Novapulse SMS Opt-In & Consent Policy

Document owner: Novapulse Compliance

Version: 1.0

Last updated: 04-20-2026

Review cadence: Annual, or on material change to messaging program

1. Purpose & Scope

This policy documents how Novapulse ("we," "the Platform") obtains, records, and honors end-user consent for SMS text messages sent through the Novapulse platform. It applies to all SMS traffic originated from Novapulse-provisioned phone numbers and registered under our A2P 10DLC Campaign with The Campaign Registry (TCR).

This policy exists to demonstrate compliance with:

TCPA (Telephone Consumer Protection Act, 47 U.S.C. § 227)
CTIA Messaging Principles and Best Practices
Carrier 10DLC requirements (AT&T, T-Mobile, Verizon, U.S. Cellular) as enforced through TCR
HIPAA (for messages involving protected health information or patient-identifying content)
Twilio Acceptable Use Policy and the signed Business Associate Agreement (BAA)

2. Message Types Covered

All SMS sent through Novapulse is transactional. We do not send marketing, promotional, or third-party advertising content. Three message types are registered under the campaign:

#	Recipient	Message Type	Purpose
1	Clinic / practice staff	Passwordless login magic link	Authenticates a user session in the Novapulse web application
2	Clinic / practice staff	Voicemail notification with magic link	Alerts staff to a new patient voicemail and provides secure access to it
3	Patients of participating clinics	Secure conversation link	Delivers status updates and a secure channel to continue a conversation initiated by the patient via voicemail

Any new message type must be added to this policy and re-registered with the carrier campaign before being sent.

3. Opt-In: Clinic and Practice Staff

3.1 Mechanism

Staff opt-in occurs during account creation on the Novapulse web application, or when invited to join an existing clinic workspace.

During signup, the user:

Enters their mobile phone number in a dedicated field.
Is presented with a consent checkbox that is unchecked by default.
Must affirmatively check the box to complete signup.
Sees links to the Privacy Policy and Terms & Conditions directly beneath the checkbox.

3.2 Required Disclosure Language

The checkbox label reads, verbatim:

I agree to receive SMS messages from Novapulse, including passwordless login links and notifications about new patient voicemails. Message and data rates may apply. Message frequency varies based on account activity. Reply HELP for help or STOP to unsubscribe.

3.3 Record Captured

For each staff opt-in, Novapulse stores:

User ID and associated clinic workspace
Phone number (E.164 format)
Timestamp of consent (UTC)
IP address at time of consent
User-agent string
Version of Terms & Conditions and Privacy Policy accepted
Exact disclosure text presented

These records are retained for the lifetime of the account plus four (4) years after account closure.

4. Opt-In: Patients (via Participating Clinics)

Patients are not signed up directly through Novapulse. Opt-in is facilitated by the participating clinic or practice as part of the clinic's standard patient onboarding or intake process. This is a third-party-facilitated consent model, and it is governed by the obligations below.

4.1 Mechanism

During patient intake (whether paper-based, tablet-based, or via the clinic's patient portal), the patient is presented with an SMS consent disclosure and must affirmatively opt in by checking a box, signing, or electronically signing before the clinic transmits the patient's phone number to Novapulse.

A phone number is not enrolled in the Novapulse SMS program until the clinic attests that valid consent has been captured.

4.2 Required Disclosure Language

Participating clinics must present, at minimum, the following disclosure to patients. The clinic may adapt formatting but must not materially alter the wording:

I agree to receive SMS text messages from Novapulse on behalf of [Clinic Name] if I leave a voicemail with the practice. These messages will contain a secure link to view the status of my voicemail and to communicate with the practice. Message and data rates may apply. Message frequency varies. I can opt out at any time by replying STOP to any message, or by contacting the practice directly.

4.3 Clinic Obligations

Every participating clinic is contractually required to:

Present the disclosure above, verbatim or with only non-material formatting changes, to every patient before enrolling their phone number.
Obtain the patient's affirmative opt-in (checkbox, signature, or electronic signature) and not use passive or pre-checked consent.
Retain the record of consent, including timestamp, patient identifier, and disclosure version, for a minimum of four (4) years.
Provide the consent record to Novapulse within five (5) business days of a written request (for example, in response to a carrier audit, consumer complaint, or regulatory inquiry).
Immediately notify Novapulse when a patient revokes consent so the number can be suppressed platform-wide.
Not enroll any phone number where consent was not clearly obtained.

These obligations are specified in the Novapulse Clinic Services Agreement and the accompanying Business Associate Agreement (BAA).

