Privacy Policy

Introduction

VERO SCRIBE INC. ("Vero", "we", "our", "us") is committed to protecting the privacy and security of the information we collect and process. This Privacy Policy describes the collection, use, disclosure, and protection of information obtained through our website (www.veroscribe.com), the Vero Platform, and all related services (collectively, the "Services").

This policy explains our data practices; it does not itself obtain a Patient's consent to recording or processing health information. We process Patient information on behalf of the Practitioner or healthcare organization responsible for that information, under its lawful instructions and the applicable service and data-protection agreements. We remain responsible for our own obligations under applicable law. For account, subscription, recruitment, and website information, we determine the purposes described in this policy.

This policy applies to our information practices in Canada, the United States, and other jurisdictions where the Services are made available, subject to applicable local law and any deployment-specific notice or agreement. It is not a representation that every feature is available or approved worldwide. A French version of this policy is available without charge.

1. Definitions

Practitioner: A qualified medical practitioner, their associated medical clinic, or other licensed health professional who uses our Services.
Patient: An individual whose information is processed through the Platform by a Practitioner.
Personal Information: Any information relating to an identified or identifiable natural person. This may include, but is not limited to, names, contact details, and professional credentials.
Sensitive Health Information or Clinical Data: Patient information processed through the Services, including encounters, clinical notes, audio, transcripts, uploaded records, diagnoses, treatment information, and generated clinical outputs such as coding suggestions. Records containing this information remain Clinical Data even when included in support requests, diagnostic logs, or other technical records. In some jurisdictions, this information is referred to as personal health information or Protected Health Information (PHI).
Platform: The proprietary Vero software and service provided to Practitioners and their authorized users.
Privacy Laws: All applicable international, federal, state, and provincial privacy and data protection laws and regulations governing our handling of Personal and Sensitive Health Information.

2. Information We Collect and Process

In the course of providing our Services, we collect and process the following categories of information:

Personal and Professional Identifiers Information that can be used to identify you, such as your full name, email address, phone number, physical address, and date of birth. For Practitioners, this also includes professional details such as qualifications, medical registration numbers, and educational background.
Payment and Transactional Information Subscription, invoice, and transaction information needed to charge for our Services. Payment providers process payment credentials under their own arrangements. Patient diagnoses, suggested codes, and clinical documents used in a medical billing workflow are Clinical Data, rather than ordinary subscription-payment information.
Sensitive Health Information We process Sensitive Health Information about Patients as provided by Practitioners through the Platform. This is essential for the core functionality of our Services. This information may include medical histories, clinical notes, laboratory results, diagnoses, prescribed medications, and other treatment-related data.

We also process transcripts, uploaded documents and audio, and generated notes, summaries, forms, and candidate diagnosis codes. Generated information about an identifiable Patient is treated as Sensitive Health Information. De-identification or pseudonymization may be used where appropriate; this does not mean that every record is anonymous or that all direct identifiers have been removed. Retention is described in section 9.

Under no circumstances is Patient data or Sensitive Health Information used to train, develop, or improve any of our proprietary AI models.

We do not permit third-party AI providers to use Patient data supplied through the Services to train their public or general-purpose AI models. Processing information to produce an output for a Practitioner is distinct from training a model. Provider processing, retention, and access are subject to the applicable data-protection arrangements and the residency commitments in section 6.
Device and Usage Data Technical information collected automatically when you interact with our Services, including device ID, device type, IP address, geo-location data, connection information, page view statistics, and standard web log data.
User-Provided Content Any additional information you voluntarily provide to us through customer support channels, surveys, or direct correspondence.
Aggregated and De-Identified Data We may use aggregated or de-identified non-clinical account and usage information for internal service analysis and improvement, where permitted by law. This does not authorize a separate use of Patient data for research, advertising, or AI model training. Pseudonymized information that can still be linked to an individual continues to receive the protections applicable to Personal Information.
Recruitment Information If you apply for a position at Vero, we collect information relevant to your application, including your resume, employment history, contact details, and information from professional references.

3. Methods of Information Collection

We collect information from the following sources:

Information You Provide Directly: We collect information when you register for an account, communicate with our team, or otherwise interact directly with our Services.
Information from Your Use of the Services: We automatically collect technical and usage data when you access and navigate the Platform and our website.
Information from Third-Party Sources: We may collect information from third parties, such as recruitment agencies or publicly available professional registries, in accordance with applicable laws.

4. Purposes for Which We Use Information

We use the information we collect for the following business and commercial purposes:

To Provide and Maintain the Services: To enable your access to the Platform, manage user accounts, and deliver the core functionalities of our Services.
To Administer Referrals: To attribute referrals, determine eligibility, issue and apply credits, and prevent abuse using referral codes, referral cookies, non-clinical account information, and subscription billing events. Do not provide Patient information or Clinical Data for a referral.
To Support Clinical Documentation and Coding Review: To process Sensitive Health Information on behalf of Practitioners for transcription, note generation, summaries, forms, and candidate diagnosis-code suggestions. These outputs require review by a clinician or qualified coding professional before use. Vero does not independently determine a Patient's diagnosis, coverage, or reimbursement entitlement, or automatically submit medical claims.
For Service Analysis and Improvement: To analyze non-clinical account and usage information, improve the user experience, and develop Platform features, where permitted by law. This purpose does not authorize a separate use of Patient data for research, advertising, or model training. Clinical Data used to provide, troubleshoot, or secure the Services remains subject to the Practitioner's lawful instructions and the governing data-protection agreements.
For Communication: To send administrative messages, technical notices, security alerts, and support responses.
To Comply with Legal Obligations and Law Enforcement: To adhere to applicable laws, regulations, and legal processes, and to respond to lawful requests from government or law enforcement agencies.
For Security and Fraud Prevention: To protect the security and integrity of our Platform, our users, and our business.
For Recruitment: To evaluate and process your application for employment with Vero.

5. Marketing Communications

Vero may periodically send communications regarding our products, services, and important updates. We distinguish between two types of communications:

Service-Related Communications: These are essential transactional messages related to your account, security, and use of the Services (e.g., password resets, security alerts). You cannot opt out of these communications.
Promotional Communications: These are marketing messages about new features or services. You may opt out of receiving promotional communications at any time by following the unsubscribe instructions included in each communication or by contacting us directly.

We do not sell your Personal Information to third parties for their own marketing purposes.

6. Data Storage and International Transfers

Canadian Clinical Data: For Canadian customers, Vero stores and processes Clinical Data exclusively within Canada. This commitment includes Patient information, encounters, notes, uploads, audio processing, transcripts, and generated outputs, including diagnosis-code suggestions. It applies to transcription, AI processing, and subprocessors handling that Clinical Data. Storage, backups, diagnostic records containing Clinical Data, and access by Vero personnel or subprocessors to that Clinical Data are subject to the same Canadian location requirement.

Non-Clinical Information: Account administration, subscription billing, recruitment, website analytics, and support information that does not contain Clinical Data may be processed by providers outside Canada. These arrangements do not permit Canadian Clinical Data to be routed outside Canada. Support attachments, logs, or other records containing Patient information are not covered by this non-clinical exception. Please use an approved support channel when clinical information is needed for assistance.

U.S. Deployments: U.S. customer data is stored in the U.S. regional deployment. Processing locations and relevant providers must be assessed separately under the applicable agreements and deployment configuration; the Canadian all-processing commitment should not be read as a promise that all U.S. processing occurs in-country. Where HIPAA applies, the relevant business associate agreement governs processing of protected health information. Applicable state privacy and health-information laws may impose additional requirements or cover information outside HIPAA.

Other International Deployments: Before Clinical Data from another jurisdiction is introduced, the supported deployment, processing locations, recipients, and required legal arrangements must be confirmed with Vero in writing. Local hosting, professional confidentiality, health-data, and international-transfer rules may differ. A Canadian or U.S. location does not itself authorize a transfer or satisfy those rules. Any required processing agreement, lawful transfer mechanism, and safeguards must be established before that processing begins. No general promise of in-country storage or processing is made for another jurisdiction without an express applicable agreement. Contact us for the location and safeguard information relevant to a proposed deployment.

Transfers and Provider Review: For permitted processing outside a customer's province, state, or country, we use applicable contractual safeguards and assess the relevant legal requirements. Information processed abroad may be subject to lawful access by authorities in that jurisdiction; a contract cannot override local law. Canadian hosting alone does not establish compliance with every provincial requirement. For example, applicable Quebec requirements may require a privacy impact assessment and a written agreement for handling information outside Quebec, including elsewhere in Canada. Your own export or sharing of records into systems outside Vero is subject to your legal obligations and the recipient's arrangements.

Where the EU or UK GDPR applies, processing on behalf of a healthcare organization requires the applicable controller-processor arrangements. That organization must identify a lawful basis and any required condition for health-data processing; Vero remains responsible for obligations applicable to its own role. Any restricted transfer must have a valid legal mechanism and required safeguards. This notice does not itself supply consent, execute standard contractual clauses, or establish an adequacy decision for a particular transfer.

The Vero Trust Center provides subprocessor and security-review resources. Contact us to clarify the providers, data categories, locations, and contractual safeguards relevant to your deployment.

7. Disclosure of Information

We do not sell your Personal Information. We may disclose your information to the following categories of third parties for legitimate business purposes:

Service Providers: Third-party vendors who perform services on our behalf, such as hosting, transcription, AI processing, payment processing, and non-clinical analytics. Access is limited to the information needed for the applicable service. These providers are contractually obligated to protect information and process it for permitted purposes, subject to section 6. Not every provider receives Clinical Data.
Corporate Affiliates: Our subsidiaries and related corporate entities, for purposes consistent with this Privacy Policy.
Referral-Link Recipients: Your name may be displayed to people who open your referral link to identify you as the referrer.
As Required by Law: Government authorities, law enforcement, or other third parties when we are compelled to do so by a subpoena, court order, or other legal process.
To Protect Our Rights: Where disclosure is lawful and necessary to address security incidents, fraud, threats to safety, or violations of our agreements. This provision does not authorize an independent use or disclosure of Patient information beyond what applicable law and the governing data-protection agreement permit.

