Privacy Declaration
Last updated: September 13, 2026
UroAI Health is a product of Consent Vault, Inc. ("Consent Vault," "we," "us," or "our"). This Privacy Declaration explains how we collect, use, share, and protect information when you visit the UroAI Health website, contact us, or use our software. It also explains the choices available to you.
Two kinds of information
It helps to separate two kinds of information, because different rules apply to each.
Information about website visitors and business contacts. This is information about you as a visitor or a professional contact, such as your name and email address. This declaration describes how we handle it, and we act as the controller of it.
Patient information in the platform. When a urology practice uses our software, we process protected health information ("PHI") on that practice's behalf. Under HIPAA we act as a business associate, and the practice is the covered entity. Our handling of PHI is governed by our Business Associate Agreement with that practice, and patients' rights over that information are described in the practice's own Notice of Privacy Practices. This declaration does not change either of those. If you are a patient with a question about your health records, please contact your urology practice directly.
Information we collect
Information you give us. When you use our contact form, we collect your name, email address, your message, and anything else you choose to include, such as your role or your practice. If you correspond with us afterward by email or phone, we keep a record of that correspondence.
Information collected automatically. When you visit the website, we and our service providers may collect technical information such as your IP address, browser type and version, device and operating system, referring page, the pages you view, and the dates and times of your visits. We collect this through cookies and similar technologies.
Account information. If your practice uses our platform, we collect the information needed to create and administer user accounts, such as names, work contact details, role, and records of activity in the system for security and auditing.
Information we do not want. Please do not send us PHI or other sensitive personal information through the website. The contact form is not a secure channel for patient information.
How we use information
- Respond to your messages and questions, and follow up with you about them.
- Provide, operate, maintain, secure, and improve our website and software.
- Create and manage user accounts and verify who is accessing the platform.
- Send administrative and service messages, such as security alerts, policy changes, and support updates.
- Monitor for and investigate fraud, abuse, security incidents, and technical problems.
- Produce aggregated or de-identified statistics that do not identify any individual.
- Comply with our legal, regulatory, and contractual obligations.
We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use PHI for our own marketing. We use PHI only as permitted by our Business Associate Agreement with the relevant practice and by applicable law.
Legal bases for processing
Where the laws of your jurisdiction require a legal basis for processing, we rely on your consent, on our legitimate interest in operating and improving our business, on the performance of a contract with you or your organization, and on compliance with our legal obligations.
How we share information
We share personal information only as needed to run our business:
- Service providers. Companies that host, secure, monitor, or support our website and software, or that help us communicate with you, under contracts that limit their use of the information. Providers with access to PHI are bound by business associate agreements.
- Your practice or organization. If you use the platform through an employer or a practice, we may share information about your use of it with that organization's administrators.
- Professional advisers. Auditors, lawyers, and insurers, where they need the information to advise us.
- Legal requirements. When we are required to disclose information by law, subpoena, or court order, or where disclosure is needed to protect the rights, property, or safety of our users, our company, or the public.
- Business transfers. In connection with a merger, acquisition, financing, or sale of assets, subject to appropriate safeguards and to this declaration.
- With your direction or consent. Any other sharing you ask for or agree to.
How we protect information
We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, disclosure, alteration, and destruction. These include encryption of data in transit and at rest, role-based access controls and least-privilege access, multi-factor authentication for administrative accounts, activity logging and monitoring, background checks and privacy and security training for workforce members, vendor security review, and a documented incident response plan. Our safeguards for PHI are designed to meet the requirements of the HIPAA Security Rule.
No method of transmitting or storing information is completely secure, so we cannot guarantee absolute security. If a breach affects your information, we will notify you and the appropriate authorities as required by law and by our agreements.
How long we keep information
We keep contact form submissions and related correspondence for as long as needed to respond to you and to maintain a record of our dealings, after which we delete or de-identify them. We keep account and audit records for the life of the account and for the period required by law and by our agreements. PHI is retained, returned, or destroyed as set out in the applicable Business Associate Agreement.
Your rights and choices
Depending on where you live, you may have the right to request access to the personal information we hold about you, to request that we correct or delete it, to request a portable copy, to object to or restrict certain processing, and to withdraw consent you previously gave. Residents of some states, including California, Colorado, Connecticut, Utah, and Virginia, have specific rights under state privacy laws, including the right to appeal a decision we make about a request. We will not discriminate against you for exercising any of these rights.
To make a request, use the contact form on our website. We will verify your identity before acting and will respond within the time the applicable law allows. You may use an authorized agent where the law permits. If you are a patient, requests about your health records should go to your urology practice, which holds those records.
You can opt out of marketing emails at any time using the unsubscribe link in the message or by contacting us. We will still send you administrative messages about any account or correspondence you have with us.
Cookies and analytics
We use cookies that are necessary for the website to function, and we may use analytics cookies to understand how visitors find and use the site so we can improve it. You can block or delete cookies through your browser settings, though some parts of the site may not work properly if you do. We currently do not respond to browser Do Not Track signals, and we will update this section if that changes.
Children
The website is intended for healthcare professionals and other adults, and is not directed to children under 13. We do not knowingly collect personal information from children through the website. If you believe a child has provided us with information, contact us using the contact form and we will delete it. Information about pediatric patients held in the platform is PHI belonging to the treating practice and is governed by our agreement with that practice.
Information transfers
We store and process information in the United States. If you access the website from another country, you understand that your information will be transferred to and processed in the United States, where privacy laws may differ from those where you live. Where required, we put appropriate transfer safeguards in place.
Third-party sites
The website may link to sites we do not operate. We are not responsible for their privacy practices, and we encourage you to read the privacy policy of any site you visit.
Changes to this declaration
We may update this Privacy Declaration from time to time. When we do, we will revise the date at the top of this page. If a change is significant, we will provide additional notice, such as a notice on the website or an email where appropriate.
Contact
If you have questions about this Privacy Declaration or how we handle your information, please use the contact form on our website and your message will reach our privacy officer. If you are not satisfied with our response, you may have the right to complain to your local data protection authority or to the U.S. Department of Health and Human Services Office for Civil Rights.