Privacy Policy
This policy explains how VVIDAI, Inc. (“VVIDAI”, “we”) handles personal data when you visit vvidai.io, sign in to VVIDAI with your Google account, ask for a Health Plan Fee & Compensation Review, or write to us. It covers this website and VVIDAI accounts. Leviqa and any service we deliver under contract have their own terms.
We collect little, and we say exactly what. If something here is unclear, write to contact@vvidai.io. Use of the site is also governed by our Terms of Use.
Who we are
VVIDAI, Inc. is a corporation based in Dover, Delaware, USA. We are the controller of the personal data described in this policy: we decide why and how it is processed.
We serve people in several countries, so this policy is written to meet the Brazilian General Data Protection Law (LGPD), the EU General Data Protection Regulation (GDPR) where it applies, and the privacy-notice laws of California and Delaware.
- Controller
- VVIDAI, Inc.
- Location
- Dover, Delaware, USA
- Privacy contact
- contact@vvidai.io
- Encarregado (LGPD)
- Thiago Oliveirathiago.oliveira@vvidai.io
What we collect
We only receive personal data from the five sources below. Nothing else collects it.
| Source | Data | Why |
|---|---|---|
| The Health Plan Fee & Compensation Review request form | Full name, work email, company, role, covered lives range, plan renewal month, an optional message, and the time you agreed to be contacted | To reply to your request and talk with you about the review |
| Email you send to contact@vvidai.io | Your email address, your name and anything you choose to write | To reply to you |
| Sign in with Google, when you choose it to create or access your VVIDAI account | From your Google account: its unique identifier, your email address and whether Google has verified it, your name, given name and family name, your profile picture and your language setting. Google sends only what the openid, email, and profile scopes cover, and may leave out the given name, family name or language | To create your account, sign you in, keep your session secure and show your name and photo in the product |
| Technical data from your visit | IP address, browser user agent, the page requested and the date and time, recorded in our hosting provider’s logs. Your IP address is also held briefly in memory to limit repeated form submissions | To run the site, keep it secure and meet legal record-keeping duties |
The NEXT_LOCALE cookie | The language the site is shown in: the one you chose, or the default | To show the site in your language on your next visit |
We do not use third-party analytics, advertising, tracking pixels or social media plugins, and we do not build profiles of visitors.
Sign in with Google gives us only the profile details listed above. We do not access any other data in your Google account or any other Google service. “Google user data” below explains how we handle what we receive.
Google user data
This section explains how VVIDAI accesses, uses, stores and shares the data it receives when you choose Sign in with Google. Sign in with Google is the only Google service we use, and we use it only to authenticate you.
VVIDAI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
How we access it
We receive Google user data only when you choose Sign in with Google. Google shows you what it will share with VVIDAI before you continue. We request only the openid, email, and profile scopes, which cover your basic profile and email address. They give us no access to any other Google service and do not let us act in your Google account.
From Google we receive:
- the unique identifier of your Google account, which becomes your username with us;
- your email address and whether Google has verified it;
- your name, and your given and family names when Google provides them;
- your profile picture;
- your language setting, when Google provides it.
How we use it
We use Google user data only to:
- create your VVIDAI account;
- authenticate you and keep your session secure;
- show your name and profile picture in the product.
We do not use it for advertising, to build profiles, to train artificial intelligence models, or for any purpose other than signing you in and running your account.
How we store and keep it
Your account is stored in Amazon Cognito, a service of Amazon Web Services, in the us-east-1 region in the United States. Data received from Google travels to it encrypted over HTTPS.
We keep it while your account exists and delete it when the account is deleted. You can ask us to delete your account at any time by writing to contact@vvidai.io.
How we share it
We do not sell Google user data and do not use or share it for advertising. We share it only with Amazon Web Services, which stores it as our processor and under our instructions, and with public authorities when the law or a court order requires it. In a merger or acquisition, we would transfer it only with your prior consent.
No one at VVIDAI reads it, except when needed for security (for example, to investigate abuse), to comply with the law, or with your express consent.
How to remove access
You can remove VVIDAI’s access to your Google account at any time at myaccount.google.com/permissions(opens in a new tab). Google then stops sharing your data with us unless you sign in with Google again. Removing access does not delete what we already received: to delete it, ask us to delete your account at contact@vvidai.io.
Purposes and legal bases
Each use of your data rests on a legal basis. Where both laws apply, the table shows the LGPD basis and the GDPR basis for the same purpose.
| Purpose | LGPD | GDPR |
|---|---|---|
| Replying to your request for a review or to your message. We record the time you agreed to be contacted | Preliminary steps taken at your request (art. 7, V) | Steps taken at your request before a contract (art. 6(1)(b)) |
| Creating your account and authenticating you with Sign in with Google | Performance of a contract to which you are a party (art. 7, V) | Performance of a contract (art. 6(1)(b)) |
| Security, abuse prevention and limiting repeated submissions | Legitimate interest (art. 7, IX) | Legitimate interests (art. 6(1)(f)) |
| Keeping access logs | Legal obligation (art. 7, II, and Marco Civil da Internet, art. 15) | Legitimate interests (art. 6(1)(f)) |
| Remembering your language | Legitimate interest (art. 7, IX), through a strictly necessary cookie | Legitimate interests (art. 6(1)(f)), through a strictly necessary cookie |
| Exercising or defending rights in legal, administrative or arbitration proceedings | Regular exercise of rights (art. 7, VI) | Legitimate interests (art. 6(1)(f)) |
Where we rely on legitimate interest, we have weighed it against your rights and kept the processing to what the purpose needs. You can object at any time (see “Your rights”). No law or contract requires you to give us your details, but without the form fields we cannot reply to your request.
