Privacy Policy

Effective Date: August 10, 2026  ·  Last Updated: August 10, 2026


1. Introduction

Welcome to Sheltas Health Inc. ("Sheltas," "we," "our," or "us").

Sheltas is a platform that connects healthcare practitioners with organizations developing and deploying healthcare AI to support practitioner-led evaluation, validation, contextualization, and other healthcare AI services.

We are committed to protecting your privacy and handling your personal information responsibly, securely, and transparently.

This Privacy Policy explains how we collect, use, disclose, store, and protect your information when you use our website, platform, or services.

2. Information We Collect

Depending on how you use our platform, we may collect:

Practitioner Information

  • Name
  • Email address
  • Telephone number
  • Professional title
  • Country of residence
  • Medical specialty
  • Professional license information
  • Curriculum vitae (CV)
  • Educational qualifications
  • Employment history
  • Certifications
  • Languages spoken
  • Areas of expertise
  • Payment information (where applicable)

Identity Verification & Biometric Information

As part of practitioner onboarding, we collect the following to verify your identity and complete onboarding steps:

  • Government-issued identification (uploaded during onboarding)
  • Identity photos
  • Facial geometry data captured during automated liveness detection (used to confirm you are a real, present individual and to match your identity documents)
  • Voice recordings captured during the onboarding voice assessment

This information is used solely for identity verification, credential validation, and onboarding assessment, processed on the legal bases described in Section 4, and retained only as long as necessary for those purposes before secure deletion.

Account Information

  • Username
  • Password (hashed)
  • Authentication information
  • Login history
  • Account preferences

Technical Information

We automatically collect:

  • IP address
  • Browser type
  • Device information
  • Operating system
  • Cookies
  • Log files

Customer Project Information

Organizations using Sheltas may provide project-related information necessary for practitioner evaluation activities.

Whenever possible, we encourage the use of de-identified or synthetic data rather than identifiable patient information.

Protected Health Information (PHI)

Certain customer projects may involve Protected Health Information (PHI).

Where applicable:

  • PHI is handled in accordance with applicable laws, including the Health Insurance Portability and Accountability Act (HIPAA).
  • Sheltas only processes PHI when authorized by the customer and supported by appropriate contractual agreements.

3. How We Use Your Information

We use information to:

  • Create practitioner accounts
  • Verify professional credentials
  • Match practitioners with projects
  • Manage training programs
  • Process payments
  • Communicate platform updates
  • Improve our services
  • Maintain platform security
  • Prevent fraud
  • Meet legal and regulatory obligations
  • Respond to customer support requests

We do not sell your personal information.

4. Legal Bases for Processing (Where Applicable)

Where required under applicable privacy laws, we process personal information based on one or more of the following:

  • Your consent
  • Performance of a contract
  • Compliance with legal obligations
  • Legitimate business interests
  • Protection of vital interests

5. Sharing of Information

We may share information with:

  • Healthcare AI companies
  • Health systems
  • Research organizations
  • AI/LLM service providers we use to operate the platform (currently Anthropic and OpenRouter)
  • Payment processors
  • Cloud hosting and infrastructure providers (currently Google Cloud and Firebase)
  • Professional advisors
  • Government authorities when legally required

We only share information necessary for the intended purpose.

We do not sell personal information to third parties.

6. International Data Transfers

Because Sheltas operates globally, your information may be transferred to and processed in countries outside your country of residence.

Where required, we implement appropriate safeguards for international transfers, including contractual protections and other legally recognized transfer mechanisms.

7. Data Security

We employ administrative, technical, and physical safeguards designed to protect personal information, including:

  • Encryption in transit
  • Encryption at rest
  • Role-based access controls
  • Audit logging on certain platform modules
  • Secure cloud infrastructure

No security system is completely risk-free, but we strive to protect your information using industry-recognized security practices.

8. Data Retention

We retain personal information only as long as necessary to:

  • Provide our services
  • Meet contractual obligations
  • Comply with legal requirements
  • Resolve disputes
  • Enforce our agreements

When information is no longer required, it is securely deleted or anonymized.

9. Your Privacy Rights

Depending on your location, you may have the right to:

  • Access your personal information
  • Correct inaccurate information
  • Request deletion
  • Request data portability
  • Restrict processing
  • Object to certain processing
  • Withdraw consent where processing is based on consent

Requests may be submitted using the contact information below.

10. Cookies

We use cookies and similar technologies to:

  • Maintain user sessions
  • Remember your cookie preferences
  • Enable sign-in via third-party providers

We do not currently use analytics, advertising, or marketing cookies. For a full list of the cookies we use and their purpose, see our Cookie Policy.

You may adjust cookie settings through your browser.

11. Children's Privacy

Our platform is intended for healthcare professionals and organizations. Use of the platform is not permitted for individuals under the age of 18.

We do not knowingly collect personal information from individuals under the age of 18.

12. HIPAA

Where Sheltas processes Protected Health Information on behalf of healthcare organizations, we do so pursuant to applicable contractual agreements and applicable law.

Sheltas implements reasonable administrative, technical, and physical safeguards designed to protect PHI.

13. Third-Party Services

Our platform may use third-party providers, including cloud hosting and infrastructure (Google Cloud, Firebase), authentication (Firebase, Google Sign-In), AI/LLM providers (Anthropic, OpenRouter), and payment processing services. We do not currently use analytics services.

These providers process information under contractual obligations designed to protect your information.

14. Changes to this Policy

We may update this Privacy Policy periodically.

Material changes will be communicated through our website or platform.

The Effective Date at the top of this document reflects the most recent version.

15. Contact Us

Sheltas Health Inc.

Email: legal@sheltashealth.com

Website: www.sheltashealth.com


Privacy Policy · Terms of Use · Cookie Policy