Privacy Policy

Version 2.3.0 · Effective November 2, 2026

How Veluxe Health protects your health information.

No medical-device claim. The Veluxe Health Platform is a health-information and care-coordination tool. No feature is registered as a medical device with the U.S. FDA, licensed under Health Canada's Medical Devices Regulations, or CE-marked in any jurisdiction. AI features provide clinical decision support for licensed clinicians and health information for patients — they are not a substitute for professional medical judgment. See the regulatory section of our Terms of Service for the full disclosure.

1. Overview

Veluxe Health Inc. ("Veluxe", "we", "us", or "our") provides a healthcare technology platform for individuals, healthcare providers, employers, and partner organizations (collectively, the "Platform"). This Privacy Policy describes how we collect, use, disclose, and protect personal information — including Protected Health Information ("PHI") under HIPAA and Personal Health Information under PIPEDA — when you use the Platform.

Hospital-grade by default. All clinical data is encrypted at rest (AES-256-GCM) and in transit (TLS 1.3), stored in Canadian-region data centers, and access is gated by identity verification, role-based access control, and continuous audit logging.

2. Information We Collect

2.1 Information You Provide

• Account Information: name, email, phone number, password, date of birth, preferred language
• Identity Verification: government ID, biometric face data (facial geometry only — never raw photos beyond verification window), liveness recordings
• Health Information: medical history, medications, conditions, lab results, allergies, vitals (manual entry, wearable sync, or provider notes)
• Communications: messages with care team, appointment notes, AI assistant conversations
• Payment Information: billing address, last 4 digits of card (full card stored only by our payments processor — we never see it)
• Provider/Partner Credentials: license number, NPI, organization affiliation, verification documents

2.2 Information Collected Automatically

• Device & Network: IP address (hashed), browser type, OS, device fingerprint (consent-gated)
• Session Data: session timestamps, time-on-app, navigation paths (no third-party trackers)
• Wearable & Connected Devices: heart rate, step count, sleep, blood glucose (only with your explicit per-device consent)
• Real-Time Health Signals: camera-based vital signs during virtual care sessions when you opt in, with on-screen consent banner

2.3 Information from Third Parties

• Insurance eligibility data (when you connect a plan)
• Healthcare provider records via authorized HIE (Health Information Exchange) connections
• Employer benefit eligibility (when joining via an employer organization)
• Lab results from connected diagnostic providers (where you have authorized the connection)

2.4 Google Calendar (only if you connect it)

If you choose to connect a Google Calendar, Veluxe Health uses Google's APIs to read when your existing events start and end, so we only offer times when you're free and avoid double-booking. If you are a clinic or clinician, we also add an event titled "Veluxe booking" to your primary Google Calendar for each booking made through Veluxe, with no patient or health details, and update or remove it if that booking changes. If you are a patient and turn on two-way sync, we add your Veluxe calendar entries to your Google Calendar as private events titled "Veluxe Appointment", with no health details.

For clinics and clinicians we keep only the start and end times of busy periods. If you are a patient and choose to import specific events into your Veluxe calendar, we store the title (up to 200 characters), time and location of only the events you select.

We do not use Google user data for advertising, we do not sell it, and we do not use it to train AI models. You can disconnect at any time in Settings, which deletes our stored access tokens, and you can revoke access at myaccount.google.com/permissions.

Veluxe Health's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3. How We Use Your Information

Under HIPAA, we use PHI only for Treatment, Payment, and Healthcare Operations (TPO), plus uses you have explicitly authorized. Under PIPEDA, we use personal information only for the purposes you have consented to (express or implied), or as required by law.

3.1 Treatment Uses

• Coordinate care between you and your healthcare providers
• Surface clinical decision support to your provider during your visit
• Power AI clinical features: drug interaction checks, lab interpretation, vital pattern analysis
• Schedule appointments and manage prescriptions
• Enable virtual care sessions (with consent)

3.2 Payment Uses

• Process payments for services rendered
• Submit billing to insurance and follow up on claims
• Apply Wellness Miles credits and process Health Spending Account (HSA/PHSP) reimbursements
• Anti-double-billing checks across payment sources

3.3 Healthcare Operations

• Quality improvement (de-identified, aggregated only)
• Provider credentialing, licensing verification, performance review
• Compliance audits, regulatory reporting
• Security monitoring and fraud prevention

3.4 With Your Authorization

• Marketing communications (you can opt out at any time)
• Research participation (separate, granular consent for each study)
• Employer wellness programs (only data you explicitly choose to share)

4. Identity Verification & Biometrics

Why we verify identity. In healthcare, identity fraud risks medical record tampering, prescription fraud, and billing abuse. We use multi-factor identity verification to protect you and your providers.

