Security at Velugu AI

Last updated: October 26, 2026

Velugu AI works with your practice's insurance and billing information every day. This page is for practice owners, office managers, compliance leads and IT vendors who want to know exactly how that information and your account access are protected.

Agreements first

We sign a HIPAA business associate agreement (BAA) with your practice before any patient information is processed. Our infrastructure and AI providers that may handle patient information are covered by their own BAAs with us. Our Privacy Policy lists those providers.

What we access

Velugu AI works from your schedule, insurance and billing records: the information needed to check coverage, update plan details and post payments. We don't access clinical notes, x-rays or treatment charts.

Your account access

To check benefits and update your records, Velugu AI signs in to your practice management system and your insurance carrier accounts on your practice's behalf, using logins your practice authorizes.

• Stored encrypted. Logins are kept in an encrypted vault, never in plain text, in code or in spreadsheets. They're retrieved only at the moment a sign-in is needed.
• Verification codes. Many carriers send a one-time code by email when signing in. With your permission, Velugu AI reads only those code messages from the carrier, from a mailbox you choose, and only right after it requests a code. It doesn't read other email.
• Authenticator apps. Where a carrier uses an authenticator app, the setup key is stored in the same encrypted vault.
• Revoke anytime. Change a password or remove our mailbox access and our access ends immediately. We recommend creating a dedicated Velugu AI user in your practice management system and carrier accounts, so our activity is separate from your staff's.

Protecting data

• Encryption: data is encrypted in transit (TLS) and at rest.
• Separation: each practice's records are kept separate from every other practice's.
• Least access: only Velugu AI team members who support your practice can access its data, and only for that purpose.
• No AI training: your data isn't used to train AI models.

A person approves every change

• Plan updates and payment postings wait in an approval queue. Nothing is written to your practice management system until your team approves it.
• After each update, Velugu AI reads the value back to confirm it saved correctly.
• Every check keeps a record of what the carrier reported, and every change is logged with who approved it and what changed.

Reliability

Carriers change their systems from time to time. We check every carrier integration regularly, and results that look incomplete or unusual are flagged for review instead of being written to your records.

If something goes wrong

If we discover a security incident affecting your practice's information, we'll notify you as required by HIPAA and our BAA, and work with you on next steps.

Security overview and questions

We're happy to send a one-page security overview and our BAA to your compliance lead or IT vendor before your first call. Email hello@veluguai.com.