Privacy Policy
This policy explains what personal information VeinFusion collects, how we use it, who we share it with, and the choices you have. California residents should also read our California Privacy Notice.
1. Health information and HIPAA
When VeinFusion processes protected health information (PHI) on behalf of a specialty pharmacy or another HIPAA covered entity, we do so as a business associate under a business associate agreement (BAA). That agreement — together with HIPAA — governs our handling of PHI, and where it conflicts with this policy, the BAA controls. We use PHI only to operate the coordination service (scheduling, visit documentation, physician sign-off, billing support) and as permitted by law. We do not sell PHI, and we do not use PHI for advertising.
2. What we collect
- Account data — name, email, phone, role, and for professionals: licenses, certifications, credential documents, and payout details (held by our payment processor).
- Visit and care coordination data — work orders, schedules, visit documentation, secure messages, and signatures. For patients this includes health information supplied by your pharmacy and care team.
- Location data — nurses share live location during an active visit window so patients can track arrival; patients' addresses are shared with the confirmed nurse only.
- Technical data — device type, app version, IP address, and logs needed for security and reliability.
- Contact form data — what you send us through the contact and data-deletion forms on this site.
3. How we use it
- To match work orders with qualified nurses and coordinate visits, sign-off, and payment.
- To verify professional credentials before matching.
- To maintain the audit trail the service is built on — status changes, signatures, and payout decisions are recorded immutably.
- To secure the Platform, prevent fraud, and comply with legal obligations.
- To respond when you contact us.
Marketing pages on veinfusion.com may use aggregate analytics with no patient context; PHI is never used in analytics or advertising.
4. Who we share it with
- The people coordinating your care — your pharmacy, your confirmed nurse, and the reviewing physician see the information their role requires. Contact details are masked wherever possible; in-app messaging and calling avoid exposing personal numbers.
- Service providers (sub-processors) — the vendors listed on our Sub-processors page, under contracts limiting their use of your data, including BAAs where PHI is involved.
- Legal — when required by law, subpoena, or to protect the safety of users, and in a merger or acquisition subject to this policy.
We do not sell personal information, and we do not share it for cross-context behavioral advertising.
5. Security
Authentication runs on Google Cloud Identity Platform; all data access flows through an authorization layer that isolates each role's view. Data is encrypted in transit and at rest by our cloud provider. No system is perfectly secure; we will notify affected users and authorities of breaches as the law requires.
6. Retention
Visit documentation and audit records are retained as required for clinical, legal, and billing purposes (and, for PHI, per the controlling covered entity's instructions). Account data is retained while your account is active and thereafter as required by law. Contact-form messages are kept only as long as needed to handle them.
7. Your choices and rights
- You can access and correct your account information in the apps and portals.
- You can request deletion of your personal information — see Request data deletion. Note that PHI held for a pharmacy is subject to that pharmacy's retention obligations; requests concerning your medical records may need to go to your pharmacy or provider.
- Location sharing runs only during an active visit window and is controlled by app permissions.
- Depending on your state, you may have additional rights (access, portability, correction, deletion, non-discrimination). California residents: see the California Privacy Notice.
8. Children
The Platform is not directed to children. Patient accounts for minors are managed by a parent, guardian, or authorized caregiver.
9. Changes and contact
We will post updates here with a new effective date, and notify signed-in users of material changes. Questions or requests: privacy@veinfusion.com · VeinFusion · [ADDRESS].