The full text of every policy governing VESPER Psychology, published by Foundry SMB LLC of Colorado. A plain summary of each sits on the Policies page.
These policies are written in plain English wherever possible. Where terms are defined ("Customer," "PHI," "Subscription"), the defined meaning applies throughout. Nothing in these policies is legal advice to you. If any provision is held unenforceable, the rest remains in effect.
Foundry SMB LLC ("we," "us," "Foundry") is a Colorado limited liability company. We publish the Vesper Psych desktop application and operate vesperpsych.com. You can reach our privacy team at [email protected].
This policy describes how we collect, use, disclose, and retain personal information processed through the Vesper Psych website, the Vesper Psych desktop application, and our sales and support operations. It does not cover the content of clinical records created inside Vesper Psych. Those records are created, stored, and controlled by you. Vesper Psych is a local-first application; clinical content remains on the clinician's workstation.
Account and fulfillment data. When you purchase a subscription or request a trial, we collect your name, email address, organization name, license tier, billing identifiers from Stripe, device fingerprint tied to your seat token, and your IP address at the time of purchase.
Support, sales, and feedback data. When you submit a form on this site or email us, we receive whatever you send. We ask you not to include protected health information (PHI) unless you are a Practice or Enterprise customer under a signed Business Associate Agreement. Feedback submissions may be anonymous unless you choose to provide contact details.
Website analytics. We run Cloudflare Web Analytics for aggregate visit statistics. Cloudflare does not set cookies for this product and does not profile you across sites. Our CDN logs retain IP, user agent, referrer, and request path for up to 30 days for security and troubleshooting.
Desktop application data. After activation, Vesper Psych runs offline. The only network traffic to our servers is a daily license refresh (the device fingerprint, license status, and JWT). Clinical content, patient identifiers, test scores, interview notes, and draft reports never reach our servers in the default configuration.
Vesper Psych is a local-first desktop application. Before any supported model call, the local UNID redaction pipeline removes HIPAA Safe Harbor identifiers from the text. The redaction manifest, including identifier categories and counts removed, is recorded and can be surfaced in the application UI. The model call goes out with zero HIPAA identifiers.
Architecturally, we cannot retain PHI we never receive.
This is why our compliance position is stronger than a zero-retention policy. A policy is a promise. Our architecture is proof.
We do not sell personal information. We do not share personal information with advertisers. We do not use your content to train AI models.
For visitors subject to the EU or UK GDPR, our legal bases are:
We rely on a small set of processors to run the service. Each is bound by a data processing agreement and, where applicable, a Business Associate Agreement.
We do not disclose personal information to other third parties except: (a) with your instruction, (b) to our attorneys, accountants, or insurers under a duty of confidence, (c) in a business transfer where the acquirer assumes this policy, or (d) when required by law.
Our processors are primarily in the United States. For transfers from the European Economic Area or the United Kingdom, we rely on Standard Contractual Clauses issued by the European Commission and the UK International Data Transfer Addendum. A copy of the transfer mechanism is available on request.
You have rights to access, correct, delete, restrict, or port your personal information. You may object to processing based on legitimate interest. EU and UK residents may lodge a complaint with their supervisory authority. California residents may exercise rights under the California Consumer Privacy Act, including the right to know, delete, correct, and opt out of any sale or sharing of personal information. We do not sell or share personal information as those terms are defined by the CCPA.
To exercise any right, email [email protected]. We verify the request against the account email on file and respond within thirty days, or forty-five where allowed. We do not charge for the first request in a twelve-month period.
Vesper Psych is a professional tool intended for licensed clinicians. We do not knowingly collect personal information from anyone under sixteen. If you believe a child has provided us information, contact [email protected] and we will delete it.
We use industry-standard administrative, technical, and physical safeguards to protect personal information under our control. These include encryption in transit, encryption at rest for customer databases, least-privilege access, logging, vendor due diligence, and an incident response plan. See the Security and Responsible Disclosure policy for the researcher-facing contact.
Vesper Psych does not use advertising cookies. The website sets a minimal set of functional and security cookies (for example, session protection on the license server). Cloudflare Web Analytics operates without cookies. Browsers that send a Global Privacy Control signal are treated as opt-out of any "sale" or "sharing" under the CCPA, even though we do not engage in either.
We version this policy. The version number changes on material updates. We notify active customers of material changes by email at least thirty days before the new version takes effect.
These Terms of Service ("Terms") form a binding agreement between you (or the organization you represent, "Customer") and Foundry SMB LLC ("Foundry," "we," "us"). By purchasing a subscription, activating Vesper Psych, or using vesperpsych.com beyond browsing, you accept these Terms. If you do not accept these Terms, do not use Vesper Psych.
Subject to Customer's compliance with these Terms and payment of fees, Foundry grants Customer a non-exclusive, non-transferable, non-sublicensable, revocable license to install and use the Software during the Subscription term, on the number of Seats purchased, for Customer's own professional psychological work. All rights not expressly granted are reserved.
Customer shall not, and shall not permit any third party to:
The clinician diagnoses. Vesper Psych does not. The Software organizes evidence, proposes diagnoses for clinician review, and drafts language. It does not practice medicine, psychology, or any other licensed profession. It does not sign reports. Customer is solely responsible for all clinical judgments, for the accuracy and appropriateness of every rendered diagnosis, and for the ethical and legal sufficiency of any report the clinician signs. Use of the Software does not create a clinician-patient relationship with Foundry.
Subscriptions are billed monthly in advance at the rates published at vesperpsych.com/pricing or set out in an Enterprise order form. Fees are in United States dollars and are exclusive of applicable taxes. We may change prices on thirty days' written notice, effective at the next renewal. Failure to pay within ten days of invoice date may result in suspension of the Subscription.
Each monthly Subscription renews automatically until Customer cancels. Customer may cancel at any time through the Stripe Customer Portal or by emailing [email protected]. Upon cancellation, access continues through the end of the current billing period and the Subscription does not renew. Fees already paid are not refunded. See the Refund Policy tab.
Foundry owns all right, title, and interest in the Software, vesperpsych.com, and any improvements, modifications, and derivatives, including feedback Customer provides. Customer owns Customer Data. Foundry claims no license over Customer Data beyond what is strictly necessary to provide the Software, and in the default local-first configuration Foundry does not receive Customer Data.
Each party will protect the other party's non-public information using at least the care it uses for its own confidential information of similar importance, and will use it only to perform this agreement. These obligations do not apply to information that is public, already known, independently developed, or required to be disclosed by law after reasonable notice to the other party.
THE SOFTWARE AND WEBSITE ARE PROVIDED "AS IS" AND "AS AVAILABLE." FOUNDRY DISCLAIMS ALL WARRANTIES, EXPRESS AND IMPLIED, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. FOUNDRY DOES NOT WARRANT THAT THE SOFTWARE WILL MEET EVERY REQUIREMENT, OPERATE WITHOUT INTERRUPTION, BE ERROR-FREE, OR PRODUCE ANY PARTICULAR CLINICAL OR LEGAL OUTCOME.
TO THE FULLEST EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, DATA, OR BUSINESS OPPORTUNITY, ARISING OUT OF OR RELATED TO THIS AGREEMENT, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT WILL NOT EXCEED THE FEES PAID OR PAYABLE BY CUSTOMER TO FOUNDRY UNDER THIS AGREEMENT IN THE TWELVE MONTHS PRECEDING THE EVENT GIVING RISE TO LIABILITY. THESE LIMITS DO NOT APPLY TO A PARTY'S INDEMNIFICATION OBLIGATIONS, A BREACH OF CONFIDENTIALITY, CUSTOMER'S PAYMENT OBLIGATIONS, OR A PARTY'S GROSS NEGLIGENCE OR WILLFUL MISCONDUCT.
Customer will defend, indemnify, and hold harmless Foundry from and against third-party claims arising out of: (a) Customer's use of the Software in violation of these Terms or applicable law, (b) Customer Data, (c) Customer's clinical work, including any diagnosis, evaluation, report, or testimony, and (d) Customer's breach of professional ethics. Foundry will defend, indemnify, and hold harmless Customer from and against third-party claims that the Software, as provided and used in accordance with these Terms, infringes a United States patent, copyright, or trade secret, subject to the cap in Section 11.
Foundry may suspend or terminate access on notice if Customer materially breaches these Terms and does not cure within ten days, if required by law, or if Customer's use presents a security risk to the Software or other customers. Customer may terminate by cancelling the Subscription. Sections that by their nature should survive termination will survive, including Sections 5, 8, 10, 11, 12, and 14.
These Terms are governed by the laws of the State of Colorado, without regard to conflict of laws principles. The United Nations Convention on Contracts for the International Sale of Goods does not apply. The parties submit to the exclusive jurisdiction of the state and federal courts located in Denver County, Colorado, for any dispute, subject to the informal-resolution step below. Each party waives any right to a jury trial to the fullest extent permitted by law. Each party waives any right to participate in a class, collective, or representative action against the other. Before filing suit, the parties will attempt to resolve any dispute in good faith for at least thirty days, starting with written notice to [email protected].
These Terms, together with any order form and the other policies linked on this page, are the entire agreement between the parties on this subject. Neither party may assign this agreement without the other party's consent, except in a merger, acquisition, or sale of substantially all assets. Notices under these Terms must be in writing and sent to the email addresses listed in the Overview. If any provision of these Terms is held invalid, the remaining provisions remain in effect. A failure to enforce a provision is not a waiver.
This policy lists conduct that is prohibited while using Vesper Psych or vesperpsych.com. It supplements, and is incorporated into, the Terms of Service. Violation may result in suspension or termination of the Subscription without refund.
