Privacy Policy

At a Glance

VertigoDx Inc. (“VertigoDx,” “we,” “our,” “us”) makes the SmartVertigo™ Vestibular Assessment System — a video-oculography (VOG) system that records, tracks, stores, and displays a patient’s eye movements so that a licensed clinician can review them. It is a prescription-use medical device. It provides no diagnosis and does not provide diagnostic recommendations. This Privacy Policy explains what information we collect, why we collect it, how we use and share it, how long we keep it, and the choices you have. Some highlights:

• The VertigoDx headset uses a close-range camera to record video of your eye during a vestibular assessment session, so a clinician can review your eye movements and look for nystagmus (involuntary eye movement). This video is captured and uploaded as a routine, necessary part of every session — it is not an optional or incidental feature. The exam video is recorded without audio.
• After a recording is uploaded, our software automatically measures your eye movements and proposes a nystagmus classification for the clip. That output is decision-support information presented to your clinician for review. It is not a diagnosis, and your clinician remains responsible for interpreting it (see Section 13).
• VertigoDx does not use its eye-movement recordings to identify who you are. We do not use the video for facial recognition or any other biometric-identity purpose, and we do not extract a facial or identity template from any image.
• De-identified recordings and measurements may be used to develop, test, and improve the software. Use of your recordings for education, professional training, or marketing depends on the optional permission in the authorization you signed — that authorization, not this summary, controls.
• VertigoDx does not sell or rent Personal Information. We do not use your information for cross-context behavioral advertising. Our public website runs no analytics, advertising, or session-replay trackers and sets no cookies.
• VertigoDx holds your session data directly and has a direct relationship with you regarding that data, as described in your signed Patient Consent, Video Recording, Data Use & HIPAA Authorization. If your visit took place through a clinic, your information is also shared with that clinic and is subject to the clinic’s own Notice of Privacy Practices for your in-clinic care. This summary is for convenience — the full policy below controls.

1. Who We Are and What This Policy Covers

This Privacy Policy describes how VertigoDx Inc., a company incorporated and registered according to the laws of Delaware, USA, with Enterprise Identification No. 99-4061009, and located at 7050 W Palmetto Park Rd, Ste 15-341, Boca Raton, FL 33433, USA (“VertigoDx”), collects, uses, discloses, retains, and otherwise processes Personal Information through our website https://www.vertigodx.com and any subdomain (the “Site”), the VertigoDx mobile application for iOS (the “App”), the clinician web portal (the “Portal”), and our backend services and APIs (together, the “Services”).

Two relationships are possible: (a) Controller relationship — when you visit the Site, fill in a contact form, or otherwise interact with us outside of a clinical assessment, VertigoDx is the controller of your Personal Information; or (b) Direct patient relationship — when you receive a SmartVertigo assessment, VertigoDx holds your session data directly and has a direct relationship with you regarding that data, governed by this Policy and your signed Patient Consent, Video Recording, Data Use & HIPAA Authorization. Where your assessment takes place at or through a healthcare clinic, the clinic remains responsible for your clinical care and its own Notice of Privacy Practices applies to that care. If you are unsure which relationship applies to you, contact us at alan@vertigodx.com.

1.1 About the device and its regulatory status.

The SmartVertigo™ Vestibular Assessment System received FDA 510(k) clearance (K260566) on 30 July 2026. It is indicated for use in the medical office, hospital and healthcare settings for viewing and recording eye movements in patients with symptoms of dizziness caused by peripheral vestibular disorders, under the supervision of a clinician. The target population is individuals 12 years of age and older. The device records, tracks, stores and displays normal and abnormal eye movements, including vertical, horizontal and torsional. It provides no diagnosis and does not provide diagnostic recommendations. Clinical interpretation and treatment decisions remain the responsibility of the licensed healthcare professional. Prescription use only. “Cleared” is not “approved”: a 510(k) clearance means the FDA has found the device substantially equivalent to a legally marketed predicate device.

