Privacy Policy

Effective August 5, 2026

This policy explains how Verismo Health Inc. ("Verismo," "we," "us," or "our") collects, uses, discloses, retains, and protects information through Verismo Ads at ads.verismohealth.com.

1. Scope

Verismo Ads is an invitation-only clinic marketing platform for authorized Verismo personnel and invited clinic users. It supports paid advertising, search engine optimization, Google Business Profile workflows, creative approvals, reporting, and related marketing operations. This policy applies to the portal and its connected integrations.

2. Information we collect

Account and access information

• Your name, verified Google email address, immutable Google account identifier, assigned role, clinic access, invitation status, session information, and security/audit events.
• For portal authentication, Google authorization is used only to verify identity. Verismo Ads does not retain Google access or refresh tokens for sign-in.

Clinic and marketing information

• Clinic identity, website, location, services, approved brand assets, advertising consent, and authorized team profiles synchronized from Verismo's Support Portal.
• Campaign settings, advertisements, approved creative, budgets, payments, performance metrics, conversions, reports, SEO audits, public website information, search visibility, local presence, reviews, and publishing history.
• Public communications and content you approve or publish through connected advertising, social, business-profile, or website services.

Google user data

When an authorized administrator connects Google services, Verismo Ads may access the Google Ads accounts and campaign data, Search Console properties and search-performance data, Analytics properties and aggregate measurement data, and Google Business Profile locations, performance, posts, and reviews that the administrator selects and is authorized to manage. Connected-account identifiers and encrypted integration credentials may be stored so the requested features can continue to operate.

Technical information

We process IP address, device/browser information, request identifiers, authentication events, security signals, and essential cookies needed to protect sessions, prevent abuse, and operate the service. We do not use third-party behavioural advertising cookies in the portal.

3. How we use information

• Authenticate invited users, enforce roles and clinic scope, secure sessions, and maintain audit records.
• Connect, read, create, update, pause, measure, reconcile, and report on advertising and public business-profile resources that authorized users choose to manage.
• Generate and review creative, analyze aggregate performance, identify SEO opportunities, support A/B testing, and prepare client reports.
• Process managed marketing budgets, taxes, payments, and service communications.
• Detect abuse, diagnose failures, meet legal obligations, and improve reliability and security.

4. Google API data and Limited Use

Verismo Ads' use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide or improve the user-facing features requested by an authorized user, to maintain security, and to comply with applicable law.

We do not sell Google user data, use it for personalized advertising, transfer it to data brokers, or allow humans to read it except with the user's affirmative agreement for a specific support purpose, when required for security or legal compliance, or when the data has been aggregated and anonymized. We do not use Google user data to train general-purpose artificial intelligence models.

5. When we disclose information

We disclose information only as needed to operate the service, follow your instructions, protect the platform, or comply with law. Recipients may include:

• Connected services such as Google and Meta when an authorized user publishes, synchronizes, or measures resources.
• Infrastructure, storage, security, email, payment, and support providers acting for Verismo under contractual safeguards.
• OpenAI for approved, privacy-screened creative or marketing assistance. Patient information and raw clinical data are not sent to OpenAI.
• Authorized Verismo personnel and the clinic organizations assigned to the relevant tenant scope.
• Government, law-enforcement, or other parties when required by law or necessary to protect rights, safety, and platform integrity.

We do not sell personal information or Google user data.

6. Retention and deletion

We retain account, campaign, reporting, payment, approval, integration, and audit information only for as long as needed to provide the service, meet contractual and legal obligations, resolve disputes, and protect the platform. Retention periods vary by record type. Backup copies expire through controlled backup lifecycles.

Authorized users can disconnect Google access through the portal where available or through Google Account connections. To request access, correction, deletion, or integration-token removal, email support@verismohealth.com. We will verify authority and respond subject to legal, security, billing, and audit-retention requirements.

7. Security

We use invitation-only access, Google identity verification, role and clinic-scope controls, secure cookies, CSRF protection, rate limiting, encrypted transport, encrypted integration credentials, private storage, tenant isolation, audit logging, and operational monitoring. No service can guarantee absolute security; users must protect their Google accounts and report suspected unauthorized access promptly.

8. International processing

Verismo is based in Canada. Our service providers may process information in Canada, the United States, or other jurisdictions where they operate. Information may therefore be subject to the laws of those jurisdictions. We apply contractual, technical, and organizational safeguards appropriate to the information and service.

9. Your choices and rights

Depending on applicable law, you may have rights to access, correct, or request deletion of personal information, withdraw consent where processing relies on consent, and raise a concern about our practices. Clinic access administrators may also revoke portal access. Some records must be retained for security, audit, fraud-prevention, billing, or legal reasons.

10. Changes to this policy

We may update this policy as the service, providers, or legal requirements change. We will post the updated policy here, revise the effective date, and provide additional notice when a material change requires it.

11. Contact

Verismo Health Inc.
Privacy and support inquiries: support@verismohealth.com