Privacy Policy
This Privacy Policy describes how Spring Health, Inc. (“Spring Health,” “we,” “us,” or “our”) collects, uses, discloses, and safeguards information in connection with the VERA-MH website and related activities (collectively, the “Site”).
VERA-MH (Validation of Ethical and Responsible AI in Mental Health) is a Spring Health led initiative and independent open-source project hosted by Spring Health. VERA-MH is intended to support research, discussion, and standard-setting related to ethical and responsible uses of artificial intelligence in mental health contexts. VERA-MH does not provide mental health services.
1. Scope of This Privacy Policy
This Privacy Policy applies to information collected through:
The VERA-MH public website
Request for Comment (RFC) and feedback submission forms
Public repositories maintained in connection with VERA-MH
This Policy applies only to VERA-MH and stands alone from Spring Health’s general consumer or employer-sponsored service offerings, which are governed by separate privacy notices.
2. Information We Collect
A. Information Collected Automatically
When you access the Site, we may collect limited technical and usage information automatically, such as:
Browser type and version
Operating system
Pages viewed and time spent
Referrer URLs
This information is used solely for basic site functionality, security, and internal understanding of site usage.
No third-party analytics tools are currently used, and we do not engage in cross-site tracking or behavioral advertising.
B. Information You Voluntarily Submit
You may voluntarily submit information through RFC or feedback forms. This may include:
Name
Email address
Organization
Role or title
Free-text comments or feedback
RFC and feedback submissions are treated as private and internal and are not publicly attributed to individuals by name or affiliation, unless explicitly stated otherwise in the future.
3. How We Use Information
We use information collected through the Site for the following purposes:
Operating, maintaining, and securing the Site
Reviewing and evaluating RFC submissions and community feedback
Research, analysis, and development of ethical and clinical AI evaluation standards
Preparing aggregated or de-identified summaries, reports, or publications
Communicating about VERA-MH updates, initiatives, or related outreach
Information collected through VERA-MH is not used to train artificial intelligence or machine learning models.
Information collected through VERA-MH is used solely to support open research, governance, and standards development activities and is not used to produce legal, clinical, or automated decision-making outcomes.
4. Sensitive Data and Mental Health Information
VERA-MH is not a mental health service, does not provide treatment, and does not collect or process Protected Health Information (PHI).
Users are explicitly instructed not to submit:
Mental health or clinical information
Medical records
Other sensitive personal data
If sensitive information is inadvertently submitted, Spring Health will take reasonable steps to limit access, minimize use, and handle such data consistent with internal policies and applicable law.
5. Cookies and Similar Technologies
The Site may use essential and functional cookies necessary for basic operation and security.
Because no third-party analytics or advertising technologies are currently used, cookie usage is limited. Users may manage cookies through their browser settings.
6. Data Sharing and Disclosure
We may share information:
Internally within Spring Health teams supporting VERA-MH
With VERA-MH Council members for evaluation, governance, or review purposes
As required by law, legal process, or to protect rights, safety, or security
We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.
7. Open-Source Repositories
VERA-MH maintains public repositories. Content submitted or posted in these repositories is public by design and may be viewed, indexed, or reused by third parties.
This Privacy Policy does not govern how third parties use public repository content.
8. International Access and Transfers
The Site is accessible globally and may receive submissions from individuals outside the United States. Information may be processed and stored in the United States or other locations where Spring Health operates.
9. Data Retention
We retain information only for as long as reasonably necessary to:
Review and analyze RFC submissions
Maintain research integrity and documentation
Comply with legal, security, or audit requirements
Specific retention periods will be documented and applied consistently with internal policies.
10. Children and Minors
The Site is not directed to children under 13, and we do not knowingly collect personal information from children under 13.
We do not knowingly sell personal information or engage in targeted advertising directed at minors.
11. Your Privacy Rights
Depending on your location, you may have certain rights regarding your personal information, as described below.
California Privacy Rights Addendum (CCPA / CPRA)
This section applies to California residents.
Categories of Personal Information Collected
Identifiers (e.g., name, email address)
Professional information (e.g., organization, role)
Internet or electronic activity information (limited site usage data)
Purpose of Collection
See Section 3 above.
Sales and Sharing
Spring Health does not sell or share personal information as defined by California law.
Your Rights
You may have the right to:
Know and access personal information
Request deletion
Request correction
Opt out of sale or sharing (not applicable)
Non-discrimination
Requests may be submitted to privacy@springhealth.com
12. U.S. State Privacy Rights (Certain States)
If you are a resident of a U.S. state with a comprehensive privacy law (such as Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others), you may have the right to
Confirm whether we process your personal data
Access your personal data
Correct inaccuracies
Request deletion
Obtain a portable copy of data you provided
Opt out of processing for:
Targeted advertising
Sale of personal data
Certain profiling with legal or similarly significant effects
Universal Opt-Out Signals
Where required by applicable law, we honor browser-based universal opt-out preference signals (such as Global Privacy Control) as a request to opt out of applicable processing.
Appeals
If we deny a request, you may appeal by replying to our response with the subject line “Appeal – VERA-MH Privacy Request.” We will respond within the timeframe required by applicable law.
European Privacy Rights (GDPR)
Data Controller
Spring Health, Inc.
Email: privacy@springhealth.com
13. Legal Bases
We process personal data on the basis of:
Legitimate interests (operating the Site, research, governance)
Consent, where required (e.g., voluntary submissions)
Your Rights
You may have the right to:
Access, correct, or delete your data
Restrict or object to processing
Data portability (where applicable)
Lodge a complaint with a supervisory authority
International Transfers
Data may be transferred to and processed in the United States using appropriate safeguards where required.
14. Security
We use reasonable administrative, technical, and organizational safeguards designed to protect information against unauthorized access or disclosure. No system is entirely secure, and we cannot guarantee absolute security.
15. Changes to This Policy
We may update this Privacy Policy periodically. Updates will be reflected by the “Last Updated” date.
16. Contact Us
For questions or privacy requests, contact:
Spring Health, Inc.
Attn: Privacy Team
Email: privacy@springhealth.com