Goodison Systems Hub Privacy Policy

Effective October 1, 2026

Who we are

Goodison Systems Hub is being developed by Goodison Collective LLC, Florida, to organize business communications, client-update notifications, and follow-up work.

Contact: krissy@thegoodisongroup.com.

Current status

The Hub is being released in controlled stages for the owner's authorized business communications and follow-up work. Authorized Gmail intake and the four operational queues are active. AI-assisted reply preparation and internal working documents are a separate capability that may be enabled only after the relevant service, privacy and production checks pass. Client-specific preparation is confined to an explicitly approved protected environment. Prepared work remains in the private Hub for the owner to review and edit. Gmail draft creation and CRM writeback require separate implementation and verification. Autonomous external sending remains disabled. Publication of this notice does not itself enable any capability.

Google account access

With the account holder's authorization, the Core Insurance Solutions email connection uses Gmail read-only access (gmail.readonly) and permission to manage drafts and send emails (gmail.compose). These permissions apply across the authorized mailbox; Google does not limit them to MedicarePRO notifications. Although compose permission includes sending, the Hub does not enable autonomous sending.

The authorized release processes new inbox communications after activation to identify requests and maintain follow-up work. At initial activation, it may also review inbox communications received during the preceding 48 hours solely to identify unresolved requests and establish follow-up work. It does not perform a broader historical mailbox import. When draft creation is separately implemented and enabled, eligible drafts will remain in Gmail for the owner to review and send. No external message is sent merely because an item is ingested or a draft exists.

Google’s permission description

Information and purpose

The connection handles account identity, authentication credentials and sign-in audit metadata. After activation, the worker processes message and thread identifiers, sender and recipient headers, subject and time. In the separately reviewed bounded-text mode, it processes limited inline plain text and retains at most 1,200 characters as a request excerpt on the operational item. The excerpt is not a verified statement of fact. Full message bodies, attachments and quoted message histories are not retained as separate Hub source records. Unsupported or incomplete content requires review in Gmail.

Operational records include source references, request and next-action review state, identity-matching evidence, workflow status and audit history. When preparation is enabled, they may also contain a proposed reply, an internal working document, review checks and owner edits. These are working materials, not verified research, completed business actions or authoritative client facts. MedicarePRO remains the authoritative CRM. A confident match uses its Contact ID; uncertain matches remain visible for review and are excluded from automatic preparation. These records do not authorize an automatic overwrite of existing CRM information. Routine append-only CRM documentation will be enabled only after its supported write contract is verified; material CRM changes continue to require owner approval.

OAuth credentials support the authorized connection; they are not intended for display in operational records.

Use, storage, and sharing

Google account data is limited to the disclosed communication and follow-up functions. It is not sold, used for advertising, or used to train general-purpose AI models. When separately enabled inside the approved protected environment, AI-assisted preparation uses the existing bounded request excerpt, a limited subject and source timing to prepare a reply and an internal working document. The excerpt may contain personal or health information. The Hub does not add attachments, full conversation histories, authentication credentials, sender-address fields or MedicarePRO Contact ID fields to that request. This minimization does not mean that the excerpt itself is de-identified. No client-derived content may be transmitted to an AI provider outside the approved protected environment. This restriction covers names, contact information, MedicarePRO and other CRM identifiers, beneficiary identifiers, health information, medications, providers, plan selections, correspondence, attachments, source URLs, client-specific summaries and derived client facts. Any permitted generic assistance outside that environment receives only fixed generic instructions, placeholders and a fresh cryptographically random opaque token for that job. The token is not derived from a client identifier or reused as a persistent client pseudonym. Its mapping to operational work remains exclusively in the protected Hub. Re-association and insertion of client-specific information occur only after the generic result returns to the protected environment.

The private backend uses Google Cloud Run, Firestore and Secret Manager in the Goodison Google Cloud project. The intake worker and operational database are in us-east1. Approved identity resolution uses the existing private MedicarePRO read service in us-west1. Separately enabled client-specific AI preparation uses Google's Gemini 3.5 Flash model through Google Cloud's US multi-region service only after that exact account, service, endpoint, contractual coverage and data handling have been verified and approved as part of the protected environment. A general vendor agreement or an unverified model endpoint is not sufficient. This release does not connect a provider outside that protected environment to client content. Prepared replies and working documents are stored on the existing operational record and follow its retention, access and recovery controls. Source changes invalidate outdated prepared work, and owner edits are recorded in the audit history. No mailbox content is connected to the synthetic Sites prototype or its separate database. The public website does not receive Gmail credentials or operational client records. Application diagnostic logs contain status codes and counts rather than prompts, prepared text, client-message content or credentials. Model request/response content logging and in-memory model caching must be disabled before this preparation capability is activated. Google's separate abuse-monitoring rules may retain flagged prompts for up to 90 days; the applicable contractual requirements and retention must be verified before activation. The Hub does not claim zero provider retention.

Disclosure to service providers is limited to delivering the authorized functions. Human access to Google data requires the user’s affirmative agreement to the specific data, except where Google’s policy permits access for security or legal reasons.

Google API data handling is subject to the Google API Services User Data Policy, including Limited Use restrictions.

Retention and deletion

Active operational items remain while work is unresolved, including unmatched items. The operational policy calls for review of stale items every 30 days; age alone does not resolve or delete an item. Closed working records become eligible for removal 90 days after the later of closure and verified preservation of required information, only when classification is complete and no hold applies. Automatic deletion of operational records is not enabled. Destructive batches require the owner's approval, and uncertain records remain protected.

Required business and compliance records follow their applicable legal, contractual and preservation requirements. The company baseline for minimal access, approval, deletion and security audit evidence is six years, or longer where required. Routine Google Cloud diagnostic logs currently retain for 30 days; mandatory platform logs retain for 400 days. Firestore has a seven-day point-in-time recovery window and daily backups that expire after 35 days. Recovery copies are restricted and are not an indefinite compliance archive. Logical deletion does not mean that every recovery copy or provider-managed physical copy has immediately disappeared. Deletion decisions must be reapplied before restored data is made available to the application.

Connection credentials are retained only for an authorized connection. On a confirmed disconnect or compromise, further collection must stop and the affected credential must be disabled; the policy targets destruction of retired credentials within seven days, subject to preservation requirements and provider behavior. Disconnecting Google does not automatically delete previously stored records. Contact us for review, correction or deletion, subject to applicable recordkeeping obligations. Do not include medical information or credentials in an initial request.

Your choices

You can revoke access through Google Account connections. Please do not include medical information, passwords, or access tokens in an initial support request.

This website

These information pages are hosted using ZenBusiness Website Builder and are separate from the private Hub application. They do not provide access to connected mailboxes or client records and are not a client intake portal.

Hosting services may process technical information, such as IP addresses, browser details, and request logs, to deliver and secure the website. No Google tracking IDs are configured through the website editor’s Google Tools setting.

Please do not submit medical information, passwords, authentication tokens, or private client-portal links through this website.

Changes

Changes to data access or use will be disclosed before activation, with renewed authorization where required.