Privacy

The short version

Vouch is for invented referral letters only. The referral screen has no account and no analytics, and it stores no letter. The example letters need nothing; reading your own letter asks once for a work email, which sets one cookie (both described below). The only place letter text goes is to the two AI readers, to name a specialty: each reads it five times, independently, and the answers are compared.

Before that happens, text carrying an identifier shape the guard recognises is refused: a PPS, NHS, CHI or Health and Care number, an Eircode or a UK postcode, a date written with slashes, dashes or the month’s name, a date-of-birth label, a phone number, an email address or a hospital record number. Be clear about what that is and is not. It matches shapes, so it is not a detector of personal data, and it will not catch a name, an address or a town. What Vouch asks for is the presentation, not the patient: age, symptoms, duration. Do not paste a real letter.

If you press “Save to this device”, the evidence that was on screen is written into this browser’s own storage: the specialty, the hospitals’ published figures, what the readers said and the note you copied. Never the letter. It stays on your device, it is never sent to us, and Your records has a button to delete it.

Four forms are different, and this is the whole of it. The evidence page at /finding asks for a work email before it opens, and the home page asks for one with the practice system you use. The referral screen asks for one, once, before it reads a letter of your own; the example letters need none. The pilot request on /trust asks for one with your organisation’s name and three choices from fixed lists, stores them with the time, and sends them to us by email so a person replies. In each case the address is stored, with what you pick or type beside it. Nothing else is: no personal name, no IP address, no record of which pages you read. Ask and we delete it.

Who is responsible

The Vouch team, Dublin, is responsible for this site and for any personal data it handles. Contact: legal@aqta.ai.

The email on the evidence page, the home page and the referral screen

What is stored: the address you type; on the evidence page, the role and the difficulty you pick from the two lists beside it and anything you type in the last box; on the home page, the practice system and role you pick; on the referral screen, the address alone, asked for once before your own letter is read, with no note sent; which of the forms it was; and the time. Where: Google Cloud Firestore in europe-west1, which is Belgium, on the same project as the site. Why: Vouch is free for clinicians and paid for by the practice systems and hospital groups that carry referrals, so knowing who reads the method is how the first of those conversations starts. How long: until you ask us to delete it.

Our basis is your consent, given by submitting the form, and you can withdraw it at any time by writing to legal@aqta.ai; we will delete the row and confirm. We will only write to you about Vouch, one reply saying stop ends it, and we do not sell, share or transfer the list to anyone. From the home page that means one note when you submit, and one more only if Vouch arrives in the practice system you named. The same identifier guard the referral screen uses runs on the evidence page’s free-text box, so a patient detail typed into it is refused rather than stored; the home page has no free-text box.

Submitting sets vouch_access, which holds your address and a signature, is readable only by the server, and expires after ninety days. It exists to avoid asking you twice, and it is what lets the referral screen read a letter of your own. If you use the “read it once” link instead, the same cookie is set to a reserved value that is not an address, no row is written, no mail is sent, and it is gone when you close the browser.

If you sign in to a practice

Signing in creates an account and a workspace. What is stored: your email address, the workspace name, your role in it, and the readings you choose to save. A saved reading holds the specialty, the published figures as they were shown, their publication date and what each reader said. It never holds the referral letter; there is no field for one. Where: Google Cloud Firestore in europe-west1, which is Belgium. How long: until you delete the record or ask us to delete the account.

You can sign in with a one-time link and code sent to your address, or with Google where the sign-in page offers it. Choosing Google sends you to Google to sign in and returns your email address and whether Google has verified it; we ask for nothing else and receive no other profile information. We never see your Google password.

None of this is needed to use the referral screen, which works with no account and always will; reading your own letter there asks only for a work email.

Cookies and browser storage

There are no analytics, advertising or tracking cookies, and no third-party scripts. Everything below is set by this site alone and is necessary for something you asked it to do, which is why you are not being asked to consent to a banner.

