Privacy Policy
Last updated: June 28, 2026
VeriPrep Health LLC ("VeriPrep," "we," "us") operates veriprep.health and related services. This Privacy Policy explains how we collect, use, and protect information in connection with our procedure preparation guide service.
WHO WE SERVE
VeriPrep provides software to healthcare organizations ("clinics"). Clinics use VeriPrep to deliver procedure preparation instructions to their patients via SMS and a mobile web guide.
INFORMATION WE COLLECT
From clinics:
- Organization name, contact information, and billing details
- Staff account email addresses and passwords (stored as bcrypt hashes)
- Protocol content (procedure preparation instructions authored by clinic staff)
From patients (on behalf of clinics):
- Phone number (encrypted at rest using AES-128 encryption)
- Procedure date and time
- A clinic-supplied patient reference code
- Consent record including the exact text of the consent checkbox at the time of enrollment
- Guide engagement events (which steps were viewed and completed, when the guide was opened)
We do not collect patient names, dates of birth, insurance information, medical record numbers, or clinical diagnoses.
HOW WE USE INFORMATION
Patient phone numbers are used only to send procedure preparation SMS messages on behalf of the enrolling clinic. Phone numbers are decrypted only at the moment of SMS send and are never stored in decrypted form outside that process.
Guide engagement data is used to help clinic staff identify patients who may need additional preparation support.
We do not sell patient data. We do not use patient data for advertising. We do not share patient data with third parties except as necessary to deliver the service (Twilio for SMS delivery) or as required by law.
HIPAA
VeriPrep operates as a Business Associate under HIPAA for healthcare clinic customers. We maintain a Business Associate Agreement (BAA) with each clinic customer before processing any protected health information. Our security practices include encryption at rest and in transit, access controls, and audit logging.
SMS MESSAGES
Patients receive SMS messages only after providing explicit consent through the enrolling clinic. VeriPrep supports two consent paths: clinic staff attestation (a staff member confirms patient consent in the dashboard before enrollment is submitted) and patient self-enrollment (the patient checks a consent checkbox on the enrollment page before their first message is sent). No SMS is sent until consent is confirmed through one of these paths.
Message frequency varies based on the patient's procedure preparation schedule. Message and data rates may apply.
Mobile phone numbers and consent records are not sold, shared, or provided to third parties or affiliates for marketing or promotional purposes.
Every SMS includes instructions to reply STOP to opt out. Opt-out requests are honored immediately and permanently. A confirmation message is sent upon opt-out. We do not send SMS messages between 8 PM and 8 AM in the patient's local time zone.
DATA RETENTION
Guide engagement data is retained for the duration of the clinic's subscription and for a period thereafter consistent with applicable law. Phone numbers are deleted upon patient opt-out or at clinic request.
YOUR RIGHTS
Patients who wish to opt out of SMS messages may reply STOP to any message. For questions about data held on behalf of a clinic, patients should contact their clinic directly. Clinics may contact us at hello@veriprep.health to request data deletion or export.
SECURITY
We use industry-standard security practices including encryption of sensitive data at rest, HTTPS for all data in transit, and access controls limiting staff access to authorized users only.
CONTACT
VeriPrep Health LLC
hello@veriprep.health
veriprep.health
This policy may be updated periodically. The date at the top of this page reflects the most recent revision.