Privacy Policy

The short version

• Your research data stays on your computer unless you save a project to Vesta Online or share it.
• We never send your datasets to an AI model. The AI Advisor sees what you type and the names of your datasets and variables. It sees data values only if you turn on data visibility, which is off by default.
• We do not sell personal information.
• Card details never reach our servers. Payments are handled by Stripe.
• You can delete your account at any time.

What we collect

When you contact us or sign up for news. Your name, email address, phone number, institution, and mailing address, if you give them through our contact, support, trial or subscription forms.

Your Vesta account. Your name, email address and institution. Sign-in is handled by a dedicated sign-in service. We never see or store your password.

Your subscription and payments. Your plan, seats, renewal dates and invoices. Payments are processed by Stripe on its own checkout page. We keep only the card type and its last four digits, so we can show you which card is on file.

Your use of Vesta. When you open Vesta, our server records your account, the time, and whether you used the desktop app or Vesta Online. We use this to check your subscription. We also count how often each feature is used each day, without recording who used it. Vesta Online keeps a history of the analysis jobs you run. We do not collect crash reports, and Vesta does not record the contents of your analyses.

Projects you save online. If you choose Save to Cloud in the desktop app, or work in Vesta Online, your project file is stored on our servers. That file includes your data, not just a description of it. See Vesta Online below.

AI Advisor conversations. If you use the Advisor, what you send to it is described under The AI Advisor below.

Public data requests. When you import US Census or CDC Environmental Public Health Tracking data in the desktop app, the request goes through BioMedware’s data proxy. It carries the query and your Windows username. Other public sources are contacted directly from your computer. In Vesta Online, our server requests the data from the source for you.

Website visits. Some pages on vesta.biomedware.com (pricing, checkout, sign-in, account, and the Terms and Refund pages) use Google Analytics to count visits, sign-ups, and purchases. These pages share an analytics identifier with biomedware.com so a visit can be followed across the two sites. biomedware.com also uses Google Analytics, loaded through Google Tag Manager. The contact and trial forms on biomedware.com are provided by Nutshell, our customer-relationship software, so what you submit goes directly into our customer records and we can respond to your request. Nutshell also records the pages you view on biomedware.com, so when you submit a form we can see what you were interested in. Meetings booked from our sites are scheduled through Calendly.

vestastats.com and booked calls. vestastats.com, including docs.vestastats.com and academy.vestastats.com, uses Google Analytics to understand how visitors use the site. It shares an analytics identifier with biomedware.com and vesta.biomedware.com, so a visit can be followed across the sites. Nutshell also records the pages you view on vestastats.com, so when you submit a form or book a call we can see what you were interested in. If you visit from the EU, EEA or UK, we ask first. Google Analytics and Nutshell stay off unless you accept, and you can change your choice at any time with “Cookie settings” at the bottom of each page. If you book a call with us on vestastats.com through Calendly, our scheduling service, we pass along the campaign tags in the link that brought you to our site, such as the website or campaign that referred you, and your Google Analytics identifier. Calendly saves them with your booking, and we may add them to your record in Nutshell. This links your visit to your name and email address, so we can see how people find us. If you decline analytics cookies, nothing from your visit is passed along with your booking.

How we use it

• To provide Vesta: sign you in, check your subscription, store and share the projects you choose to save online, and answer your Advisor questions.
• To bill you and keep the financial records the law requires.
• To support you and to tell you about your trial, renewals, and important changes.
• To send news about Vesta and events, if you have not unsubscribed.
• To understand which features and pages are used, so we can improve Vesta.
• To keep Vesta secure and to meet legal obligations.

We keep a record of customers and trial users in Nutshell, our customer-relationship software, including your contact details and our notes on our conversations with you.

Your data in the desktop app

The Vesta desktop app processes your data on your computer. Projects are saved on your computer and leave it only if you choose Save to Cloud. Vesta does not encrypt project files itself. If you work with sensitive data, protect your computer with disk encryption and access controls.

Map backgrounds come from a map service. To fetch them, Vesta requests map tiles for the area you are viewing, which reveals that general area but none of your data. Charts are drawn on your computer.

Vesta Online

Vesta Online runs on Amazon Web Services in the United States. Projects are private to you. You can share a project only with named Vesta accounts, and they can view it or save their own copy, but not change yours. Files are encrypted in transit and at rest. Our Security & data privacy page describes the protections in detail.

The AI Advisor

The Advisor is an optional, AI-assisted guided workflow that helps you choose methods and interpret results. The analyses themselves run on Vesta’s own statistical methods.

