parties in Connection with Corporate Transactions
- Government Bodies, Dispute Resolution Organizations, Law Enforcement Agencies and Third Parties
Audio-Visual Information
- Service Providers
- Health Professional Schools
- Advisers and Financial Institutions
- Third Parties in Connection with Corporate Transactions
- Government Bodies, Dispute Resolution Organizations, Law Enforcement Agencies and Third Parties
Device Information
- Service Providers
- Health Professional Schools
- Advisers and Financial Institutions
- Third Parties in Connection with Corporate Transactions
- Government Bodies, Dispute Resolution Organizations, Law Enforcement Agencies and Third Parties
Geolocation Data
- Service Providers
- Health Professional Schools
- Advisers and Financial Institutions
- Third Parties in Connection with Corporate Transactions
- Government Bodies, Dispute Resolution Organizations, Law Enforcement Agencies and Third Parties
Internet Activity
- Service Providers
- Health Professional Schools
- Advisers and Financial Institutions
- Third Parties in Connection with Corporate Transactions
- Government Bodies, Dispute Resolution Organizations, Law Enforcement Agencies and Third Parties
Other Identifying Information that You Voluntarily Choose to Provide
- Service Providers
- Health Professional Schools
- Advisers and Financial Institutions
- Third Parties in Connection with Corporate Transactions
- Government Bodies, Dispute Resolution Organizations, Law Enforcement Agencies and Third Parties
Your Rights
Under California law, you have a right to receive notice, upon collection, of the categories of personal information collected and the purposes for which the information will be used. You have the right to: (i) access a copy of the categories and specific pieces of personal information about you that we collect, use, disclose, and/or “sell” or “share”; (ii) ask us to delete your personal information; and (iii) to correct inaccurate personal information that we maintain about you, subject to certain exceptions. You also have the right to opt out of the “sale” or “sharing” of your personal information and the right to request that we limit the use and disclosure of your sensitive personal information, where applicable. Finally, you have the right to be free from discrimination for exercising your rights.
These rights apply to personal information for which we act as a business or controller under applicable law, which generally includes information we collect and use directing in connection with our own operations, such as through our website, communications, or other direct interactions with you. Where we process personal information on behalf of an educational institution or other organization that uses the Service, that organization is responsible for responding to your request, and you should contact that organization directly to exercise your rights. We will assist Customers in responding to such requests as required by applicable law and our contractual obligations.
Certain privacy rights (such as the right to opt out of the “sale” or “sharing” of personal information and the right to limit the use of sensitive personal information) may be exercised without submitting a verifiable consumer request. Other rights (such as the rights to access, correct, or delete personal information) require us to verify your identity before processing your request. Additional information about how to submit a request and how we verify requests is provided in Section 14 below.
You may exercise your right to opt-out of “sales” or “sharing” of your personal information by clicking this link and following the instructions: “Do Not Sell or Share My Personal Information.” We also recognize the Global Privacy Control (“GPC”) as a valid consumer request to opt out of marketing cookies for the browser that you use to access the Site.
14. Exercising Your Rights Under Applicable Privacy Laws
To exercise the rights described in this Privacy Policy you, or, if you are a California resident, your Authorized Agent (defined below), must send us a request that:
- provides sufficient information to allow us to verify that you are the person about whom we have collected personal information; and
- describes your request in sufficient detail to allow us to understand, evaluate and respond to it.
Requests meeting these requirements are considered “Verifiable Consumer Requests.”
Where we process personal information behalf of an educational institution or other organization that uses the Service, that organization is responsible for responding to your request. In such cases, we may direct you to submit your request to the relevant organization, and we will assist Customers in responding to such requests as required by applicable law and in accordance with our contractual obligations.
These verification requirements apply only to requests that require identity verification under applicable law (for example, requests to access, correct, or delete personal information). Requests to opt-out of the “sale” or “sharing” of personal information or to limit the use of sensitive personal information do not require identity verification.
We will only use personal information provided in connection with a Verifiable Consumer Request to verify your identity and complete your request. You do not need to create an account to submit a Verifiable Consumer Request.
You may submit a Verifiable Consumer Request using the following methods:
- Email us at: info@exxat.com
We will respond to Verifiable Consumer Requests within the timeframes required by applicable law.
Authorized Agents
If you are a California resident, you may also authorize an agent (an “Authorized Agent”) to exercise your rights on your behalf. To do this, you must provide your Authorized Agent with written permission to exercise your rights on your behalf, and we may request a copy of this written permission from your Authorized Agent when they make a request on your behalf.
15. Links to Other Websites
For your convenience, we may link to third-party sites and services or otherwise display third-party content through the Service to provide increased value to our visitors. We have no control over these linked sites, each of which has separate privacy and data collection policies and practices independent from us. As such we have no responsibility or liability for these independent policies or actions and are not responsible for the privacy practices or the content of any such websites. Please note that these other sites may send their own cookies to users, collect data, or solicit personal information, and we encourage you to review their policies before engaging with these third-party sites.
16. Effective Date and Changes to This Privacy Policy
This Privacy Policy is effective as of the date at the top of this page. Exxat has the discretion to update this Privacy Policy at any time. When we do, we will revise the effective date at the top of this page. We encourage users to frequently check this page for any changes and to stay informed about how we are helping to protect the personal information we collect, especially before you provide information, and particularly personal information, directly to us through the Service. In the event of a material change to this Privacy Policy, we will provide a message through our website or via email informing you of the change.
17. How to Contact Us
If you have any questions about this Privacy Policy or the Service, please contact us at info@exxat.com or support@exxat.com. In addition, you may contact us at www.exxat.com/contact-us or use the live chat feature available on the Site.