Privacy Policy
Last updated: August 15, 2026
VeriPrep LLC (“VeriPrep,” “we,” “us,” or “our”) provides procedure-preparation software to healthcare organizations through veriprep.health and related VeriPrep services.
This Privacy Policy explains the types of information VeriPrep collects, how we use and protect that information, and the choices available to clinics and patients.
Who We Serve
VeriPrep provides software to healthcare organizations such as medical practices, clinics, ambulatory surgery centers, and other outpatient procedural-care organizations (“Clinics”).
Clinics use VeriPrep to create and deliver procedure-preparation instructions, send preparation-related communications, track patient engagement with preparation guides, and identify patients who may need additional support.
For patient information that VeriPrep processes on behalf of a Clinic, the Clinic generally acts as the healthcare provider or Covered Entity and VeriPrep acts as its Business Associate under HIPAA.
Information We Collect
Information From Clinics and Clinic Staff
Depending on how a Clinic uses VeriPrep, we may collect or maintain:
- Clinic legal and display names;
- Clinic addresses, telephone numbers, websites, hours, and other contact information;
- Billing and subscription information;
- Staff names and email addresses;
- Staff account and authentication information;
- Staff roles, permissions, and account activity;
- Preparation protocols, instructions, schedules, and other content created or approved by Clinic staff;
- Records of staff actions within VeriPrep, including audit records; and
- Communications between the Clinic and VeriPrep regarding the Services.
Passwords are stored using password hashing rather than in plaintext.
Information From or About Patients
When VeriPrep processes information on behalf of a Clinic, the information may include:
- First and last name;
- Mobile telephone number;
- Procedure or appointment date and time;
- A Clinic-supplied patient or participant reference;
- The Clinic and preparation protocol associated with the patient's enrollment;
- Consent information, including the consent language presented or attested to and the date and method of consent;
- For patient self-enrollment, technical information associated with the consent event, such as IP address and browser or device information;
- Guide activity, including when a guide is opened, which preparation steps are viewed, and which steps are marked complete;
- Patient actions within a guide, such as requesting help, reporting difficulty following an instruction, or requesting a schedule change;
- SMS delivery, opt-out, opt-in, and related communication records;
- Preparation outcome information entered by an authorized Clinic user, where the Clinic uses that functionality; and
- Other information necessary to provide the preparation guide and related Services as configured by the Clinic.
VeriPrep is designed to avoid collecting patient information that is not necessary for the Services. VeriPrep does not require patient dates of birth, insurance information, or clinical diagnoses as standard enrollment fields.
Information From Website Visitors
If you submit a contact, demo, waitlist, or similar form on a VeriPrep website, we may collect the information you choose to provide, such as your email address, name, organization, or message.
How We Use Information
We use information to:
- Provide, operate, maintain, and secure VeriPrep;
- Create and administer Clinic accounts;
- Deliver patient preparation guides and related communications on behalf of Clinics;
- Display information to authorized Clinic users;
- Schedule and deliver preparation-related messages;
- Record guide activity and patient-reported events;
- Help Clinics identify patients who may require follow-up;
- Provide reports and analytics to Clinics;
- Maintain security, audit, troubleshooting, and compliance records;
- Respond to support, privacy, and legal requests;
- Prevent misuse, fraud, unauthorized access, and security incidents;
- Improve the reliability and functionality of VeriPrep; and
- Comply with applicable law and our contractual obligations.
We do not sell patient PHI.
We do not use identifiable patient PHI for targeted advertising.
HIPAA and Clinic Data
For healthcare customers subject to HIPAA, VeriPrep operates as a Business Associate when it creates, receives, maintains, or transmits Protected Health Information (“PHI”) on behalf of the Clinic.
VeriPrep requires an applicable Business Associate Agreement (“BAA”) before a healthcare Clinic uses VeriPrep to process real patient PHI.
Our BAA governs VeriPrep's permitted uses and disclosures of PHI and controls over this Privacy Policy if there is a conflict concerning PHI processed on behalf of a Clinic.
Patients seeking to exercise HIPAA rights concerning information maintained by their healthcare provider should ordinarily contact that provider directly. VeriPrep assists its Clinic customers with applicable HIPAA requests as required by our BAA and applicable law.
How We Share Information
We may disclose information:
To the Clinic
Patient information is made available to authorized users of the Clinic that enrolled the patient or is otherwise authorized to access the patient's information.
To Service Providers and Subcontractors
We use service providers to operate VeriPrep, including infrastructure, database, communications, email, security, and other technology providers.
Where a service provider creates, receives, maintains, or transmits PHI on VeriPrep's behalf, VeriPrep requires appropriate contractual protections, including a Business Associate Agreement where required by HIPAA.
We disclose only the information reasonably necessary for the provider to perform its function.
For Legal or Safety Reasons
We may disclose information when required by law or where otherwise permitted to:
- Comply with lawful legal process;
- Respond to a valid government request;
- Protect the security or integrity of VeriPrep;
- Investigate fraud, misuse, or security incidents; or
- Protect the rights, safety, or property of VeriPrep, our customers, patients, or others.
Business Transfers
If VeriPrep is involved in a merger, acquisition, financing, reorganization, sale of assets, or similar business transaction, information may be transferred as part of that transaction subject to applicable law and contractual obligations, including applicable HIPAA obligations.
De-Identified and Aggregated Information
Where permitted by our agreements with Clinics and applicable law, VeriPrep may create information that has been de-identified in accordance with HIPAA.
Information that has been properly de-identified so that it is no longer PHI may be used for purposes such as:
- Aggregate analytics;
- Benchmarking;
- Product performance measurement;
- Statistical analysis;
- Improving VeriPrep; and
- Understanding general preparation and engagement patterns.
VeriPrep does not attempt to re-identify properly de-identified information except where permitted by law for purposes such as evaluating a de-identification methodology.
SMS Communications
VeriPrep sends preparation-related SMS messages on behalf of participating Clinics.
Consent
Messages are sent only after the applicable enrollment process records patient consent.
VeriPrep supports consent paths that may include:
- Clinic-assisted enrollment, in which an authorized Clinic user attests that required patient consent was obtained; and
- Patient self-enrollment, in which the patient provides information and affirmatively accepts the consent language presented on the enrollment page.
Clinics are responsible for using VeriPrep in accordance with applicable law and for obtaining any consent or authorization required for their use of the Services.
Message Content
VeriPrep's patient-facing SMS templates are designed to avoid including patient names, procedure type, procedure date or time, Clinic name, or other identifying clinical details.
Messages generally contain generic preparation-related language and a secure, tokenized guide link.
Frequency
Message frequency varies depending on the preparation protocol, the patient's schedule, and the VeriPrep features used by the Clinic.
Message and data rates may apply.
Opt-Out
Patients may reply STOP to opt out of SMS communications.
Opt-out enforcement may be performed at the wireless-carrier or communications-provider level as well as reflected within VeriPrep's records. Depending on the messaging provider and telephone number configuration, an opt-out confirmation or network notice may be generated by the carrier or provider rather than by VeriPrep.
Patients may use supported opt-in keywords, such as START, where available, to restore SMS eligibility.
Quiet Hours
VeriPrep generally restricts scheduled healthcare SMS delivery between 8:00 PM and 8:00 AM in the Clinic's local time zone.
Automated recovery and re-engagement messages continue to respect the quiet-hours window.
Responses to patient-initiated messages may be sent outside the scheduled-message window.
Security
VeriPrep uses administrative, technical, and physical safeguards designed to protect information appropriate to the nature of the data we process.
These safeguards include, as applicable:
- Encryption of sensitive patient identity fields at the application layer;
- Encryption of data in transit using HTTPS/TLS;
- Encryption of production data at the infrastructure/storage layer;
- Access controls and authentication for Clinic users;
- Role- and Clinic-based authorization controls;
- Audit logging;
- Security monitoring and operational controls;
- Restricted patient-facing URLs using randomly generated access tokens; and
- Use of HIPAA-eligible infrastructure and services for production PHI where required.
No method of storage or transmission can be guaranteed to be completely secure.
Data Retention
VeriPrep retains information for as long as reasonably necessary to:
- Provide the Services;
- Fulfill our agreements with Clinics;
- Maintain appropriate security, audit, and compliance records;
- Resolve disputes;
- Comply with legal obligations; and
- Carry out other legitimate purposes permitted by applicable law.
Retention periods may differ by data type.
An SMS opt-out stops or blocks further applicable SMS delivery; it does not necessarily result in immediate deletion of the underlying patient enrollment or associated records.
Following termination of a Clinic's Services, PHI is returned or destroyed in accordance with the applicable BAA, subject to legally required or permitted retention and technically unavoidable backup or archival copies.
Where information must be retained, applicable protections continue for as long as the information remains in VeriPrep's possession.
Patient Requests
Patients may reply STOP to applicable SMS messages to opt out of further messaging.
Because VeriPrep generally maintains patient information on behalf of a healthcare provider, patients seeking access, amendment, deletion, or other rights regarding their medical information should ordinarily contact their Clinic directly.
Clinics may contact VeriPrep for assistance with requests involving information maintained in VeriPrep.
Clinic Requests
Authorized Clinic representatives may contact us regarding:
- Data access or export;
- Correction or amendment requests;
- Account administration;
- Data retention or deletion;
- Security or privacy concerns; or
- Questions about VeriPrep's handling of PHI.
Privacy and HIPAA inquiries should be directed to: privacy@veriprep.health
Children
VeriPrep is a service used by healthcare providers. VeriPrep does not independently market its Services to children.
If a Clinic uses VeriPrep in connection with a minor patient, the Clinic is responsible for determining the appropriate consent, authorization, and personal-representative requirements applicable to that patient.
Changes to This Policy
We may update this Privacy Policy as our Services, practices, or legal obligations change.
When we make changes, we will update the “Last updated” date above. If a change materially affects how we handle information, we may provide additional notice where appropriate.
Changes to this Privacy Policy do not modify a Clinic's BAA or other executed contractual obligations unless those agreements are separately amended in accordance with their terms.
Contact
VeriPrep LLC
1615 E Georgia Ave #140
Phoenix, AZ 85016
United States
Privacy and HIPAA inquiries: privacy@veriprep.health
General inquiries: hello@veriprep.health