Privacy Policy for Practitioners

Virka is operated by Finsane Consulting EOOD (ФИНСЕЙН КОНСУЛТИНГ ЕООД), a company registered in Bulgaria, with its registered office at 14 Lyulyakova gradina str., Izgrev District, Floor 2, 1113 Sofia, Bulgaria ("Virka", "we", "us"). You can reach us about privacy at vlad@virka.ai.

This policy explains how we handle personal data about you when you use Virka for practitioners, the practitioner space at app.virka.ai: when you ask for access, sign in, invite patients, read what they share with you, prepare synthesis drafts, and connect a calendar. For this data, Virka is the controller.

It does not cover the information your patients share with you. For that information, Virka acts on your behalf under the Data Processing Agreement in our Terms for Practitioners. A patient's own Virka account is covered by the Virka Privacy Policy they agreed to.

• Access request: your name, the name of your practice, your email address, and any note you add when you ask for access.
• When you request access after opening a summary a patient shared with you, we create a pending access request. This request records your email, the practice name and note you provide, and the fact that it originated from a patient's share. It does not grant you access to any patient data. Access begins only if the patient later consents.
• Account: your sign-in email address, your display name, the short name of your practice that appears in your patient links, the date we gave you access, and when you last used the practitioner space.
• Sign-in: if you sign in with Google, we receive your email address from Google and nothing else from your Google account. If you sign in by email, we send you a one-time sign-in link.
• Calendar connections: if you connect a calendar, we keep the access tokens that let us reach it, and the date you connected it. For Google Calendar we read your events to show your day in the portal and create an event when you book a consultation. For Microsoft Outlook we only read your events. We read your events when you open the portal; we do not store their contents.
• Invitations: the email address of each person you invite, and whether the invitation was sent, opened and accepted.
• Connections. When a patient chooses to connect with you, you appear on their list of practitioners. This does not give you access to their data. You see their information only for each category they separately consent to share (lab results, supplements and medications, summarised sleep, activity and body data, and habits and programs), and they can withdraw any category, or remove you, at any time. A connection never includes their questionnaire, medical records or genetic results.
• Usage records: for each synthesis draft you ask for, the amount of AI processing it used and its cost, counted per day and kept for 90 days, so we can run and pay for the service.
• Help improve Virka, only if you turn it on: metadata about your synthesis drafts, described below.

This setting is off unless you turn it on in Settings. When it is on, for each synthesis draft you ask for, we record:

• whether the draft was prepared, or which error stopped it
• whether it was your first draft for that patient or a regenerated one, and how many
• how long preparing it took, and how many attempts it needed
• how many lines our automatic checks removed or corrected, and how many were kept
• when the draft was prepared, whether and when you marked it reviewed, and how long after it was prepared
• how many times you copied it, and when you last did
• how many times you downloaded it as a PDF, and when you last did

We never record the text of the draft, the sources it cites, or which patient it was for. Each record is linked only to a random identifier that means nothing outside Virka. Records are deleted automatically after 90 days.

We use these records only to make synthesis drafts better and more reliable. Our legal basis is your consent, which you can withdraw at any time by turning the setting off. Turning it off also deletes everything recorded so far. You can also delete the records at any time with Delete my captured data, without turning the setting off.

• To give you the practitioner space you asked for: your account, sign-in, patient invitations, the patients who share with you, synthesis drafts, calendar connections and bookings. Legal basis: performing our contract with you (GDPR Article 6(1)(b)).
• To decide on your access request. Legal basis: steps you asked us to take before entering a contract (Article 6(1)(b)).
• To keep the service secure, check that you are still allowed in each time you use it, prevent misuse, and understand what the service costs to run. Legal basis: our legitimate interest in a secure, working service (Article 6(1)(f)).
• To improve synthesis drafts from Help improve Virka records. Legal basis: your consent (Article 6(1)(a)).
• To send you the emails the service needs: sign-in links, and a notice when a patient sends you their questionnaire. These notices name no patient and carry none of their answers.

We do not sell your data, use it for advertising, or build marketing profiles from it.

We use these service providers, acting as our processors:

• Vercel: hosting.
• Microsoft Ireland Operations Ltd (Azure): the encrypted datastore where your account and records are kept, on Microsoft Azure in the Sweden Central region (Sweden), with daily backups kept there and deleted within 15 days.
• Redis Ltd (Redis Cloud, on AWS in Ireland): our previous datastore. It keeps a read-only copy of your account and records for up to 14 days after our move to Microsoft Azure, then the copy is deleted.
• Resend: sending email, such as sign-in links, patient invitations and patient-submitted notices.
• Microsoft Ireland Operations Ltd (Azure): our primary AI provider, preparing synthesis and plan drafts on AI models hosted on Microsoft Azure in the Sweden Central region, on EU Data Zone deployments that keep the data in the EU. It receives the patient information needed for a draft, not your account details, and does not use it to train models.
• Anthropic: our fallback AI provider, used only when the primary provider is unavailable. It receives the same patient information for that draft, not your account details, and does not use data sent through its commercial API to train its models.
• Google and Microsoft: sign-in with Google, and the calendars you choose to connect, at your direction.

We do not otherwise disclose your data, except where the law requires it.

Some of these providers are based in, or process data in, the United States. Where they do, the transfer relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider is certified under it, or on the European Commission's Standard Contractual Clauses in that provider's data processing terms.

• Your account, calendar connections and invitations: for as long as you have access, and until you ask us to delete your account.
• Usage records and Help improve Virka records: 90 days, then deleted automatically.
• Backups of the datastore: deleted automatically within 15 days, so deleted data leaves the backups within 15 days.
• An access request: until you ask us to delete it, or until your access ends and your account is deleted.

The practitioner space uses only the cookies it needs to work: a sign-in cookie that keeps you signed in, and short-lived cookies that protect a sign-in or calendar connection while it is in progress. We use no analytics or advertising cookies.

Your data is stored in an encrypted datastore and sent only over encrypted connections. Your sign-in cookie is signed and cannot be read by scripts on the page. Each time you use the practitioner space we check again that your access is still active.

Under the General Data Protection Regulation you have the right to:

• get a copy of the personal data we hold about you
• have inaccurate data corrected
• have your data deleted, including your whole account
• restrict or object to processing based on our legitimate interests
• receive your data in a portable format
• withdraw consent at any time, without affecting what was done before
• complain to a data protection authority. In Bulgaria that is the Commission for Personal Data Protection (Комисия за защита на личните данни), www.cpdp.bg.

To delete your account, use Delete account on your Account page, or email us. To exercise any other right, email vlad@virka.ai from your sign-in address. We answer within one month. You can disconnect a calendar and turn off Help improve Virka yourself, in Settings.

If we change this policy in a way that matters, we will tell you by email or in the practitioner space before the change takes effect. The date at the top shows when it last changed.

This policy is written in English, and the English version governs.

Finsane Consulting EOOD, 14 Lyulyakova gradina str., Izgrev District, Floor 2, 1113 Sofia, Bulgaria. vlad@virka.ai.