Valian
Book a call
// LEGAL · PRIVACY

Privacy Policy

Last updated: October 13, 2026

About This Policy

This Privacy Policy explains how Valian Systems LLC (“Valian,” “we,” “us”) collects, uses, stores, and shares information when you visit our website or use our Medical Revenue Operating System. By using the Service, you agree to this Policy.

Information We Collect

Account & Practice Information

  • Name, email, phone number
  • Practice name, location, PMS type, providers, hours of operation
  • Authentication credentials (passwords are hashed, never stored in plaintext)
  • OAuth tokens for Google Workspace + PMS integrations

Payment Information

Payment processing is handled by Stripe. We do not receive, see, or store your full credit card number. We retain the last 4 digits, card brand, and expiration date as Stripe returns them for billing display. We also keep the card’s fingerprint, a code Stripe creates for each card number that identifies the card without revealing the number, together with the card brand, the last 4 digits and Stripe’s ID for the saved card. We use it only to allow one free trial per card, and we keep it after an account closes so the same card cannot start a second free trial.

Operational Data

  • Call recordings and transcripts
  • SMS and email content sent through the platform
  • Patient memory records (preferences, prior visits, escalation history)
  • Audit logs of every read, write, and API call

Patient Health Information (PHI)

When your practice signs our Business Associate Agreement (BAA), Valian processes PHI on your behalf as a HIPAA Business Associate. PHI is encrypted, tenant-isolated, and audit- logged. We do not use PHI for AI model training, analytics, advertising, or any purpose outside delivering the Service.

Usage & Device Data

Standard server logs (IP address, user-agent, request timestamp, response status), plus Google Analytics and Meta pixel events on this marketing website (page views, button clicks, form submissions). The dashboard application does not include third-party analytics.

On our ad landing page (valiansystems.com/iv, and the second version of it that we test at valiansystems.com/iv/b) we also use Microsoft Clarity to see how visitors use the page: where they click and tap, how far they scroll, and a replay of the visit as it looked on their screen. What you type into the form is never captured by Clarity. Clarity is not used on any other page of this website, in the dashboard application, or on any page that handles patient information.

Forms on Our Website

Some forms on our website, such as the form on our ad landing pages, save your answers as you type them, even if you never press submit, so we can help you finish. Once you have typed a valid email address or mobile number, we add your contact details and answers to our customer relationship management system (Close). When you enter your details in our insurance verification form, or submit it, you agree that we may call, text and email you about your request and offers, including with automated calls and texts, as described under Calls, texts and emails in our Terms of Service. If you start our form but do not finish it, we may call or email you, including with automated reminders, to help you finish. Calls and video meetings with our team may be recorded and transcribed, and a summary is kept with your record in Close.

When you fill in a form on our website, we may also record the approximate location your internet connection points to (city, state, and time zone), your device's time zone, basic facts about your device (such as screen size and language), and the ad or link that brought you to us. We use this to show meeting times in your time zone and to route your request to the right person on our team. We do not use your device's GPS.

How We Use Information

  • To deliver the Service (answer calls, schedule appointments, send communications)
  • To process payments and prevent fraud
  • To maintain security, debug issues, and provide support
  • To send transactional notifications (account, billing, service)
  • To respond to people who contact us or fill in a form on our website, including calls, texts and emails
  • To measure and improve our advertising (see Advertising Measurement below)
  • To improve the Service in aggregate, never with PHI

Advertising Measurement

Our website uses the Meta pixel and the Meta Conversions API to measure and improve our ads on Facebook and Instagram.

