Privacy Policy

Last updated: November 13, 2026. This version replaces our previous privacy policy.

Our privacy policy tells you what personal data (PD) and non-personal data (NPD) VCA may collect from you, how we collect it, how we protect it, how we may share it, and how you can access, change, or delete it. Our privacy policy also explains certain legal rights that you have with respect to your personal data. VCA Software LLC administers this privacy policy and is responsible for personal data collected through our websites, including Google Analytics data. If at any time you have questions about our practices or any of your rights described below, please write to us by email at privacy@vcasoftware.com or by mail to VCA Software LLC, 7400 E. McDonald Drive, Suite 121, Scottsdale, AZ 85250, USA, Attn: Privacy Officer. Residents of Canada may also write to VCA Software, 10 Parr Boulevard, Suite 104, Bolton, ON L7E 4G9, Canada, Attn: Privacy Officer. This Privacy Policy applies to all websites, domains, software, offerings, information portals, and registries (“site”, “sites” and/or “services”) maintained by VCA.

This Privacy Policy explains how VCA handles personal data in running its own business: on our websites, in our sales and marketing, and in the accounts our customers and their users hold with us. It does not govern the claims data our customers enter into VCA, which is covered in the next section.

CLIENT CLAIMS DATA

Our customers, such as insurers, third-party administrators and adjusting firms, use VCA to manage their claims. The claims data they enter or upload, including information about claimants, policyholders and others involved in a claim, belongs to the customer. VCA processes that data only on the customer’s behalf and on its instructions, under our agreement with that customer and its data processing addendum. The customer’s own privacy notice governs how that data is used.

If your information is part of a claim managed through VCA, please contact the organization handling your claim. We will help them respond to your request.

AI FEATURES (CLAIMSAI BY VCA™)

Some features of VCA, including ClaimsAI by VCA™, use artificial intelligence. These are optional features that a customer can choose to turn on. To provide them, we use a third-party AI provider. It processes data on our behalf under a written agreement, to deliver the feature and, using only data that has been aggregated and irreversibly anonymized so that it cannot identify any person or customer, to improve it. If a customer does not turn these features on, no data is sent to the AI provider.

We may use aggregated data that has been irreversibly anonymized, so that it cannot identify any person or customer, to improve ClaimsAI by VCA™.

AI output is presented to users as an aid. It does not make decisions about claims.

DEFINITIONS

‘Non-personal data’ (NPD) is information that is in no way personally identifiable.

‘Personal data’ (PD) means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Personal Data is in many ways the same as Personally Identifiable Information (PII). However, Personal Data is broader in scope and covers more data.

A “visitor” is someone who merely browses our website or login pages. A “user” is someone who has registered with us to use or buy our services and products.

INFORMATION WE COLLECT

Generally, you control the amount and type of information that you provide to us when using our application.

OUR LEGAL BASIS FOR PROCESSING PERSONAL DATA (EEA and UK Individuals Only)

If you are a visitor from the European Economic Area (EEA) or the United Kingdom, our legal basis for processing your personal data will depend on the personal data concerned and the specific context in which we collect it.

However, we will normally collect personal data from you only where we have your consent to do so, where we need the personal data to perform a contract with you, or where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms. In some cases, we may also have a legal obligation to process personal data about you to protect your vital interests or the vital interests of the party who provided you with user access rights to the application.

If we collect and use your personal data in reliance on our legitimate interests (or those of any third party), this interest will normally be to operate our application and communicate with you as necessary to provide our products and services to you and for our legitimate commercial interest. These legitimate interests include, for example, responding to your queries, improving our platform, undertaking marketing, or detecting or preventing illegal activities. We may have other legitimate interests and if appropriate we will make clear to you at the relevant time what those legitimate interests are.

If you have questions about or need further information concerning the legal basis on which we collect and use your personal data, please contact us using the contact details provided above.

We Collect Your Personal Data in the Following Ways

AUTOMATIC INFORMATION

We automatically receive information from your web browser or mobile device. This information may include the name of the website from which you entered our website, if any, your Internet service provider’s name, your web browser type, the type of mobile device, your computer operating system, and data about your browsing activity when using our website or VCA. We use all this information to analyze trends among our users to help improve VCA.

WHEN ENTERING AND USING VCA

VCA uses cookies, and some of them may contain your Personal Data. Where the law requires it, including for visitors in the United Kingdom and the European Economic Area, we ask for your consent before setting any cookie that is not strictly necessary, and you can change or withdraw that consent at any time. A cookie is a small piece of data or a text file that is downloaded to your computer or mobile device when you access certain websites. Cookies may contain text that can be read by the web server that delivered the cookie to you. The text contained in the cookie generally consists of a sequence of letters and numbers that uniquely identifies your computer or mobile device; it may contain other information as well.

