Effective Date: July 27, 2026
At a Glance
VertigoDx is a video-oculography (VOG) diagnostic platform offered by VertigoDx Inc. (“VertigoDx,” “we,” “our,” “us”), used by clinicians to help diagnose vertigo and other vestibular disorders. This Privacy Policy explains what information we collect, why we collect it, how we use and share it, how long we keep it, and the choices you have. Some highlights:
• The VertigoDx headset uses a close-range camera to record video of your eye during a vestibular diagnostic session, so a clinician can detect and classify nystagmus (involuntary eye movement). This video is captured and uploaded as a routine, necessary part of every diagnostic session — it is not an optional or incidental feature.
• VertigoDx does not use its eye-movement recordings to identify who you are. We do not use the video for facial recognition or any other biometric-identity purpose, and we do not extract a facial or identity template from any image.
• VertigoDx processes clinical eye-movement video solely to present diagnostic recordings to your treating clinician and to maintain the technical quality, safety, and reliability of our software services.
• VertigoDx does not sell or rent Personal Information. We do not use your information for cross-context behavioral advertising.
• VertigoDx holds your diagnostic data directly and has a direct relationship with you regarding that data, as described in your signed Patient Consent, Video Recording, Data Use & HIPAA Authorization. If your account was provisioned through a clinic, your information may also be shared with that clinic and is subject to the clinic’s own Notice of Privacy Practices for your in-clinic care. This summary is for convenience — the full policy below controls.
1. Who We Are and What This Policy Covers
This Privacy Policy describes how VertigoDx Inc., a company incorporated and registered according to the laws of Delaware, USA, with Enterprise Identification No. 99-4061009, and located at 1221 College Park Dr, Suite 116, Dover, DE 19904, USA (“VertigoDx”), collects, uses, discloses, retains, and otherwise processes Personal Information through our website https://www.vertigodx.com and any subdomain (the “Site”), the VertigoDx mobile application for iOS (the “App”), and our backend services and APIs (together, the “Services”).
Two relationships are possible: (a) Controller relationship — when you visit the Site, fill in a contact form, sign up for marketing, or otherwise interact with us outside of a diagnostic evaluation, VertigoDx is the controller of your Personal Information; or (b) Direct patient relationship — when you receive a SmartVertigo diagnostic evaluation, VertigoDx holds your diagnostic data directly and has a direct relationship with you regarding that data, governed by this Policy and your signed Patient Consent, Video Recording, Data Use & HIPAA Authorization. Where your evaluation takes place at or through a healthcare clinic, the clinic remains responsible for your clinical care and its own Notice of Privacy Practices applies to that care. If you are unsure which relationship applies to you, contact us at contact@vertigodx.com.
2. Information We Collect
2.1 Information you provide directly.
• Patient contact information. Patients do not create a VertigoDx account or log into the App — the App is operated by your clinician. Your clinician enters your first name, last name, and phone number into your VertigoDx record. We do not currently collect a patient email address. We may use your phone number to send you text messages about your diagnostic visit and follow-up.
• Phone verification (clinician accounts). When a clinician sets up or resets access to the App, our SMS provider sends a one-time code to the clinician’s phone number to verify it. We store the masked phone number and the verification timestamp; we do not store the one-time code after verification.
• Passkey credential (clinician accounts). VertigoDx signs the clinician in using a passkey (a FIDO2 / WebAuthn credential). The private key is generated and stored on the clinician’s device by Apple, in the Secure Enclave, and is never sent to VertigoDx. VertigoDx stores only the public key and a randomly generated credential identifier.
• Clinical / care information. Your clinician enters intake information (such as age, presenting symptoms, and relevant medical history), the diagnostic tests ordered for your visit, and clinical notes about your session into your VertigoDx record.
• Communications. If you contact us by email, through our support form at https://www.vertigodx.com/support, or otherwise, we collect what you send us together with our response.
2.2 Information collected automatically when you use the App.
• Clinical Analytics. During a vestibular diagnostic session, software algorithms compute numerical analytics, including velocity, amplitude, and direction of eye movements, for clinician review.
• Camera and video. During a diagnostic session, the App records close-up eye-movement video and uploads it to VertigoDx so your clinician can review it and so the analytics above can be generated (see Section 3).
