Legal

Privacy Policy

How Verdi Labs collects, uses, and protects information on this website and in Emma and the Verdi platform.

Effective September 15, 2026 · Last updated September 15, 2026

1. What this policy covers

This policy describes how Verdi Labs, Inc. (“Verdi Labs”, “we”, “us”) handles information about the people who visit verdilabs.ai (the “website”) and the people who use Emma, the AI Practice Assistant, and the Verdi platform (the “Services”). It is written for the medical practices that are our customers and for the members of their workforce who use the Services.

2. This website

The website is a static site. It does not set cookies, run analytics, or use tracking pixels, and it has no forms that collect information. When you load it, our hosting provider and the font service record ordinary web-server information such as your IP address, browser type, and the page requested, which is used for security and to serve the page.

• Fonts are loaded from Google Fonts, which receives your IP address to deliver them.
• “Start a conversation” links to a scheduling page operated by Cal.com. Anything you enter there is collected by Cal.com under its own privacy policy and shared with us so we can hold the meeting.

3. The Services

When a practice administrator invites you to the Services, and when you use them, we collect and hold information about you as a user:

• Account and profile — your name, work email address, and, if you or your administrator add them, phone number, time zone, and professional identifiers such as an NPI and taxonomy code; the practices you belong to and the roles and permissions you hold in each.
• Sign-in — authentication is handled by Microsoft Entra External ID. Microsoft processes your credentials and multi-factor authentication on our behalf; we receive an identifier for your account, your email address, and your display name, and we never see your password.
• Activity and audit records — what you did in the Services and when: sign-ins, invitations, changes to memberships and permissions, and the records you viewed or edited. We keep these so practices can see who did what, and so we can secure the Services.
• Operational data — application logs, error reports, and performance measurements. Our telemetry pipeline is designed to strip patient information before it is stored.
• Email — invitations and account notices are sent to your work address through Azure Communication Services. We record that a message was sent and whether it was delivered, not its content.
• Session preferences — a cookie that remembers which practice you selected when you belong to more than one. It carries no personal information beyond that choice.

4. Patient information (PHI)

The Services handle Protected Health Information that a practice submits or that we retrieve from its connected electronic health record on its instructions. We are the practice’s business associate under the Health Insurance Portability and Accountability Act (HIPAA) and are bound by a Business Associate Agreement with each practice. Under it we:

• use and disclose PHI only to provide the Services to the practice, as the agreement permits, or as the law requires;
• never sell PHI and never use it for advertising;
• keep each practice’s data logically separated from every other practice’s;
• report security incidents affecting PHI to the practice within the time the agreement and the law require; and
• return or destroy PHI when the relationship ends, except where the law requires us to keep it.

We may create de-identified data in accordance with the HIPAA de-identification standard and use it to operate, maintain, and improve the Services.

5. How we use information

We use the information described above to:

• provide, operate, secure, and support the Services, including signing you in and routing work to the right people;
• send invitations, account notices, and service communications (we do not send marketing email to users of the Services);
• investigate and prevent unauthorized access, fraud, and abuse, and meet our security and audit obligations;
• understand how the Services perform and improve them; and
• comply with law and enforce our agreements.

6. When we share information

We share information only as needed to run the Services, and never sell it. Recipients are:

• Your practice. Administrators of a practice you belong to can see your profile, your role, and your activity in that practice.
• Service providers that process information for us under contracts that limit what they may do with it: Microsoft Azure (hosting, databases, storage, identity, and email delivery), Anthropic (the AI models that power Emma, Section 7), Google (fonts on the website), and Cal.com (scheduling, only if you book a meeting). Providers that touch PHI are bound by business associate terms.
• Connected systems that a practice has chosen to link, such as its electronic health record, when the practice instructs us to read or write information there.
• Legal and safety — when required by law, subpoena, or court order, or when necessary to protect the rights, safety, or property of Verdi Labs, our customers, or others. Where the law allows, we will tell the affected practice first.
• A successor in a merger, acquisition, or sale of assets, under the same protections, with notice to our customers.

7. Artificial intelligence

Emma uses artificial intelligence to organize and prepare work for clinicians. The models are provided by Anthropic and process the information a practice makes available to them for that purpose only, under commercial terms that prohibit Anthropic from using our inputs or outputs to train its models. We do not use one practice’s PHI to train models that serve other customers, and every output Emma produces is reviewed by a clinician before it is acted on. Where PHI is processed by a model provider, that provider is bound by business associate terms.

8. Security

We protect information with administrative, physical, and technical safeguards appropriate to the sensitivity of health data: encryption in transit and at rest, multi-factor authentication for every user, role-based access with the least privilege needed, per-practice data separation, audit logging, and regular review of our controls. No system is perfectly secure; if we learn of a breach affecting your information we will notify the practice and, where the law requires, you.

9. Retention

• User accounts and audit records are kept for as long as the practice is a customer and for a period afterward as our agreements and the law require, then deleted.
• PHI is retained on the practice’s instructions and under the Business Associate Agreement, and is returned or destroyed when the relationship ends, except for copies in routine backups until they cycle out or as the law requires.
• Operational logs are kept for a limited period for security and troubleshooting and then deleted.

10. Your choices and rights

If you use the Services, you can view and correct your own profile in the application, and your practice administrator can update or remove your access. You can ask us at the address in Section 14 to access, correct, or delete the information we hold about you as a user; we will honor the request unless our agreement with your practice or the law requires us to keep it, and we may refer requests about a practice’s data to the practice. Depending on where you live, you may have additional rights under state privacy law; we do not sell personal information or share it for cross-context behavioral advertising, and we do not discriminate against anyone for exercising their rights.

Requests about patient records go to the practice that holds them (Section 1).

11. Where information is processed

Verdi Labs is based in the United States and the Services are hosted in Microsoft Azure regions in the United States. We do not offer the Services outside the United States unless we agree otherwise in writing.

12. Children

The website and the Services are for organizations and their workforce and are not directed to children. We do not knowingly collect information from anyone under 18 as a user. Patient records handled on a practice’s behalf may concern minors and are governed by Section 4.

13. Changes to this policy

We may update this policy. We will post the new version here with its effective date and, for material changes affecting the Services, give our customers at least thirty days’ notice by email or in the application.

14. Contact