1.Who we are and who this policy is for
Vybz Health Inc. ("Vybz Health", "we", "us") builds AI care teams for primary care and behavioral health practices. Luna, our AI practice manager, and the agents she coordinates answer calls and messages, run intake, confirm appointments, check insurance, follow up with patients between visits, and carry out operational work inside the systems a practice already uses.
This policy speaks to three groups of people, and different parts apply to each:
- Practices and their staff ("customers"): clinicians, owners, administrators and team members who sign up for and use our services.
- Patients and clients: people who interact with a practice through our agents, booking pages, forms, calls and messages. We handle your information on behalf of your practice, which decides what is collected and why. Section 8 explains what that means for you.
- Visitors: anyone who reads vybz.health, requests a demo, or tries a public demo.
2.We do not train AI models on your data
Our agents still improve over time. The next section explains how that works without training, because the difference matters.
3.How our agents improve over time
A new member of staff gets better at their job by remembering how your practice works: who the clinicians are, which insurance plans you accept, where things live in your systems, and which shortcuts save time. Our agents improve the same way, by remembering, not by being retrained. Nothing an agent learns changes the underlying AI model, and nothing it learns from one practice is used to answer another practice's questions.
Your practice's private memory
As the agents work for your practice, they keep a working memory of operational facts about it: staff names and contact details, the plans you are in network with, your fees and policies, how you prefer tasks to be done, and the quickest way to complete recurring work in your systems. This memory is stored separately for each practice. It is only used to do your practice's work, it is never shared with or visible to any other practice, and it is never used to improve the service for anyone else.
You are in control of it. Practice administrators can read everything the agents have remembered, correct anything that is out of date, and delete anything they do not want kept. When you leave, it is deleted with your account.
Continuity for individual patients
So that a returning patient does not have to repeat themselves, the agents keep notes from earlier calls and messages with that patient, such as what they asked about and what was arranged. These notes are patient information, they belong to your practice, they are visible to your practice, and they are used only to serve that patient within your practice. They are never used to improve the agents, to build profiles, or for any other purpose.
General know-how
Separately, we maintain general working knowledge that helps every practice, such as how a common type of insurance plan tends to behave or how a widely used scheduling system is laid out. This general know-how is written and reviewed by Vybz Health. When an agent notices something general while working, it may suggest an addition, but the rule is fixed: general know-how never contains information about a patient and never contains anything that identifies your practice, your staff, or your business arrangements. Those stay in your practice's private memory.
Judging quality
We review how the agents perform so we can fix mistakes and improve our instructions to them. That review looks at the agents' work and reasoning, not at your patients, and it does not involve training a model on your information.
4.Information we collect
From practices and their staff
- Account details
- Name, work email, phone number, role, professional credentials and licence details, time zone, profile photo, and your sign-in information.
- Practice details
- Practice name, address, phone numbers, tax and provider identifiers, the services you offer, your fees, your insurance panels, and your operating policies.
- Billing details
- Your plan, invoices, and payment history. Card details are collected and held by our payment processor, not by us.
- Connected accounts
- When you connect a calendar, inbox, EHR, scheduling tool, spreadsheet, messaging workspace, advertising account, or another system, we receive the access you grant and the information the agents need from it to do the work you ask for. Section 7 has more detail.
- Instructions and settings
- The workflows you design, the instructions you give the agents, your preferences, and the practice memory described above.
- Usage and support
- How you use the product, the tasks the agents run, records of what each agent did and why, and the messages you send our team.
From patients and clients, on behalf of a practice
- Contact and identity
- Name, email, phone number, date of birth, and other details a practice's booking or intake forms ask for.
- Booking and intake
- Appointments, the answers you give on intake, consent and screening forms, and any documents you upload.
- Conversations
- Calls with a practice's AI phone agent, text message conversations including between-visit check-ins, website chat, and emails to the practice. Calls are recorded and transcribed so the practice has a record and so the agent can act on what was said.
- Insurance and payment
- Insurance plan and member details used to check coverage and, where a practice asks us to, to submit claims. Payment confirmations where a practice collects payment through a page we host.
- Care information
- Information a practice shares with the agents so they can do their work, such as appointment history, the clinician you see, and care plan tasks the practice asks the agents to follow up on.
From visitors to vybz.health
- Demo requests
- Name, email, practice name and anything you tell us in the form.
- Site analytics
- Pages viewed, approximate location from your network address, device and browser type, and how you move through the site, including a replay of your visit with anything you type hidden. Section 12 explains how to opt out.
5.How we use information
- To provide the services: answering and making calls and messages for your practice, booking and confirming appointments, running intake, checking insurance, following up with patients, carrying out tasks in your connected systems, migrating records between systems, and reporting back to you.
- To keep your practice's private memory so the agents work the way your practice works.
- To run your account: sign-in, billing, usage records, and support.
- To keep the service safe and reliable: preventing misuse, detecting problems, and investigating errors.
- To improve the product: understanding which features are used and where the agents make mistakes, so we can fix them. This never involves training AI models on your information.
- To communicate with you about your account, the service, and changes to our policies.
- To meet our legal obligations.
We do not use personal information for advertising, and we do not build profiles of patients for any purpose other than serving them within their own practice.
7.Connected accounts and Google user data
You decide which systems to connect, and you can disconnect any of them at any time from your settings. When you disconnect, the agents stop reading from and writing to that system, and we delete the access you granted.
