Verus Surgical

Last updated: April 6, 2026 · Effective date: April 6, 2026

Verus Surgical, Inc. ("Verus Surgical," "we," "us," or "our") operates the Verus Surgical system, which includes the Cortex surgical video system, the web portal at my.verussurgical.com, and the Verus Surgical mobile application (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

This policy is designed to comply with the EU General Data Protection Regulation (GDPR), the U.S. Health Insurance Portability and Accountability Act (HIPAA), and the Google Play Developer Program Policies.

1. Definitions

Personal Data means any information relating to an identified or identifiable natural person, including name, email address, IP address, and device identifiers. Protected Health Information (PHI) means individually identifiable health information transmitted or maintained in any form, as defined by HIPAA. The Data Controller is the healthcare institution (hospital, clinic, or practice) that deploys the Service and determines the purposes and means of processing patient data; Verus Surgical acts as a Data Processor (GDPR) and Business Associate (HIPAA) on behalf of the Data Controller. A User is any healthcare professional, administrator, or authorized individual who accesses the Service.

2. Information We Collect

2.1 Account Information

When your organization provisions an account for you, we collect your full name, email address, organizational role and department assignment, authentication credentials (password hash — we never store plaintext passwords), and multi-factor authentication (MFA) enrollment status.

2.2 Surgical Case Data

When the Cortex device records a surgical procedure, the following data may be uploaded to the Service: video recordings (H.265/HEVC encoded), screenshots and thumbnail images, case metadata (patient identifier as anonymized ID or initials, patient age, sex, procedure type, surgeon name, timestamps, and duration), and case notes, annotations, and tags added by authorized users.

Important: Patient data is pseudonymized at the point of capture. The Cortex device generates a randomized case ID. Linking a case to a specific patient requires access to the hospital's internal records, which are not stored in our Service.

2.3 Device Telemetry

Cortex devices periodically report system health data, including CPU, RAM, GPU, and disk usage, temperature readings, network status (IP address, connectivity), and software version and uptime. Device telemetry does not contain patient data or PHI.

2.4 Usage Data

We automatically collect login timestamps and session duration, pages viewed and features used (audit log), IP address and browser/device user agent, and push notification tokens (mobile app only, for delivery purposes).

2.5 Mobile App Data

The Verus Surgical mobile application additionally collects push notification tokens (Firebase Cloud Messaging) to deliver alerts and notifications, biometric authentication events (success/failure only — we never receive, transmit, or store biometric data such as fingerprints or facial geometry; biometric processing occurs entirely on your device), and device platform and app version for compatibility and support.

The mobile app does not access your contacts, calendar, location, microphone, or photo library unless you explicitly initiate a specific action (e.g., attaching a photo to a Rounds post, which uses the standard system file picker).

3. How We Use Your Information

We do not use your data for advertising, profiling, automated decision-making, or any purpose unrelated to the delivery and improvement of the Service.

4. HIPAA Compliance

4.1 Business Associate Agreement (BAA)

Verus Surgical enters into a Business Associate Agreement with each healthcare institution (Covered Entity) before processing PHI. The BAA governs our obligations regarding the use, disclosure, and safeguarding of PHI.

4.2 PHI Safeguards

Administrative safeguards include role-based access control (RBAC) with a three-tier hierarchy (User, Admin, Super Admin), multi-tenant isolation ensuring organizations cannot access each other's data, department-level scoping to restrict access within organizations, and an immutable audit trail of all access events. Technical safeguards include encryption of all data in transit (TLS 1.2+) and at rest (AES-256 via AWS S3 server-side encryption), authentication via AWS Cognito with MFA support, session tokens that expire after 1 hour with automatic refresh, and time-limited sharing links that expire after a configurable period (default 48 hours). Physical safeguards are provided by AWS: all data is stored in AWS data centers in the EU (eu-central-1, Frankfurt), which maintain SOC 2, ISO 27001, and HIPAA compliance certifications.

4.3 Minimum Necessary Standard

We limit access to PHI to the minimum necessary to accomplish the intended purpose. Users only see cases belonging to their assigned tenant and department(s). Patient identifiers are pseudonymized — only initials and randomized IDs are stored in the Service.

4.4 Breach Notification

In the event of a breach of unsecured PHI, we will notify the affected Covered Entity without unreasonable delay and no later than 60 days after discovery, in accordance with the HIPAA Breach Notification Rule (45 CFR §§ 164.400–414). Where GDPR applies, we will additionally notify the relevant supervisory authority within 72 hours of becoming aware of a personal data breach, in accordance with GDPR Art. 33, and the affected Data Controller without undue delay.

5. GDPR Compliance

5.1 Data Controller and Processor

Your healthcare institution is the Data Controller. Verus Surgical acts as a Data Processor, processing personal data solely on behalf of and under the instructions of the Controller. We execute a Data Processing Agreement (DPA) with each Controller.