2. Information We Collect

2.1 Information you provide directly.

• Patient identity and contact information. Patients do not create a VertigoDx account and do not sign into the App — the App is operated by your clinician or clinic staff. Your clinic enters your name and a patient identifier into your VertigoDx record. Date of birth, gender, an email address, and a phone number are optional fields that a clinic may also record. VertigoDx does not operate an email or SMS sending service and does not send you text messages or emails about your visit — any such contact comes from your clinic.
• Clinical / care information. Your clinician enters intake information (such as presenting symptoms, questionnaire answers, and relevant history), the assessment tests performed at your visit, treatment steps, and clinical notes about your session into your VertigoDx record.
• Signed consent and authorization. When you sign the Patient Consent, Video Recording, Data Use & HIPAA Authorization on the device, we store the completed document (including your signature image, your name, the date and time of signing, and the clinician’s counter-signature), the version of the consent you signed, and — for a patient under 18 — the guardian’s name and relationship. If you later revoke your authorization in writing, we record that revocation against the same document.
• Clinic sign-in credential (App). Each clinician or staff member who uses the App has a personal unlock password. VertigoDx stores only a bcrypt hash of that password, never the password itself, and never logs it. Because a clinic handset must be able to verify a sign-in when it has no network connection, the hashes for that clinic’s people are synchronised to the handset and verified locally on the device. Newly provisioned people are given a default password that they or an administrator can change from the device or the Portal; we record who last changed it and when.
• Portal account (clinic and VertigoDx staff). Portal sign-in is a separate account, held in our authentication service, consisting of an email address, a password we never see in plain text, a role, and a session cookie set in your browser after you sign in.
• Communications. If you email us at alan@vertigodx.com or submit the contact / demo-request form on the Site, we collect what you send us (name, email address, institution, specialty, message, and the browser user-agent string) together with our response. Submissions are stored in the Portal for the team to action; we do not operate a separate support-ticketing system.

2.2 Information collected automatically when you use the App.

• Camera and video. During a session, the App records close-up eye-movement video and uploads it to VertigoDx so your clinician can review it and so the measurements below can be generated (see Section 3). The camera is configured to record video only; exam recordings contain no audio track.
• Eye-movement measurements and automatic classification. Once a recording is uploaded, it is analysed by our software, which computes numerical measurements — such as slow-phase velocity, beat amplitude, beat frequency, and direction of eye movement — and produces a proposed nystagmus classification for the clip, tagged with the model version that produced it. Both are stored with the recording and shown to your clinician (see Section 13).
• Voice dictation (optional, clinician-initiated). A clinician may dictate symptoms or notes instead of typing. When they do, iOS speech recognition converts the speech to text. VertigoDx stores only the resulting text; we do not receive or store the audio. The dictation audio is processed by Apple under Apple’s privacy policy.
• AI summary of a clinician’s note (optional, clinician-initiated). If a clinician asks for a summary of a session note they have written, the note text is sent to Anthropic’s API to produce a short bullet summary. The summary is displayed to the clinician only; it is not written into the clinical record, and neither the note text nor the summary is stored or logged by that feature.
• Device and app information. We record information about the clinic handset itself — device identifier (including IMEI), model, nickname, app version, iOS version, and when it last contacted our servers — so that a clinic can manage its devices and so we can support them.
• Audit and security logs. We record security-relevant events — sign-ins, password changes and resets, video uploads and deletions, consent signing and revocation, record access and changes — together with the acting user’s identifier, email address and role, the IP address and browser user-agent of the request, and a timestamp. These entries are hash-chained so that tampering is detectable, and are kept for HIPAA audit-trail and account-security purposes.

2.3 Information collected automatically when you use the Site or the Portal.

• Server logs. Our hosting provider records standard server log data for requests to the Site and Portal (IP address, browser and operating-system identifiers, referring URL, pages requested, timestamps).
• No analytics and no advertising trackers. The public Site loads no analytics, tag-manager, advertising, or session-replay script, and sets no cookies. We do not use Google Analytics or any comparable product, and we do not correlate your Site visits with any account for marketing attribution.
• Portal session cookie. When a clinician or administrator signs into the Portal, our authentication service sets a strictly necessary session cookie in that browser so the session persists between pages. It is not used for advertising or for tracking you across other websites.

2.4 Information we never collect.

• Your Face ID or Touch ID biometric template. Face ID and Touch ID are not used by the App at all.
• Audio of your examination. Exam video is recorded without audio, and VertigoDx does not receive or store dictation audio (see Section 2.2).
• Your location. The App does not collect or transmit location data.
• Apple HealthKit data. The App does not integrate with HealthKit.
• Advertising identifiers. VertigoDx does not collect your iOS Advertising Identifier (IDFA) and does not use the AppTrackingTransparency framework.
• Payment card or bank details from patients. Patients do not pay VertigoDx through the Services.

3. Camera, Eye-Movement Video, and Face Data

This section answers the requirements of Apple App Store Review Guideline 5.1.1(i) in detail. If you only read one section, read this one.

3.1 What the camera does in the App.

The VertigoDx headset uses a close-range camera during a session to record video of your eye so that nystagmus (involuntary eye movement) can be observed and measured. Software then analyses the recorded eye video to compute outputs such as slow-phase velocity, beat amplitude, beat frequency, and eye-movement direction, and to propose a nystagmus classification for the clip. The camera is positioned close to your eye in order to capture it, and records video without audio.

3.2 What the eye-tracking software does, and does not, do.

• It does not use Apple’s face-detection, face-landmark, face-mesh, ARKit face-tracking, or Vision-framework face APIs.
• It does track your eye’s pupil position and movement, and it does automatically propose a nystagmus classification for each recording — that is a core function of the product. It does not extract or store facial geometry, a face mesh, or any biometric template that could identify who you are.
• It does not diagnose. The measurements and the proposed classification are presented to your clinician as decision-support information for their review; the device provides no diagnosis and no diagnostic recommendation (see Sections 1.1 and 13).
• The software’s outputs are not designed or used to identify who you are. The underlying video, however, does show your eye and the surrounding periorbital area, and is treated as health data.
• The recorded eye video, together with the numerical outputs above, is transmitted to VertigoDx as a routine part of every session so your clinician can review it.

3.3 When video containing your eye is transmitted.

Eye-movement video is transmitted from the headset-mounted smartphone to VertigoDx as part of every session — this is how the exam is performed. Any image of your eye or the surrounding area is treated as face / health data. To produce the automatic classification described above, our backend generates a short-lived signed link to your recording and passes it to the model-hosting provider named in Section 7.2, which reads the clip, returns the measurements and classification, and is not permitted to use it for any other purpose.

3.4 Face ID.

Face ID is not used at all.

4. Health and Clinical Data

VertigoDx is a recording and review system used in the assessment of vestibular disorders. The Services therefore involve information about your eye movements and your visit, and may include: demographic and intake information; the tests performed and session records; eye-movement measurements and the automatic classification generated from your recorded video; clinician notes and clinical observations; follow-up and visit history; your signed authorization; and any free-text feedback you submit.

We treat this information as sensitive health data: we use it to allow your clinician to review your eye-movement recordings and measurements, to maintain a record of your sessions, and to keep the software safe and reliable. This information is Protected Health Information (PHI) under HIPAA. VertigoDx holds and processes it directly, under your signed Patient Consent, Video Recording, Data Use & HIPAA Authorization. We do not sell, rent, or share health or clinical data with advertising networks, data brokers, social-media platforms, or any third party for marketing purposes. We do not use health or clinical data to make decisions that produce legal or similarly significant effects about you without human review (see Section 13).

5. Platform Maintenance, Quality Improvement, and De-Identified Use

5.1 Internal operations.

Session data, including eye-movement recordings, is used by VertigoDx to operate, maintain, test, audit, troubleshoot, and improve the reliability and accuracy of the Services, and to investigate faults, complaints, and safety issues as our quality system and FDA obligations require. Access for these purposes is limited to VertigoDx personnel who need it for their role and is recorded in the audit log.

5.2 Service providers.

We share session data and video files with the service providers named in Section 7.2 strictly as needed to store, process, display, and analyse your session records.

5.3 De-identified use.

VertigoDx may de-identify clinical video and session measurements in accordance with HIPAA. De-identified information may be used to develop, train, validate, and improve our eye-movement software, and — where the authorization you signed includes the optional permission for education, professional training, research, AI training, and marketing use — for those purposes as well. Recordings used outside direct clinical care show only the eye region. We do not attempt to re-identify de-identified data, and we do not sell it.

5.4 Retention and withdrawal for de-identified use.

Your authorization expires on the earlier of three (3) years from the date you signed it or the end of your care relationship with VertigoDx, and you may revoke it in writing at any time before then. Revocation stops further use going forward; it cannot undo a use or disclosure that already occurred. As your consent form explains, once data has been aggregated and de-identified into a trained model, its influence on that model’s learned parameters cannot be isolated and removed.

6. How We Use Personal Information

We use the information described in Section 2 to:

• let your clinician review your eye-movement recordings and measurements and maintain a record of your sessions;
• generate the eye-movement measurements and the automatic classification that support your clinician’s review;
• maintain, test, and improve software accuracy, platform security, and system functionality;
• maintain the security, integrity, and reliability of the Services, including fraud prevention, abuse detection, and HIPAA-required audit trails;
• respond to a demo request, question, or other message you send us;
• comply with our legal, regulatory, and contractual obligations, including those imposed by HIPAA, FDA medical-device requirements, state privacy laws, the Apple Developer Program License Agreement, and applicable App Store rules; and
• develop and improve our software using de-identified data, and make other de-identified uses to the extent your signed authorization permits (see Section 5).

7. How We Share Personal Information

7.1 With your clinic and care team.

If you were assessed at or through a clinic, VertigoDx shares your intake, session, and progress information with that clinic and the clinicians and clinic staff assigned to your care, according to the access each person has been granted in the Portal. A clinician may also generate a report of your session as a PDF; when that report is opened from the App, it is served through a signed link that expires after about ten minutes.

7.2 With service providers (subprocessors).

• Supabase (United States): hosts our PostgreSQL database and the object storage that holds your video files, consent PDFs, and session data. Supabase runs this infrastructure on Amazon Web Services in the US-East region.
• Vercel (United States): hosts and serves the Site, the Portal, and our APIs, terminates TLS, and produces the server logs described in Section 2.3.
• Modal (United States): runs the eye-movement analysis and classification model. It receives a short-lived signed link to the recording being analysed and returns the measurements and proposed classification.
• Anthropic (United States): processes the text of a clinician’s session note when that clinician asks for the optional AI summary described in Section 2.2. No other information is sent, and the request is not stored by VertigoDx.
• Apple: distributes the App through the App Store, provides the speech recognition used for optional voice dictation, and provides any crash reporting a device owner chooses to share with developers through iOS. Apple’s privacy practices are governed by Apple’s Privacy Policy.
• Professional advisors (lawyers, accountants, auditors) bound by confidentiality.

VertigoDx does not use an email-delivery provider or an SMS provider, and no analytics or advertising provider receives any information from the Services. A current list of named subprocessors is available on request at alan@vertigodx.com.

7.3 In legal or safety circumstances.

We may disclose Personal Information if we have a good-faith belief that disclosure is necessary to comply with applicable law, enforce our Terms, address fraud or security issues, meet a regulatory reporting obligation, or protect the rights, property, or safety of VertigoDx, our users, or others.

7.4 In a corporate transaction.

If VertigoDx is involved in a merger, acquisition, financing, or sale of assets, Personal Information may be transferred as part of that transaction, subject to commitments equivalent to this Policy.

7.5 Aggregated and de-identified data.

We may produce de-identified or aggregated information from Personal Information. De-identified or aggregated information that cannot reasonably be linked back to an individual is not subject to this Policy. We will not attempt to re-identify such data.

8. International Transfers

VertigoDx and the service providers listed in Section 7.2 are based in the United States, and the Services are hosted in the United States. If you access the Services from outside the United States, your information will be transferred to and processed in the United States. If you are in the EEA, the UK, or Switzerland and you wish to learn more about the safeguards we apply to transfers, contact us at alan@vertigodx.com.

9. How Long We Keep Information (Retention)

We retain Personal Information no longer than necessary for the purposes for which it was collected:

• Session records, eye-movement measurements, classifications, and clinician notes (PHI / medical records): seven (7) years from the date of the recording or clinical encounter, unless a longer period is required by state or federal medical-record retention law. This matches the retention period stated in your Patient Consent, Video Recording, Data Use & HIPAA Authorization.
• Eye-movement videos: seven (7) years from upload. Every uploaded recording is stamped with its scheduled purge date when it arrives. A nightly job retires recordings whose date has passed — removing them from clinical view and moving the file to a restricted location — and permanently deletes the file and its record thirty (30) days later.
• Signed consent forms and revocations: kept with the clinical record for the same period as the record they authorise.
• Security and audit logs: retained for at least the six (6) years HIPAA requires for such documentation. They are not deleted automatically today; where an audit entry is no longer required, it is removed under a documented review rather than on a timer.
• Contact and demo-request submissions: kept until the request has been actioned and is no longer needed, and removed on request.
• Backups: deleted information may persist in our infrastructure providers’ encrypted backup snapshots for a limited period, in line with their backup schedules, before those snapshots roll off.

10. How We Protect Information (Security)

We use administrative, technical, and physical safeguards, including:

• HTTPS with TLS and HTTP Strict Transport Security for all traffic between the App, the Site, the Portal, and our backend, with a restrictive content-security policy on the Site and Portal;
• AES-256-GCM encryption of stored session payloads containing PHI, using a key held only in our server environment, so that direct inspection of the database reveals ciphertext;
• encryption at rest of our database, object storage, and backups as provided by our infrastructure providers;
• role-based access controls that restrict clinic, clinician, staff, and VertigoDx access to the minimum necessary for each role, with optional per-clinic IP allow-listing for device access;
• password hashing (bcrypt) for App unlock credentials and hashed, revocable API keys for clinic devices — no credential is stored or logged in plain text;
• hash-chained audit logging of security-relevant events, so that alteration of the trail is detectable;
• time-limited signed links for video playback and report downloads, rather than public file URLs;
• secure software-development and change-control practices under our quality management system.

No security control is perfect. We will notify you and, where applicable, your clinic of a security incident affecting your Personal Information as required by applicable law and by our agreements with your clinic.

11. Your Rights and Choices

Subject to applicable law, you have the following rights: access, correction, deletion, portability; withdraw consent at any time; opt out of “sale” or “sharing” (VertigoDx does not sell or share Personal Information for cross-context behavioral advertising, so this is honored by default); restrict or object to certain processing; non-discrimination for exercising rights; and authorized agent and appeal.

To exercise any of these rights, email alan@vertigodx.com. We will verify your identity and respond within the time required by applicable law (generally 45 days under CCPA / CPRA, one month under GDPR / UK GDPR). You also have rights under HIPAA (access, amendment, accounting of disclosures, restriction), exercised directly with VertigoDx or with the clinic that holds your care record.

12. State and Country-Specific Privacy Disclosures

These disclosures supplement the rights described in Section 11. Residents of the jurisdictions below may have additional rights; to exercise them or request jurisdiction-specific detail, contact alan@vertigodx.com.

12.1 California (CCPA / CPRA).

12.2 Washington (My Health My Data Act) and Nevada (SB 370).

12.3 Other U.S. states (Colorado, Connecticut, Virginia, Utah, Texas).

12.4 European Economic Area, United Kingdom, and Switzerland.

13. Automated Processing and AI

Every uploaded recording is analysed automatically. The software produces numerical outputs — such as slow-phase velocity, beat amplitude, beat frequency, and eye-movement direction — and a proposed nystagmus classification for the clip, recorded together with the version of the model that produced it. This happens without a clinician asking for it, as part of processing the upload.

These outputs are decision-support information presented to your clinician for review. The device provides no diagnosis and does not provide diagnostic recommendations; a clinician reviews the recording and the outputs and remains responsible for interpreting your results and reaching any diagnosis. VertigoDx does not use these outputs to make decisions that produce legal or similarly significant effects about you without human review. Separately, a clinician may ask for an AI-generated summary of a note they wrote themselves; that summary is shown to the clinician only and is never written into your record (see Section 2.2).

14. Children and Minors

The VertigoDx Services are provided to patients ages 12 and older, consistent with the device’s cleared indications for use. For a patient under 18, the patient’s parent or legal guardian must provide the consent and authorization described in the Patient Consent, Video Recording, Data Use & HIPAA Authorization on the minor’s behalf, and we record the guardian’s name and relationship. We do not knowingly collect Personal Information from children under 12; if we learn that we have, we will delete it.

15. Third-Party Services and Links

The Services may contain links to third-party websites, products, or services that VertigoDx does not operate. This Policy does not apply to those third parties. The VertigoDx App relies on the following Apple-operated services: the Apple App Store and iOS speech recognition for optional voice dictation. Apple’s privacy practices are governed by Apple’s Privacy Policy at https://www.apple.com/legal/privacy/. Our other service providers are named in Section 7.2.

16. Changes to This Policy

We may update this Policy from time to time. When we do, we will update the “Last Updated” date at the top. If the changes are material, we will notify you in advance by an in-App or in-Portal notice, through your clinic, and, where required, obtain your consent.

17. Contact Us

VertigoDx Inc.
7050 W Palmetto Park Rd, Ste 15-341
Boca Raton, FL 33433
United States
alan@vertigodx.com