Terms for Practitioners

Virka for practitioners (the "Practitioner Space", at app.virka.ai) is provided by Finsane Consulting EOOD (ФИНСЕЙН КОНСУЛТИНГ ЕООД), registered in Bulgaria, registered office 14 Lyulyakova gradina str., Izgrev District, Floor 2, 1113 Sofia, Bulgaria ("Virka", "we", "us"). Contact: vlad@virka.ai.

These terms apply to your use of the Practitioner Space as a practitioner ("you"). If you also use the Virka app for yourself, that use is covered by the Virka Terms of Service and Privacy Policy, not by these terms. By signing in to the Practitioner Space, you accept these terms. If you do not accept them, do not use it.

The Practitioner Space is for health and wellbeing practitioners acting in the course of their professional practice, not for consumers. Access is by our approval: we decide who is let in, and under which practice name. You confirm that you hold whatever qualifications, registrations and insurance your practice requires where you work.

The Practitioner Space is in early access. Features may change, be added or be removed, and we may change or end early access with reasonable notice.

Your account is for you alone. You sign in with the email address we approved, either with Google or with a one-time email link. Keep access to that email account secure, do not share your account, and tell us straight away at vlad@virka.ai if you think someone else has used it.

• Invitations and intake: you invite patients by email or by link. A patient who accepts fills in your intake questionnaire in Virka and chooses what to share with you.
• Connections: lets a patient connect with you after they have shared a summary, placing you on their practitioner list with no access to their data until they consent to share specific categories. A connection never includes their questionnaire, medical records or genetic results.
• What patients share: their questionnaire answers and symptom scores, and, only if they also agree to it, their lab results, their medical records summary, their genetic results, their supplements and medications list, summarised sleep, activity and body composition data, and their active habits and programs, with journal yes/no answers shared as day counts. Items a patient shares may be used in the AI-drafted summaries you review.
• Synthesis drafts: when you ask, Virka prepares a draft reading of a patient's intake with the help of an AI model, for you to review. See section 5.
• Calendars: you can connect Google Calendar or Microsoft Outlook to see your day in the portal, and Google Calendar to book consultations. See section 8.

A synthesis draft is a set of prompts for you to consider: things that may be worth exploring, confirming or ruling out, or flagging and checking. Each line cites the parts of the intake it comes from. It is not a diagnosis, not a treatment recommendation, not a finding, and not a record of your consultation. It can be incomplete or wrong, and automatic checks remove lines that cite nothing or quote numbers the patient did not give, but they cannot catch every error.

A draft is prepared only when you ask for it, only while your practice has AI tools turned on in Settings, and only from what the patient has agreed to share with you. Drafts are private to you: the patient does not see them, and marking a draft as reviewed is a private note for you. Neither Virka nor any draft is a medical device.

You remain fully responsible for your professional judgement and for everything you decide, advise or do for your patients. Check anything a draft suggests against the patient's own information and your own assessment before relying on it.

When you copy a draft or any patient information out of Virka, or download it, for example as the intake forms document on your Account page, it leaves our control. You are then responsible for it, including your duties of confidentiality and record-keeping.

Patients decide what they share with you, and can stop sharing at any time. When a patient stops sharing, you lose access to everything they shared, and the copies of their lab results and genetic results made for you are deleted. Copies in our daily backups are deleted automatically within a further 15 days. You agree not to try to obtain patient information through Virka in any other way.

Genetic data. Genetic results are special-category data under Article 9 GDPR, shared only on the patient's explicit, separate consent. You:

• use them only to provide care to that patient;
• do not disclose them onward, including to insurers or employers, except where required by law or to another health professional involved in the patient's care with the patient's knowledge;
• treat them as the patient's reported test results, not as a diagnosis, and refer clinically significant findings to appropriate clinical or genetic counselling where indicated;
• understand that withdrawal of consent ends your access and that Virka deletes its copy; any record you have made in your own clinical file is governed by your own legal obligations.

Invite only people you have, or are arranging, a professional relationship with, who would expect to hear from you. Virka sends the invitation email for you, to the address you enter, and shows you whether it was opened and accepted.

Where you register after opening a summary a patient has shared with you, your registration creates a request only. It gives you no access to that patient or their data. Any access follows solely from the patient's own consent, given per category and revocable by them at any time. You must not represent to a patient that registering, or appearing on their list, entitles you to their data.