Report suspected violations to [email protected]. Security vulnerabilities should go through the Security tab.
Foundry may take any of the following steps, alone or together: warn Customer, suspend the Subscription, terminate Seats, refuse future service, notify affected parties, or cooperate with law enforcement. Fees already paid are not refunded where Customer has materially breached this policy.
Vesper Psych is sold as a monthly subscription. All fees are earned when charged. Cancellation stops the next renewal; it does not refund the current period. Customer retains access through the end of the current billing period.
The one-time Enterprise setup fee is non-refundable once work has begun. Monthly seat fees invoiced under an Enterprise agreement are non-refundable after the billing period begins. Early termination provisions, if any, are set out in the order form.
Foundry may, at its discretion, issue a refund or credit in the following situations:
Email [email protected] from the account email on file, with the invoice identifier and a description of the issue. We acknowledge receipt within two business days and resolve within ten business days. Approved refunds are issued to the original payment method.
Initiating a chargeback with a payment network without first contacting [email protected] may result in immediate suspension of the Subscription and termination of access, in addition to any dispute-response fees.
Support hours are Monday through Friday, 9:00 to 18:00 Mountain Time, excluding United States federal holidays. Channels by tier:
Response means a human has read the ticket and replied within the window below. Resolution time depends on severity and reproducibility and is not part of the SLA.
| Tier | Critical | General |
|---|---|---|
| Pro | 1 business day | 2 business days |
| Practice | 1 business hour | 1 business day |
| Enterprise | 30 minutes | 4 business hours |
| Evaluating | Best effort | Best effort |
Support does not include: custom software development, integration with third-party clinical systems beyond our documented interfaces, infrastructure Customer operates, training on Customer's internal processes, legal advice, or clinical guidance. We do not render, review, or sign clinical opinions.
For efficient support, Customer should provide: the Vesper Psych version number, operating system, a clear description of what happened and what was expected, the steps to reproduce, and any non-PHI log excerpts we request. Customers must not include PHI in support communications unless a Business Associate Agreement is in force.
This policy covers: vesperpsych.com, Cloudflare Pages Functions under vesperpsych.com, the license API (api.vesperpsych.com), and the Vesper Psych desktop application installers we publish. Out of scope: third-party services we depend on (Stripe, Resend, Cloudflare), social engineering of Foundry staff, and denial-of-service tests.
Send findings to [email protected]. Describe the issue, steps to reproduce, affected components, and the impact you believe it has. A PGP key is available on request. We acknowledge every report within five business days.
Foundry will not pursue legal action, issue a takedown, or refer to law enforcement any researcher who in good faith complies with this policy. "Good faith" means: you stay within scope, you stop as soon as you have enough information to confirm the issue, you do not access or modify data that is not yours, you do not exfiltrate data beyond what is needed to demonstrate the issue, you do not disrupt service or users, and you give us a reasonable time to fix before public disclosure.
Once a fix is available, we will credit the researcher by name or handle, if they wish, in release notes or a security advisory. A formal bug-bounty program with monetary rewards is not offered at this time.
Vesper Psych is designed so that protected health information (PHI), as defined in 45 CFR 160.103, remains on the clinician's workstation. Intake fields, test scores, interview content, drafts, and signed reports are stored locally. In the default configuration, Foundry's servers do not create, receive, maintain, or transmit PHI.
PHI can reach us through narrow channels: support tickets that include identifying details, crash reports if Customer enables them, or future features that Customer elects to use that route content through our infrastructure. For Practice and Enterprise tiers, Foundry will enter into a Business Associate Agreement ("BAA") on request to cover those incidental flows.
If a BAA is in force, Foundry flows down HIPAA obligations to its subcontractors that may come into contact with PHI, including Cloudflare, Stripe, and Resend, each of which offers a BAA. Foundry maintains administrative, physical, and technical safeguards consistent with 45 CFR 164.308, 164.310, and 164.312.
If Foundry discovers a breach of unsecured PHI, Foundry will notify the affected Covered Entity without unreasonable delay and in no case later than sixty days after discovery, consistent with 45 CFR 164.410.
Customer, as the Covered Entity, is responsible for: lawful collection of PHI, patient authorizations, minimum-necessary disclosures, workstation security, user access controls on the clinician's device, and reporting breaches that occur on Customer-controlled systems. Vesper Psych's decision gates and audit log help, but do not discharge, these obligations.
Email [email protected] from the account email on file. Include the legal name of the Covered Entity, the authorized signer, and the tier. Our standard BAA is based on the HHS sample BAA and can be sent for signature through our e-signature provider.
Questions about these policies: [email protected]. Privacy requests: [email protected]. Security reports: [email protected].
VESPER Psychology
A workspace for psychological evaluations. Built by Foundry SMB in Colorado. The diagnosis is yours. The software keeps the record.
vesperpsych.com