• App and device diagnostics. The App may send us limited diagnostic information about app version, iOS version, device model, language, time zone, and crash logs. VertigoDx does not collect your iOS Advertising Identifier (IDFA) and does not use the AppTrackingTransparency framework.
• Push notification token (clinician accounts). If a clinician enables notifications, iOS issues a device token that VertigoDx uses with Apple Push Notification Service (APNS) to deliver reminders and session updates.
• Audit and security logs. We record sign-in events, passkey registration and reset events, and similar security-relevant events for HIPAA audit-trail and account-security purposes.
2.3 Information collected automatically when you use the Site.
• Server logs and cookies. Our website collects standard server log data (IP address, browser and operating-system identifiers, referring URL, pages requested, timestamps), and uses cookies and similar technologies for analytics and site functionality.
• Web analytics. We use Google Analytics on the Site to measure traffic and improve content. See https://www.google.com/policies/privacy/partners/.
• Cross-device tracking. We may correlate Site visits with accounts you later create so we can attribute marketing activity. We do not use cookies to follow you to unrelated third-party sites.
2.4 Information we never collect.
• Your Face ID biometric template.
• Your microphone or audio recordings.
• The App does not request location permissions.
• The App does not integrate with HealthKit.
3. Camera, Eye-Movement Video, and Face Data
This section answers the requirements of Apple App Store Review Guideline 5.1.1(i) in detail. If you only read one section, read this one.
3.1 What the camera does in the App.
The VertigoDx headset uses a close-range camera during a diagnostic session to record video of your eye so that nystagmus (involuntary eye movement) can be detected and classified. Computerized software algorithms analyze the recorded eye video to compute outputs such as slow-phase velocity, beat amplitude, beat frequency, and eye-movement direction. The camera is positioned close to your eye in order to capture it.
3.2 What the eye-tracking model does NOT do.
• It does not use Apple’s face-detection, face-landmark, face-mesh, ARKit face-tracking, or Vision-framework face APIs.
• It does track your eye’s pupil position and movement in order to detect and classify nystagmus for clinical diagnosis — that is the App’s core function. It does not extract or store facial geometry, a face mesh, or any biometric template that could identify who you are.
• The model’s outputs are not designed or used to identify who you are. The underlying video, however, does show your eye and the surrounding periorbital area.
• The recorded eye video, together with the numerical outputs above, is transmitted to VertigoDx as a routine part of every diagnostic session so your clinician can review it.
3.3 When video containing your eye is transmitted.
Eye-movement video is transmitted from the headset-mounted smartphone to VertigoDx as part of every diagnostic session — this is how the exam is performed and is not conditioned on any separate opt-in. Any image of your eye or the surrounding area is treated as face/health data. If you separately consent under Section 7a of your Patient Consent to the use of de-identified recordings for education, research, or AI model development (see Section 5.3), any such recording is limited to your eye and the immediate periorbital area — no other identifying footage is used outside of your direct clinical care.
3.4 Face ID.
Face ID is not used at all.
4. Health and Clinical Data
VertigoDx is a diagnostic platform for vestibular disorders. The Services therefore involve information about your eye movements and your diagnostic visit, and may include: demographic and intake information; diagnostic tests ordered and session records; eye-movement (nystagmus) analytics generated from your recorded diagnostic video; clinician notes and clinical observations; follow-up and diagnostic history information; and any free-text feedback you submit.
We treat this information as sensitive health data: we use it solely to support your clinician’s diagnosis of your vestibular condition, to allow your clinician to review your eye-movement recordings and analytics, and to maintain internal software quality, algorithm validation, and platform operation. We may send you a text message to track your progress. This information is Protected Health Information (PHI) under HIPAA. VertigoDx holds and processes it directly, under your signed Patient Consent, Video Recording, Data Use & HIPAA Authorization. We do not sell, rent, or share health or clinical data with advertising networks, data brokers, social-media platforms, or any third party for marketing purposes. We do not use health or clinical data to make decisions that produce legal or similarly significant effects about you without human review (see Section 13).
5. Platform Maintenance, Testing, and Quality Improvement
5.1 Internal Operations. Diagnostic session data, including eye-movement recordings, are used by VertigoDx to maintain, test, audit, and improve the reliability and accuracy of our software applications and platform infrastructure.
