Privacy policy

VAVerifyCare.com and the VAVC platform are operated by The Concept Factory, LLC, a limited liability company organized in the Commonwealth of Virginia. Questions about this policy can be sent through the contact page.

• Contact and inquiry details you type into our forms: name, role, organization, email, phone, and your message.
• Facility onboarding requests submitted at /connect: facility name and type, sponsoring VA medical center or VISN, points of contact, EHR vendor, and preferred connection method.
• Account details if you sign in to a demonstration or production console: email address and authentication records.
• Basic technical data generated by serving the site, such as request logs used for security and reliability.

We do not sell personal information, and we do not use it for advertising or behavioral profiling.

When a facility uses VAVC operationally, we process a deliberately narrow set of non-clinical data on that facility's behalf: veteran identifier and name, facility and appointment identifiers, one attendance flag (attended, no-show, or emergency walk-in), the time and station that recorded it, and computed travel amounts.

Diagnoses, clinical notes, results, imaging, medications, and diagnostic or procedure codes are outside the VAVC boundary and are not requested, stored, or transmitted. The full boundary is documented on the security page.

For this data the facility or the VA is the controller of record and The Concept Factory, LLC acts as a service provider under the terms of the applicable license, subscription, or data agreement. Where that agreement conflicts with this policy, the agreement governs.

• To respond to inquiries and facility onboarding requests.
• To provide, operate, support and secure the VAVC platform.
• To compute reimbursable travel amounts and notify subscribed offices.
• To maintain an append-only audit log of attendance and payment events.
• To meet legal, contractual and audit obligations.

Attendance events are delivered only to the offices a facility configures as subscribers. Beyond that, we share information with service providers who host and secure the platform on our behalf, and when required by law or by a valid government request. We do not share personal information with third parties for their own marketing.

Website inquiries and onboarding requests are retained while a business relationship is being evaluated and for a reasonable period afterward for recordkeeping. Operational attendance and audit records are retained according to the facility's or the VA's records-retention requirements as set out in the applicable agreement, and are returned or deleted at the end of that agreement under the documented exit path.

Access is role-scoped, actions are recorded in an append-only audit log, and data is encrypted in transit. Corrections to a veteran record are made by facility staff by phone so an accountable person is attached to every change. No system is perfectly secure; if you believe you have found a vulnerability, report it through the contact page and we will respond.

You may ask us what information we hold about you, ask us to correct it, or ask us to delete information you submitted through this website. For operational veteran records held on behalf of a facility or the VA, requests must go through that organization, since it controls the record.

This website is intended for adults conducting business with the VA and community care organizations. We do not knowingly collect information from children.

We will update this page when our practices change and revise the date above. Material changes affecting a participating facility will also be communicated under the applicable agreement.