Privacy

If you just read the site, our hosting provider records ordinary server logs: IP address, browser, the page requested and the time. That is standard for any website and is used to keep the service running and to investigate abuse.

If you have an account, we hold the details you gave us to create it, such as your name, work email and organisation, along with a record of what you did in the product so that we can support you and bill correctly.

If you email us, we keep the correspondence.

We do not sell or rent personal information. We do not run advertising and we do not share data with advertising networks. There is no Google Analytics, no advertising pixel and no session-recording tool on this site.

Our published analysis is built from public government filings: hospital price transparency files, Medicare cost reports, CMS utilisation files and similar sources. Those files are published by hospitals and by federal agencies, not collected from you, and they contain no patient information.

Where a customer sends us their own files, such as a claims extract, we handle them under the agreement with that customer. That data is theirs, we use it only to provide the service they asked for, and we do not use it to build products for anyone else.

Data is stored in the United States on Amazon Web Services, encrypted at rest and in transit, in accounts covered by a Business Associate Agreement with AWS.

Some parts of the product send content to a third-party AI model provider in order to answer a question or draft an analysis. That means the content of those requests leaves our infrastructure and is processed by that provider under their terms.

We are direct about this because the alternative is a sentence that sounds reassuring and is not true. If you have data that must not be processed by an external model provider, tell us before you send it and we will agree how to handle it in writing.

We use a small number of vendors to run the service: Amazon Web Services for hosting, storage and compute, Vercel for the website, and third-party AI model providers as described above. They process data on our instructions and for no other purpose.

Account records are kept while the account is open and for as long afterwards as we need them for tax, accounting and legal reasons. Customer files are kept for the term of the agreement and deleted on request after it ends. Server logs are kept for a short operational period.

You can ask what we hold about you, ask us to correct it, or ask us to delete it. Depending on where you live you may have further rights, including under the GDPR or the California Consumer Privacy Act. Write to us and we will act on it.

Vlada Health. Questions about this policy, or any request about your data, go to ben@vladahealth.com.

If we change this policy we will change the date at the top. If the change is significant we will tell account holders directly rather than relying on you to notice.