Vidoris Privacy Policy

In enterprise deployments, Foresia is provided by a healthcare organization / health system to its clinical staff. The hospital determines how patient and staff data is processed within the system (including user role assignments, SBARI form configurations, and authentication pathways).

Processor / Service Provider: Where we process patient and staff data on behalf of a hospital, the hospital acts as the Data Controller and Vidoris acts as the Data Processor / Service Provider under an executed Business Associate Agreement (BAA) and Master Services Agreement (MSA).

Patient Inquiries: If you are a patient seeking information on how your health data is handled, please contact the hospital providing your care, as they control the official Electronic Health Record (EHR) and clinical workflow.

A. Staff & User Account Data

We collect staff profile and account credentials required for authentication and workflow assignment, including name, corporate email, phone, staff ID, role/designation, unit assignments, and hospital-assigned identifiers (login methods support single sign-on [SSO] or EHR credentials).

Biometric Authentication: We support optional biometric login (e.g., Face ID / fingerprint) for quick mobile access. Biometric data remains locally managed by your device operating system; Vidoris does not store or process raw biometric data on our servers.

B. Patient & Clinical Data (Protected Health Information / PHI)

To deliver real-time risk assessment and rapid response coordination, Foresia processes clinical data synchronized from the hospital's EHR via HL7 / FHIR R4 interfaces based on unit configuration and user permissions. This includes:

• Patient demographics and identifiers (hashed/encrypted).
• Vital signs, laboratory results, LOINC-mapped trends, and nurse-documented clinical observations.
• Medical history, current orders, and notes synchronized from the EHR.
• Rapid Response Team (RRT) event records, team response actions, SBARI clinical documentation, and AI-assisted summaries.

C. Real-Time Communications & Alerts

Foresia processes clinical notifications, real-time alerts, and messaging content across secure, role-restricted channels (including 1:1 clinician chats, patient event group chats, and conversational AI queries).

Urgent alerts and push notifications are transmitted via authenticated channels to assigned mobile devices and clinical dashboards.

D. Technical, Security & Audit Data

We collect platform audit logs, security events, authentication attempts, processing durations, and error traces to ensure compliance and support quality improvement initiatives. IP-based rate limiting and API key validation are applied as part of enterprise security controls.

Platform Operations: To operate, deliver, and secure the platform, including user authentication, shift nurse assignments, real-time clinical monitoring, RRT/PRRES event management, and SBARI documentation workflows.

Clinical Decision Support: To power Foresia's predictive analytics (e.g., detecting early signs of patient deterioration, evaluating vital sign trends, generating risk alerts, and drafting handoff summaries) as configured by the health system.

Governance & Compliance: To maintain complete event audit trails with clinician attribution, investigate operational issues, and fulfill hospital governance requirements.

Authorized Health System Personnel: Data is accessible only to authorized staff based on strict Role-Based Access Controls (RBAC).

Vetted Sub-processors & Cloud Hosting: With contracted cloud and technology infrastructure vendors under strict confidentiality, security, and enterprise BAA terms.

Clinical AI Sub-processors: Where clinical AI models are utilized, processing is governed under enterprise data processing agreements ensuring zero retention for third-party model training.

Legal & Regulatory Obligations: When required by law, court order, or regulatory body to protect system security and patient safety.

Zero Commercialization: Vidoris does not sell, rent, or commercialize personal health information or user data.

We implement industry-standard administrative, technical, and physical safeguards appropriate for healthcare data, including:

Encryption Standards: Full end-to-end encryption in transit (TLS 1.3) and at rest (AES-256) for all patient data, with patient identifier hashing to prevent correlation outside authorized contexts.

Interoperability & Access: HL7/FHIR R4 integration with API key validation, token-based session management, and granular role-based access control.

Data Residency: Deployment support for on-premises, cloud, or sovereign-cloud configurations aligned with regional health authority jurisdiction rules.

Access Revocation: Real-time permission filtering that immediately terminates event access if a clinician's credentials are modified or revoked in the hospital EHR.

Data retention schedules are aligned with the hospital’s contractual requirements, legal regulations, and state-level clinical record laws:

• Automatic expiration/TTL (Time-To-Live) policies for temporary patient monitoring states.
• Immediate, on-demand removal of temporary patient state data upon authorized hospital request.
• Persistent, clinician-signed event records retained in accordance with health system quality improvement and audit policies.

Hospital Staff: Account updates, role changes, and access permissions are managed directly by your hospital system administrator.

Patients: Inquiries regarding access, correction, or deletion of clinical records and PHI must be directed to your care provider (the hospital holding your official medical record).

The Services are intended for professional use by authorized healthcare providers and enterprise administrative staff. They are not intended for direct consumer or pediatric use.

The Vidoris corporate website (vidoris.ai) may feature an AI conversational assistant for general inquiries, partner communication, and demo scheduling.

Separation of Systems: This assistant operates independently on public web infrastructure and is strictly isolated from the Foresia clinical application and EHR data.

No PHI Collection: The website assistant is not designed or authorized to collect, store, or process Protected Health Information (PHI) or clinical data.

AI Disclosure: Interactions with the website assistant are powered by automated artificial intelligence.

We may update this Privacy Policy periodically to reflect enhancements to Foresia, platform updates, or evolving regulatory requirements. Updated versions will be published on our platform with a revised "Last Updated" date.

For enterprise privacy inquiries, security questions, or BAA verification, please contact:

Vidoris Privacy & Compliance Office

📧 Email: [email protected]

🌐 Website: www.vidoris.ai