  • On each page you visit, the pixel in your browser and our server each tell Meta that the page was viewed, with your IP address, browser type, the page address, and the Meta cookie IDs stored in your browser.
  • When you submit the form on one of our ad landing pages, we also report the submission, with the same browser details and your email address in hashed form: our server scrambles it with a one-way code (SHA-256) before anything is sent, and Meta matches that code against its own records. We never send Meta your phone number.
  • When the form you send on one of our ad landing pages qualifies, or you book a call with us, our server tells Meta, with the hashed email address from the form, the same browser details as the form submission (your IP address, browser type, the page address and the Meta cookie IDs stored in your browser) and a scrambled ID for that form. Never the phone number.
  • When a practice that came from one of our ad pages creates its account, starts its free trial, makes a payment, cancels its trial or its plan, or puts either back on, our server reports that to Meta too, with the hashed email address of the person who signed up, the browser type and Meta cookie IDs of the browser they signed up in (when it has them), the sign-up page address, the plan they picked, for a payment its amount, and the same scrambled ID as the form they sent. These reports never include a phone number, a name, an IP address or anything about a patient.

We never send Meta patient information. Meta may use what it receives, together with information it collects elsewhere, to provide measurement services and to show ads. See Cookies & Analytics below for how to opt out.

Google Business Profile Integration

When a practice customer connects their Google Business Profile during Valian onboarding, we use Google's OAuth 2.0 flow to request the https://www.googleapis.com/auth/business.manage scope. Customers grant this access explicitly and can revoke it at any time from their Google account at myaccount.google.com/permissions or from the Valian dashboard at app.valiansystems.com/settings/google-business-profile.

What we access with this scope:

  • Read the practice's current Google Business Profile (location name, address, hours, photos, services, posts, reviews)
  • Write profile updates with the customer's explicit consent (refresh hours, replace photos, update services, post announcements)
  • Read and reply to patient reviews on the customer's behalf, with their explicit consent

How we handle the data:

  • OAuth refresh tokens are stored encrypted at rest in the customer's scoped tenant row, isolated from other tenants by Row-Level Security policies
  • Google Business Profile data is used solely to deliver the Service to the customer who connected their profile. We never use it to train AI models, for analytics, advertising, or any other purpose
  • We never share Google data with third parties
  • Profile snapshots and review records are retained for the life of the customer relationship plus 7 years per HIPAA recordkeeping requirements, then purged
  • When a customer disconnects via the dashboard, we immediately revoke the OAuth token at Google and delete our stored copy

Valian's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

HIPAA & Business Associate Agreements

Valian acts as a Business Associate to its practice customers (Covered Entities). A signed BAA is required before any Protected Health Information flows into our system. Sub-processors that touch PHI (hosting, voice, SMS, email) have signed BAAs with us and are listed below.

Sub-Processors

The following service providers process data on our behalf, under signed agreements:

  • Supabase, database, authentication, file storage (US-region)
  • Vercel, web hosting (US-region)
  • Cartesia, voice AI infrastructure (US-region)
  • Twilio, SMS and telephony
  • Amazon Web Services (SES), transactional email (US-region)
  • OpenAI + Anthropic, language model APIs (zero-retention enterprise tier)
  • Stedi, insurance eligibility (X12 270/271)
  • Stripe, payment processing
  • Cal.com, demo scheduling (no PHI)
  • Sentry, error monitoring (PII scrubbed)
  • Close, customer relationship management: contact details and form answers from our website, and our calls, texts and emails with you (no PHI)
  • Slack, internal alerts to our team about new website inquiries, with your name, practice, and contact details (no PHI)
  • Google Workspace (Google Calendar and Google Meet), scheduling and holding meetings you book with us (no PHI)

Meta (Facebook and Instagram) also receives the advertising data described in Advertising Measurement above. Meta is not a sub-processor and never receives PHI.

We do not sell, rent, or trade your personal information. We share data only with the sub-processors above, only as necessary to deliver the Service and to respond to people who contact us, and only under data processing agreements. We share data with Meta only as described in Advertising Measurement.

Data Security

  • All data encrypted in transit (TLS 1.3) and at rest (AES-256)
  • Tenant-isolated via row-level security on every database table
  • Every read, write, and API call logged in an immutable audit ledger
  • Role-based access control with least-privilege defaults
  • Annual security review and incident response procedures

Data Residency

All compute, databases, and backups are hosted in US regions only. No offshore replicas. No sub-processors store PHI outside US boundaries. Data residency is contractually enforced.

