Privacy Policy

1. Introduction & Scope

This Privacy Policy applies to information we collect through our website at www.vuchealthcare.com, our patient portals and applications, our AI clinical assessment platform, our telehealth services, our AI-driven medical devices, and our mobile health units, as well as information collected in person, by phone, or by email in connection with our Services. It applies to visitors, patients, event participants, and healthcare professionals who use our platform.

Where we provide treatment or other covered healthcare services, health information we maintain may also be protected by the Health Insurance Portability and Accountability Act (“HIPAA”) and governed by our Notice of Privacy Practices, which will control in the event of a conflict with this Policy with respect to protected health information (“PHI”). See Section 5.

2. Information We Collect

Information you provide to us

• Identifiers & contact details — name, date of birth, mailing address, email address, phone number, emergency contact information, and government-issued identifiers where required for care or billing.
• Health & medical information — medical history, symptoms, medications, allergies, immunizations, vital signs, laboratory and imaging results, assessment responses, treatment records, and other information you or your providers share in the course of care.
• Genomic & ancestral information — genetic test results, family health history, and ancestry information you choose to provide or that we collect with your explicit consent as part of our genomic health services.
• Mental health & cognitive information — responses to mental wellness screenings, cognitive assessment results, and related clinical notes.
• Payment information — billing details, insurance information, and transaction records. Card payments are processed by payment processors; we do not store full card numbers on our systems.
• Communications — messages you send through our contact forms, portals, email, or phone, and your communication preferences.

Information collected automatically

• Device & monitoring data — readings from AI-driven medical devices, wearables, and remote monitoring equipment you use as part of your care, such as heart rate, ECG traces, activity, and sleep data.
• Technical & usage data — IP address, browser type, device identifiers, pages viewed, and interactions with our website and applications, collected through cookies and similar technologies (see Section 9).

Information from other sources

• Records from other healthcare providers, laboratories, and imaging centers involved in your care, received with appropriate authorization.
• Information from event organizers, employers, schools, or community partners when you register for services delivered through our mobile health units, limited to what is needed to schedule and deliver care.

3. How We Use Your Information

• To provide care — delivering assessments, diagnostics, treatments, monitoring, telehealth visits, and mobile unit services, and coordinating your care among providers.
• To personalize your care — combining your health history, lifestyle information, and (with your consent) genomic and ancestral data to generate personalized insights, risk assessments, and care plans.
• To operate and improve the Services — administration, scheduling, billing, quality improvement, safety monitoring, and developing and validating our clinical tools.
• To communicate with you — appointment reminders, results notifications, service updates, and responses to your inquiries; marketing communications only with your consent, which you may withdraw at any time.
• Research & analytics — using de-identified or aggregated data that does not identify you to advance preventive medicine and improve our AI models.
• Legal & safety purposes — complying with legal obligations, responding to lawful requests, protecting the rights, safety, and property of patients, staff, and the public, and enforcing our Terms of Service.

4. AI & Automated Processing

Our Services use artificial intelligence to analyze the information described above and generate assessments, risk insights, and care recommendations. We want you to understand how this works:

• AI outputs are decision-support tools. They inform — but do not replace — the judgment of licensed healthcare professionals.
• Clinically significant findings and treatment decisions are subject to review by qualified clinicians.
• We do not use your information to make solely automated decisions that produce legal or similarly significant effects on you without human involvement.
• We monitor and evaluate our AI systems for accuracy, reliability, and fairness on an ongoing basis.

5. HIPAA & Protected Health Information

Health information we create or receive in connection with providing healthcare services may constitute PHI under HIPAA. We use and disclose PHI as permitted by HIPAA — including for treatment, payment, and healthcare operations — and as described in our Notice of Privacy Practices, which is available upon request and provided at the time of care. Our workforce receives privacy training, and our vendors that handle PHI are bound by business associate agreements requiring them to safeguard it.

