Recorded template baseline: September 18, 2024. Historical bundle release: July 9, 2026. Actual agreement and notice dates depend on execution or adoption. This resource does not establish operational compliance.

Financial Data and GLBA Policy

Template and counsel-review notice. This document is a website/app integration template, not a legal opinion. Before publication, replace bracketed placeholders, confirm actual data flows, obtain advice from qualified counsel for each jurisdiction and regulated workflow, and approve final wording through privacy, security, product, marketing, health/clinical, and executive stakeholders. Do not promise controls, certifications, response times, retention periods, or legal rights unless they are actually implemented and operationally supported.

Recorded template baseline: September 18, 2024
Last updated: September 30, 2026
Organization: NEXQ Inc.
Services covered: NEXQ websites, web applications, protected workspace surfaces, mobile app surfaces, APIs, secure healthcare and healthtech workflow demonstrations, security and post-quantum readiness planning, diagnostics-workflow support concepts, oncology workflow research, cardiovascular longevity research, research collaboration, support, and related services
Privacy contact: hello@nexq.us
Security contact: hello@nexq.us
Mailing address: Irvine, CA, United States — contact hello@nexq.us for legal notices

1. Scope

This policy applies to financial products, payment workflows, credit, lending, insurance, tax, bank, investment, financial-wellness, customer financial records, account aggregation, fraud review, and financial-service integrations.

2. GLBA and safeguards

If the organization is a financial institution or service provider subject to GLBA, provide privacy notices and opt-out rights where required, maintain a written information security program, assess risks, implement safeguards, oversee service providers, train personnel, monitor controls, and handle qualifying security events according to applicable FTC Safeguards Rule requirements.

3. Payment data and PCI

Use approved, tokenized payment processing through PCI-compliant payment processors. For merchant payment processing, do not retain card-verification codes (including CVV), full track data, or PIN/PIN-block data after authorization, even if encrypted. Internal approval cannot waive applicable PCI DSS restrictions. Any permitted retention of other cardholder data, including full card numbers, requires express approval by security, finance, and legal, a documented need, appropriate protection, retention limits, and payment-compliance review. PCI DSS is a payment-industry standard and contractual requirement where applicable, not a United States statute.

4. Consumer reports and credit data

Consumer reports, credit scores, eligibility determinations, adverse-action workflows, and identity verification may trigger FCRA, ECOA, state law, and customer contract obligations. AI or automated decision tools in financial eligibility require separate impact assessment and legal approval.

5. Data minimization and retention

Collect only financial data required for the approved purpose. Encrypt financial records, restrict access, log access, segregate environments, and map data to the retention schedule. Delete or deidentify data when no longer needed, subject to legal holds and regulatory retention requirements.

Do not use financial data for targeted advertising, sale/share, lookalike audiences, AI training, or cross-product marketing unless counsel confirms the use is lawful and notices/opt-outs/consents are implemented.

Payment reference

PCI Security Standards Council guidance on card-verification codes confirms the post-authorization prohibition. This policy does not attest to NEXQ’s payment architecture or PCI validation status.