WE MAY USE COOKIES FOR

Identifying the areas of VCA that you have visited.
Personalizing content that you see on VCA.
Our application analytics.
Remembering your preferences, settings, and login details.
Allowing you to post updates.
Allowing you to share content with others within the organization.

DO NOT TRACK SETTINGS

You may modify and control how and when cookies are set through your browser settings. If you choose to reject cookies, several of the functions and conveniences of VCA may not work properly, and you may be unable to use some of our services that require registration in order to participate, or you will have to re-register each time you visit our site.

When you are registering for VCA, during the purchasing process, or when using VCA, we may collect some or all of the following information: your name, email address, physical location, company name, phone number, user name, password, and other information listed.

TRIALS, SANDBOXES AND EVALUATIONS

If you use a VCA trial, sandbox or evaluation account, we collect the account details you give us, logs of how the account is used, and a record of your acceptance of our Evaluation Terms. We use this information to provide and secure the evaluation, to understand how VCA is being evaluated, and to keep a record of the terms you agreed to.

WEB BEACONS

We may also use a technology called web beacons and other technologies, such as pixels and ad tags, to collect general information about your use of our website and your use of special promotions or newsletters. The information we collect by web beacons allows us to statistically monitor the number of people who open our emails. Web beacons also help us to understand the behavior of our customers, members, and visitors.

LOCATION INFORMATION

When you use a location-enabled device, we may collect and process information about your actual location, like GPS signals sent by a mobile device. We also may use various technologies to determine location, such as sensor data from your device that may, for example, provide information on nearby Wi-Fi access points and cell towers.

NEW TECHNOLOGIES

As new technologies emerge, we may be able to improve our services or provide you with new ones, which means that we may create new ways to collect information on the site and our services. If we offer a new service or new features to our existing site, for example, these changes may result in our collecting new information in order to improve your user experience.

GOOGLE ANALYTICS PRIVACY POLICY

Our website uses Google Analytics to collect information about the use of our website. Google Analytics collects information from users such as age, gender, interests, demographics, how often they visit our public website, what pages they visit, and what other websites they have used before coming to our website. We use the information we get from Google Analytics to analyze traffic, remarket our products and services to users, improve our marketing and advertising, and improve our website. We have enabled Google Analytics advertising features such as remarketing with Google Analytics, Google Display Network Impression Reporting, and Google Analytics Demographics and Interest Reporting. Visitors in the United Kingdom and the European Economic Area are asked for their consent before these cookies are set, and these cookies are not set unless they agree. We do not send Google names, email addresses or any other information that directly identifies you. Although Google Analytics plants a permanent cookie on your web browser to identify you as a unique user the next time you visit our website, the cookie cannot be used by anyone but Google. Google also uses specific identifiers to help collect information about the use of our website. For more information on how Google collects and processes your data, visit www.google.com/policies/privacy/partners

You can prevent Google Analytics from using your information by opting out at this link: tools.google.com/dlpage/gaoptout

HOW YOUR INFORMATION IS USED

We use your information for our legitimate interests, including to:

Provide our products and services you have requested or purchased from us.
Respond to your questions and provide you support.
Personalize and customize our content.
Make improvements to our product.
Contact you with updates to our product.
Resolve problems and disputes.
Contact you with marketing and advertising that we believe may be of interest to you.

COMMUNICATIONS AND EMAILS

From time to time VCA (and our partners, affiliates, and resellers) may email you electronic newsletters, announcements, surveys or other information. If you prefer not to receive any or all of these communications, you may opt out by following the unsubscribe directions provided within the electronic newsletters and announcements. While you may opt out of receiving promotional emails from VCA, you may not opt out of receiving product related transactional emails from us relating to your active VCA account.

We do not sell or rent your Personal Data to third parties for marketing purposes. We do, however, engage third party companies and individuals to perform services on our behalf. The types of services and providers may include:

Hosting and infrastructure: Microsoft Azure.
Email, identity and productivity: Microsoft 365 and Entra ID.
Email and text messages sent by the VCA product: Mailgun and Twilio.
Business phone system: RingCentral.
Meeting recording and transcription: Fathom.
CRM, marketing and customer support: HubSpot.
E-signature: DocuSign.
Compliance monitoring and code security: Drata and SonarCloud.
Integrations a customer chooses to turn on: Verisk/Xactware, Symbility, Encircle, Hover, Xero, QuickBooks and Google Maps.

These third parties have access to your information so that they may perform these tasks on our behalf and they are prohibited by us from using or disclosing your information for any purpose other than to provide this assistance, except to the extent required by law. We may permit our service providers to use aggregated information that has been irreversibly anonymized, so that it cannot identify you, for other purposes.

We also share information with professional advisers, such as auditors and independent security testers, under confidentiality obligations.

