Privacy

What Medvetta does not hold

Medvetta holds no patient records, no treatment records and no clinical notes. Not restricted, not permissioned, not gated behind a support process — absent. There is no field, no import path and no permission that would allow it, which means there is nothing for anybody at Medvetta to look at and nothing for a subpoena to reach here.

A compliance finding therefore carries a category and never a diagnosis: it can say that a treatment class was performed without a current standing order, and it cannot say who was treated or what was done to them.

• No patient identity, contact detail, chart, image or consent form.
• No treatment performed, product administered, dose or lot given to a person.
• No clinical note, no assessment, no outcome.
• No schedule and no appointment. Two such surfaces are listed in the navigation and marked withheld, so their absence is visible rather than assumed; the navigation engine refuses to make either reachable for any role, on any plan, and building the page would not change that.
• No path by which a Medvetta employee reads a tenant’s clinical record. Support answers account questions; for anything inside a treatment room, the tenant shows us.
• No ratings, reviews, prices or booking, for anyone, at any tier.

The public resolver is anonymous

The public verification page records no identity for the person asking. Not an account, not an IP address retained against the query, not a cookie that survives the visit. A locum agency, a board investigator and a patient’s daughter all get the same answer and none of them leaves a trace on the record they looked at.

What deletion can and cannot reach

These are the other party’s records as much as yours, and a compliance product whose audit trail can be edited by one of its parties is worth nothing to either. Stating it here is the honest version; a retention table that quietly omits it is not.

• A signature. You signed something and another party relies on it; a signature one party can delete is not a signature.
• A countersigned agreement. It is the other party’s record too, and they did not ask for it to go.
• An append-only audit entry. Its whole value is that nobody, including Medvetta, can edit it after the fact.

Changes to this policy

These documents are versioned rather than edited. A change publishes a new version with a date, and the previous version stays readable at its own address — a document that silently changes cannot be relied on by anyone who read it yesterday. Material changes are notified at least thirty days before they take effect.