Privacy policy

This notice applies when you visit www.vitalvoice.ai. Website analytics are separate from the vitalvoice app and never contain patient information.

1. Privacy-Friendly Measurement

We use Plausible Analytics to measure aggregate website traffic and outcomes. Plausible does not set analytics cookies, use local storage, or create a persistent browser identifier, so we do not show a separate analytics consent banner for this measurement.

2. Information We Collect

• Page and content context: Page path and type, plus site-controlled fields such as article cluster, audience, search intent, and content template.
• Interactions: Article engagement, sharing intent, calls-to-action, App Store outbound clicks, and whether the Calendly scheduler was opened or a demo was scheduled.
• Attribution: Referring source and allowlisted UTM campaign fields. Current campaign parameters are also forwarded to Calendly when you open the demo scheduler.
• Technical context: Browser, operating system, device type, and approximate country-level location derived from the analytics request.

3. Information We Do Not Send to Website Analytics

We do not send names, email addresses, phone numbers, patient data, form contents, Calendly invitee details, free-text input, session recordings, persistent visitor identifiers, or unrestricted query strings. Automatic click and form capture are not used.

4. How We Use and Store It

We use this information to understand reach, improve useful content, measure sharing, and see which paths lead to a demo or App Store interest. Plausible processes the website analytics on our behalf and reports aggregate results without storing an analytics cookie or a persistent cross-day identifier in your browser.

5. Contact

To ask a question about website analytics, contact hello@vitalvoice.ai. Because these reports do not contain a persistent browser identifier, we generally cannot retrieve an individual analytics history by name or browser.

This Privacy Notice applies to fire departments, EMS agencies, healthcare systems, and other enterprise partners using vitalvoice under a commercial agreement or field trial.

1. Where Encounter Content Is Kept

• On the crew's device: Encounter content (transcripts, interpretations, narratives and PCR fields) is kept encrypted on the device, with the key in the device's secure storage, for 90 days by default or on your organization's wipe schedule. Capture audio is sealed with AES-GCM-256.
• On our servers: vitalvoice servers process encounter content and discard it. No transcript, interpretation, narrative, PCR field or audio is stored on our servers, and audio buffers are zeroed on every exit path.
• Live interpretation: Live interpreter audio goes from the device to the AI model provider directly.
• Ask the Protocols: Questions and answers are processed in real time and are not stored on our servers.

2. Information We Keep

• Account and admin information: Name, organization, email and organization settings.
• Operational session metadata: For example the mode, language detected, timestamps, location and session identifiers. We treat this metadata as ePHI.
• Audit log: A hash-chained audit log of access and activity in vitalvoice systems.
• Survey responses: Ratings and feedback you choose to submit, safeguarded as Customer PHI when they contain PHI.

3. Retention Controls

• On-device encounter content is kept for 90 days by default, or on the wipe schedule your organization sets.
• A crew member can delete an encounter from their device at any time in the app. Deleting removes it from the device; our servers hold no transcript, narrative or audio to delete.
• Session metadata is kept for the term of the services and deleted within 30 days after termination. The audit log is kept for at least six years.

4. HIPAA and BAA

We act as a Business Associate under HIPAA, and a Business Associate Agreement (BAA) is available to Covered Entities. Security includes:

• Encryption in transit (TLS 1.2 or higher)
• Encryption at rest, on the device and on our servers
• Role-based access
• Hash-chained audit logging

5. Data Location

• We store and process Customer PHI within the United States.

6. Subprocessors

We work with these subprocessors:

• Amazon Web Services (AWS): application hosting, database, logs and encryption keys, in the U.S. (us-west-2). Covered by AWS's BAA. Processes Customer PHI.
• OpenAI (API): real-time AI processing for transcription, interpretation, narrative drafting and Ask the Protocols. Covered by a BAA with OpenAI, configured for zero data retention; PHI is not used for training. Processes Customer PHI.
• Mixpanel: de-linked product analytics under a random analytics identifier, limited to allowlisted events that cannot reconstruct a patient encounter. Receives no encounter content.
• Sentry: crash and error reporting with personal-information collection disabled and an event scrubber. Receives no encounter content.
• Cloudflare R2: storage for published guides and department logos. Receives no encounter content.
• Firecrawl: reads published guide documents and public protocol web pages. Receives no encounter content, questions or user context.
• Resend: sign-in emails. Receives no encounter content.
• RevenueCat: subscription status. Receives no encounter content.
• Expo (EAS), Apple and Google: app builds, updates and distribution. Receive no encounter content.
• Render: hosts this website, and holds retained pre-migration backups until their verified disposal.

7. Incident Response

In the event of a data breach, we will notify affected clients and relevant authorities per HIPAA timelines.

8. Contact

hello@vitalvoice.ai
vitalvoice.ai Inc., 488 Winslow St., Unit 103, Redwood City, CA 94063, USA