Privacy policy
Introduction
Velarya LLC ("Velarya," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, including our website, mobile applications, and related services (collectively, the "Services").
Please read this Privacy Policy carefully. If you are in the European Economic Area, the United Kingdom, or Switzerland, section 10 explains the legal bases we rely on and the rights you have under the GDPR.
1. Information We Collect
Information You Provide
We collect information you voluntarily provide when you create an account (name, email address, and phone number); book appointments (appointment details, service preferences); make purchases (payment information processed through Stripe); enroll in memberships or rewards programs; communicate with us or with Clinics through the platform; or participate in referral programs.
Information Collected Automatically
When you use our Services, we automatically collect certain information, including device information (device type, operating system, unique device identifiers); log information (access times, pages viewed, IP address); location information (with your consent, for finding nearby clinics); and usage data (features used, interactions with the app).
Our website, velarya.com, uses cookies and similar technologies from Google (Google Analytics and Google Ads), HubSpot, Meta, and Microsoft Clarity to understand how visitors use the site and to measure the performance of our advertising.
If you visit from the European Economic Area, the United Kingdom, or Switzerland, we ask for your consent before these tools run: they stay off until you choose Accept in the cookie banner, and Reject is offered just as prominently. Our pages for Saudi Arabia, under velarya.com/sa and velarya.com/lp/sa, do not show the banner. To decide whether to ask, we look up the country you are visiting from, using your IP address, and we do not store the result beyond your browsing session. We remember your choice on your device for six months.
You can change your choice at any time with the Cookie settings link at the bottom of every page. Withdrawing consent stops these tools and deletes the cookies they set on velarya.com. You can also block or delete cookies through your browser settings. These tools are not used in our mobile applications or in the clinic dashboard.
Information from Third Parties
We may receive information about you from third parties, including Clinics that use our platform and, where a Clinic has asked us to build a connection, practice software the Clinic authorizes.
2. How We Use Your Information
We use your information to provide and maintain the Services; process transactions and send related information (confirmations, receipts); manage your account and membership; send appointment reminders and notifications; administer rewards and referral programs; respond to your inquiries and provide customer support; improve and optimize the Services; protect against fraudulent or unauthorized activity; and comply with legal obligations.
3. How We Share Your Information
With Clinics
We share your information with the Clinics whose services you use through our platform. This includes your contact information, appointment history, membership status, and purchase history. Each Clinic is responsible for its own use of your information in accordance with its privacy practices.
With Service Providers
We share information with third-party service providers who perform services on our behalf, including Amazon Web Services, Inc. for cloud infrastructure, covering compute, database hosting, object storage, key management, and secrets management, and for transactional email through Amazon SES; Stripe, Inc. for payment processing; Twilio Inc. for SMS delivery, including appointment reminders and sign-in passcodes, until text messaging completes its move to Amazon Web Services; Google LLC for push notification delivery through Firebase Cloud Messaging and app crash reporting through Firebase Crashlytics; Vercel Inc. for hosting the clinic dashboard; Netlify, Inc. for hosting our website and receiving website form submissions; and HubSpot, Inc. for managing inquiries and demo requests.
Text Messages
Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes. The categories above exclude text messaging opt-in data and consent, and this information will not be shared with any third parties. The providers that deliver our text messages receive your mobile number only to deliver them.
For Legal Purposes
We may disclose your information if required by law, in response to legal process, or to protect the rights, property, or safety of Velarya, our users, or others.
Business Transfers
In connection with a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.
4. Data Security
We implement appropriate technical and organizational measures to protect your information, including encryption of data in transit (TLS/SSL) and at rest; access controls and authentication requirements; regular security assessments; and employee training on data protection.
However, no method of transmission over the Internet or electronic storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security.
5. Data Retention
We retain your information for as long as necessary to provide the Services and fulfill the purposes described in this Privacy Policy. We may also retain information as required by law or for legitimate business purposes, such as resolving disputes and enforcing our agreements.
When you delete your account, we will delete or anonymize your personal information within 30 days, except where we are required to retain it for legal, regulatory, or security purposes.
6. Your Rights and Choices
Access and Correction
You may access and update your account information at any time through the app settings. You may also contact us to request access to or correction of your information.
Deletion
You may request deletion of your account and personal information. We will process your request in accordance with applicable law.
Marketing Communications
You may opt out of receiving promotional communications from us by following the unsubscribe instructions in those messages or by updating your notification preferences in the app.
Text Messages
You can stop text messages at any time by replying STOP to any message, or by turning text messages off in the app under Communication preferences. Reply HELP for help. Our Terms of Service set out the full terms for text messages.
Push Notifications
You may disable push notifications through your device settings.
Location Information
You may disable location services through your device settings. Note that some features may not function properly without location information.
7. California Privacy Rights
If you are a California resident, you have certain rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, use, and disclose; request deletion of your personal information; opt out of the sale of your personal information (we do not sell personal information); and non-discrimination for exercising your privacy rights.
To exercise these rights, please contact us using the information provided below.
8. Health Information
Velarya's primary function is to provide scheduling, payment, and customer management tools. We are not a healthcare provider and do not provide medical services.
To the extent that any information processed through our platform may constitute protected health information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA), we maintain appropriate safeguards and enter into Business Associate Agreements with Clinics as required. Clinics are responsible for determining whether HIPAA applies to their use of the Services.
9. Children's Privacy
The Services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child under 18, we will take steps to delete such information promptly.
10. International Users, Including the EEA, UK, and Switzerland
The Services are hosted in the United States, where Velarya is based. If you use the Services from outside the United States, your information is transferred to, stored, and processed in the United States.
Clinics in the EEA, UK, and Switzerland
When a Clinic in the European Economic Area, the United Kingdom, or Switzerland uses the Services, the Clinic is the controller of the patient and client records it keeps, and Velarya processes those records on the Clinic's behalf under our GDPR Data Processing Agreement. That agreement sets out the terms Article 28 of the GDPR requires, and includes the EU standard contractual clauses, with the UK and Swiss adaptations, for the transfer to the United States.
Legal Bases
Where the GDPR, the UK GDPR, or the Swiss Federal Act on Data Protection applies to information Velarya processes for its own purposes, we rely on the following legal bases: performance of a contract with you, or steps you ask us to take before entering into one, such as providing your account and processing a booking or purchase; our legitimate interests in operating, securing, and improving the Services, preventing fraud, and responding to business inquiries, where those interests are not overridden by your rights; compliance with legal obligations, such as tax and accounting rules; and your consent, such as for location information, which you can withdraw at any time.
Your Rights
Where those laws apply, you have the right to access your information; to have it corrected or erased; to restrict or object to our processing of it, including an absolute right to object to direct marketing; to receive it in a portable format; and to withdraw any consent you have given, without affecting processing that took place before. To exercise these rights, contact us at hello@velarya.com. We respond within one month and may ask you to verify your identity first. Where a Clinic is the controller of your information, we will pass your request to that Clinic and help it respond.
You also have the right to lodge a complaint with the data protection supervisory authority in the country where you live or work, or where you believe your rights were infringed.
Automated Decisions
We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated Privacy Policy on our website and, where applicable, through the Services. We encourage you to review this Privacy Policy periodically.
12. Contact Us
If you have any questions about this Privacy Policy or our privacy practices, please contact us at:
Velarya LLC Email: hello@velarya.com Website: https://velarya.com