If you connect Google Calendar, Virka reads your events to show your day in the portal, and creates an event on your calendar only when you book a consultation. The patient is invited to that event, and Google emails them the invitation. If you connect Microsoft Outlook, Virka only reads your events. Virka never accepts, declines, moves or deletes anything on your calendar. You can disconnect a calendar at any time in Settings.

You agree not to:

• use the Practitioner Space unlawfully, or in breach of your professional obligations
• use it for anyone who is not your patient, or share access with anyone else
• present a synthesis draft to a patient, or to anyone else, as a diagnosis or as Virka's clinical advice
• try to get around its access controls, or reverse engineer, extract or copy its software, models or prompts
• send invitations that are unsolicited marketing

The Practitioner Space is free during early access. If we introduce fees, we will tell you in advance, and nothing will be charged unless you agree to it.

We own the Practitioner Space, its software and its content, other than what you and your patients put into it. Patients keep all rights in the information they share. Your own notes and settings are yours.

If you turn on Help improve Virka in Settings, we record metadata about your synthesis drafts, never their text and never which patient they were for, to improve the drafts. This is described in full in the Privacy Policy for Practitioners. It is off unless you turn it on.

We provide the Practitioner Space in good faith, as it is and as available, without any warranty that it will be uninterrupted, error-free, or fit for a particular purpose, in particular during early access.

To the extent the law allows, we are not liable for any indirect or consequential loss, for loss of profit, business or goodwill, or for any clinical or professional decision made using the Practitioner Space. Our total liability to you under the Agreement is limited to the greater of the fees you paid us in the twelve months before the claim and 100 euros.

Nothing in the Agreement limits liability that cannot be limited by law, including for death or personal injury caused by negligence, or for fraud.

You can stop using the Practitioner Space at any time, and ask us to delete your account with Delete account on your Account page, or by emailing vlad@virka.ai from your sign-in address. Either way it is a request, and we answer within one month. We may suspend or end your access if you break these terms, if your professional standing changes, or when early access ends, with notice where we reasonably can.

When the Agreement ends, the data we hold for you is dealt with as described in Part B, section 10.

We may update these terms as the Practitioner Space develops. We will tell you about significant changes by email or in the Practitioner Space before they take effect. If you keep using it after that, the updated terms apply.

The Agreement is governed by the laws of Bulgaria, and the courts of Sofia, Bulgaria have jurisdiction over any dispute. It is written in English, and the English version governs.

This Part applies to personal data about your patients that Virka processes on your behalf in the Practitioner Space ("Patient Data"). For that processing, you are the controller and Virka is your processor, under Article 28 of the General Data Protection Regulation ("GDPR").

Virka is separately the controller of a patient's own Virka account, and of their decisions about what to share with you, under the Virka Privacy Policy the patient agreed to. Virka is also the controller of personal data about you, under the Privacy Policy for Practitioners. Neither is covered by this Part.

• Subject matter and purpose: providing the Practitioner Space to you: showing you what patients share, preparing synthesis drafts when you ask, holding drafts and your review marks, sending invitations to the addresses you give us, and creating consultation bookings in your calendar.
• Nature: storage, display, transmission, structuring, and analysis by an AI model to prepare drafts.
• AI tools: your practice decides whether it uses AI tools (Settings, by its Owner or an Admin; on by default). When they are on, Virka prepares summaries, plan drafts and reply drafts, under your control, from what patients share with you. They run on the primary AI provider in the EU; only if it is unavailable is the same request sent to the fallback provider listed below. Nothing reaches a patient without your review. A patient's consent covers sharing their data with you, not the tools you choose.
• Duration: for as long as the Agreement is in force and a patient continues to share with you, then as set out in section 10.
• Data subjects: your patients, and people you invite.
• Types of data: names and email addresses; intake questionnaire answers, including personal and medical history; symptom scores; where the patient has agreed, lab results, supplements and medications lists, summarised sleep, activity and body composition data, and active habits and programs, with journal yes/no answers shared as day counts; synthesis drafts about them; your review marks; consultation booking details.
• Medical records summary: where the patient has agreed, visit dates, specialties, diagnoses and follow-ups, as summarised from documents the patient has added.
• Genetic results: where the patient has agreed, for clinical findings, condition, gene, variant identifier, the patient's genotype, and the source report's own result category and evidence level; for lifestyle and nutrition results, the trait, its result, the report's one-line statement of it and any daily amount; all as stated in DNA test reports the patient has added. No source report files or detailed report text are provided.
• Special categories: much of this is data concerning health under Article 9 GDPR, and genetic results are genetic data under the same Article.

