Privacy Policy

For clinic patient data, including PHI, Vinician acts as a business associate processing information on behalf of covered entity customers under a BAA. For clinic staff account, billing, marketing, and administrative data, Vinician acts as a controller or business collecting information for its own operations. These categories are governed differently.

• Staff account data: name, work email, role, authentication and audit records.
• Patient data: name, phone number, timezone, program assignment, SMS consent status.
• Care engagement data: check-in responses, survey responses, message and reminder logs.
• Operational metadata: access logs, timestamps, exports, imports, and security events.

PHI is processed on behalf of treatment providers. Patients should direct access, amendment, deletion, and portability requests to their treatment provider, not to Vinician. Vinician supports clinic-directed requests as required by the BAA and applicable law.

Vinician uses encryption in transit and at rest, field-level encryption for sensitive fields, role-based access controls, audit logging, and scoped tenant access controls.

• Twilio for SMS delivery.
• Neon for database hosting.
• Vercel for application hosting.

Where Vinician handles PHI under a BAA, breach notification will be handled according to the HIPAA Breach Notification Rule and the applicable BAA.

Records are retained according to customer instructions, legal obligations, security needs, and BAA requirements. On BAA termination, PHI will be returned or destroyed as required by the BAA, unless retention is legally required.

HIPAA-covered PHI is exempt from CCPA/CPRA under Cal. Civ. Code 1798.145(c). Staff account, marketing, and business contact information may not fall under that PHI exemption and may be subject to California privacy rights where applicable.

Vinician does not sell personal information and does not share personal information for cross-context behavioral advertising. Mobile opt-in data is not shared with third parties for marketing.

Privacy inquiries may be sent to noah@vinician.com.