Acceptable Use Policy

This Acceptable Use Policy (the “AUP”) governs your use of VitaMedas, operated by VitaMedas, Inc. (commercial name VitaMedas), 2261 Market Street STE 69554, San Francisco, CA 94114, United States (“VitaMedas”, “we”, “us”). It is incorporated by reference into our Terms of Service. By accessing or using the Service you agree to comply with this AUP. Violations may result in suspension or termination of your account and, where appropriate, referral to law enforcement.

Files in the Health records vault are zero-knowledge: they are encrypted on your device and we are technically incapable of reading them. (What you send the Vita assistant is different — it has to read your question to answer it; see the Privacy Policy.) Even for the vault, the abuse vectors we can observe (account-level metadata, payment fraud, share patterns, abuse reports, public-facing pages) are still actionable, and this AUP is how we govern them.

User

Any natural or legal person who registers for, accesses or otherwise uses the Service, whether as a free or paying customer, on the consumer app, the clinician portal or any embedded SDK.

Content

Any data, file, text, image, document, audio, video, structured medical record, metadata, comment, share message or other material that a User uploads to, generates within, or transmits through the Service.

Platform

The VitaMedas website (vitamedas.com and sub-domains), the iOS and watchOS applications, the clinician sub-portal, all backend APIs, any official VitaMedas mobile, desktop or browser client, and any future channel through which the Service is delivered.

Account

The credentialled identity through which a User authenticates to the Platform, including consumer accounts, clinician accounts, child / guardian accounts, and B2B sub-accounts created under a Master Subscription Agreement.

Abuse

Any breach of this AUP, applicable law, the Terms of Service, the Data Processing Agreement (where applicable), or the Medical Disclaimer.

This AUP applies to every User of the Service, regardless of jurisdiction. Where local law imposes stricter requirements than this AUP (for example mandatory take-down deadlines under the EU Digital Services Act, Regulation (EU) 2022/2065, or a take-down or access-blocking order issued by a competent authority in the country where you are), the stricter requirement prevails.

You may not upload, store, share, transmit, link to, or otherwise make available through the Service any Content that:

1. Is unlawful under United States federal or state law, or under the law of the country where you are. Including (without limitation) child sexual abuse material, obscenity directed at minors, gambling facilitation, prostitution facilitation, suicide encouragement, and any other content for which a court of competent jurisdiction has issued a removal or access-blocking order that binds us.
2. Constitutes child sexual abuse material (CSAM) in any form, regardless of jurisdiction. Detection of such material results in immediate account termination, preservation of all evidence available to us, reporting to the National Center for Missing & Exploited Children (NCMEC) as required of United States providers by 18 U.S.C. § 2258A, onward reporting to INHOPE network partners and to the competent authorities of the country where the User or victim is located, and a permanent ban from the Service. There is no appeal.
3. Promotes, glorifies, finances or facilitates terrorism within the meaning of 18 U.S.C. § 2339A–B, Regulation (EU) 2021/784 on addressing the dissemination of terrorist content online, or the UK Terrorism Act 2000.
4. Incites violence, hatred or discrimination against any individual or group on the basis of race, ethnicity, religion, sex, gender identity, sexual orientation, disability, age, nationality or any other protected characteristic.
5. Infringes third-party intellectual-property rights, including copyright, trademark, patent or trade-secret rights, and content posted in breach of a confidentiality obligation.
6. Was obtained, recorded or uploaded without lawful basis. In particular, patient records, lab results, imaging, prescription data or clinician notes that pertain to an identifiable natural person other than the User, where the User does not hold either (a) the express consent of that person within the meaning of GDPR Article 9(2)(a) / KVKK Article 6, or (b) another lawful basis recognised under GDPR Article 9(2)(c)–(j) / KVKK Article 6(3) (typically Article 9(2)(h) for medical purposes carried out under the responsibility of a professional subject to a duty of professional secrecy).
7. Is a deepfake, forgery or other synthetic medical artefact presented as a genuine record, including AI-generated lab results, fabricated prescriptions, falsified radiology, or any document forged to defraud an insurer, employer or government.
8. Is malware, ransomware, a phishing kit, an exploit payload, a credential dump, or any code designed to compromise a system or another User.
9. Doxxes, threatens, harasses or stalks any person, or contains non-consensual intimate imagery.
10. Violates export-control or sanctions law, including EU Council Regulation (EU) 2024/1745 and equivalents in the United States, the United Kingdom and Turkey.

