Privacy Notice

This notice explains what information Veya collects, why, where it is kept, and what rights you have over it. It covers both ordinary information, such as your name and booking history, and health information, which is handled under stricter rules and kept separately.

Two kinds of information, kept apart

Veya deliberately separates ordinary contact and billing information from health information. They live in different parts of the database, with different access rules, and different people can reach them.

• Ordinary information. Your name, email address, phone number, appointments, payments, and how you first found the site.
• Health information. Intake answers, symptom check-ins, medications, medical history, any results you share, and your practitioner’s notes. This is Protected Health Information, and it is treated as such.

Where it is stored

Veya runs its own database on infrastructure it controls directly, rather than on a third-party health platform. Your health information is not held by a cloud database vendor, is not used to train anything, and is not pooled with other companies’ data.

Who can see your health information

Access is granted to an individual person, not to a job title. A staff member must be both senior enough for the task and individually authorised for clinical access. Seniority alone does not grant it, and administrative staff who do not need clinical information do not have it.

Every access is recorded, including reads. The log captures who looked, at whose record, and when, and the log itself cannot be edited or deleted.

The assistant on this site

The assistant available on the public site can answer questions about services, hours and booking. It has no access to any client record, it is never given health information, and it will not interpret symptoms or give medical advice. If you ask it something clinical it will tell you to speak to a qualified clinician.

Analytics and tracking

The public marketing site and the signed-in application run on separate domains. Any analytics used on the marketing site are structurally unable to reach the parts of the product that hold health information, because they are not present there at all. Veya does not run advertising trackers on pages that carry health information, and does not use session recording anywhere in the application.

What Veya never does

• Sell your information, health or otherwise.
• Share health information with advertisers, data brokers or analytics providers.
• Use your health information to target advertising to you or to anyone else.
• Send health information to an AI provider.

Service providers

Veya uses a small number of outside providers, for example to send email or process card payments. Any provider that could come into contact with health information is required to sign a Business Associate Agreement before it is used for that purpose.

Your rights

• Ask for a copy of the information Veya holds about you, including your health record.
• Ask for a correction where something is wrong.
• Ask for an accounting of disclosures of your health information.
• Ask for a copy of your record to be sent to another provider.
• Ask for your account to be closed and your ordinary information deleted.

Health records are subject to retention periods set by state law, so a deletion request cannot always remove a clinical record immediately. You will be told plainly what can and cannot be deleted, and why.

Breach notification

If health information is exposed in a way that is likely to cause harm, affected people will be notified, along with the authorities the law requires, within the deadlines the law sets.

Contact

Questions about this notice, or about your information, can go to the contact page. Please do not include medical details in that form.