5.2 Third-Party Service Providers. We share session data and video files with cloud infrastructure providers (such as Amazon Web Services) strictly as needed to process, store, and display session recordings to your clinician. All service providers operate under strict written Data Processing Agreements and Business Associate Agreements (BAAs) and are contractually prohibited from using your data for any independent purpose.
5.3 De-Identified Data Use. In accordance with HIPAA standards, VertigoDx may de-identify clinical video and session metrics. De-identified information may be retained and used for internal research, platform maintenance, and algorithm development purposes only for patients who have separately consented under Section 7a (Education, Research, and AI Training) of the Patient Consent, Video Recording, Data Use & HIPAA Authorization. For patients who have not provided that consent, clinical data is used solely to deliver, operate, and maintain the diagnostic service itself (including routine software validation and quality assurance necessary to run the Services), and is not retained or used for research, algorithm development, or AI model training. Any recording used for education, research, or AI model development under this Section shows only your eye and the immediate periorbital area — no other identifying footage is used outside of your direct clinical care.
5.4 Retention and Withdrawal for Research Use. De-identified data retained under Section 5.3 is retained no longer than the duration of your Section 7a authorization — currently up to three (3) years from the date of your signature, or earlier if your care relationship with VertigoDx ends or you revoke your authorization in writing, as described in your Patient Consent, Video Recording, Data Use & HIPAA Authorization. Once data has been de-identified and incorporated into aggregate research or model-training outputs, it may not be possible to fully remove its influence from those outputs, consistent with Section 6 of your signed Authorization.
6. How We Use Personal Information
We use the information described in Section 2 to:
• support your clinician’s diagnostic evaluation and maintain a record of your diagnostic sessions;
• generate the eye-movement analytics that support your clinician’s review;
• maintain, test, and improve software accuracy, platform security, and system functionality;
• communicate with you about your clinical progress;
• maintain the security, integrity, and reliability of the Services, including fraud prevention, abuse detection, and HIPAA-required audit trails;
• comply with our legal, regulatory, and contractual obligations, including those imposed by HIPAA, state privacy laws, the Apple Developer Program License Agreement, and applicable App Store rules; and
• with your consent, send you marketing communications about VertigoDx (see Section 11 for opt-out).
7. How We Share Personal Information
7.1 With your clinic and care team.
If you were evaluated at or through a clinic, VertigoDx shares your intake, diagnostic, and progress information with that clinic and the clinicians and clinic owners assigned to your care.
7.2 With service providers (subprocessors).
• Cloud infrastructure and storage: Amazon Web Services.
• SMS verification: Twilio.
• Email delivery: Amazon Web Services.
• Error and crash reporting: Apple App Store Connect.
• Professional advisors (lawyers, accountants, auditors) bound by confidentiality.
A current list of named subprocessors is available on request at contact@vertigodx.com.
7.3 In legal or safety circumstances.
We may disclose Personal Information if we have a good-faith belief that disclosure is necessary to comply with applicable law, enforce our Terms, address fraud or security issues, or protect the rights, property, or safety of VertigoDx, our users, or others.
7.4 In a corporate transaction.
If VertigoDx is involved in a merger, acquisition, financing, or sale of assets, Personal Information may be transferred as part of that transaction, subject to commitments equivalent to this Policy.
7.5 Aggregated and de-identified data.
We may produce de-identified or aggregated information from Personal Information. De-identified or aggregated information that cannot reasonably be linked back to an individual is not subject to this Policy. We will not attempt to re-identify such data.
8. International Transfers
VertigoDx and its subprocessors are based in the United States, and the Services are hosted in the United States. If you access the Services from outside the United States, your information will be transferred to and processed in the United States. If you are in the EEA, the UK, or Switzerland and you wish to learn more about the safeguards we apply to transfers, contact us at contact@vertigodx.com.
9. How Long We Keep Information (Retention)
We retain Personal Information no longer than necessary for the purposes for which it was collected:
• Account information: while your account is active, deleted or de-identified within ninety (90) days after account closure (except where law requires longer retention).
• Diagnostic session records, eye-movement analytics, and clinician notes (PHI / medical records): seven (7) years from the date of the recording or clinical encounter, then permanently deleted or de-identified, unless otherwise required by state or federal medical record retention law. This matches the retention period stated in your Patient Consent, Video Recording, Data Use & HIPAA Authorization.
