VHT.ai Privacy Policy
Effective Date: October 6, 2025
Last Updated: November 5, 2026
Introduction
This Privacy Policy is for the VHT / VHT.ai apps and website operated by Virtual Healthcare Technologies Inc. We are committed to protecting your privacy. This Policy explains how we collect, use, disclose, retain, and safeguard your information, and how you can delete your account and data. We protect health information with safeguards aligned to HIPAA, and we comply with Washington's My Health My Data Act (MHMDA), and applicable international laws (e.g., GDPR-inspired rights for EU users). Privacy questions: echna@vht.ai.
Information We Collect
Personal Information
Name, email, phone, address, demographics.
Health Information
Medical history, symptoms, records, vitals (PHI under HIPAA).
Usage Data
Device info, IP address, interactions with ECHNA (anonymized where possible).
From Third Parties
Integrations with wearables or EHRs (e.g., Epic). For global users, we may collect location data for compliance.
How We Use Your Information
We use your information to: provide services (e.g., telehealth, AI guidance), improve our platform (e.g., anonymized AI training), communicate with you per your consent, and comply with laws, audits, or research using de-identified data. We do not use PHI for marketing without explicit consent.
Data Security
We use encryption, Sign in with Apple or Google (two-factor managed by those providers), access controls, and periodic internal security reviews, aligned with the HIPAA Security Rule. Data is stored in Supabase infrastructure (SOC 2 Type II), configured to HIPAA Security Rule safeguards. For international transfers, we use Data Privacy Framework (DPF) or standard contractual clauses. Despite these measures, no system is 100% secure; we notify breaches per HITECH Act and MHMDA requirements.
Sharing and Disclosure
We share your information with: healthcare providers for your care, service providers bound by contractual confidentiality and data-processing terms (we are putting Business Associate Agreements (BAAs) in place with our core vendors), AI service providers that generate ECHNA's replies, voice, suggestions and insights; they receive your messages and the health information needed for each reply when you accept this Privacy Policy and the Terms of Service at sign-up, under data-processing terms, as required by law (e.g., subpoenas), and anonymized aggregates with partners (e.g., insurers, with consent). We do not sell your data. For EU users, no transfers occur without appropriate safeguards.
Data Retention
We keep personal and health information only as long as needed to provide the Services, to meet a legal obligation, or for the limited security and fraud-prevention purposes below. We do not keep it longer than those purposes require. Deleting your account is permanent deletion of the live account — not a freeze, pause, or deactivation.
While your account is active
We keep the personal and health information you provide and the records we create for you (health profile, ECHNA conversations, uploaded documents, and connected-device data we store on your behalf, including Apple Health / HealthKit data synced with your permission on iOS) while your account remains open so we can provide the Services. You can correct or delete individual items in the app at any time.
How to delete your account and data
In the app: Settings → Account → Delete My Account (type DELETE to confirm). On the web: https://vht.ai/account-deletion or email echna@vht.ai from the address on your account. We complete verified deletion requests within 30 days. Live account access and associated personal and health information are typically removed from production systems immediately so you cannot sign in. Returning later requires a new account and onboarding.
What we may retain after deletion
Google Play and the App Store allow limited retention after account deletion only for legitimate reasons, which we disclose here. We may keep: (1) a limited backup copy used only for security, fraud prevention, and to finish deletion safely — not to provide the Services or restore your account — which we destroy when you request it by emailing echna@vht.ai, when it is no longer needed for those purposes, or as required by law; (2) records we are legally required to keep (for example HIPAA documentation, a legal hold, tax, or dispute records) — only what the law requires and only for as long as the law requires; (3) security and audit logs in anonymized or de-identified form; and (4) aggregated data that cannot reasonably identify you, used for safety and product improvement. Operational logs that can still identify you expire automatically, typically within 7 to 90 days. To stop introductory offers (such as free trials and first-year discounts) being claimed more than once, we keep a one-way code made from your email address, and a card fingerprint from our payment processor, for up to 3 years, including after you delete your account. These cannot be turned back into your email or card number.
Apple Health (HealthKit) and connected devices
On iOS, if you grant permission, we read health and fitness data from Apple Health (HealthKit) to populate your VHT record. On Android, if you grant permission, we read the same kinds of data from Health Connect (steps, heart rate, sleep, weight, and related activity) into the same VHT health record. If you use VHT on both an iPhone and an Android phone, each store writes separately and is merged for your Hub — we do not overwrite one phone’s data with the other. We do not write false data back to HealthKit or Health Connect. We do not use this data for advertising, marketing, or use-based data mining. Deleting your VHT account deletes HealthKit- and Health Connect-derived data we stored on our servers. You can revoke Health access in iOS Settings → Privacy & Security → Health, or Health Connect permissions in Android settings. To improve the quality of the data for ECHNA, VHT may occasionally run an automated resync from its servers: the app then reads again, for a past date range, only the data you have already allowed.
How to revoke consent
You may withdraw optional consents in the app (for example HealthKit permissions, communication preferences, or connected devices) without deleting your account. To withdraw all processing that depends on your account, use Delete My Account or https://vht.ai/account-deletion. We respond to access, correction, and deletion requests within 30 days, or longer only if the law requires.
Your Rights
You have the right to: access, correct, or delete your data (subject to the Data Retention practices above and applicable law), opt-out of non-essential uses, and for EU users, additional GDPR rights like data portability or objection. Submit requests via echna@vht.ai; we respond within 30–45 days.
Children's Privacy
VHT.ai is intended for adults aged 18 or older (or the age of majority where you live). We do not knowingly collect personal or health information from anyone under 18. If we learn that we have collected such information, we will delete it. Parents or guardians who believe a minor has created an account can contact us at echna@vht.ai to request deletion.
Changes and Contact
We may update this policy; you will be notified via email. For questions, contact us at echna@vht.ai.