• Always sent: the questions you type and the conversation so far, the names of your datasets, variables, grids, models and visualizations, each dataset’s geometry type and number of observations, and a summary of your workspace. Names can carry identifiers, so keep identifiers out of them if you work with personal or health data.
• Sent only if you turn on data visibility (“Allow the AI assistant to see my project’s data values”, off by default): summary statistics for each variable (such as minimum, maximum, mean and percent missing), the results of completed analyses, and, when the Advisor needs them to answer a question, the values of up to 10 specific places or objects at a time. You confirm this in a consent dialog, and you can turn it off at any time.
• Never sent: your project file, map coordinates, file paths, your name or your email address.

Advisor requests go through BioMedware’s server to Amazon Bedrock, inside our own AWS environment, in the United States. They pass through a content guardrail. Your conversations are saved only inside your project, and they are not used to train AI models. Usage is counted per account by the amount of text processed, not by its content. On request, we can turn off all AI features for your account.

Service providers

We share personal information only with companies that help us run Vesta and our business, such as cloud hosting, sign-in, payment processing, email delivery, call scheduling and website analytics. They may use it only to provide those services to us. Our customer and sales records, including the forms you submit on biomedware.com and vestastats.com, are kept in Nutshell. Nutshell uses hCaptcha on its forms to check that they are sent by a person and not a bot; hCaptcha’s Privacy Policy applies.

We may also disclose information when the law requires it, or to protect the rights, property or safety of our customers, BioMedware or others.

We do not sell or rent personal information.

Cookies and browser storage

• Vesta Online and vesta.biomedware.com use a sign-in cookie, a cookie that keeps your session on the same server, and the sign-in service’s cookies. They also store a few interface preferences in your browser, such as your language and the last project you opened. Sign-in tokens are not kept in browser storage.
• biomedware.com uses cookies from Nutshell that recognize your browser across visits, for up to 10 years, and link a form you submit to the pages you viewed. Calendly sets its own cookies when you book a meeting.
• vestastats.com keeps your choice in the cookie banner in a cookie for one year. When analytics is allowed, it also keeps the campaign tags you arrived with in a cookie that ends when you close your browser, so they can be passed to Calendly if you book a call, and Nutshell sets cookies that recognize your browser across visits, for up to 10 years, and link a form you submit to the pages you viewed.
• Google Analytics sets cookies on biomedware.com, vestastats.com and the vesta.biomedware.com pages listed above. Google explains how it uses information from sites that use its services. You can block them in your browser settings or with Google’s opt-out add-on.

How long we keep it

• Your account and projects: for as long as you have an account. If your trial ends without a subscription, online projects and files are deleted as described in our Terms of Service. Your account stays so you can subscribe later.
• When you delete your account: you have 14 days to change your mind. After that your account and projects are deleted permanently. Backup copies expire on their own: stored files within 30 days, database backups within 35 days, and server logs within 90 days.
• What we keep after deletion:
  • Invoices and payment records, as the law requires.
  • A short record that the account was deleted, with its email address, for 24 months.
  • Your contact details and our notes in our sales records, unless you ask us to remove them.

Where your data is processed

Vesta runs in the United States. If you use Vesta from the European Economic Area, the United Kingdom or Switzerland, your personal data is transferred to the United States. Our hosting, sign-in and payment providers each participate in the EU–U.S. Data Privacy Framework and offer Standard Contractual Clauses in their data-processing terms. If your institution needs EU data residency, please ask us.

Your choices and rights

• Delete your account from your account page at any time.
• Ask for a copy, a correction, or deletion of the personal information we hold about you, including our sales records, by writing to support@biomedware.com.
• Unsubscribe from news and reminder emails using the link in any email. Emails about your purchases and account are still sent.
• Leave the Advisor off, or ask us to turn off AI features for your account.

Depending on where you live, you may have further rights under local law. We will respond to any request within the time that law requires.

Health and personal data

Vesta works with aggregate and individual-level data, including health data. If you work with protected health information (PHI), keep it in desktop projects saved on your computer, leave data visibility off, and keep identifiers out of dataset and variable names. Do not upload PHI to Vesta Online. Our Terms of Service explain this in full.

Changes to this policy

We will post changes on this page. If a change is important, we will email account holders at least 30 days before it takes effect.

Contact

Bio-Analytics, Inc. (BioMedware)
PO Box 100, Jerome, MI 49249
support@biomedware.com · (734) 913-1098