Velora Privacy Policy and Data Safety Disclosure

1Introduction, Operating Entity & Regulatory Baselines

In the high-stakes ecosystem of professional scheduling and clinical booking, transparency is not merely a legal checkbox; it is a foundational trust agreement and a strategic competitive differentiator. At Datasirpi, we prioritize the digital sovereignty of our users. This Privacy Policy serves as the definitive framework for how Velora governs data, ensuring that every interaction remains secure, purposeful, and compliant with the world’s most stringent regulatory regimes.

Datasirpi is a legal entity incorporated in the United Arab Emirates (UAE). We operate under the primary jurisdiction of UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection (UAE PDPL) and are subject to the oversight of the UAE Data Office. To provide a seamless experience for our global user base, Velora maintains a synthesized compliance matrix:

Legal Bases for Processing

Velora differentiates processing necessity across three distinct user classes:

• Business Owners: Processing is grounded in the Performance of Contract, as identifiers and financial data are essential for branch management and payroll.
• Hybrid/Independent Staff: This class includes “Specialists” and “Fellows” (as categorized in clinical settings). Processing relies on Performance of Contract for scheduling and Explicit Consent for device-level permissions.
• Client Bookers: Processing is governed strictly by Explicit Consent, specifically regarding the collection of personal identifiers and geolocation.

These regulatory baselines dictate the rigorous standards applied to our data inventory.

2Data Inventory & Explicit Processing Purposes

To ensure full compliance with the “Privacy Nutrition Label” requirements of the Apple App Store and Google Play Store, Velora defines Collection as transmitting data off-device for a period longer than what is necessary to service the request in real time.

Comprehensive Data Categorization

• Personal Identifiers: Name, email, physical address, and phone number. Phone numbers are specifically collected to facilitate 2-way SMS reminders, which achieve a 97-99% reach rate, far exceeding the 30-60% contact rate of traditional phone calls.
• Sensitive Personal Information (SPI): Precise geolocation coordinates (latitude/longitude with three or more decimal places). This is activated only to display nearby branches; we recognize the high privacy impact and limit processing to real-time utility.
• Financial & Transactional Data: Velora utilizes Stripe/Connect for invoices and payouts via PCI-DSS compliant encrypted server-to-server endpoints. Raw payment data is never readable by or stored on Velora production servers.
• Healthcare & Clinical Data: Derived from specialized clinical booking requirements, Velora processes:
  • Medical Record Numbers (MRN) and Birthdays.
  • Specific Diagnoses (e.g., Cardiac conditions).
  • Clinical Metadata: Admission Site, Consultant performing the procedure, and Procedure type (e.g., Closure of PDA).
• User Content & Tags: Internal “Banning and Tagging” data (e.g., “Bad Client” tags for safety or “VIP” for service tiers).

Each data point is linked to core “App Functionality.” Velora prohibits the use of this data for third-party advertising or brokerage.

3Mobile-Specific Privacy & Consent Mechanisms

Our “Privacy by Design” philosophy necessitates that mobile-first architecture provides immediate, context-aware choices. We reject “all-or-nothing” permissions in favor of a granular disclosure sequence.

“Just-in-Time” Disclosure Sequence

Velora triggers OS-level permission alerts (GPS, Camera, Calendar) only at the moment of functional need. This ensures users understand exactly why a permission is requested — for instance, accessing the camera only when a Fellow scans a clinical document.

Unified Calendar Consent & Clinical Safety

Velora implements 2-way syncing (Google/Outlook/iCloud) with strict guardrails:

• Privacy Guardrail: The system defaults to reading only “free/busy” status. Logging personal meeting titles or attendee notes is prohibited without additional, explicit authorization.
• Functional Necessity: Real-time sync is critical to prevent “catheterization team confusion” and the “loss of bed appointments” that occurs in manual systems.
• Controlled Double-Booking: The system accommodates high-volume practitioners. While Acupuncturists may space clients every 30 minutes, Chiropractors often require the ability to schedule three patients within a 15-minute window. Granular calendar access ensures these complex overlaps are managed without clinical error.

4User Dashboards & Data Subject Access Rights (DSAR)

We empower users through a centralized Privacy Dashboard, serving as the hub for data governance.

DSAR Fulfillment & Purging

In accordance with CCPA Section 1798.130(1)(2)(A), Velora guarantees a response to all Access, Rectification, and Portability requests within 45 days.

• Automatic Purging Protocol: Upon account deletion, all personal info and metadata are permanently removed from production servers within the 45-day window.
• Financial Retention Carve-outs: Per UAE tax auditing mandates, transactional records (invoices/payouts) are retained in an archived, non-production state for the duration required by law.
• Tagging & Rectification: While Velora permits safety-based “Banning and Tagging,” the accuracy of these tags is subject to DSAR. Users have a “Right to Correct” internal tags if they are inaccurate or processed unlawfully.

5Third-Party Data Disclosure & Security Protocols

Velora operates within a strictly vetted SDK ecosystem (e.g., Firebase, Stripe). We maintain a “Private Right of Action” risk mitigation strategy by ensuring non-encrypted personal information is never exposed.

Encryption & Transfer Standards

• Transport & At-Rest: All data transmitted off-device utilizes TLS 1.3/AES-256 encryption.
• International Transfers: Data moving outside the UAE or EEA is protected by Standard Contractual Clauses (SCCs).
• SDK Prohibitions: All third-party partners are barred from:
  • Accessing sensitive device data (contacts/photos) beyond their core function.
  • Sharing Velora user data with data brokers.
  • Using data for cross-context behavioral advertising.

6Regional Opt-Outs & Protected Populations

California Privacy Rights (CCPA/CPRA)

California residents are hereby notified that the “Grace Period” for curing violations has been removed under the CPRA. Velora maintains strict compliance to avoid statutory fines of $2,500 per non-intentional violation and $7,500 per intentional violation or those involving minors.

• Do Not Sell or Share: Velora does not engage in data brokerage.
• Limit Sensitive SPI: Users may restrict the use of geolocation and healthcare data to only what is “reasonably necessary” for booking.

Children’s Privacy Restriction

Velora enforces a strict age threshold of 18 in the UAE (and 13/16 under COPPA/GDPR). If we discover inadvertent collection of minor data, it is subject to immediate, permanent deletion.

7Policy Governance & Non-Silent Updates

A Privacy Policy must evolve alongside technology and law. Velora prohibits “Silent Updates.”

• Notice Period: Material changes require a 30-day notice period via in-app banner or email.
• Click-to-Accept: Any update that diminishes existing protections or expands data collection requires a “Click-to-Accept” mechanism. Consent is never assumed through continued use.

Contact Information

For formal DSAR submissions or privacy inquiries, contact our Data Protection Officer:

Velora remains steadfast in its commitment to your digital sovereignty and the integrity of your professional data.