01No intended-use collection
Veritura does not ask what a user intends to do with any product, what conditions they have, what they are taking, or what outcomes they seek.
02Account and report data
Account details (your name, work email, organization and sign-in records) and, for each report, submitted URLs, uploaded document metadata, extracted fields, hashes and evidence records. These are used to provide your workspace, saved reports and monitoring.
An active workspace's records are kept for as long as it is open. Its owner can close it: the records become read-only and stay exportable for six years, then they are deleted. Or the owner can delete it at once, after an export is offered: every record, stored original, sign-in and key of the workspace is erased, and Veritura keeps only a receipt of the deletion (when, by whom, and how many records). A legal hold placed by the owner pauses any erase. Earlier copies leave the database provider's daily backups as those backups expire, on the provider's own schedule.
03Documents
Documents arrive by upload, by your workspace's own email-in address, or through a supplier's door link, and each is filed under your workspace. Each is processed to extract documentation signals.
The original is kept as received, with its SHA-256 fingerprint. Nothing a decision rested on is ever overwritten or deleted, and a free workspace keeps its first three. Users should avoid submitting private health information or unnecessary personal data.
04How documents are read
Reading a document can involve sending its text or page images to an AI model provider (OpenAI or Anthropic) to extract the fields the review checks. Scans and photographs are read this way, as is the Second Reader where a workspace has it switched on.
05Comparisons across accounts
To catch a document reused across buyers, strong identifiers of a document (its fingerprint, and its laboratory and report identity) are compared across Veritura accounts. A workspace sees only how many other accounts are involved, never who they are or their files, suppliers, lots or orders.
06Service providers
Veritura runs on these providers: Render (hosting), Supabase (database and file storage), Resend (email delivery and the email-in address), WorkOS (sign-in with Google or Microsoft), Stripe (payments; Veritura never stores card numbers), OpenAI or Anthropic (reading documents, as above), and Google Fonts (the typefaces on the public site and the sign-in page, which a visitor's browser requests from Google).
07Patient vial records
When a pharmacy emails a patient their Passport through Veritura, the patient's address is used to send that email and is then kept as a recall contact for that batch. It is used only to send that patient recall or safety notices about that batch: never for marketing, never shared, and never included in exports, the mail log or event records. A notice the mail provider could not take is held in a retry queue until it is sent. The address is deleted a year after the batch's use-by date, at once when the patient uses the opt-out link that every such email carries, or when the pharmacy's owner switches patient email off and chooses to delete it. A patient's name, birth date or phone number is never accepted. A pharmacy's owner can switch patient email off; while it is off, an address sent to Veritura is refused and nothing of it is kept.
When a patient saves a vial from its scan page, Veritura stores the email address, the saved vial serials, and the notice history for those serials. A patient who also creates a space at /myvials sets a password, which is stored only as a one-way hash, never in readable form: scrypt with a random 16-byte salt for each account, kept as the salt and the 64-byte result, so the password cannot be read back from what is stored, and signing in recomputes the hash and compares the two. Apart from the dates the space was created and last signed in to, and a sign-in session (kept as a one-way hash of its token) while the patient is signed in, nothing else is stored. We never store a name, address, chart or prescription, and no field for them exists. Every claim is patient-initiated from a printed seal and confirmed by email, and deletion is self-serve: the "Delete my space" control at /myvials removes the account, deletes the email from every saved-vial record, and stops all notices.
08Contact
Privacy requests and correction requests should reference the relevant report ID, account email, or submitted source and can be sent through the contact page.
09Boundary
Veritura is document diligence only. It does not provide medical, legal, pharmaceutical, or purchase advice, and does not make safety, quality, or FDA-approval claims.