Data Retention

We retain account, billing, and operational data for the duration of your subscription plus a reasonable period afterward to satisfy legal, tax, and audit obligations. Call recordings, transcripts, and patient memory are retained for the period defined in your BAA, then deleted on schedule. You may export your data and request deletion at any time. Answers you type into a form on our website, including ones you did not submit, are kept with your inquiry in our systems and in Close so our team can follow up; you can ask us to delete them at any time.

Your Rights

You may request access to, correction of, export of, or deletion of your personal information at any time. Contact privacy@valiansystems.com. We respond within 30 days. Practice customers retain ownership of all PHI; export is provided in standard formats on request.

Cookies & Analytics

Our marketing website (valiansystems.com) uses essential cookies for session continuity, Google Analytics for aggregate usage metrics, and the Meta pixel, which sets cookies so Meta can measure our ads (see Advertising Measurement). Third parties, including Meta, may use cookies, web beacons, and similar technologies to collect or receive information from our website and elsewhere on the internet, and use that information to provide measurement services and target ads. You can opt out of interest-based ads from Meta in your Facebook or Instagram ad settings (facebook.com/adpreferences), and from many other companies at optout.aboutads.info. On our ad landing page, Microsoft Clarity sets cookies so it can tell one visit from another, and Microsoft receives the usage data described under Usage & Device Data; the Microsoft Privacy Statement explains how Microsoft handles it. The dashboard application uses only session cookies required for authentication, no third-party analytics or advertising cookies. You can disable non-essential cookies via your browser settings.

SMS / Text Messaging

When you provide your phone number and consent to receive text messages from Valian Systems LLC, you may receive the following types of messages depending on your relationship with us:

If you requested a product demo

  • Demo scheduling confirmations, confirming your demo date and time
  • Demo appointment reminders, reminders before your scheduled demo
  • Demo rescheduling notifications, notifications if your demo is rescheduled

If you entered your details in our insurance verification form

Valian Systems LLC may text you at the mobile number you gave, from the Valian Systems number that calls you, about your request and Valian's insurance verification service: scheduling, reminders, follow-ups and offers. These texts may be automated.

If you are a patient of a practice using Valian

  • Appointment reminders, confirmations, rescheduling notifications, and upcoming visit reminders
  • Missed call follow-ups, text messages sent after a missed call to help you book an appointment
  • Service notifications, updates about your appointments and care

Message frequency: Message frequency varies.

Message and data rates: Standard message and data rates may apply depending on your mobile carrier and plan. Valian Systems LLC is not responsible for any charges from your mobile carrier.

Opt-out: You can opt out of text messages at any time by replying STOP to any message you receive from us. After opting out, you will receive a final confirmation message and no further texts will be sent.

Help: For help with text messages, reply HELP to any message or contact us at support@valiansystems.com.

Carriers: Carriers are not liable for delayed or undelivered messages. Supported carriers include AT&T, T-Mobile, Verizon, and all other major US carriers.

Consent: Consent to receive text messages is not a condition of purchase. You may use our services without opting in to text messages.

Opt-in data sharing: No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Your phone number is shared only with the healthcare practice you are communicating with and with the messaging providers we send texts through, solely for the purpose of delivering the messages described above. All of the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

For full details on how we collect SMS consent, see our Demo SMS Consent Policy or Patient SMS Consent Policy.

Children's Privacy

Valian is intended for use by healthcare practices and adults ages 18 and over. We do not knowingly collect personal information from children under 13. PHI of pediatric patients is processed only on behalf of practices under their direct authorization and their own privacy practices.

Changes to This Policy

We may update this Policy as our Service evolves. Material changes will be communicated via email to account holders and posted at the top of this page with a new “Last updated” date.

Contact

For privacy inquiries, contact privacy@valiansystems.com. For HIPAA matters, contact our Privacy Officer at the same address.