Your health data, handled with care.

VLOOP is a community-based cardiac screening and referral platform operated as a G-ACT Foundation initiative (“VLOOP”, “we”, “us”). This policy covers the VLOOP mobile application, the VLOOP web portal used by participating hospitals and field associates, and this website (v-loop.health).

VLOOP is a screening and care-navigation tool. It does not provide medical diagnoses, and it does not replace evaluation by a qualified clinician.

Depending on how you use VLOOP, we may collect:

• Identity and contact data — name, phone number, and country, collected when a trained VLOOP associate registers you for a screening or when you sign in to the patient app.
• Health screening data — your answers to the screening questionnaire, the resulting V-Risk score and risk level, and, where performed, point-of-care ultrasound (POCUS) findings and attached reports.
• Referral data — which participating hospital a referral was sent to and its status.
• Account and security data — for hospital and program staff: email, role, and sign-in records. For patients: one-time SMS verification codes (never stored in readable form).
• Technical data — basic device and usage information needed to operate and secure the service, such as IP address and request logs.

We do not collect data from your device’s health sensors, and we do not access your contacts, photos, or location.

• To run your screening and calculate your V-Risk score.
• To connect you with a participating hospital when a referral is recommended, and to let that hospital review your screening results.
• To show you your own screening history and guidance in the patient app.
• To verify identity at sign-in (one-time SMS codes).
• To operate, secure, and improve the platform, including audit logging of access to health records.
• For research and program evaluation, using de-identified or aggregated data only.

We never sell personal information, and we do not share it for advertising. Information is shared only:

• With the participating hospital that receives your referral, so its clinical team can review your screening and provide care.
• With service providers who help us run the platform (for example, SMS delivery and secure cloud hosting), bound by confidentiality obligations.
• With researchers and public-health partners in de-identified, aggregated form.
• When required by law or to protect the safety of a patient.

• All data is encrypted in transit (TLS).
• Passwords are stored using modern one-way hashing (Argon2id); verification codes are stored only as hashes and expire quickly.
• Access is role-based: hospital staff can only see patients referred to their own hospital, and every access to health records is audit logged.
• Patients can only ever access their own record, verified by their own phone number.

Screening and referral records are retained for as long as needed to support your care and the program’s research obligations, after which they are deleted or irreversibly de-identified. You may request deletion at any time (see Section 7); we will honor it unless a legal or clinical-safety obligation requires otherwise.

You may at any time:

• Request a copy of the personal information we hold about you.
• Ask us to correct inaccurate information.
• Ask us to delete your information.
• Withdraw from the program.

To exercise any of these rights, contact us at berker@v-loop.health. We respond within 30 days.

VLOOP is not directed at children under 13, and we do not knowingly collect their information without the consent of a parent or guardian as part of a supervised screening.

We may update this policy as the program evolves. The “last updated” date above always reflects the current version, and material changes will be announced in the app.

Questions about privacy at VLOOP? Write to berker@v-loop.health.