4.1 What We Verify

• Document verification: government ID checked against issuer (when required)
• Liveness: proprietary checks confirm a real person is present, not a photo or replay attack
• Face matching: compares live capture to your enrolled facial geometry — never raw photos beyond the verification window
• Phone/email verification: one-time codes via SMS or email
• Passkey enrollment: WebAuthn-backed hardware-bound credentials

4.2 Biometric Data Handling

• Facial geometry templates stored in Canadian-region biometric services with BAAs in place
• Original capture frames are NOT retained beyond the verification session unless you grant explicit consent for fraud investigation
• You can request deletion of all biometric templates from Account Settings → Privacy & Security
• Biometric data is NEVER shared with employers, partners, or marketing systems

4.3 Sign-In

Standard sign-in uses passkey, magic link, or email + password. Higher-risk sessions (new device, unusual location, expired session) may step up to a quick liveness check. We use risk-adaptive authentication so most sessions stay frictionless and only unusual ones see additional verification.

5. How We Share Information

We share PHI only as permitted by HIPAA and required by PIPEDA. We do NOT sell your data. We do NOT use your health data for advertising. Vendors who handle PHI on our behalf sign Business Associate Agreements (BAA) under HIPAA.

5.1 With Your Healthcare Providers

Providers you've connected with (clinicians, pharmacies, labs, imaging centers) can access the parts of your record needed for your care, scoped by your consent settings.

5.2 With Service Providers (BAAs in place)

We use a small number of HIPAA-eligible / PIPEDA-aligned service providers to operate the Platform. All providers handling PHI sign Business Associate Agreements (US) or equivalent Data Processing Agreements (Canada). The categories of providers we use:

• Cloud infrastructure — Canadian-region hosting + storage with BAAs in place
• AI clinical compute — HIPAA-eligible model providers, scoped to specific clinical features
• Real-time communications — voice + video for virtual care, BAA-covered
• AI phone calls (voice agent) — when you ask our AI assistant to place a call for you, or to join your phone appointment as a scribe or advocate, the call is recorded and transcribed to create your notes. The assistant always identifies itself as AI and never impersonates a person. Voice processing is performed by a third-party telephony and AI voice provider located in the United States, under a signed Business Associate Agreement and Data Processing Agreement; that provider retains call data for at most 30 days. Your durable, encrypted copy of the recording, transcript, and notes is stored in Canada. You consent before the first call and can revoke AI calling anytime in Settings.
• Transactional email — appointment confirmations + security notices, BAA-covered
• Payments processor — PCI DSS Level 1; payment data only, never PHI
• Identity verification — facial geometry templates only, never raw photos

Our up-to-date subprocessor list (with vendor names + DPAs) is available to enterprise customers under NDA on request. Contact legal@veluxehealth.ca.

5.3 With Your Employer or Organization

If you joined via an employer benefit, we share only the aggregate benefit-utilization data you've explicitly authorized. We never share identified health data, diagnoses, prescriptions, or visit content with employers.

5.4 As Required By Law

• Court orders, subpoenas (we will notify you when legally permitted)
• Public health reporting (mandatory infectious disease reporting, etc.)
• Adult/child protective services (mandatory reporters)
• Law enforcement (only with valid legal process)

6. Your Rights

Under HIPAA (US users), PIPEDA (Canadian users), and provincial health privacy laws, you have these rights:

• Right to access — view and download your complete health record from Settings → Health Data → Export
• Right to correct — request corrections to inaccurate information. Provider-authored notes follow standard amendment procedures.
• Right to restrict — limit how we use or share your information for specific purposes (with some legal exceptions)
• Right to portability — export your record in machine-readable formats (FHIR R4, JSON)
• Right to delete — request deletion of your account and associated data, subject to legal retention requirements (HIPAA: 6 years for billing; provincial health acts vary)
• Right to revoke consent — withdraw consent for specific data uses prospectively
• Right to know who accessed your data — view audit log of every PHI access from Settings → Privacy → Access Log
• Right to file a complaint — with us, with the federal Privacy Commissioner of Canada, with US HHS Office for Civil Rights, or with your provincial privacy commissioner

7. PIPEDA & Canadian Provincial Privacy

For Canadian users, the Platform is built to the principles of the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and the applicable provincial health privacy statutes:

• British Columbia: PIPA, E-Health (Personal Health Information Access and Protection of Privacy) Act
• Alberta: HIA (Health Information Act)
• Ontario: PHIPA (Personal Health Information Protection Act)
• Quebec: Act Respecting the Protection of Personal Information in the Private Sector + Bill 64/Law 25
• Nova Scotia: PHIA (Personal Health Information Act)
• Newfoundland & Labrador: PHIA
• Manitoba: PHIA

Data residency: Canadian users' health records are stored in Canadian-region data centers. Limited cross-border transfers may occur for specific operational needs (e.g., backups, AI clinical reasoning that requires capacity not yet available in Canada) and are governed by appropriate contractual safeguards under PIPEDA Principle 4.1.3 (accountability for transferred data). AI phone-call audio and transcripts are processed in the United States by a service provider under Business Associate Agreement and Data Processing Agreement safeguards (PIPEDA Principle 4.1.3); our retained copy stays in Canada.

Privacy Officer: Founder & CEO, Veluxe Health Inc. — contact via privacy@veluxehealth.ca

8. HIPAA Alignment (United States)

For US users: Veluxe Health is architected to the standards of the HIPAA Privacy, Security and Breach Notification Rules, and handles health information in line with them as described below. HIPAA does not certify companies; this section describes our practices, not a certification.

8.1 Uses Without Your Authorization

Treatment · Payment · Healthcare Operations · Required Disclosures (subpoenas, public health) · Limited Data Set for research with Data Use Agreement.

8.2 Disclosures Requiring Your Authorization

• Marketing communications
• Sale of PHI (we do not sell PHI)
• Most psychotherapy notes
• Research not conducted under a Data Use Agreement

8.3 Breach Notification

If a breach affects unsecured health information, we will notify affected individuals within 60 days, consistent with the HIPAA Breach Notification Rule (45 CFR 164.404), and notify the relevant regulators and, where applicable, the media (for breaches affecting 500+ residents of a state/jurisdiction).

9. How We Protect Your Information

• Encryption at rest: AES-256-GCM for all PHI columns; KMS-managed keys with rotation
• Encryption in transit: TLS 1.3 only (older protocols disabled)
• Access controls: Role-based access control (RBAC), Row-Level Security (RLS) on every PHI table, identity verification for sensitive actions
• Audit logging: every PHI access logged with caller ID, IP, action, and reason; 6-year retention per HIPAA
• Network isolation: private VPCs, no public database endpoints, IP allowlisting for admin access
• Multi-factor authentication: required for clinicians, available for all users; passkeys preferred
• Real-time threat monitoring: AI-driven anomaly detection runs continuously across authentication and PHI-access events
• Penetration testing: annual third-party tests; continuous static analysis
• Vendor security review: all subprocessors complete SOC 2 Type II + sign BAA
• Incident response plan: 24-hour acknowledgement, 60-day notification commitment

10. Cookies & Local Storage

We use a minimal set of cookies and local storage entries — strictly for authentication and core app function. We do NOT use third-party advertising cookies, behavioral tracking, or fingerprinting beyond fraud-prevention.

• Authentication cookies: session tokens issued by our auth provider (HttpOnly, Secure, SameSite=Lax). Required for sign-in.
• UI preferences: theme (dark/light), accessibility settings, sidebar expanded/collapsed. Stored locally — never PHI.
• Security cookies: CSRF tokens, rate-limit cookies. Short-lived.

You can clear all cookies and storage from your browser settings; you'll be signed out and your UI preferences will reset.

11. Children's Privacy

Veluxe is not intended for individuals under 13 (US) or under 14 (Quebec) without parental/guardian consent. For minors aged 13–17, parental consent is required for account creation in jurisdictions where applicable.

Family Health Plans allow parents to manage their children's health records via consented family-link relationships. Each minor's record has its own access controls and audit log.

12. Changes to This Policy

We may update this Privacy Policy. Material changes are notified via email and an in-app banner at least 30 days before they take effect. Continued use of Veluxe after the effective date constitutes acceptance. Version history is available at /changelog.

13. Contact Us

• Privacy Officer (Founder & CEO): privacy@veluxehealth.ca
• Legal: legal@veluxehealth.ca
• Security disclosures: security@veluxehealth.ca
• Mailing address: Veluxe Health Inc., Vancouver, British Columbia, Canada

Privacy regulators:

• Office of the Privacy Commissioner of Canada — priv.gc.ca
• US HHS Office for Civil Rights — hhs.gov/ocr