• Diagnostic eye-movement videos retained as part of your clinical record: seven (7) years from the date of the recording.
• Security and audit logs: two (2) years.
• Customer-support communications: two (2) years from last contact.
• Marketing contact lists: until you unsubscribe, with deletion within thirty (30) days.
• Backups: deleted information may persist in encrypted backup snapshots for up to thirty-five (35) days after deletion.
• De-identified research / AI-training data (Section 7a authorization): see Section 5.4 (Retention and Withdrawal for Research Use) above.
10. How We Protect Information (Security)
We use reasonable administrative, technical, and physical safeguards, including:
• TLS 1.2 or higher for all transit between the App, the Site, and our backend;
• encryption at rest of databases, storage buckets, and backups;
• access controls that restrict VertigoDx employee and contractor access to Personal Information to the minimum necessary for their role, audited centrally;
• HIPAA-required security and audit-logging policies;
• written confidentiality and data-processing agreements with all subprocessors;
• secure software-development practices.
No security control is perfect. We will notify you of a security incident affecting your Personal Information as required by applicable law and our BAAs.
11. Your Rights and Choices
Subject to applicable law, you have the following rights: access, correction, deletion, portability; withdraw consent at any time; opt out of “sale” or “sharing” (VertigoDx does not sell or share Personal Information for cross-context behavioral advertising, so this is honored by default); opt out of marketing; restrict or object to certain processing; non-discrimination for exercising rights; and authorized agent and appeal.
To exercise any of these rights, visit https://www.vertigodx.com/support or email contact@vertigodx.com. We will verify your identity and respond within the time required by applicable law (generally 45 days under CCPA / CPRA, one month under GDPR / UK GDPR). You also have rights under HIPAA (access, amendment, accounting of disclosures, restriction), exercised directly with VertigoDx. To withdraw your Section 7a (Education, Research, and AI Training) authorization specifically, submit written revocation to VertigoDx as described in your Patient Consent, Video Recording, Data Use & HIPAA Authorization; revocation will not affect data already used in reliance on your prior authorization.
12. State and Country-Specific Privacy Disclosures
These disclosures supplement the rights described in Section 11. Residents of the jurisdictions below may have additional rights; to exercise them or request jurisdiction-specific detail, contact contact@vertigodx.com.
12.1 California (CCPA / CPRA).
12.2 Washington (My Health My Data Act) and Nevada (SB 370).
12.3 Other U.S. states (Colorado, Connecticut, Virginia, Utah, Texas).
12.4 European Economic Area, United Kingdom, and Switzerland.
13. Automated Decision-Making
VertigoDx’s eye-movement analytics software produces automated numerical outputs — such as slow-phase velocity, beat amplitude, beat frequency, and eye-movement direction. It does not automatically classify or diagnose nystagmus. These outputs are presented to your clinician as decision-support information, not as an automated diagnosis, and are not intended to replace your clinician’s independent clinical judgment. Your clinician remains responsible for interpreting your results and reaching a diagnosis. VertigoDx does not use these outputs to make decisions that produce legal or similarly significant effects about you without human review.
14. Children and Minors
The VertigoDx Services are provided to patients ages 12 and older. For a patient under 18, the patient’s parent or legal guardian must provide the consent and authorization described in the Patient Consent, Video Recording, Data Use & HIPAA Authorization on the minor’s behalf. We do not knowingly collect Personal Information from children under 12; if we learn that we have, we will delete it.
15. Third-Party Services and Links
The Services may contain links to third-party websites, products, or services that VertigoDx does not operate. This Policy does not apply to those third parties. The VertigoDx App relies on the following Apple-operated services: the Apple App Store, Apple Push Notification Service, Apple Passkey services, and Face ID / Touch ID for local biometric unlock. Apple’s privacy practices are governed by Apple’s Privacy Policy at https://www.apple.com/legal/privacy/.
16. Changes to This Policy
We may update this Policy from time to time. When we do, we will update the “Last Updated” date at the top. If the changes are material, we will notify you in advance by email or by an in-App notice and, where required, obtain your consent.
17. Contact Us
VertigoDx Inc.
1221 College Park Dr, Suite 116
Dover, DE 19904
United States
contact@vertigodx.com