Nuvem.health, Nuvem340b.com

The timeline behind nuvem.health

Registration, the decision and the archived record of what this domain actually displayed — from public RDAP and the Internet Archive.

How each disputed name was decided in this proceeding.

Result of record. The panel's reasoning and decisive facts behind each element are in the Intelligence dossier below.

ARBITRATION AND MEDIATION CENTER ADMINISTRATIVE PANEL DECISION 340B Technologies, Inc. d/b/a Nuvem v. Albert Rojas Case No. D2025-4322 1. The Parties The Complainant is 340B Technologies, Inc. d/b/a Nuvem, United States of America (“United States”), represented by Davis Wright Tremaine LLP, United States. The Respondent is Albert Rojas, United States, self-represented. 2. The Domain Names and Registrar The disputed domain names <nuvem.health> and <nuvem340b.com> are registered with GoDaddy.com, LLC (the “Registrar”). 3. Procedural History The Complaint was filed with the WIPO Arbitration and Mediation Center (the “Center”) on October 22, 2025. On October 22, 2025, the Center transmitted by email to the Registrar a request for registrar verification in connection with the disputed domain names. On October 22, 2025, the Registrar transmitted by email to the Center its verification response confirming that the Respondent is listed as the registrant and providing the contact details. The Center verified that the Complaint satisfied the formal requirements of the Uniform Domain Name Dispute Resolution Policy (the “Policy” or “UDRP”), the Rules for Uniform Domain Name Dispute Resolution Policy (the “Rules”), and the WIPO Supplemental Rules for Uniform Domain Name Dispute Resolution Policy (the “Supplemental Rules”). In accordance with the Rules, paragraphs 2 and 4, the Center formally notified the Respondent of the Complaint, and the proceedings commenced on October 24, 2025. In accordance with the Rules, paragraph 5, the due date for Response was November 13, 2025. The Response was filed with the Center on October 24, 2025. On October 27, 2025, the Respondent submitted a Supplemental Filing to the Center. The Center appointed W. Scott Blackmer as the sole panelist in this matter on October 30, 2025. The Panel finds that it was properly constituted. The Panel has submitted the Statement of Acceptance and Declaration of Impartiality and Independence, as required by the Center to ensure compliance with the Rules, paragraph 7. page 2 4. Factual Background The Complainant is a corporation organized under the laws of the State of Delaware, United States and headquartered in Sharon Hill, Pennsylvania, United States. It is an “integrated pharmacy solutions partner that optimizes accessibility and adherence to medication improving clinical care for non-profit healthcare organizations” under the NUVEM brand. As indicated by the Complainant’s name and the Complainant’s website at “www.nuvem.com”, the Complainant uses proprietary software to help healthcare organizations maximize price reductions on outpatient drugs for low-income and uninsured patients under Section 340B of the federal Public Health Service Act of 1992. The Complainant states that it is a leading provider of this niche service. The Complainant holds United States trademark registration number 6142318 (registered on September 1, 2020) in international classes 35, 44, and 45 for a figurative mark featuring the word NUVEM in stylized letters following two checkmarks. This logo is prominently displayed on the Complainant’s website. The Complainant states that it employed the Respondent for nine days in October 2023 and then terminated him for repeated violations of the Complainant’s policies on attendance and punctuality. The Complaint attaches the Employee Confidentiality and Intellectual Property Assignment Agreement (“Confidentiality Agreement”) signed by the Respondent on October 10, 2023. This includes a provision to maintain the confidentiality of “all information not generally known outside of 340B Technologies Inc. and its business, regardless of whether such information is written, oral, electronic, digital, or other form”. The agreement further provides that the Complainant is entitled to recover damages for breach of the agreement “even after the termination of my employment”. The Complainant recounts that after his termination, the Respondent published a website directed against the Complainant, using the domain name <nuvem.nyc>. The Respondent’s website reproduced materials from the Respondent’s brief tenure as an employee, including a notice that the Respondent sent to the United States Department of Health and Human Services concerning his view that there was a security vulnerability in the Complainant’s information technology systems that risked exposing protected personal health information. The Respondent asserted that this was the real reason for his termination. Contacted by the Complainant about the website, the Respondent replied in part in an email dated June 14, 2024, “I dare Nuvem to bring a lawsuit against me ... we have laws we need to follow”. The Parties engaged in settlement discussions over the website, and in August 2024 counsel for the Respondent conveyed a demand for USD 250,000, plus attorneys’ fees, in exchange for relinquishing the domain name <nuvem.nyc> and the Respondent’s website. The Parties ultimately reached an agreement effective in January 2025 under which the Complainant paid the Respondent USD 10,000 and the Respondent agreed to “surrender” the domain name <nuvem.nyc> “as well as any other domain name that uses or otherwise references the Company, its Affiliates, and/or their trade names” and to return and destroy all copies of the Complainant’s property, subject to liquidated damages for breach. The Respondent relinquished the domain name <nuvem.nyc>. 1 (The Panel notes that this domain name now resolves to a landing page offering the domain name for sale and featuring GoDaddy advertising links.) Meanwhile, the Respondent registered the disputed domain name <nuvem.health> on November 7, 2024, listing a postal address in the State of California, United States, and a Gmail contact email address. The Respondent later registered the disputed domain name <nuvem340b.com> on May 23, 2025, giving the same contact details. At some point, despite the settlement agreement, the Respondent reposted the Respondent’s “whistleblower” website using the disputed domain name <nuvem.health> and then redirected that disputed domain name to the disputed domain name <nuvem340b.com>, where the Respondent’s website is found at the time of this Decision. 1 The documents attached to the Complaint show that the settlement agreement and accompanying confession of judgment were originally dated in October 2024 (before the registration of the disputed domain name <nuvem.health> and ultimately signed by the Respondent in January 2025 (before the registration of the disputed domain name <nuvem340b.com>). page 3 The Respondent also brought a legal action against the Complainant in federal district court on June 4, 2025, Rojas v. Nuvem Health LLC, 1:25-cv-04684 (USDC, SD NY) (the “federal lawsuit”), citing whistleblower protection laws, including anti-retaliation claims, as described on the Respondent’s website. That action is pending at the time of this Decision. The Respondent’s website consists of a home page and “selected exhibits”. It does not present commercial advertising for the Respondent or third parties but serves as a criticism site aimed at the Complainant. The home page displays the Complainant’s trademarked logo under a banner that reads, “Nuvem Legal Notice: Protected Whistleblower Disclosure”, with the words “Protected Whistleblower Disclosure” also highlighted after the logo and followed by citations to United States and New York statutes protecting “whistleblowers” (employees or other individuals who report suspected illegal or unethical activities within an organization). The home page then displays the following text: “Legal Notice: This archive reproduces evidence filed in Rojas v. Nuvem Health LLC, No. 1:25-cv-04684 (SDNY), under 28 U.S.C. § 1746. Originally published on Nuvem.health, now hosted for continuity of public-interest record under federal whistleblower protection statutes. All materials are non-commercial, redacted, and statutorily immune from liability under 18 U.S.C. § 1833(b).” After this, a “Juror-Facing One-Pager (plain-language copy)” explains that the Respondent, an information technology employee, was terminated by the Complainant in 2023 after raising a security concern with the Complainant and filing a security breach notice with a federal government authority. The narrative is supported by exhibits produced in the court proceeding mentioned above, the Respondent’s breach notice to the United States Department of Health and Human Services, a disclosure timeline, and contemporaneous emails, as well as the Respondent’s declaration submitted in October 2025 in the ongoing judicial proceeding. A small-print disclaimer of affiliation with the Complainant can be found by scrolling down in two or three places on the Respondent’s website: “Unofficial whistleblower archive • Not affiliated with Nuvem • Noncommercial” There is no copyright notice on the Respondent’s website, and there is no explicit statement identifying the website operator. The Complainant reports that the Respondent is also involved in a legal action brought by a subsequent employer, Mphasis Corporation v. Albert Rojas, 25-CV-3175 (USDC, SD NY) (the “Mphasis lawsuit”), after the Respondent posted a similar “whistleblower” website about that former employer (now found at “www.qbe.world/mphasis-retaliation-1”). The Complainant has intervened in that action in an effort to retrieve the Complainant’s proprietary