Sensitive data
None of our services needs health information about any person. The Health Plan Fee & Compensation Review works with plan-level fee and compensation documents, not with claims or medical records.
Please do not send us clinical information, protected health information (PHI) or other people’s personal data, in the form or by email. If you do, we will delete it once we notice it and will not use it.
International transfers
We are a United States company, and the site and VVIDAI accounts are hosted in the United States. If you visit from Brazil, the European Union or elsewhere, the data you send us is collected directly by us and processed in the United States.
Where data moves between us and our providers, we rely on contractual safeguards, including standard contractual clauses where the law requires them (LGPD art. 33, II, “b”, and ANPD Resolution CD/ANPD 19/2024; GDPR art. 46). You can ask us for information about these safeguards.
Retention
We keep personal data only as long as the purpose needs, then delete or anonymize it:
- Review requests and emails: up to 24 months after our last contact if no engagement follows. If we sign a contract with you, for the length of the relationship and then for the periods the law sets for legal claims.
- Your VVIDAI account and the data received from Google: while the account exists. That data is deleted with the account, which you can ask us to delete at any time.
- Access logs: for the period our hosting provider keeps them, and at least 6 months where Brazilian law (Marco Civil da Internet, art. 15) applies.
- The IP address used to limit repeated submissions: in memory only, for a short time. That copy is never written to storage.
- The
NEXT_LOCALEcookie: 365 days from when it was last set, or until you delete it.
Your rights
To exercise any right below, write to contact@vvidai.io. It is free. We may ask for information to confirm your identity before acting on a request, so that we never hand your data to someone else.
Brazil (LGPD)
As a data subject under the LGPD (art. 18), you may ask us for:
- confirmation that we process your data;
- access to your data;
- correction of incomplete, inaccurate or outdated data;
- anonymization, blocking or deletion of data that is unnecessary, excessive or processed unlawfully;
- portability of your data to another provider;
- deletion of data processed with your consent;
- information about the public and private entities we share your data with;
- information about the option not to give consent and what follows from refusing;
- withdrawal of consent, where processing relies on it.
You may also object to processing carried out without your consent if it does not comply with the LGPD (art. 18, § 2). We do not make decisions about visitors based solely on automated processing (art. 20).
We answer full access requests within 15 days (art. 19, II). You can also petition Brazil’s National Data Protection Agency (ANPD).
European Union (GDPR)
Where the GDPR applies, you have the right to access your data (art. 15), to have it corrected (art. 16) or erased (art. 17), to restrict processing (art. 18), to receive it in a portable format (art. 20), to object to processing based on legitimate interests (art. 21), and not to be subject to a decision based solely on automated processing (art. 22). We make no such decisions.
You can lodge a complaint with the data protection authority where you live or work, such as the CNIL in France.
United States
Wherever you live in the United States, you can ask us by email to show you the personal data we hold about you and to correct or delete it.
As required by California and Delaware privacy-notice laws, this policy lists the categories of personal data we collect (“What we collect”), the categories of third parties we share it with (“Sharing”), how we respond to Do Not Track signals (“Cookies”) and how we tell you about changes (“Changes to this policy”).
Security
The site is served only over HTTPS, so data is encrypted in transit. Access to logs and messages is limited to the people who need it. The form limits repeated submissions and filters automated abuse.
No system is perfectly secure. If a security incident could create a relevant risk or harm to you, we will notify the ANPD and the people affected within the deadlines set by law (Resolution CD/ANPD 15/2024), and other authorities where their law requires.
Children
The site is meant for professionals and companies. It is not directed at anyone under 18, and we do not knowingly collect data from children or adolescents (LGPD art. 14; COPPA). If you believe a child has sent us personal data, write to contact@vvidai.io and we will delete it.
Other websites
The site links to leviqa.com(opens in a new tab) and to our profiles on social networks. Those sites are run under their own privacy policies, which apply once you leave vvidai.io.
Changes to this policy
The effective date at the top of this page shows when this policy last changed. If we make a material change, we will display a prominent notice on this page before it takes effect.
Contact
For any question about this policy or your data, write to contact@vvidai.io.
- Controller
- VVIDAI, Inc.
- Location
- Dover, Delaware, USA
- Privacy contact
- contact@vvidai.io
- Encarregado (LGPD)
- Thiago Oliveirathiago.oliveira@vvidai.io