HIPAA and
Your Data
What Vasl Health collects, who can see it, how VLAP handles your information, and your rights as a member or organizational partner ? in plain language.
What HIPAA means here
HIPAA ? the Health Insurance Portability and Accountability Act ? sets federal standards for how health information is handled, stored, and shared. Vasl Health is a HIPAA-covered entity, which means your health information in the Vasl platform receives the same legal protections as your medical records at a doctor's office.
In practice, this means Vasl cannot share your individual health information with anyone outside your care team without your explicit consent ? not your school, not your employer, not your parents (unless you're a minor and applicable state law requires it), and not any commercial third party. The architecture enforces this. It's not just a policy.
What you share in Vasl is treated like medical information. It stays within your care team ? your coach and your clinician. Your school administrator, your employer, and your parents do not have access to it. We don't sell it, share it for advertising, or disclose it without your consent. That's the commitment, and HIPAA makes it a legal one.
What data Vasl collects
We collect the minimum data necessary to provide the platform's care functions. Here's a specific breakdown of what is and isn't retained:
The PHQ-8 and GAD-7 scores you complete during onboarding are stored and visible in your profile. They are also visible to your coach and clinician as clinical context. They are not shared with your school, employer, or org administrator. Your individual scores are never part of any aggregate data provided to organizations ? only de-identified population-level trends are shared with org administrators.
Who can see what
This is the most important section for most members. Here is exactly who has access to each type of your data ? with no exceptions to what's described here.
The school administrator or org admin column says "Never" for every individual data type ? and "Aggregate ? De-identified" for community-level trends. That last entry means the org can see things like "this week, 34% of members reported mood scores below 3" ? with no names, no individual records, and no way to identify who contributed to the number. A minimum cohort size is required before aggregate data is surfaced, specifically to prevent de-identification by inference.
This is a question many members have ? especially students who worry that what they share will reach their counselors, teachers, or parents. The answer is architectural: the system is built so that individual disclosure to school administrators is structurally impossible. It is not a setting that can be changed, a policy that can be overridden by the school, or an exception that applies in any circumstance. Individual member data never reaches school staff.
How VLAP handles your data
VLAP ? the Vasl Language Analysis Platform ? processes the language you share in check-ins and coach messages to generate clinical signal context for your care team. Here's exactly how that processing works from a data perspective:
Your rights under HIPAA
As a Vasl member, HIPAA gives you specific rights over your health information. Here's what those rights are and how to exercise them:
You have the right to request a copy of your health information held by Vasl ? including your check-in history, assessment scores, mood data, and VLAP signal profiles. We will provide this within 30 days of a valid request.
If you believe any information in your Vasl records is inaccurate or incomplete, you have the right to request a correction. We will review the request and respond within 60 days.
You have the right to request an accounting of disclosures ? a record of who has accessed or received your health information, other than your care team and standard platform operations. We maintain audit logs and can provide this upon request.
You have the right to request restrictions on how your health information is used or shared within the platform ? beyond what HIPAA already requires. We will consider all requests and respond within 30 days, though we are not required to grant all restrictions.
You have the right to request deletion of your health information from Vasl's systems. Some data may be retained for the legally required period under HIPAA (minimum 6 years for certain records), but we will delete everything that can be deleted and confirm what, if anything, must be retained and why.
If you believe Vasl has violated your HIPAA rights, you have the right to file a complaint ? with us directly or with the U.S. Department of Health and Human Services Office for Civil Rights. We will not retaliate against you for filing a complaint.
For organizations ? BAA and compliance requirements
Every organization that deploys Vasl Health ? school districts, universities, community health centers, health plans ? is required to execute a Business Associate Agreement (BAA) with Vasl Health before any member data is collected or processed. The BAA establishes the legal framework for how Vasl handles protected health information (PHI) on behalf of the organization, and the specific safeguards that apply.
Breach notification
HIPAA requires that Vasl notify affected individuals and, where applicable, the U.S. Department of Health and Human Services if a breach of unsecured protected health information occurs. Here's how that works:
Individual notification: If a breach affects your health information, Vasl will notify you in writing within 60 days of discovering the breach. The notification will include: what happened, what types of information were involved, what Vasl is doing to investigate and mitigate the breach, and what you can do to protect yourself.
HHS notification: Breaches affecting 500 or more individuals in a state or jurisdiction are reported to HHS within 60 days. Smaller breaches are reported annually.
Media notification: Breaches affecting 500 or more individuals in a single state may require notification to prominent media outlets in that state, in addition to individual notification.
If you believe you've discovered a security vulnerability in the Vasl platform, or have reason to believe your data may have been accessed without authorization, contact us immediately at security@vaslhealth.com. We take all security reports seriously and will respond within 24 hours.
Questions and contact
For any question about your privacy, your data, or your HIPAA rights under the Vasl platform, contact our Privacy Officer directly: