Privacy Policy

Vextara (“Vextara”, “we”, “us”) is operated by [Legal entity], [address]. This policy explains what personal information we collect, why, how we protect it, and the choices and rights you have. For any privacy question or request, contact us at [privacy@vextara.com].

Vextara provides an objective ADHD screener and connects you with licensed clinicians for review. It is not an emergency service and the app itself does not provide a diagnosis.

• Account details — name, email, and (for a parent) your relationship to the child.
• Screener & intake data — the DSM-5-based responses you provide about yourself or your child.
• Assessment data — objective test results, including reaction-time and movement measures captured during the test.
• Care data — clinician orders, interpretations, plans, messages, and appointments.
• Payment data — processed by our payment provider; we do not store full card numbers.
• Technical data — device/browser information and basic logs needed to run and secure the service.

Camera & motion: the objective test uses your device camera or motion sensor to measure movement. No video is recorded, uploaded, or stored — each frame is reduced on-device to movement measurements and then discarded.

• To provide the screener, assessment, and clinician review you request.
• To let your care team review results and deliver a clinical conclusion and plan.
• To operate, secure, and improve the service.
• To communicate with you about your account and care.
• To meet legal, regulatory, and safety obligations.

Where GDPR applies, we rely on: your consent (which you can withdraw at any time); performance of a contract with you; our legitimate interests in operating and securing the service; and legal obligations. Health-related data is processed with your explicit consent and/or for the provision of care.

We share data only with providers that process it on our behalf under contract:

• Supabase — secure database, authentication, and file storage.
• OpenAI — powers the optional Ollie copilot and content matching.
• Stripe — payment processing.
• Resend — transactional email.
• Licensed clinicians in our network — to review your results and provide care.

We do not sell your personal information. A current list of our sub-processors, with the data each handles, is at Sub-processors.

Your information may be processed in countries other than yours. Where required, we use appropriate safeguards (such as Standard Contractual Clauses) for international transfers.

We keep your information only as long as we need it:

• Clinical records (screener, intake, assessment, orders, interpretations, plans, care messages, medications) — kept while your account is active and as needed to provide care and meet records obligations; removed when you delete your account.
• Operational data — product-usage analytics (up to 12 months), lifecycle reminders (up to 6 months), copilot conversation history and security/audit logs (up to 24 months) are purged automatically once past those windows.
• Erasure record — when you delete your account we retain only a non-identifying marker that an erasure occurred.

You can delete your account at any time (see Your rights); erasure removes your data across our database and file storage.

We use only strictly-necessary cookies to keep you signed in and to secure your session. We do not use advertising or cross-site tracking cookies, and we do not run third-party analytics that profile you. Because these cookies are essential to provide the service you request, they don’t require consent — but we show a brief notice so you’re informed. If we ever add non-essential analytics, we’ll ask for your opt-in first.

Accounts are created and managed by an adult (a parent or guardian) on a child’s behalf, or by an adult for themselves. A parent/guardian provides consent for a child’s data and can exercise all rights below on the child’s behalf. We do not knowingly allow children to create their own accounts.

Depending on where you live, you may have the right to access, correct, delete, export (portability), restrict, or object to processing of your data, and to withdraw consent. You can:

• Export a copy of your data or delete your account from Settings → Privacy & data.
• Contact us at [privacy@vextara.com] to exercise any right.
• Lodge a complaint with your local data-protection supervisory authority.

We use industry-standard measures — encryption in transit, access controls, and row-level data isolation so each account can only reach its own records. No system is perfectly secure, but protecting health-related data is a core priority.

We may update this policy; we’ll revise the “Last updated” date and, for material changes, notify you. Continued use after an update means you accept the revised policy.

[Legal entity] · [address] · [privacy@vextara.com]. If you are in crisis, call or text 988, or call 911.