Some connections use your Google account, such as Google Calendar, Gmail, Google Drive and Google Sheets. We use that access only to do what you set the agents up to do: for example, reading new inquiries in a practice inbox so an agent can respond and log them, checking a calendar for free time, sending appointment confirmations, or writing rows to a sheet you choose. We do not use Google user data for advertising, we do not sell it, and we do not let humans read it except with your permission for support, for security or legal reasons, or where the data has been aggregated so it no longer identifies anyone.
Where the agents work inside a system that has no connection of its own and you give them a login to use, that login is stored encrypted, used only for the tasks you assign, and removed when you disconnect the system.
8.Patient information and HIPAA
When a practice uses our services, the practice remains responsible for its patients' information and decides how it is used. Vybz Health acts as the practice's service provider and, where HIPAA applies, as its business associate. We sign a Business Associate Agreement with every practice customer before protected health information is handled, and we handle that information only as the agreement and the practice's instructions allow.
If you are a patient or client
- Your practice decides what is collected about you and why. Questions about your information, requests to see or correct it, and requests to delete it should go to your practice, which can instruct us. If you contact us directly, we will help you reach the right practice.
- Calls with a practice's AI phone agent are recorded and transcribed for the practice's records. If you prefer not to speak with an automated agent, you can ask for a person, and the agent will hand you over according to your practice's instructions.
- Text messages from a practice are sent only after the practice has enrolled you. You can stop them at any time by replying STOP, and the practice can turn them off for you on request.
- The agents do not make clinical decisions. Anything that needs a clinician's judgment, and anything that looks urgent, is passed to a person at your practice.
Serene clients
If your clinician uses Serene, the Serene privacy policy describes how session notes, recordings, telehealth and the client portal are handled.
9.How we protect information
- Information is encrypted while it travels between you, us and our service providers, and while it is stored.
- Logins, access tokens and other credentials you give the agents are stored with an additional layer of encryption and are never shown to anyone, including our staff.
- Access within a practice follows the roles its administrators set. Each practice's information is kept separate from every other practice's.
- Our services run on cloud infrastructure in the United States, operated under a Business Associate Agreement.
- Every task an agent runs leaves a record of what it did, in which system, and why, so your practice can review it.
- Our staff receive security and privacy training, and their access to customer information is limited to what their role requires.
No system is perfectly secure. If we learn of a breach affecting your information, we will notify your practice without undue delay and in any event within the time required by law and by our Business Associate Agreement, and we will support the practice in notifying affected individuals.
10.How long we keep information
- Account and practice information is kept for as long as your account is active. After an account is closed, we keep the practice's information for 90 days so you can export it or reactivate, and then delete it, except where we must keep specific records for legal, tax or billing reasons.
- Patient information is kept for as long as the practice instructs us to, and is deleted or returned to the practice when the practice's account closes, in line with the Business Associate Agreement.
- Call recordings are kept so the practice has a record of the conversation. Transcripts and summaries are kept with the patient's record; recordings themselves are kept for a limited period set with the practice and then deleted.
- Files handled during an EHR migration are deleted from our systems once they have been placed in the destination system and verified.
- Practice memory and patient conversation notes are kept while your account is active and deleted with it, or earlier at your request.
- Website analytics, including visit replays, are kept for a limited period and then deleted.
11.Your choices and rights
Wherever you are, you can:
- Ask what we hold about you and receive a copy in a usable format.
- Correct anything that is inaccurate, including what the agents have remembered about your practice.
- Delete your information or close your account. We will complete deletion within 30 days, subject to the retention rules above.
- Disconnect any connected system at any time.
- Opt out of marketing email by using the link in the message, and of text messages by replying STOP.
- Opt out of website analytics by enabling Global Privacy Control or Do Not Track in your browser; we honor both on vybz.health.
To exercise any of these, email [email protected]. We will verify that the request comes from you or from someone authorized to act for you, and respond within 30 days. If you are a patient, we will work with your practice to fulfil the request. We will never treat you differently for exercising your rights.
Residents of California and other US states with privacy laws have the rights those laws provide, including the right to know, to delete, to correct, and to not be discriminated against. We do not sell or share personal information for cross-context advertising, and we have not done so in the past 12 months. You may appeal a decision on your request by replying to our response, and you may contact your state attorney general.
12.Cookies and analytics
Our products use cookies that are necessary for you to sign in and stay signed in. We do not use advertising cookies or tracking pixels anywhere.
On vybz.health we use PostHog, a product analytics tool, to understand which pages are read and where visitors get stuck. This includes replays of visits in which anything you type is hidden before it leaves your browser. Analytics is not run inside the practice dashboards in a way that records what is on the screen. You can opt out of analytics on vybz.health by enabling Global Privacy Control or Do Not Track in your browser.
13.Children
Our services are sold to healthcare practices, not to individuals, and our website is not directed at children. Practices may use our services to care for minors with the consent of a parent or guardian, in which case the practice is responsible for obtaining that consent and the information is handled as patient information on the practice's behalf. We do not knowingly collect information from a child under 13 for our own purposes; if you believe we have, contact us and we will delete it.
14.Where information is processed
Vybz Health is based in the United States and our services are designed for US practices. Information is stored and processed in the United States. If you use our website or services from outside the United States, your information will be transferred to and handled there, under the protections described in this policy.
15.Changes to this policy
When we change this policy we will update the effective date at the top. If a change reduces your rights or materially changes how we use information, we will tell practice customers by email at least 30 days before it takes effect. Our commitment not to train AI models on your data will not change without your explicit agreement.
Questions
Write to [email protected]. Vybz Health Inc., United States.