Privacy Policy

This Privacy Policy explains how WTT Solutions LLC (“WTT,” “we,” “us,” or “our”) collects, uses, and shares information in connection with VCare Health (the “Service”). It applies to clinic staff who use the application and to information we process on behalf of healthcare organizations (“Clinics”).

It is not a substitute for the Clinic’s own Notice of Privacy Practices or for a business associate agreement (“BAA”). If this Policy conflicts with a signed BAA on protected health information (“PHI”), the BAA controls for that PHI.

1. Who we are and roles

WTT Solutions LLC is a Delaware limited liability company located at 4211 Cedar Springs Rd, Dallas, Texas 75219, United States. Telephone: 945.352.5002. VCare Health is sold by WTT; there is no separate VCare legal entity.

For PHI that a Clinic places in the Service, the Clinic is the covered entity (or similarly situated controller). WTT is a business associate and processes that PHI only to provide the Service, as instructed by the Clinic, and as required by law. For staff account data we collect to operate the product (for example, a user’s email and login events), WTT acts as a service provider to the Clinic and, where applicable, as a business.

Liliia Lytvyn is our Security and Privacy Officer. She owns privacy and security policies, risk analysis, workforce training, and review of violations.

2. Information we process

Depending on how the Clinic uses the Service, we may process:

• Staff account data: name, email, phone number, role, authentication credentials (stored as Argon2id password hashes), MFA settings, and sign-in activity.
• Clinic settings: clinic name, contact details, timezone, reminder templates, and notification preferences.
• Patient demographics used for scheduling: name, phone number, date of birth, optional email, optional insurance member ID and plan fields, and visit history needed to book or look up appointments.
• Appointments and reminders: date and time, clinician or care-team assignees, status, notes the Clinic enters, and reminder delivery status.
• Voice interactions: live audio handled by our voice provider; after the call, a transcript, a text summary, and the raw post-call payload stored on the call log.
• Technical and audit data: IP address, user agent, timestamps, and structured audit entries for access to patients, appointments, call logs, reminders, users, and clinic settings.

3. How we use information

We use information to:

• authenticate users and enforce role-based access;
• schedule, confirm, cancel, and reschedule appointments;
• operate the AI voice assistant and send SMS or email reminders the Clinic enables;
• maintain audit logs and investigate security incidents;
• provide support, improve reliability, and meet legal duties.

We do not sell patient information. We do not use PHI to train public foundation models for our own unrelated products. Workforce members may not place patient data in personal email, chat, or unapproved AI tools.

4. Voice, SMS, and email

Patient voice calls are handled by ElevenLabs Conversational AI. Speech recognition and speech synthesis run on ElevenLabs. The agent language model is Claude Haiku 4.5, so conversation text is processed by Anthropic through ElevenLabs. During a call the agent may receive patient name, phone number, date of birth, and appointment details from our API, plus what the caller says.

After the call, ElevenLabs sends a post-call transcription webhook. We store the transcript JSON, a text summary, and the raw webhook payload on the call log in our database. Call recordings are kept for 90 days and then deleted. Transcripts and summaries remain on the call log until that record is removed.

SMS is sent by template through Twilio. Messages may include the patient name where the template uses it, the clinician or care team, the appointment date and time, and a short action. SMS does not include date of birth, diagnosis, insurance, or clinical notes. Email notifications are sent through Amazon SES when the Clinic enables them.

5. Subprocessors and hosting

We host the Service on Amazon Web Services in the United States (us-east-1). Application data is stored in PostgreSQL. Redis is used for short-lived operational data such as MFA challenges. Audit events are written to Amazon CloudWatch Logs. Email uses Amazon SES.

Current subprocessors that may process Service data include:

• Amazon Web Services — hosting, database, email, and logs (United States);
• ElevenLabs — voice conversations (United States);
• Twilio — SMS delivery (United States);
• Anthropic (through ElevenLabs) — language-model processing of conversation text (United States).

We operate VCare Health in a HIPAA-oriented AWS environment. We have reviewed vendor terms for these processors. This Policy does not state that a BAA is already executed with each vendor. We will enter vendor agreements required to support the Clinic’s BAA as the product scales and as those agreements are in place.

6. Retention

• Call recordings: 90 days, then deleted.
• Call transcripts, summaries, and raw post-call payloads: retained with the call log until that record is removed.
• Audit logs in CloudWatch: retained for six years to support HIPAA documentation requirements.
• Patient records: deleted when an Admin or Staff user deletes the patient in the application. Staff accounts are soft-deleted and can be restored.
• After a Clinic contract ends, remaining tenant data is removed as an operations step (application database, audit log group, leftover recordings, and backups), except records we must keep by law.

7. Security

We use administrative, technical, and physical safeguards appropriate to the Service, including:

• TLS in transit, with a minimum of TLS 1.2 for Redis connections;
• HTTPS at the public edge;
• Argon2id hashing for passwords;
• role-based access control; user administration limited to Admins;
• optional SMS multi-factor authentication (five-digit codes, short expiry, attempt limits);
• structured, append-only audit logs of PHI access and authentication events (who, what, which record, when, IP address, and user agent).

Risk analysis is performed at least annually and when a product or vendor change affects patient data. Workforce members who can access patient data or production systems are trained before access and annually thereafter. We do not claim an independent HIPAA certification, SOC 2 report, or third-party penetration test at this time.

8. Security incidents

A security incident is any confirmed or suspected event that affects the confidentiality, integrity, or availability of clinic or patient data. We identify and record the event, contain it, remove the cause, restore service, and document what happened.

If we confirm that a Clinic’s data was affected, we notify the Clinic’s administrative contact without undue delay and no later than 72 hours after that confirmation. If the investigation is still open, we send an initial notice and follow with updates. Notices describe what happened, which data was involved, when we discovered it, what we have done, and what the Clinic should do.

9. Patient and clinic rights

Patients should contact their Clinic to access, correct, or restrict PHI, or to ask about calls and messages. The Clinic can update or delete patient records and communication preferences in the Service. We assist the Clinic as required by the BAA and applicable law.

Staff users may update their profile information in the application. Account closure is handled by the Clinic’s administrator or by contacting us.

10. Cookies and account data

The staff application uses cookies or similar technologies as needed for authentication (including an access-token cookie) and to keep the session secure. We do not use third-party advertising cookies on the staff application.

11. Children

The Service is directed to healthcare organizations and their workforce. We do not knowingly collect staff account information from children. Pediatric patient records, if any, are processed only as instructed by the Clinic for treatment, payment, or healthcare operations.

12. Changes

We may update this Policy by posting the revised version on this page and changing the “Last updated” date. Material changes that affect how we process PHI will be handled consistently with the BAA and applicable law.

13. Contact

Security and Privacy Officer: Liliia Lytvyn
WTT Solutions LLC
4211 Cedar Springs Rd
Dallas, Texas 75219
United States
Telephone: 945.352.5002
Website: vcare-health.com