FOR CLINIC IT AND COMPLIANCE
This page describes what the product does. It does not describe internal hosts, account identifiers, or repository layout. Public application hosts are app.vcare-health.com and staging.vcare-health.com. Liliia Lytvyn is the designated Security and Privacy Officer. The internal program is documented in the HIPAA Handbook, with an annual risk analysis and workforce training.
All connections are encrypted in transit with TLS 1.2 or higher. Passwords are hashed with Argon2id; audit logs are encrypted with AWS KMS.
Access is role-based. VCare defines six roles — Admin, Staff, Doctor, Nurse, Physical Therapist, and Occupational Therapist — carried in the session token and enforced on every API call. User administration (invite, suspend, delete) is limited to Admin; clinical roles work only with their own visits. Account states are Invited, Active, Inactive, and Suspended; an inactive account cannot sign in. Multi-factor authentication uses a 5-digit SMS one-time code, valid for 60 seconds, with limited attempts and resends. New accounts are created with MFA enabled. Sign-in is email and password, and accounts with MFA enabled also enter that code. MFA is not enforced as a global switch for every existing account. There is no SSO for staff. Google OAuth is used only to connect the clinic calendar, never as a login.
Every access to PHI and every authentication event is written to an append-only audit log in Amazon CloudWatch: who (user id, name, role), what (action and resource), which record, when, and where (IP and device), plus success or failure. Logged resources include patients, appointments, call logs, reminders, users, and clinic settings; logged actions include view, create, update, delete, and sign-in events. Logs are queried with CloudWatch Logs Insights and are available to support your annual HIPAA review.
We run on HIPAA-eligible infrastructure and are completing Business Associate Agreements with our subprocessors.
| Subprocessor | Purpose | Region | BAA |
|---|---|---|---|
| Amazon Web Services | Hosting, database, storage, and audit logs (HIPAA-eligible environment) | United States (us-east-1) | In progress |
| ElevenLabs | Conversational voice AI (speech-to-text and text-to-speech) for calls | United States | In progress |
| Anthropic (Claude Haiku 4.5, via ElevenLabs) | Agent language model — processes conversation text | United States | In progress |
| Twilio | SMS reminders sent from a template | United States | In progress |
Patient voice calls are handled by ElevenLabs Conversational AI; the agent language model is Anthropic's Claude Haiku 4.5. During a call the agent receives only what it needs to schedule — patient name, phone, date of birth, and appointment details — plus what the caller says. After the call we store the transcript, a summary, and the raw payload on the call record. Call recordings are kept for 90 days and then deleted.
| Data | What happens |
|---|---|
| Call recordings | Kept for 90 days, then deleted. |
| Transcripts, summaries, and payloads | Stored with the call record. No deletion date is stated here. |
| Patient records | An Admin or Staff user can hard-delete the row. |
| Staff accounts | Soft-deleted and can be restored. |
| After the agreement ends | Database records, the log group, and backups are deleted as a manual operations step. There is no automatic wipe. |
If patient data is ever affected, we notify the clinic's account contact without undue delay — and no later than 72 hours after we confirm the impact — with what happened, what data was involved, when we found it, what we did, and what you should do. If the investigation is still open, we send an initial notice and follow up until it closes. Our five-step process is identify, contain, eradicate, recover, and document, with evidence drawn from the audit log. The 72-hour window is stricter than the HIPAA business-associate outer limit of 60 days.
Patient data is hosted on Amazon Web Services in the United States (us-east-1): the application, database, storage, and audit logs. Voice calls go to ElevenLabs, SMS reminders to Twilio, and conversation text to Anthropic Claude Haiku 4.5 through ElevenLabs. We run on HIPAA-eligible infrastructure and are completing Business Associate Agreements with those subprocessors.
Yes. VCare signs a Business Associate Agreement with your practice before patient information is processed. That agreement is with your clinic. We are completing Business Associate Agreements with Amazon Web Services, ElevenLabs, Anthropic, and Twilio. Those subprocessor agreements are in progress. This page does not claim end-to-end BAA coverage.
Patient voice calls are handled by ElevenLabs Conversational AI. The agent language model is Anthropic's Claude Haiku 4.5, reached through ElevenLabs. This page does not claim that protected health information is excluded from model training. That statement waits on confirmed no-train terms from those vendors and on signed subprocessor agreements.
PHI access and sign-in events are written to an append-only audit log in Amazon CloudWatch: who, what, which record, when, and where, plus success or failure. Logs are queried with CloudWatch Logs Insights and are available to support your annual HIPAA review. This page does not state how long those logs are kept.
Six roles can open VCare: Admin, Staff, Doctor, Nurse, Physical Therapist, and Occupational Therapist. Clinical roles work only with their own visits. Only an Admin can invite, suspend, or delete users. Liliia Lytvyn is the designated Security and Privacy Officer. Amazon Web Services, ElevenLabs, Anthropic, and Twilio also process patient data. Their Business Associate Agreements are in progress.
When the agreement ends, deletion of database records, the log group, and backups is a manual operations step. There is no automatic wipe. While the account is active, Admin or Staff can hard-delete a patient row. Staff accounts are soft-deleted and can be restored. Call recordings are deleted after 90 days. Transcripts, summaries, and payloads have no published deletion date.
Ask for a security overview, a HIPAA Handbook summary, or the subprocessor list. You can also write to security@vcare-health.com.