Data subjects also include patients who have connected with the Practitioner but have not shared any category of data. For these data subjects no personal data is processed under this Agreement unless and until the patient consents to share a specific category; connection alone transfers no data.

We process Patient Data only on your documented instructions, which are the Agreement and your use of the Practitioner Space, including where data is transferred outside the EEA, unless the law requires otherwise. If the law requires otherwise, we will tell you before processing, unless the law forbids that. We will tell you if we believe an instruction breaks data protection law.

You are responsible for having a lawful basis, and a condition under Article 9 GDPR, for your own use of Patient Data in your practice, and for giving your patients the information your role as controller requires.

Everyone at Virka who can access Patient Data is bound by a duty of confidentiality, and has access only as far as their work requires it.

We apply technical and organisational measures appropriate to the risk, as Article 32 GDPR requires, including:

• encryption of data in transit and at rest
• access to each patient's data only through a live consent from that patient, checked on every request, and only for the practitioner that consent names
• sign-in re-checked against your approved access on every request, with signed, script-inaccessible session cookies
• deletion of the lab and genetics copies made for you when a patient stops sharing
• no patient information in the emails we send you

You give us general authorisation to use sub-processors. Those we use for Patient Data are:

• Vercel Inc.: hosting.
• Microsoft Ireland Operations Ltd: Microsoft Azure, the encrypted datastore, in the Sweden Central region (Sweden), with daily backups kept there and deleted within 15 days.
• Redis Ltd: Redis Cloud, on AWS in Ireland, our previous datastore. It keeps a read-only copy for up to 14 days after our move to Microsoft Azure, then the copy is deleted.
• Microsoft Ireland Operations Ltd: Microsoft Azure, the primary provider of the AI models that prepare synthesis and plan drafts, hosted in the Sweden Central region on EU Data Zone deployments. Microsoft does not use this data to train models.
• Anthropic PBC: the fallback provider of those AI models, used only when the primary provider is unavailable. Anthropic does not use data sent through its commercial API to train its models.
• Resend: sending invitation emails.
• Google LLC: creating consultation bookings in your Google Calendar, where you connect it.

We bind each sub-processor to data protection obligations that are no less protective than this Part, and we remain responsible to you for them. We will tell you by email at least 14 days before we add or replace a sub-processor. If you object on reasonable data protection grounds, we will discuss it with you in good faith, and if we cannot resolve it you may end the Agreement.

Where a sub-processor processes Patient Data outside the European Economic Area, the transfer relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the sub-processor is certified under it, or on the European Commission's Standard Contractual Clauses.

Taking into account the nature of the processing, we will help you respond to patients exercising their rights, and help you with security, breach notification, data protection impact assessments and prior consultation with a supervisory authority, under Articles 32 to 36 GDPR. If a patient contacts us directly about Patient Data held for you, we will pass the request to you without undue delay. Patients can also stop sharing with you, and delete their Virka account, themselves.

We will tell you without undue delay after becoming aware of a personal data breach affecting Patient Data, with the information we have that you need to meet your own obligations, and will keep you updated as we learn more.

When the Agreement ends, and within 30 days, we will delete the Patient Data we hold for you in the Practitioner Space, such as your synthesis drafts and review marks, the invitations you sent, and your calendar connections, unless the law requires us to keep it. Copies in our daily backups are deleted automatically within a further 15 days. If you ask before then, we will first give you a copy of your synthesis drafts in a common machine-readable format.

A patient's own Virka account, and what they entered into it, belong to the patient. They are kept or deleted according to the patient's own choices, not by the end of this Agreement.

We will make available to you the information needed to show that we meet this Part, and allow for and contribute to audits, including inspections, by you or an auditor you appoint who is bound by confidentiality. Audits take place on reasonable notice, during business hours, at your cost, and no more than once a year, unless a supervisory authority requires otherwise or after a personal data breach.

If Part A and this Part conflict about Patient Data, this Part prevails. The limits on liability in Part A, section 13, apply to this Part as far as the law allows.