• vouch_access, described above: opens the evidence page. Ninety days, or the browsing session if you read it once.
• vouch_session, set when you sign in: keeps you signed in to your practice. Readable only by the server. Cleared when you sign out.
• vouch_oauth_state, set only while you are signing in with Google and deleted immediately afterwards: a random value that stops somebody else's link signing you in to an account you did not choose. Ten minutes at most.
• vouch_attested_at, in this browser's own storage: the time you confirmed that the letters you paste are invented, so you are not asked on every visit. It never leaves your device.
• vouch.region, in this browser's own storage: the region you last chose on the referral screen, so it opens there next time. It never leaves your device.
• vouch_text_size, in this browser's own storage: the text size you picked at the foot of the page. It never leaves your device.
• vouch_cookie_notice, in this browser's own storage: that you closed the notice about cookies, so it does not come back. It never leaves your device.
• Your records, in this browser's own storage, if you save one without an account: the same fields a practice record holds, and never the letter. It never leaves your device and you can clear it from the records page.
• The offline cache. If you install Vouch as an app, your browser caches the site's files so it can open offline. That cache lives on your device, holds no letter text, and is yours to clear.

What Vouch does with a letter

• Before anything else, the text is checked for shapes that identify a person: PPS, NHS, CHI and Health and Care numbers, Eircodes and UK postcodes, dates, phone numbers, email addresses and hospital record numbers. If one is found, the request is refused and nothing in it is processed or sent anywhere.
• If the text passes, it is sent to two AI readers, five times each, run by two AI model providers: one processes it in the United States, and the other on a global endpoint that does not keep that processing inside the EU. Each is asked one question: which published specialty does this letter address, and is the patient an adult or a child. Both process the text under their API terms, which state that it is not used to train their models. Vouch does not store the letter, the readings, or any record linking them. We do not publish which models they are; the providers are named in our data processing agreement, and to you on request.
• The waiting-list figures you see are looked up from a copy of the published figures held on our server: the National Treatment Purchase Fund's for the Republic, and the relevant publisher's for a UK region. No text of yours is involved in that lookup beyond the specialty name.
• The response contains a small record of what was asked and what each reader said. It is returned to your browser and kept nowhere else.

The browser extension

• It reads text only when you hand it over: a selection you right-click and choose Read with Vouch, text you paste into its panel, or your clipboard at the moment you click Paste what I copied. It never reads a page on its own and never sees your browsing history.
• That text goes to vouch.aqta.ai and is handled exactly as a letter typed on this site, as described above: the same identifier check, the same two readers, and nothing stored.
• It keeps two things in your browser: the region you chose, and the time you confirmed the letters you read are invented. A selection waits in the browser's session storage until the panel takes it, then is removed.
• If you have given a work email on vouch.aqta.ai, the extension sends the same cookie the site uses, which carries that address, so a letter of your own can be read. It sends nothing else about you, and nothing is sold or shared. Removing the extension removes what it kept.

What is collected

• Server request logs. The site runs on Google Cloud Run in europe-west1 (Belgium). Google's standard request logs record the time, the path requested, the response code, the requesting IP address and the browser's user-agent string. They do not contain letter text. They are kept for 30 days and used only to keep the service running and to investigate abuse.
• Refusals. When a request is refused, because it names a clinical action or carries an identifier shape, the refusal is logged: the time, the action named and the response code. Never the text. These entries sit in the same 30-day logs.
• Rate limiting. To stop one caller draining the AI budget, requests to the reading endpoint are counted per network address in the server's memory for one minute, then forgotten.
• Browser storage. Listed in full under cookies and browser storage below.

What is not collected

No analytics, no advertising or tracking cookies, no third-party scripts, no names, and no patient data. The referral screen needs no account and stores no letter; the one thing it keeps is the work email you give before reading your own letter. An account exists only if you create one, and then holds an email address and the readings you chose to save, never a letter. If you paste a real patient's details, the guard above is designed to refuse them; please do not test that with real people.

Where data goes

Google Cloud (hosting and storage, in europe-west1), the two AI model providers that run the readers, and Resend, which delivers the sign-in and reply emails and receives only the address and the message it delivers. One model provider processes text in the United States under the standard contractual clauses in its API terms. The model providers are named in our data processing agreement and to anyone who asks at legal@aqta.ai. There is no other recipient. Vouch sells nothing and shares nothing.

Your rights

Under the GDPR you may ask what we hold about you, ask for it to be corrected or deleted, and complain to the Data Protection Commission (dataprotection.ie). In practice we hold 30 days of server logs and, only if you gave them to us, the email from the evidence page and your account with the readings you saved. A request to legal@aqta.ai will be answered within a month.

Changes

If what Vouch does with data changes, this page changes first, with the date above.