Data protection and GDPR policy

Our approach

• Collect only information that is reasonably necessary for the service.
• Use information only for clear, documented purposes.
• Keep access restricted to authorised people and contracted service providers.
• Keep raw working material for shorter periods than professional records.
• Delete or anonymise information when there is no longer a justified need to keep it.
• Review new high-risk processing before it is introduced.

Controller and processor roles

Vericenta is a controller for information it uses for its own business administration, security, professional governance, report records and service operation. Where a client specifically instructs Vericenta to process personal data solely on that client's behalf, Vericenta acts as a processor and the required Article 28 processing terms apply.

Patient and special-category data

The standard service is not designed to receive private patient records. Clients should not send case files, medical records or unnecessary private health information through ordinary intake or support channels. Public healthcare content may incidentally contain testimonials, patient stories or other identifiable health-related material; Vericenta minimises what it copies and retains and may exclude or redact personal detail that is not needed for the review.

Automated analysis

Vericenta uses structured automated analysis as decision-support for content discovery, comparison and candidate issue generation. It does not replace professional judgement. Substantive client-facing findings are professionally reviewed before issue, and Vericenta does not use this service to make solely automated decisions with legal or similarly significant effects about individuals.

See our Automated intelligence and professional review policy.

Suppliers and transfers

Material technology suppliers are recorded in Vericenta's supplier and data-protection records. The relevant contract or data-processing terms, security position and any applicable international-transfer safeguard are recorded for material providers. Supplier access is limited to what is necessary for the contracted service.

Security and retention

Vericenta uses access controls, server-side secrets, encrypted connections, secure report links and audit records appropriate to the service. Retention periods are set by data category, not by a single blanket period. See the Data retention policy.

Your rights

Depending on the circumstances, individuals may have rights of access, correction, erasure, restriction, portability and objection. Requests can be sent to hello@vericenta.com. Vericenta may verify identity proportionately before disclosing or deleting personal data.

More detail

The Privacy notice explains the data Vericenta uses, the purposes and expected lawful bases, retention, individual rights and service-provider arrangements in more detail.