Privacy Policy

1. Company Identity & Scope

This Privacy Policy applies to the services, applications, and websites operated by Vital Mosaic, LLC ("Vital Mosaic," "we," "us," or "our"), including https://vitalmosaic.us, https://www.vitalmosaic.org, and related mobile and clinical software integrations.

2. Information We Collect

Depending on how you interact with our platform, we may collect the following categories of information:

• Account Information: Name, verified corporate/personal email address, authentication credentials, and subscription status.
• Clinical and Health Information (Patient-Provided): Electronic health records, laboratory biomarkers, diagnostic imaging reports, medications, surgical histories, genetic testing panels, and self-reported symptoms that you upload or sync.
• SMART on FHIR and Provider Connections: When you connect to your healthcare system via SMART on FHIR protocols, we retrieve authorized clinical resources strictly according to your explicit authorization grant.
• Device & Usage Data: Technical logs, browser types, and diagnostic performance telemetry to maintain platform reliability, encrypted under zero-knowledge or pseudonymized tokens.

3. How We Use and Protect Your Information

Vital Mosaic processes your information strictly for the following purposes:

• Synthesizing and organizing chronological medical timelines to assist clinical communication between patients and licensed providers.
• Facilitating secure, patient-permissioned sharing of clinical packets with treating clinicians.
• Enforcing multi-tier AI safety guardrails, citation verification, and data confidentiality.

Zero AI Model Training on Protected Health Information (PHI): We do NOT use patient medical records or PHI to train public generative AI foundation models. All AI analysis is conducted through isolated, zero-retention clinical API endpoints under HIPAA Business Associate Agreements.

4. Data Sharing and Third Parties

Vital Mosaic does not sell, lease, or monetize your health data under any circumstances. We disclose information solely under the following conditions:

• Direct Patient Authorization: To healthcare providers, clinics, or family caregivers with whom you explicitly share a secure access link or QR code.
• HIPAA-Compliant Infrastructure Partners: Cloud infrastructure providers (such as Google Cloud Platform and Firebase) bound by signed HIPAA Business Associate Agreements (BAAs), utilizing AES-256 encryption at rest and TLS 1.3 in transit.
• Legal Requirements: When compelled by valid, enforceable court orders or statutory legal processes.

5. Patient Rights, Data Portability, and Deletion

In alignment with HIPAA, the FTC Health Breach Notification Rule, and state privacy statutes, you retain full ownership of your records:

• Right to Export: You may export your entire clinical record portfolio in standardized FHIR JSON or printable PDF packets at any time.
• Right to Purge: You may permanently delete your account and all associated health records through your account dashboard or by submitting a written request to support@vitalmosaic.org. Purges permanently remove records from active and backup databases.

6. Security Architecture

We maintain rigorous administrative, technical, and physical safeguards including role-based access control (RBAC), multi-factor authentication, cryptographic key derivation, and automated audit logging of all data access events.

7. Corporate Contact Information