information suspected to reside on the Respondent’s laptop, which is subject to forensic examination in the Mphasis lawsuit. page 4 5. Parties’ Contentions A. Complainant The Complainant contends that it has satisfied each of the elements required under the Policy for a transfer of the disputed domain names. Notably, the Complainant contends that the disputed domain names are confusingly similar to its registered NUVEM trademark because they wholly incorporate it. The Complainant argues that the Respondent has no permission to use the mark and, in fact, violates contractual commitments in doing so. The Complainant argues that even if the Respondent characterizes its activities online as “whistleblowing”, this does not give the Respondent the right to misappropriate the Complainant’s intellectual property or to register a domain name identical to the Complainant’s mark, citing WIPO Overview of WIPO Panel Views on Selected UDRP Questions, Third Edition (WIPO Overview 3.0), section 2.6.2. The Complainant contends that the Respondent registered and used the disputed domain names in bad faith, not genuinely criticizing the Complainant but rather publishing confidential information in violation of the Respondent’s contracts with the Complainant and using domain names identical to the Complainant’s trademark to create confusion as to source or affiliation. The Complainant argues further that the Respondent’s “exorbitant” demand for USD 250,000 is evidence of bad faith. B. Respondent The Respondent contends that the Complainant has not satisfied all three of the elements required under the Policy for a transfer of the disputed domain names. The Respondent claims that the disputed domain names are not used to impersonate the Complainant or to commercially compete with the Complainant but are used nominatively to identify the subject of a protected disclosure of factual information in the public interest “consistent with whistleblower and journalistic transparency protected under the First Amendment and federal law”. The Respondent “maintains a legitimate, noncommercial, and fair-use interest in the domain names” in connection with reporting a security breach while employed by the Complainant, to “preserve public evidence and enable regulatory accountability”, citing WIPO Overview 3.0, section 2.6.2 to suggest that “criticism and whistleblower sites are lawful, fair-use expressions that create legitimate interest under the Policy.” The Respondent contends that the disputed domain names were registered “in good faith to host protected whistleblower disclosures after [the Complainant] ignored internal breach warnings and terminated Respondent days after his federal filing”. The Respondent’s Supplemental Filing is simply notice “for the Panel’s awareness” that the Respondent considers certain statements in the Complaint to be false (such as the reason for the Respondent’s termination from employment) and the Respondent’s intention accordingly to file for additional sanctions against the Complainant in the pending federal lawsuit under Federal Rules of Civil Procedure (“FRCP”) Rule 11(c)(2) unless the Complainant takes action to “withdraw or correct” these statements in all UDRP filings within 21 days (a so-called “safe harbor filing” under the FRCP). This has no effect in the current UDRP proceeding unless the Complainant seeks to file an amended Complaint or supplemental filing, and the Respondent expressly does not seek to submit further argument on these points “at this time”. Consequently, the Panel disregards the Respondent’s Supplemental Filing in rendering the following Decision. page 5 6. Discussion and Findings A. Identical or Confusingly Similar It is well accepted that the first element functions primarily as a standing requirement. The standing (or threshold) test for confusing similarity involves a reasoned but relatively straightforward comparison between the Complainant’s trademark and the disputed domain names. WIPO Overview 3.0, section 1.7. The Complainant has shown rights in respect of a trademark or service mark (the registered figurative mark featuring the word NUVEM in stylized letters following two checkmarks) for the purposes of the Policy. WIPO Overview 3.0, section 1.2.1. The Panel finds that the textual element of this mark is dominant and is identical to the disputed domain name <nuvem.health> and recognizable within the disputed domain name <nuvem340b.com>. Accordingly, the disputed domain name <nuvem.health> is identical to the mark, and the disputed domain name <nuvem340b.com> is confusingly similar to the mark for the purposes of the Policy. WIPO Overview 3.0, sections 1.7, 1.10. Although the addition of other terms (here, “340b” in the disputed domain name <nuvem340b.com>) may bear on assessment of the second and third elements, the Panel finds the addition of such terms does not prevent a finding