6. Genomic & Ancestral Data

Genetic information is among the most personal data that exists, and we treat it accordingly:

• We collect and analyze genomic and ancestral data only with your explicit, informed consent, which you may withdraw prospectively at any time.
• We never sell genetic information.
• We do not share identifiable genetic information with employers, life insurers, disability insurers, or long-term-care insurers without your written authorization, and we support the protections of the Genetic Information Nondiscrimination Act (GINA).
• Genomic data used for research or model improvement is de-identified or aggregated.
• Biological samples, where collected, are handled by accredited laboratories under contractual confidentiality obligations.

7. Mental Health & Cognitive Data

Mental wellness screenings, cognitive assessments, and related records receive heightened confidentiality protections. Access is limited to clinicians and staff involved in your care, and certain records (for example, psychotherapy notes, where applicable) receive additional protections under law. Participation in mental health and cognitive services is always voluntary.

8. How We Share Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share information only:

• With your care team — providers, specialists, laboratories, and pharmacies involved in your treatment.
• With service providers — vendors that host our systems, process payments, support scheduling and communications, or provide analytics, under contracts limiting their use of your information to providing services for us.
• With your consent or at your direction — for example, when you ask us to send records to another provider, a school, or a team.
• For legal and safety reasons — to comply with law, court orders, or public health requirements; to prevent serious harm; or to establish or defend legal claims.
• In corporate transactions — if we undergo a merger, acquisition, or asset sale, subject to this Policy’s protections and applicable law.
• De-identified or aggregated data — which cannot reasonably be used to identify you.

9. Cookies & Analytics

Our website uses cookies and similar technologies that are necessary for the site to function, that remember your preferences, and that help us understand how the site is used so we can improve it. You can control cookies through your browser settings; disabling certain cookies may affect site functionality. We do not use advertising cookies to track your health-related browsing across other sites.

10. Data Security

We maintain administrative, technical, and physical safeguards designed to protect your information, including encryption of data in transit and at rest, role-based access controls, audit logging, workforce training, secured facilities and vehicles (including our mobile health units), and vendor security requirements. No method of transmission or storage is completely secure; if a breach affecting your information occurs, we will notify you and regulators as required by law.

11. Data Retention

We retain personal information for as long as needed to provide the Services, to comply with our legal and professional obligations (including medical record retention laws), to resolve disputes, and to enforce agreements. Medical records are retained for at least the period required by Texas law and other applicable regulations, after which they are securely destroyed or de-identified.

12. Your Privacy Rights

Depending on your location and the nature of the data, you may have the right to:

• Access and obtain a copy of your health records and other personal information;
• Request correction or amendment of inaccurate information;
• Request deletion of personal information, where permitted by law (medical records are subject to mandatory retention periods);
• Request restrictions on certain uses and disclosures, and receive an accounting of certain disclosures of PHI;
• Receive your information in a portable format;
• Opt out of marketing communications at any time;
• Not be discriminated against for exercising your privacy rights.

To exercise any of these rights, contact us using the details in Section 17. We will verify your identity before acting on requests. If you believe your HIPAA rights have been violated, you may also file a complaint with the U.S. Department of Health & Human Services, Office for Civil Rights; we will never retaliate against you for filing a complaint.

13. Children’s Privacy

Our website and online Services are not directed to children, and we do not knowingly collect personal information online from children under 13. Healthcare services for minors are provided only with the consent of a parent or legal guardian, who may exercise privacy rights on the minor’s behalf as permitted by law.

14. Telehealth & Virtual Care

Telehealth sessions are conducted through secured, encrypted connections. Sessions are not recorded without your prior consent. Information generated during telehealth visits becomes part of your medical record and is protected as described in this Policy.

15. Third-Party Links

Our website may link to third-party sites or services we do not control. Their privacy practices are governed by their own policies, which we encourage you to review.

16. Changes to This Policy

We may update this Policy from time to time. Material changes will be announced on this page with an updated effective date, and where required by law, we will provide additional notice or obtain consent. Your continued use of the Services after changes become effective constitutes acceptance of the revised Policy.

17. Contact Us

For privacy questions, requests, or complaints, contact our Privacy Office:

• VUC HealthCare Inc. — Privacy Office
• 616 Cypress Creek Pkwy Ste. 250 A, Houston, TX 77090
• Phone: (832) 917-6325
• Email: info@vuchealthcare.com