5.2 Your Rights

Under the GDPR, you have the right to access a copy of the personal data we hold about you (Art. 15), to rectification of inaccurate data (Art. 16), to erasure of your data subject to legal retention obligations (Art. 17), to restriction of processing in certain circumstances (Art. 18), to data portability in a structured, machine-readable format (Art. 20), to object to processing based on legitimate interests (Art. 21), and to withdraw consent at any time where processing is based on consent (Art. 7(3)).

To exercise these rights, contact your organization's administrator or email us at privacy@verussurgical.com. We will respond within 30 days.

5.3 International Transfers

All surgical case data, account data, and audit logs are stored and processed within the European Union (AWS eu-central-1, Frankfurt, Germany). We do not transfer this data outside the EU/EEA unless required by a Data Controller's instructions and subject to appropriate safeguards (Standard Contractual Clauses or an adequacy decision).

Our push notification service (Firebase Cloud Messaging, operated by Google LLC) processes device tokens on infrastructure that may be located outside the EU/EEA. Device tokens are pseudonymous identifiers that do not contain PHI or directly identify users. Google's processing is covered by the EU–U.S. Data Privacy Framework and Google's Data Processing Terms, which include Standard Contractual Clauses.

5.4 Data Protection Contact

For questions about data protection or to exercise your rights under the GDPR, you may contact us at privacy@verussurgical.com.

5.5 Supervisory Authority

If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority. For users in Bavaria, Germany, this is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany (www.lda.bayern.de).

6. Data Sharing and Disclosure

We do not sell your personal data to third parties. We share data only in the following circumstances:

7. Data Retention

Data Controllers may request deletion of all organizational data at any time. Upon termination of the service agreement, we will delete or return all data within 30 days, unless retention is required by law.

8. Security Measures

All communications use TLS 1.2 or higher, and API endpoints are served via AWS API Gateway with HTTPS-only enforcement. All stored data in S3 and DynamoDB is encrypted using AES-256 server-side encryption. Authentication is handled by AWS Cognito with support for multi-factor authentication (TOTP); the password policy enforces a minimum of 8 characters, and temporary passwords expire after invitation. JWT session tokens expire after 1 hour with automatic refresh via secure refresh tokens, and users receive a session timeout warning with a countdown timer.

Access control is enforced through multi-tenant RBAC with department-level scoping, with tenant isolation applied at the database query level and cross-tenant data sharing requiring explicit tenant administrator approval. All significant actions — including login, data access, modifications, and deletions — are logged with the actor, timestamp, IP address, and action detail. Input validation includes XSS prevention on all user-generated content, S3 path traversal protection, and content-type validation on file uploads. The Service runs on a serverless architecture (AWS Lambda) with no persistent servers to patch, behind AWS CloudFront CDN with DDoS protection and regular dependency updates.

9. Children's Privacy

The Service is intended for use by healthcare professionals and is not directed at individuals under the age of 16 (the minimum age of digital consent under German law implementing GDPR Art. 8). In the United States, we do not knowingly collect personal data from children under 13 in accordance with the Children's Online Privacy Protection Act (COPPA). If you believe we have inadvertently collected data from a minor, please contact us immediately at privacy@verussurgical.com.

10. Cookies and Tracking

The Service uses the following client-side storage mechanisms:

We do not use third-party cookies, advertising trackers, analytics services (e.g., Google Analytics), or any form of cross-site tracking. We do not participate in ad networks or data broker ecosystems.

11. Mobile Application

11.1 Permissions

The mobile app requires internet access to connect to the Service and network state access to display an offline/online indicator. Optionally, it may request biometric permission (USE_BIOMETRIC) for fingerprint or face unlock with a password fallback, push notification permission (POST_NOTIFICATIONS) to receive alerts and updates, and camera access to attach photos to Rounds posts. Optional permissions are requested only when the user initiates the relevant action.

11.2 Data Collected by the Mobile App

The mobile app is a thin wrapper around the web portal. It does not collect additional data beyond what is described in Section 2, with the exception of an FCM push token (a device-specific identifier used by Firebase Cloud Messaging to deliver push notifications, which does not identify the user personally and is deleted on logout) and app version and platform information used for compatibility checking and support diagnostics.

11.3 Biometric Data

The app uses your device's built-in biometric hardware (fingerprint sensor or face recognition) to authenticate access to a stored session. No biometric data is ever transmitted to our servers. Biometric processing is handled entirely by the Android BiometricPrompt API or iOS LocalAuthentication framework. We only receive a boolean success/failure result.

11.4 Third-Party SDKs

The only third-party SDK used by the mobile app is Firebase Cloud Messaging, which is used for push notification delivery. Only the device token is shared with Firebase; no PHI or case data is transmitted. Google's privacy policy is available at firebase.google.com/support/privacy.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page, notify users via an in-app banner or email, and provide a 30-day notice period before changes affecting data processing take effect.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data protection rights: