1. Introduction
Sovica is a product of Vahue Ltd, a company registered in England and Wales (number [company number]), at [registered address]. We are registered with the Information Commissioner’s Office under number [ICO number]. In this policy “we” means Vahue Ltd.
2. The two roles we play
We have two different roles, depending on the data:
- Processor, for patient and clinic records. When a clinic uses our product, the clinic is the controller of its records, and we process them on its instructions under our Data Processing Addendum. If you are a patient, your clinic’s privacy notice applies to you, and your clinic is the first place to go with a request. We will pass on any request that reaches us.
- Controller, for our own business. We decide how to use data about visitors to our website, people who contact us, our customers’ account contacts and users of the product, for running and improving our service. This policy mainly covers this data.
3. What personal data we collect, and where it comes from
3.1. Data you give us
Your name, work email, phone number, clinic and role when you ask for a walkthrough, sign up or contact us; what you tell us in messages and in the chat on this site; and billing details for your subscription. Card details are handled by our payment provider, and we don’t see them in full.
3.2. Data we collect automatically
Device, browser and log data such as IP address and pages visited, kept for security and to keep the service working; and how users use the product, such as features opened and errors seen. For browser storage, see our Cookie Policy.
3.3. Data from connected services
If a user connects another service, such as a calendar or mailbox, we receive the data that the user authorises, and we use it only to provide the feature they connected it for.
3.4. Data from others
Details of your clinic from public sources and from partners who refer you to us, and details from the colleague who invites you to an account.
4. Lawful bases
- Contract: to provide the service to customers and users.
- Legitimate interests: to answer enquiries, secure and improve the service, and tell business contacts about relevant products, always weighed against your interests.
- Legal obligation: to keep financial records and respond to regulators.
- Consent: for optional cookies and anywhere else we ask for it. You can withdraw it at any time.
Where we process health data for a clinic, the clinic determines the lawful basis and the Article 9 condition, usually relating to the provision of healthcare.
5. How we use personal data
- To provide, support and bill for the service.
- To reply to you and arrange walkthroughs.
- To keep the service secure, and to detect and prevent misuse.
- To understand how the product is used, and to improve it.
- To send service messages, and relevant product news, which you can opt out of at any time.
6. AI and your data
Our AI features process data to give a result to the clinic that asked for it. We don’t use patient data to train general-purpose AI models, and we require our AI providers not to do so. The chat on this site uses AI to answer questions, so please don’t enter health information there.
7. Who we share data with
We share data with service providers who work for us, such as our hosting provider (Amazon Web Services, London region), [email, messaging, payment and AI providers], under contracts that protect it. We may also share it with professional advisers, regulators or law enforcement where the law requires it, and with a buyer if our business is sold, subject to this policy. We don’t sell personal data.
8. Where your data is kept
We host primarily in the UK. Where a provider handles data outside the UK, we rely on UK adequacy regulations or the Information Commissioner’s International Data Transfer Agreement or UK Addendum.
9. Security
We use encryption in transit and at rest, separation of each customer’s data, access controls and audit logs. No system is perfectly secure, so if you find a weakness, please use our Vulnerability Disclosure Policy.
10. Your rights
Under UK GDPR you can ask to access, correct, delete or move your data, and object to or restrict how we use it. You can also object to direct marketing at any time, and ask for human review of any solely automated decision with a significant effect on you. Email support@sovica.ai and we will reply within one month.
If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner’s Office at ico.org.uk.
11. Retention of personal data
Enquiries and chat messages: up to 24 months after our last contact with you. Server logs: up to 30 days. Account and billing records: for the life of the account and [6] years after it, for tax and legal reasons. Clinic records: for as long as the clinic instructs us, as set out in our Data Processing Addendum.
12. Children’s privacy
Our website and accounts are for adults working in clinics. Clinics may hold records about children as part of their care, and they are responsible for those records as controllers.
13. Third-party platforms
Our site links to other websites, and users can connect other products. Those services handle data under their own privacy policies.
14. How to contact us
Email support@sovica.ai or write to Vahue Ltd, [registered address]. [Data protection officer contact, if one is appointed.] When we change this policy, we update it here and announce significant changes on this site.