8. Cookies and Tracking Technologies

Our website uses cookies and similar technologies to enhance user experience, track website usage, and remember user preferences. You may control the use of cookies at the individual browser level, but disabling them may limit your use of certain features. We also utilize third-party analytics tools to understand service usage; however, no Sensitive Health Information is ever shared with or processed by these tools.

Referral cookies: When you open a referral link, we store its referral code in a browser cookie to attribute a later account signup and administer referral credits. The cookie may remain for up to one year; opening another referral link replaces the earlier code. Clearing or blocking cookies, or using a different browser or device, may prevent attribution. A referral does not itself establish consent to marketing communications.

9. Data Security and Retention

We have implemented and maintain a comprehensive security program designed to protect your information from unauthorized access, disclosure, alteration, and destruction. Our security measures include, but are not limited to:

Encryption: All data is encrypted both at rest and in transit using industry-standard cryptographic protocols.
Access Controls: Strict role-based access controls are enforced to ensure that personnel can only access information necessary to perform their duties.
De-identification and Pseudonymization: We utilize technical tools to de-identify and pseudonymize data where appropriate to reduce privacy risks.
Regular Security Audits: We conduct regular internal and external security assessments to identify and mitigate vulnerabilities.
Secure Data Handling: We maintain policies and procedures for the secure handling and disposal of information throughout its lifecycle.

Audio and Encounter Retention: Live-recording audio is streamed for transcription and is not retained after processing. Uploaded audio is a separate workflow: it remains associated with the encounter until removed or deleted. Notes, transcripts, coding suggestions, and other encounter information follow the applicable retention settings and agreements. Configurable automatic encounter deletion supports periods from 1 to 365 days based on encounter creation, including active and archived encounters and associated notes. Archiving an encounter does not delete it.

Deletion from active storage does not mean instantaneous removal from every backup or technical system. Backup copies and residual records are handled under the applicable retention and deletion procedures and legal requirements. Limited information may need to be retained for legal obligations, security, or dispute resolution; any retained Clinical Data remains protected under this policy and the governing agreements. We do not promise a universal backup-erasure deadline in this policy. Practitioners must preserve the medical records they are required to retain and export necessary records before deletion or account closure. Deleting information in Vero does not delete copies already exported to an EHR or another recipient.

Incidents: We investigate suspected unauthorized access, use, or disclosure and provide notification and cooperation as required by applicable law and the governing agreements. This policy does not replace or reduce any agreed incident-reporting obligation.

10. Your Rights and Controls

Depending on your jurisdiction, you may have the following rights regarding your Personal Information:

Right of Access: The right to request a copy of the Personal Information we hold about you.
Right to Rectification: The right to request the correction of inaccurate or incomplete Personal Information.
Right to Erasure: The right to request the deletion of your Personal Information, subject to legal and contractual retention obligations.
Other Applicable Rights: Rights to withdraw consent, object to or restrict processing, or receive information in a portable format, where provided by applicable law. Withdrawal does not undo processing already lawfully performed and may affect the availability of a service.

To exercise your rights, please submit a verifiable request to us via the contact details below. We will respond to your request within the timeframe required by applicable law. We may require you to verify your identity before processing your request.

For access to, correction of, or questions about a Patient's clinical record, contact the Practitioner or healthcare organization responsible for the record first. We assist that organization as required by law and our agreements and handle any request directed to us in accordance with our own legal obligations. A generated code or note should be corrected through the responsible clinical workflow. You may also raise a concern with the privacy regulator responsible for your jurisdiction.

Local Rights and AI-Assisted Outputs: Applicable Canadian, Quebec, U.S. state, and international law may provide additional rights, including portability, restrictions or objections to processing, an appeal, or information and human review concerning certain automated decisions. We handle those requests according to the law applicable to the information and our role. Clinical and coding outputs are intended for professional review, not solely automated clinical, coverage, or reimbursement decisions. Where legally required automated-decision notices or review rights apply, they are not waived by this policy. Where the EU or UK GDPR applies, you may complain to the competent data-protection authority and contact us about the exercise of your applicable rights.

Where Quebec's health and social services information legislation applies, additional access and disclosure restrictions may apply to clinical records. Contact the responsible healthcare organization to exercise those rights; we assist it as required by law and our agreements.

11. Updates to This Privacy Policy

When we change this Privacy Policy, we will post the updated notice and update its "Last Updated" date. We will provide additional notice and obtain any consent required by applicable law before implementing a new use that requires consent. Continued use of the Services does not substitute for legally required consent. Contractual notice requirements also continue to apply.

12. Contact Us

For questions, concerns, or requests about this policy or our data practices, contact the Privacy Officer, VERO SCRIBE INC., at hello@veroscribe.com. Please avoid including Patient information in an initial email; we can arrange an appropriate channel when needed.