Privacy Policy

Last updated: 2026-08-31

This Privacy Policy describes how VANGARD ("we", "us", or "our") collects, uses, and discloses information when you use our clinical workspace platform. Protected Health Information (PHI) is treated separately under our Business Associate Agreement (BAA) — this policy covers all other personal data.

1. Information we collect

• Account information — your name, email, role, and (for organisations) your clinic affiliation.
• Clinical data (PHI) — patient records, consultations, voice memos, uploaded documents, and SOAP notes. All PHI is encrypted with per-doctor data keys.
• Usage data — anonymised metrics about feature use, error reports, and session duration.
• Device & log data — IP address, browser, operating system, and access timestamps, retained for security and audit purposes.

2. How we use information

• To provide and improve the VANGARD service.
• To generate AI clinical assistance grounded in your patient data (never used to train external models).
• To meet legal and regulatory obligations (HIPAA, PHIPA, GDPR).
• To bill subscriptions and contact you about your account.

3. AI and your data

Patient data sent to AI models is automatically de-identified before leaving our infrastructure. We never use your clinical data to train AI models, and we don't share it with model providers for training. Every AI answer is logged with an audit trail showing which sources were retrieved.

4. Sharing

We do not sell your data. We share information only with:

• Sub-processors strictly necessary to run the service (hosting, email, video) — all contractually bound by BAAs where applicable.
• Law enforcement when required by a valid legal process.
• Your organisation's administrators if you are a member of an organisation account.

5. Your rights

You may request access, correction, export, or deletion of your personal data at any time. Email privacy@vangard.ai. We respond within 30 days as required by applicable law.

6. Retention

We retain clinical data for the duration of your subscription plus the legally required record-retention period in your jurisdiction. Inactive accounts are deleted 12 months after cancellation.

7. Contact

For privacy questions, email privacy@vangard.ai or write to:

This document is provided for transparency. It is not a substitute for legal advice. Your use of VANGARD is governed by our Terms of Service.