Velago handles some of the most sensitive information there is: details about students' mental health and well-being. This policy explains what we collect, why we collect it, who we share it with, and the choices available to students, families, schools, and providers.
1. Who we are
Velago is a care management platform operated by the Mental Health Initiative for South Asians (“MHISA,” “we,” “us,” or “our”). Velago helps school social workers and counselors screen, triage, and refer students to culturally concordant mental health providers.
When Velago is used by a school or district, the school is generally the owner and controller of student records, and we process those records on the school's behalf and under its direction, as a “school official” with a legitimate educational interest under the Family Educational Rights and Privacy Act (FERPA) and applicable state student-privacy laws.
2. Information we collect
Information provided by schools
- Student profile information such as name, student ID, grade, date of birth, and school email address.
- Optional demographic and access information used for matching, such as language, race/ethnicity, gender identity, insurance status, household income range, and home address.
- Parent or guardian name and contact details.
- Referral and case information, including the reason for referral, urgency, screening results, counselor notes, and visit history.
Information provided by students and families
- Self-referral submissions, including the concern described and any notes.
- Parent or guardian consent and student assent records, including e-signatures.
Information about school staff and providers
- Account details such as name, work email, role, and organization.
- For providers: licensure, specialties, languages, location, insurance accepted, and availability.
- Messages exchanged through the platform.
Information collected automatically
- Basic technical and usage data, such as device and browser type, pages viewed, and approximate location derived from IP address, collected through privacy-friendly analytics.
- Security and audit logs, including sign-in events and record access.
3. How we use information
We use information only to provide and improve Velago for the schools we serve:
- To create and manage student cases, screenings, and referrals.
- To match students with mental health providers based on clinical need, language, culture, insurance, and location.
- To request and record parent/guardian consent and student assent.
- To send service emails, such as referral updates, sign-in links, and reminders.
- To secure the platform, prevent misuse, and troubleshoot problems.
- To produce aggregated, de-identified reporting for schools and program evaluation.
We do not sell personal information, and we do not use student information for targeted advertising or to build profiles for any purpose unrelated to the school's use of Velago.
4. AI-assisted features
Velago uses automated tools to help counselors summarize referrals and suggest provider matches. These tools assist, but never replace, professional judgment: a counselor reviews every recommendation, and the AI never contacts students, parents, or providers on its own.
Student information is not used to train third-party AI models. Where we rely on outside AI service providers, they are contractually limited to processing data on our behalf to deliver the feature.
6. Text messages (SMS)
Parents and guardians can choose to get text updates from Velago, operated by the Mental Health Initiative for South Asians (MHISA), about a student's referral. Signing up is optional: a guardian enters their own mobile number and checks a box agreeing to receive texts. See how signing up works.
When a guardian signs up, we collect and keep:
- their mobile number;
- a record of their consent: the words they agreed to, the date and time, and the network address and browser they used;
- whether and when they opted out.
We use this only to send texts about that referral, such as reminders and updates on provider options, and to keep a record that the guardian agreed to receive them. Texts never include clinical or health details. We use a messaging provider (Twilio) to deliver texts; it processes numbers only to send messages on our behalf.
We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. Mobile numbers and text-message consent are not shared with anyone else, including schools' other vendors, except the messaging provider that delivers the texts.
Message frequency varies. Message and data rates may apply. Reply STOP to any text to stop receiving texts, or HELP for help. You can also email hello@velago.io.
7. Parent consent and student assent
Before a student's information is shared with an outside provider, Velago requests consent from the parent or guardian, as well as the student's own assent where appropriate, unless state law allows the student to consent to their own care. Families may decline or withdraw consent at any time by contacting the student's school or us.
8. Children's privacy
Velago is offered to schools, not directly to children. Where students under 13 use Velago, we rely on the school to provide consent on behalf of parents as permitted by the Children's Online Privacy Protection Act (COPPA), and we use that information solely for the educational and wellness purposes authorized by the school.
9. Data security
We use administrative, technical, and physical safeguards, including:
- Encryption of data in transit (TLS) and at rest.
- Role-based access, so each user sees only the records they need.
- Hashed passwords and time-limited sign-in and password-reset links.
- Access logging and regular review of who can reach sensitive data.
No system is perfectly secure. If we learn of a breach affecting personal information, we will notify affected schools and individuals as required by law and our contracts.
10. Data retention
We keep information for as long as the school's agreement is in effect and as needed to provide the service. When a school ends its agreement or asks us to, we delete or return student information within a reasonable period, except where we must keep it longer to meet legal obligations. De-identified data may be retained for reporting and research.
11. Your rights and choices
Parents, guardians, and eligible students may review, correct, or request deletion of student records. Because schools control these records, we will generally direct requests to the student's school and help the school respond.
Staff and provider users can update their account information at any time or contact us to close their account. Depending on where you live, you may have additional rights under state law, such as the Connecticut Student Data Privacy Act; we will honor those rights as required.
12. Changes to this policy
We may update this policy from time to time. If we make material changes, especially to how student information is used, we will notify partner schools in advance and update the effective date above. Material changes affecting student data will not take effect without notice to schools.
13. Contact us
Questions about this policy or a privacy request? Email us at hello@velago.io. See also our Terms of Service.