4.4 Record Captured by Novapulse

For each patient enrollment, Novapulse stores:

Patient phone number (E.164 format)
Associated clinic ID
Timestamp of enrollment in Novapulse
Clinic attestation that valid consent was captured
Reference to the clinic's internal consent record (pointer, not PHI)

5. Message Content Restrictions

Messages sent under this campaign will not include:

Marketing, promotional, or upsell content
Third-party advertising
Direct lending or loan offers
Age-gated content (alcohol, cannabis, firearms, gambling, tobacco, adult content)
S.H.A.F.T. content of any kind
Protected health information (PHI) in the message body itself. All clinical or sensitive information is delivered exclusively behind the magic link, following authentication.

All SMS communications containing or referencing PHI are governed by our HIPAA Security Policy and the Twilio BAA.

6. Opt-Out

6.1 Keywords Honored

The following keywords, in any case and with reasonable variation, trigger immediate opt-out: STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, QUIT.

6.2 Confirmation Message

Upon receipt of an opt-out keyword, the user receives exactly one final confirmation message:

Novapulse: You have been unsubscribed and will not receive further messages. Reply START to resubscribe.

No further messages are sent to that number unless the user re-enrolls.

6.3 Additional Opt-Out Channels

Users may also opt out by:

Emailing support@novapulse.care
Contacting the participating clinic directly (for patient-facing messages)
Toggling SMS off in their Novapulse account settings (staff only)

Regardless of channel, opt-out is honored across the entire platform (not per-clinic or per-message-type) within one (1) business day for manual channels and immediately for keyword opt-outs.

6.4 Opt-Out Record

Novapulse maintains a platform-wide suppression list. A suppressed number will not receive SMS traffic from any clinic or campaign until the user affirmatively re-enrolls through a valid opt-in mechanism.

7. HELP Response

Upon receipt of HELP (or INFO, SUPPORT) from any recipient, Novapulse responds with:

Novapulse: Reply STOP to unsubscribe. Msg&data rates may apply.

8. Revocation of Consent & Right to Deletion

Users may revoke consent at any time via any channel listed in Section 6. Revocation is permanent unless the user re-enrolls through a valid opt-in path.

Users may also request deletion of their consent records by emailing privacy@novapulse.care. Where deletion is inconsistent with our legal retention obligations (for example, carrier audit records under TCR rules), we retain only the minimum record required and delete the remainder.

9. Record Retention

Record Type	Retention Period
Staff opt-in evidence	Lifetime of account + 4 years
Patient enrollment attestation	4 years from enrollment
Opt-out events	4 years from event
Message delivery logs	18 months (per Twilio retention)
Clinic consent records (held by clinic)	Minimum 4 years (per Clinic Agreement)

10. Audit & Enforcement

Novapulse reserves the right to audit any participating clinic's consent-capture practices at any time. Clinics that fail to meet their obligations under Section 4.3 may be suspended from the platform.

Novapulse will cooperate fully with carrier audits (T-Mobile, AT&T, Verizon, U.S. Cellular) and regulatory inquiries and will produce consent evidence within the timelines required.

11. Policy Changes

Material changes to this policy are communicated to participating clinics at least thirty (30) days before taking effect. Changes that affect end-user-facing disclosures require re-consent where required by TCPA or CTIA guidance.

12. Contact

General SMS support: support@novapulse.care
Privacy & data requests: privacy@novapulse.care
Compliance / carrier audits: compliance@novapulse.care
Mailing address: [Coconut Ventures LLC mailing address]

Appendix A - Registered Campaign Sample Messages

Novapulse: Your One-Time Password to view the status of your voicemail for [Clinic Name] is 123456. You can view the status at https://www.novapulse.care/status/1a2b3c. Reply HELP for help, STOP to opt out.
Novapulse: You have a new voicemail in your department. View at https://app.novapulse.care/api/auth/magic-link/verify?token=sOSHUIAOKnvoRfNKpaYkOBJBMmqYPcPg&callbackURL=%2Fvoicemails%2F69d7af36e5ca7553e401129f. Reply HELP for help, STOP to opt out.
Novapulse: [clinic name] has received your voicemail. View status and reply securely: https://novapulse.care/s/abc123. Reply HELP for help, STOP to opt out.
Novapulse: Your secure login link for [clinic name] is https://app.novapulse.care/m/q4r8t2. Expires in 15 minutes. Do not share this link.

Appendix B - Clinic Patient Intake Consent Snippet

Provided to every participating clinic as part of onboarding. Clinics must integrate the following language into their patient intake workflow (paper, tablet, or EHR-based):

SMS Communications Consent

☐ I agree to receive SMS text messages from Novapulse on behalf of [Clinic Name] if I leave a voicemail with the practice. These messages will contain a secure link to view the status of my voicemail and to communicate with the practice. Message and data rates may apply. Message frequency varies. I can opt out at any time by replying STOP to any message, or by contacting the practice directly.

Patient signature: _________________________ Date: ____________

End of policy.