Privacy Policy

Information We Collect

Personal Information

We collect information that you provide directly to us, including:

• Name, email address, phone number, and contact information
• Employment information including employer name and job title
• Account credentials and authentication information
• Billing and payment information
• Communication preferences and correspondence with us

Protected Health Information (PHI)

For respiratory clearance services, we collect and process:

• Medical questionnaire responses regarding respiratory health
• Pulmonary function test results and spirometry data
• Fit test records and respirator clearance determinations
• Medical review documentation from our physicians
• Historical clearance records and compliance documentation

Technical Information

We automatically collect certain information when you use our platform:

• Device information including IP address, browser type, and operating system
• Usage data such as pages viewed, features accessed, and time spent on platform
• Log data including access times, error logs, and system events
• Cookies and similar tracking technologies for authentication and preferences

How We Use Your Information

We use the information we collect for the following purposes:

Service Delivery

• Process respiratory clearance evaluations and medical reviews
• Maintain fit test records and compliance documentation
• Provide spirometry software and data management services
• Communicate clearance determinations to employees and employers
• Store and retrieve historical records per OSHA requirements

Account Management

• Create and maintain your account on our platform
• Process payments and manage subscriptions
• Provide customer support and respond to inquiries
• Send important account and service notifications

Platform Improvement

• Analyze usage patterns to improve our services
• Develop new features and functionality
• Monitor and ensure platform security and performance
• Conduct internal research and analytics (with de-identified data)

Legal Compliance

• Comply with OSHA record retention requirements (30 years)
• Meet HIPAA privacy and security obligations
• Respond to legal requests and prevent fraud
• Enforce our terms of service and protect our rights

Information Sharing and Disclosure

We share your information only in the following circumstances:

With Your Employer

• Respirator clearance determination (approved, denied, or requires restrictions)
• Compliance documentation for OSHA regulatory requirements
• Fit test results and equipment compatibility information
• Note: We do NOT share underlying medical details, questionnaire responses, or specific health conditions with employers

With Medical Professionals

• Our licensed physicians review medical information for clearance determinations
• All medical professionals are bound by HIPAA and professional confidentiality
• PHI is shared only on a need-to-know basis for treatment purposes

With Service Providers

• Cloud hosting providers for secure data storage
• Payment processors for subscription and billing services
• Communication services for emails and notifications
• All service providers sign Business Associate Agreements (BAAs) under HIPAA

For Legal Reasons

• To comply with legal obligations, court orders, or subpoenas
• To protect the rights and safety of VestMed, our users, or the public
• In connection with a merger, acquisition, or sale of assets
• With your explicit consent or as otherwise disclosed at collection

Data Security

We implement comprehensive security measures to protect your information:

• Encryption: All data is encrypted in transit (TLS 1.3) and at rest (AES-256)
• Access Controls: Role-based access with multi-factor authentication
• Monitoring: 24/7 security monitoring and intrusion detection
• Compliance: HIPAA-compliant infrastructure with enterprise security controls
• Training: Regular security and privacy training for all staff
• Audits: Annual third-party security assessments and penetration testing

For more details, please see our Security page.

Data Retention

We retain your information as follows:

• Medical Records: 30 years from date of last assessment (per OSHA 1910.1020)
• Fit Test Records: Duration of employment plus 30 years
• Account Information: Duration of active subscription plus 7 years
• Billing Records: 7 years for tax and accounting purposes
• Technical Logs: 90 days for security and troubleshooting

After retention periods expire, data is securely deleted or anonymized.

Your Rights and Choices

You have the following rights regarding your information:

Access and Correction

• Request access to your personal information and medical records
• Request corrections to inaccurate or incomplete information
• Download your data in a portable format

HIPAA Rights

• Request an accounting of disclosures of your PHI
• Request restrictions on certain uses and disclosures
• Request confidential communications by alternative means
• File a complaint about privacy practices with us or HHS

Communication Preferences

• Opt out of marketing communications (service notifications will continue)
• Manage notification preferences in your account settings
• Choose how you receive clearance results and updates

Account Deletion

You may request account deletion, subject to our legal retention obligations. Medical records must be retained for 30 years per OSHA requirements, but will be de-identified from your account.

To exercise these rights, please contact us at privacy@vestmed.com or call 844-837-8767.

Cookies and Tracking

We use cookies and similar technologies for:

• Essential Cookies: Required for authentication and platform functionality
• Preference Cookies: Remember your settings and preferences
• Analytics Cookies: Understand how users interact with our platform
• Security Cookies: Detect and prevent fraudulent activity

You can control cookies through your browser settings, but disabling essential cookies may limit platform functionality.

Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. We will notify you of material changes by:

• Posting the updated policy on our website with a new effective date
• Sending email notification to registered users
• Displaying a prominent notice on our platform

Continued use of our services after changes indicates acceptance of the updated policy.

Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us: