Effective October 19, 2026. This policy covers the Vantage Health website (vantagehealth.co), the therapist and patient portals, and the NeuroBloom app operated on the same platform. It explains what we collect, why, who sees it, and the choices you have, including for text messages.
Vantage Health is a practice management and clinical support platform for licensed mental health professionals and their patients. We handle information in two different roles:
As a business associate. Records that a therapist or their patients enter into the portals (appointments, notes, forms, questionnaires, documents, EEG files, messages, billing records) are protected health information under HIPAA. The therapist's practice is the covered entity and decides how that information is used. We process it only on the practice's instructions and under our Business Associate Agreement. Questions about your treatment records go to your therapist, who can also give you a copy of their own notice of privacy practices.
As a controller of our own data. Account details for therapists, the public directory listings, visits to this website, billing between therapists and Vantage Health, and the operational logs we keep to run the service are ours to manage, and this policy is our notice for them.
Therapist accounts. Name, email address, password (stored as a one way hash), license type, license number and issuing state, the profile you write for the directory, credential documents you upload, your practice's billing details, and the plan you choose. We confirm the email address at sign up and check license details against the issuing board before a listing goes public.
Patient accounts. Name, email address, date of birth and contact details entered by the patient or by their therapist, a parent or guardian's contact details where one is on file, notification preferences, and the records described above. Patient accounts exist because a therapist added the patient or the patient joined through a practice link.
Payments. Card payments are processed by Stripe. Card numbers never reach our servers; we store the last four digits, the card brand and a Stripe reference so a saved card can be charged or removed. Payments between patients and therapists go into the therapist's own Stripe account.
Technical and usage data. IP address, browser type, the pages and features used, sign in times, and an audit trail of who viewed or changed a record. The audit trail is part of the HIPAA safeguards and is kept for the practice.
Sign in with Google. If you choose it, Google tells us your name and email address and confirms that you control that address. No other Google data is read.
To provide the service you or your therapist asked for: scheduling, reminders, documentation, forms, billing, the patient portal, the directory and the NeuroBloom program. To keep the service secure and to investigate misuse. To send emails that are part of the service, such as appointment confirmations, "you have a new message" notices, sign in links and receipts. To bill therapists for their plan. To meet legal obligations. We do not sell personal information, we do not use patient records to train artificial intelligence models, and we do not advertise to patients.
Some features for therapists (session transcription, drafted notes and summaries, intake drafts, the assistant, and the Bloom companion in NeuroBloom) send text or audio to Amazon Web Services' Bedrock service for processing. AWS acts as our subcontractor under a HIPAA business associate agreement, processes the content only to return a result, and does not keep it or use it to train models. Nothing a model drafts becomes part of a record until the therapist reviews and signs it.
Service providers who act on our instructions and are bound by contract, including a business associate agreement where protected health information is involved: Amazon Web Services (hosting, storage, email delivery, text message delivery, AI processing, all in the United States), Stripe (payments) and Google (optional sign in). Your therapist's own choices: a therapist may share a record with you, with a parent or guardian on file, or with another professional as their own privacy notice allows; they may also send EEG files to an analysis service they choose. The law: we disclose information when a valid legal process requires it, and we tell the practice when we are allowed to. A buyer of the business, if Vantage Health is ever sold, under the same commitments.
What we send. Appointment reminders for a visit you have booked with your therapist, session day reminders for members of the NeuroBloom program, and short service notices such as a reminder that a form is due. Messages never contain clinical content, diagnoses, notes or test results. Message frequency depends on how many appointments or program sessions you have; most people receive a few messages a month.
How you opt in. Text messages are off by default. You turn them on yourself in your portal under Notifications by entering your mobile number and ticking the consent box, which reads: "By checking this box, you consent to receive appointment reminders, program session reminders and health care updates by text message from Vantage Health on behalf of your provider. Message frequency may vary. Message and data rates may apply. Reply HELP for help or STOP to opt out." We record the date and time you agreed and the exact wording you saw. A therapist or their staff cannot turn texts on for you. Agreeing to texts is never a condition of receiving care or of using the service.
How you opt out. Reply STOP to any message and texts stop at once; reply START to turn them back on. You can also switch texts off under Notifications in your portal at any time. Reply HELP for help, or contact us at the address in section 12.
Costs and carriers. Message and data rates may apply according to your mobile plan. Carriers are not liable for delayed or undelivered messages. Messages are sent through Amazon Web Services from a number registered to Vantage Health.
Your number is not shared. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt in data and consent are not shared with any third party; the only exception is the carrier network and delivery provider needed to send the message to you.
The portals keep your sign in session and your display preferences in your browser's storage; these are needed for the service to work and are cleared when you sign out. The public website does not use advertising cookies or sell browsing data. If we ever add measurement of how the website is used, it will be in aggregate and this policy will say so.
Information is encrypted in transit and at rest on servers in the United States. Access is limited to the people who need it to run the service, every access to a patient record is logged, passwords are hashed, and backups are encrypted. No system is perfectly secure; if we learn of a breach affecting your information we will notify the practice, and you where the law requires, without undue delay.
Patient records are kept for as long as the therapist's practice uses the service, because the practice is responsible for its own record keeping duties. When a therapist closes their account we keep their records for 30 days so they can export them, then delete them, except where the law requires longer. Audio recordings are deleted on the schedule the therapist sets. Text message consent records are kept for as long as you have an account and for the period carriers require afterwards. Operational logs are kept for a limited period for security.
You can see and update your account details in your portal, change notification settings, remove saved cards, and ask for your account to be closed. For rights over your treatment records, including copies, corrections and restrictions, contact your therapist, who is the covered entity under HIPAA. California residents have the right to know what personal information we hold about them, to ask for it to be deleted, and not to be discriminated against for exercising those rights; we do not sell or share personal information for cross context behavioural advertising. To exercise a right, contact us as described in section 11 and we will verify your identity before acting. Protected health information is handled under HIPAA rather than the California Consumer Privacy Act.
The service is for adults and for minors who are patients of a participating practice. A patient account for a minor is created by the therapist with a parent or guardian's contact details, and a parent can have a login of their own to manage it. We do not knowingly collect information from children outside that relationship.
Questions about this policy, or requests about information Vantage Health controls, can be sent to privacy@vantagehealth.co. Therapists can also use the support link in the provider portal. Questions about treatment records go to your therapist.
We will post any change here with a new effective date. Changes that reduce your privacy will be announced in the portals before they take effect.
This is the first published version of this policy and is under legal review.