Client claims data is hosted on Microsoft Azure. Some service providers process claims data to deliver the service, for example to send emails and text messages, or to connect with systems the customer chooses to integrate. We provide customers with our current list of subprocessors on request.

QUALITY CONTROL

We may monitor or record any of your telephone conversations, emails, or chats with us for quality control purposes, for purposes of training our employees, and for our own protection.

LEGALLY REQUIRED RELEASES OF INFORMATION

We may be legally required to disclose your Personal Data if such disclosure is required by subpoena, law, or other legal process.
necessary to assist law enforcement officials or government enforcement agencies.
necessary to investigate violations of or otherwise enforce our Legal Terms.
necessary to protect us from legal action or claims from third parties, including you and/or other users or members.
necessary to protect the legal rights, personal/real property, or personal safety of our company, users, employees, and affiliates.

DATA SECURITY

VCA takes data security very seriously and implements the industry’s best practices and policies. We take all reasonable measures to protect your information, and to prevent any kind of unauthorized access, misuse, loss, or disclosure.

We log activity in our services and use a web application firewall to protect them and our customers’ data.

Our platform is hosted on Microsoft Azure, whose certifications include ISO/IEC 27001 and PCI DSS. VCA’s controls are independently audited. Our SOC 3 report is available on request, and customers can obtain our SOC 1 and SOC 2 reports under a non-disclosure agreement.

We monitor our systems continuously, review our security controls regularly, and have independent penetration tests performed, addressing the findings.

While no system is infallible, we strive to keep our systems secure and constantly updated.

DATA RETENTION

When a customer’s contract ends, we delete their data from our production systems within 30 days. We keep one final backup in secure storage for up to one year, and delete it sooner if the customer asks in writing. We will confirm deletion in writing on request.

DISCLOSURES TO SUCCESSORS

If our business is sold or merges in whole or in part with another business that would become responsible for providing VCA to you, we retain the right to transfer your Personal Data to the new business. The new business would retain the right to use your Personal Data according to the terms of this privacy policy as well as to any changes to this privacy policy as instituted by the new business.

We also retain the right to transfer your Personal Data if our company files for bankruptcy and some or all of our assets are sold to another individual or business.

RETAINING YOUR PERSONAL DATA

We retain marketing contact information for two years after our last interaction with you, or until you unsubscribe or ask us to delete it, if that is sooner. We also retain Personal Data as needed to comply with our legal obligations, resolve disputes and enforce our agreements. When your VCA contract ends, we delete your data as described in “Data Retention” above and provide written confirmation of deletion on request. We will delete this data from the servers at an earlier date if you so request, as described in “Reviewing, Correcting, and Removing Your Personal Data” below.

REVIEWING, CORRECTING, AND REMOVING YOUR PERSONAL DATA

Upon request VCA will provide you with information about whether we hold any of your Personal Data. If you provide us with your Personal Data, you have the following rights with respect to that information:

To review the user information that you have supplied to us
To request that we correct any errors, outdated information, or omissions in user information that you have supplied to us
To request that your user information not be used to contact you
To request that your user information be removed from any solicitation list that we use
To request that your user information be deleted from our records
To opt out of being solicited by VCA or third parties

To exercise any of these rights, please contact us at privacy@vcasoftware.com or by mail to VCA Software LLC, 7400 E. McDonald Drive, Suite 121, Scottsdale, AZ 85250, USA, Attn: Privacy Officer. We will respond to your request to change, correct, or delete your information within a reasonable timeframe and notify you of the action we have taken.

LINKS TO OTHER WEBSITES

Our website or application may contain links to other websites. These websites are not under our control and are not subject to our privacy policy. These websites will likely have their own privacy policies. We have no responsibility for these websites and we provide links to these websites solely for your convenience. You acknowledge that your use of and access to these websites are solely at your risk. It is your responsibility to check the privacy policies of these websites to see how they treat your Personal Data.

PROTECTING CHILDREN’S PRIVACY

Even though our website is not designed for use by anyone under the age of 16, we realize that a child under the age of 16 may attempt to access our website. We do not knowingly collect Personal Data from children under the age of 16. If you are a parent or guardian and believe that your child is using our website, please contact us at privacy@vcasoftware.com. Before we remove any information, we may ask for proof of identification to prevent malicious removal of account information. If we discover that a child is accessing our website, we will delete his/her information within 30 days. You acknowledge that we do not verify the age of our users nor do we have any liability to do so.

OUR EMAIL POLICY

You can always opt out of receiving further email correspondence from us. We will not sell, rent, or trade your email address to any unaffiliated third party without your permission except in the sale or transfer of our business, or if our company files for bankruptcy.