of confusing similarity between the disputed domain name and the mark for the purposes of the Policy. WIPO Overview 3.0, section 1.8. The Respondent does not dispute that both of the disputed domain names were expressly intended to refer to the Complainant. The Panel finds the first element of the Policy has been established. B. Rights or Legitimate Interests Paragraph 4(c) of the Policy provides a list of circumstances in which the Respondent may demonstrate rights or legitimate interests in a disputed domain name, including 4(c)(iii), “making a legitimate noncommercial or fair use of the disputed domain name, without intent for commercial gain to misleadingly divert consumers or to tarnish the trademark or service mark at issue”. Although the overall burden of proof in UDRP proceedings is on the complainant, panels have recognized that proving a respondent lacks rights or legitimate interests in a domain name may result in the difficult task of “proving a negative”, requiring information that is often primarily within the knowledge or control of the respondent. As such, where a complainant makes out a prima facie case that the respondent lacks rights or legitimate interests, the burden of production on this element shifts to the respondent to come forward with relevant evidence demonstrating rights or legitimate interests in the domain name (although the burden of proof always remains on the complainant). Here, the Complainant makes such a prima facie case, demonstrating that the Respondent knowingly targeted the Complainant’s mark for identical or confusingly similar domain names used for a website with disparaging content including confidential and proprietary information, after signing the employee Confidentiality Agreement and the more recent settlement agreement not to maintain or use such domain names or sites. Thus, the Complainant argues, the Respondent had no claim to rights or legitimate interests with respect to these disputed domain names. Nevertheless, the Respondent claims nominative fair use of the disputed domain names for a criticism or “gripe site” that is confined to noncommercial commentary, as described in WIPO Overview 3.0, section 2.6.2. The Respondent argues that both the disputed domain names and the related website are protected in the United States by federal and state whistleblowing laws and freedom of speech under the United States Constitution’s First Amendment. The Panel finds that the Respondent’s website is critical and at least on a superficial level noncommercial (see discussion below on the Parties’ settlement and the Respondent’s present demands). To the extent that it publishes confidential material in violation of the Respondent’s agreements, the Complainant may have other legal remedies. The Panel is not here required to determine whether the content of the Respondent’s website falls within or outside the protection of the First Amendment or the cited whistleblowing statutes, or whether the Respondent waived those arguments by signing the settlement agreement with the Complainant. In any event, the First Amendment and the whistleblowing statutes do not explicitly refer to domain names, and UDRP panels dealing both with United States and non- page 6 United States parties have grappled with the issue of respecting freedom of expression while also avoiding unnecessary confusion and potential abuse when trademarks are identically or recognizably incorporated in domain names labeling gripe sites. The panel in Everytown for Gun Safety Action Fund, Inc. v. Contact Privacy Inc. Customer 1249561463 / Steve Coffman, WIPO Case No. D2022-0473 (“Momsdemand”) articulated a well-reasoned approach to fair use in the case of criticism sites. If the composition of the domain name is such that it is likely to be perceived as affiliated with the trademark holder – the “impersonation test” suggested in Dover Downs Dover Downs Gaming & Entertainment, Inc. v. Domains By Proxy, LLC / Harold Carter Jr, Purlin Pal LLC, WIPO Case No. D2019-0633 – then the panel should also consider other factors in context to determine whether the Respondent’s claimed criticism interest is genuine or pretextual (this has been dubbed a “holistic approach”). Here, the disputed domain names clearly fail the impersonation test and therefore trigger the more holistic approach. Neither includes terms that denote criticism (as in the <trademarksucks.tld> cases). A domain name along the lines of <nuvemwhistleblower>, <nuvemfail>, or <nuvemcoverup>, for example, would arguably denote criticism on its face and would be unlikely to be perceived as a domain name affiliated with the Complainant. Instead, the Respondent created one disputed domain name, <nuvem.health>, that is identical to the textual element of the Complainant’s mark, with a Top-Level Domain (“.health”) uniquely relevant to the Complainant’s industry. The other disputed domain name, <nuvem340b.com>, refers to the Complainant’s company name and the federal statute relevant to its services. Thus, the Respondent went beyond minimally required referential or nominative fair use in the disputed domain names and actively courted impersonation. Examining the Respondent’s conduct holistically, the Panel finds that there are some indicia of genuine critical fair use of the disputed domain names: the Respondent’s website is noncommercial and publishes critical commentary and court documents, and there is a disclaimer of affiliation, although it is hard to find. These facts are offset by some facts that reflect negatively on the bona fides of the Respondent’s claim to legitimate noncommercial interests. The Respondent filed a security notice to HHS after working just four days for the Complainant and then created a “whistleblower” website after he was terminated. (This is broadly similar to the Respondent’s conduct in his subsequent employment, as described in the ongoing Mphasis lawsuit.) The Respondent demanded USD 250,000 plus attorney’s fees, eventually settling for USD 10,000, to relinquish his first “NUVEM” domain name and website. He was obliged by that settlement agreement to surrender any similar domain names and websites. Nevertheless, the Respondent meanwhile registered the disputed domain names and used them for a similar website. In the totality of these circumstances, the Panel finds that the Respondent appears to be motivated at least as much by pecuniary interest as by “public interest” and “journalistic” interest in “transparency”. This mixed record on the Respondent’s intent does not warrant legitimizing disputed domain names that abuse trademarks by failing the impersonation test. The Panel finds the second element of the Policy has been established on this record. C. Registered and Used in Bad Faith The Panel notes that, for the purposes of paragraph 4(a)(iii) of the Policy, paragraph 4(b) of the Policy establishes circumstances, in particular but without limitation, that, if found by the Panel to be present, shall be evidence of the registration and use of a domain name in bad faith. These include registration to sell the disputed domain names to the Complainant for a price in excess of out-of-pocket expenses. The Respondent’s recent demand for USD 250,000 for a similar domain name used for a similar website aimed at the Complainant suggests precisely such intent. Paragraph 4(b) of the Policy sets out a list of non-exhaustive circumstances that may indicate that a domain name was registered and used in bad faith, but other circumstances may be relevant in assessing whether a respondent’s registration and use of a domain name is in bad faith. WIPO Overview 3.0, section 3.2.1. page 7 The Complainant argues that the Respondent has also acted in bad faith by publishing confidential information on the Respondent’s website and violating the terms of the Confidentiality Agreement and the settlement agreement that required the Respondent to surrender certain domain names, and prohibiting him from using other similar domain names and websites. This appears to be true, although a full legal and factual assessment of those claims is beyond the scope of this proceeding. The Respondent claims that his conduct nevertheless is protected by the First Amendment and the federal and state whistleblower statutes, but the Panel notes that the Court in the Mphasis lawsuit rejected the Respondent’s arguments under those laws and granted the complainant in that case a preliminary injunction on June 9, 2025. The Court ordered the Respondent to “remove any websites using Mphasis in the domain name” and return all confidential information to Mphasis. 2 In any event, the Panel concludes that by registering and using the disputed domain names in the manner described above, while negotiating for a large payment for an earlier domain name and then using them for a similar website, despite agreeing not to, reflects bad faith for Policy purposes rather than a legitimate, “whistleblowing” motivation. The Panel finds that the Complainant has established the third element of the Policy. 7. Decision For the foregoing reasons, in accordance with paragraphs 4(i) of the Policy and 15 of the Rules, the Panel orders that the disputed domain names <nuvem.health> and <nuvem340b.com> be transferred to the Complainant. /W. Scott Blackmer/ W. Scott Blackmer Sole Panelist Date: November 13, 2025 2 Noting the general powers of a panel articulated in paragraphs 10 and 12 of the Rules, it is commonly accepted that a panel may undertake limited factual research into matters of public record, as the Panel has done in this proceeding. WIPO Overview of WIPO Panel Views on Selected UDRP Questions, Third Edition (WIPO Overview 3.0), section 4.8.

Source of record: WIPO . Reproduced for research; WIPO is the authoritative source.