OUR SECURITY POLICY

We have built our website and products using industry-standard security measures and authentication tools to protect the security of your Personal Data. We and the third parties who provide services for us also maintain technical and physical safeguards to protect your Personal Data. We also periodically monitor our system for possible vulnerabilities and attacks, consistent with industry standards. Unfortunately, we cannot guarantee against the loss or misuse of your Personal Data or secure data transmission over the Internet because of its nature.

We strongly urge you to protect any password you may have for VCA and to not share it with anyone. You should always log out by closing the browser window of our product when you finish using it, especially if you are sharing or using a computer in a public place. Data in VCA, including messages between users, is encrypted in transit and at rest. Email sent from VCA to people outside it travels over the public internet and may not be encrypted end to end, so please avoid sending sensitive information by email.

USE OF YOUR CREDIT CARD

You may have to provide a credit card to buy products and services from our website. We use third-party billing services. We use our commercially reasonable efforts to make sure your credit card number is kept strictly confidential by using only third-party billing services that use industry-standard encryption technology to protect your credit card number from unauthorized use. However, you understand and agree that we are in no way responsible for any misuse of your credit card number.

HANDLING OF SMS MESSAGES

Collection and Use of SMS Data
When you opt in to receive SMS messages from us, we collect your phone number and any other information you provide in connection with the SMS service. We use this information to send you the requested SMS messages, including multi-factor authentication (MFA) codes, notifications, and other relevant communications.

Consent
By providing your phone number and opting in to receive SMS messages, you consent to receive SMS communications from us. You may opt out of receiving SMS messages at any time by following the instructions provided in the SMS message or by contacting us directly.

Data Security
We take the security of your personal information seriously. We implement appropriate technical and organizational measures to protect your SMS data from unauthorized access, disclosure, alteration, or destruction.

Third-Party Service Providers
We may use third-party service providers, such as Twilio, to facilitate the sending of SMS messages. These providers are contractually obligated to protect your information and are prohibited from using your data for any purpose other than providing the SMS service.

Your Rights
You have the right to access, correct, or delete your personal information, including your phone number, at any time. Please contact us if you wish to exercise these rights.

INTERNATIONAL DATA TRANSFERS

Your personal information may be transferred to, and processed in, countries other than the country in which you are resident. These countries may have data protection laws that are different from the laws of your country (and, in some cases, may not be as protective).

Claims data is hosted in the Microsoft Azure region set out in each customer’s agreement, normally a data center in the customer’s own region (the United States, Canada, the United Kingdom or Australia). Some of our service providers, including those that send email and text messages from VCA, process data in the United States, so personal data from the United Kingdom and the European Economic Area may be transferred to the United States.

We have taken appropriate safeguards to require that your personal information will remain protected in accordance with this privacy notice.

When personal data is transferred from the European Economic Area or the United Kingdom to a country that has not been found to provide an adequate level of protection, VCA relies on appropriate safeguards recognized under applicable data protection law: the European Commission’s Standard Contractual Clauses and, for transfers from the United Kingdom, the UK International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses. Transfers to Canada rely on the European Commission’s and the United Kingdom’s recognition that Canada provides adequate protection for personal data handled under its federal private-sector privacy law.

You may send questions or complaints about these transfers to privacy@vcasoftware.com or by mail to VCA Software LLC, 7400 E. McDonald Drive, Suite 121, Scottsdale, AZ 85250, USA, Attn: Privacy Officer. If we have not resolved your query or complaint and you are based in the European Economic Area, the United Kingdom or Switzerland, you may also raise it with your local data protection authority. The European Data Protection Board lists the national authorities at edpb.europa.eu.

CANADIAN RESIDENTS

VCA handles personal information in accordance with Canada’s Personal Information Protection and Electronic Documents Act and applicable provincial privacy laws. The VCA entity named at the start of this policy is responsible for personal information under it. Our Privacy Officer is accountable for our compliance and can be reached at privacy@vcasoftware.com. If you are not satisfied with our response to a privacy concern, you may contact the Office of the Privacy Commissioner of Canada or your provincial privacy regulator.

CHANGES TO OUR PRIVACY POLICY

We reserve the right to change this privacy policy at any time. If our company decides to change this privacy policy, we will post those changes on our website so that our visitors, users and customers are always aware of what information we collect, use, and disclose. If at any time we decide to disclose or use your Personal Data in a method different from that specified at the time it was collected, we will provide advance notice by email (sent to the email address on file in your account). Otherwise we will use and disclose our users’ and customers’ Personal Data in agreement with the privacy policy in effect when the information was collected. In all cases, your continued use of our website, services, and products after any change to this privacy policy will constitute your acceptance of such change.

QUESTIONS ABOUT OUR PRIVACY POLICY

If you have any questions about our privacy policy, please contact us using the information at the top of this privacy policy.

VCA Software Privacy Policy