You may not, and you may not permit any third party to:

1. Scrape, crawl, harvest or extract any portion of the Platform or any data accessible through it, by automated or manual means, except via APIs we have expressly published for that purpose and within their documented rate limits.
2. Reverse engineer, decompile or disassemble any part of the Platform, except — and strictly to the extent — permitted by Article 6 of Directive 2009/24/EC on the legal protection of computer programs (interoperability with an independently created program), Article 5(3) of the same Directive (observing, studying and testing), or the equivalent non-waivable provisions of your local law. You must give us at least thirty (30) days’ written notice at legal@vitamedas.com before relying on this exception, and you must publish or use the resulting information only for the lawful interoperability purpose.
3. Bypass, disable, circumvent or stress-test any authentication, rate limiting, anti-abuse, anti-fraud, billing, cryptographic, watermarking or DRM mechanism, except as part of a security-research disclosure authorised under Section 7 below.
4. Mount a denial-of-service attack against the Platform or against any User of the Platform, including volumetric, protocol-layer or application-layer attacks, and including coordinated test traffic that we have not pre-approved in writing.
5. Share, sell, rent, sub-licence or otherwise transfer Account credentials (including passwords, recovery codes, OAuth tokens, API keys, share tokens and master vault keys) to any other person. Each Account is personal.
6. Attempt to identify, contact, profile, deanonymise or link records to any other User outside of an explicit, User-authorised sharing flow.
7. Perform automated mass uploads from a single account, including bulk-importing third-party medical records or mirroring a hospital information system into a consumer account. Bulk import is available only under a signed B2B Master Subscription Agreement and DPA.
8. Use the Service to operate a clinic, telehealth service, insurance broker, employer-screening pipeline or other regulated business without a written agreement with VitaMedas authorising that use.
9. Imitate VitaMedas, our staff, our doctors, any government body, or any other person; or send communications designed to look like they come from VitaMedas.
10. Falsify, conceal or remove any audit trail, metadata, cryptographic signature, watermark or notice on Content or on the Platform.
11. Use the Service in a manner that violates any applicable law or regulation, including healthcare, consumer-protection, data-protection, electronic-communications, tax, AML/KYC, sanctions or anti-corruption law.
12. Use VitaMedas as a Medical Device within the meaning of Regulation (EU) 2017/745 (MDR) or the Turkish Tıbbi Cihaz Yönetmeliği, e.g. by relying on VitaMedas outputs to make diagnostic, screening or treatment decisions for patients. The Service is a Personal Health Record and is expressly disclaimed as a medical device — see our Medical Disclaimer.

This Section 6 applies to any User who uploads, shares, imports, forwards or otherwise causes to be processed on the Platform any health-related Content concerning an identifiable natural person other than the User. It applies whether the User is a licensed physician, a clinic, a hospital, an allied health professional, a legal guardian, a family caregiver or any other person acting on behalf of a data subject.

By performing any such upload you represent, warrant and covenant to VitaMedas that:

1. you hold a valid lawful basis for the processing under GDPR Article 9(2) (typically (a) explicit consent, (c) vital interests, or (h) medical purposes carried out under the responsibility of a professional subject to a duty of professional secrecy) or the equivalent provision of UK GDPR;
2. you hold a valid lawful basis under KVKK Article 6 for the processing of special-category personal data in Turkey, including (where applicable) explicit consent under Article 6(2) or processing by a person under a duty of confidentiality for the protection of public health, preventive medicine, medical diagnosis or the carrying out of medical treatment under Article 6(3);
3. you have provided the data subject with all information required under GDPR Articles 13 and 14 and KVKK Article 10, including notice that the data will be stored in VitaMedas’s zero-knowledge vault and may be transferred to processors located outside the European Economic Area and Turkey;
4. you act as a controller in respect of that Content and VitaMedas acts as processor; the parties shall execute a Data Processing Agreement under Article 28 GDPR / Article 12 KVKK before any production use;
5. you maintain at all times the technical and organisational measures required by GDPR Article 32 / KVKK Article 12 on your side, including secure credential handling and timely notification of breaches on your side;
6. you will respond to data-subject access, rectification, erasure, restriction, portability and objection requests on your records within the statutory deadlines and will use the Service’s export and erasure tools to give effect to them;
7. you will defend, indemnify and hold harmless VitaMedas, VitaMedas, Inc. and their officers, directors, employees, agents, contractors and sub-processors from and against any and all claims, regulatory fines, administrative penalties, awards, settlements, costs and reasonable attorneys’ fees arising from or relating to a breach of the warranties in this Section 6, including claims by data subjects and enforcement actions by supervisory authorities.

We welcome good-faith security research and we will not pursue legal action against researchers who comply with our Responsible Disclosure terms. To qualify you must:

• test only on accounts you own or are explicitly authorised to test;
• avoid any technique that degrades the Service for other users (volumetric attacks, social engineering of staff, physical attacks on Hetzner data centres, attacks on our sub-processors);
• never access, modify, destroy or exfiltrate data belonging to another User, even if you could;
• give us a reasonable period (default ninety (90) days) to remediate before any public disclosure;
• report findings to security@vitamedas.com, encrypting sensitive details with our published PGP key.

Activity outside these limits is not authorised security research and may constitute an offence under, among others, the US Computer Fraud and Abuse Act (18 U.S.C. § 1030), the EU Cybercrime Directive 2013/40/EU, and the UK Computer Misuse Act 1990.

We expose programmatic interfaces only where we have documented them. You may not call undocumented endpoints, replay or replicate internal browser requests at scale, or use any technique that presents non-browser traffic as browser traffic. Rate limits are published in the developer documentation; persistent overrun is treated as abuse.

AI agents, LLM-driven assistants and similar automation are permitted only when (a) the agent is operating on behalf of the Account holder, (b) the agent identifies itself in the User-Agent header, and (c) the agent does not bypass any consent dialog, confirmation step or sharing flow. Agents that impersonate a human User are prohibited.

If you believe Content on the Platform breaches this AUP or applicable law, please send a Notice and Action notification under Article 16 of the EU Digital Services Act (Regulation (EU) 2022/2065) to abuse@vitamedas.com. Your notification should include:

1. a sufficiently substantiated explanation of why you allege the Content is illegal or violates this AUP;
2. a clear indication of the exact electronic location of the Content (share URL, account handle, message identifier);
3. your name and email (you may request that we treat your identity confidentially in any onward communication with the uploader, except where law-enforcement disclosure is required);
4. a good-faith statement that the information in the notification is accurate and complete.

We will acknowledge receipt without undue delay, take the action we deem appropriate (which may range from no action to immediate removal), and inform you of our decision and the reasons for it.

VitaMedas may, in its sole discretion and without prior notice, take any of the following actions in response to suspected or confirmed Abuse. The ladder is illustrative — we are free to skip steps where the violation is serious, criminal or ongoing.

1. Warning — an in-product or email warning describing the breach and the required corrective action.
2. Feature throttling — disabling sharing, AI features, export, or other specific functionality.
3. Content removal — disabling access to the offending Content. For files in the Health records vault, which we cannot read, “removal” typically takes the form of revoking shares, sealing the ciphertext from further reads and preserving an evidentiary copy under cryptographic seal pending investigation or legal process. We do not need to decrypt the file to take this action. Other Content is removed from our systems.
4. Account suspension — temporary block on sign-in and on all functionality for the Account and any associated Accounts (shared devices, paired clinicians, child accounts under guardianship), without refund where the suspension is attributable to your breach.
5. Account termination — permanent closure of the Account, irreversible deletion of associated data subject to statutory retention (see Data Retention Policy), and ban on re-registration from the same identifiers (email, phone, payment instrument, device).
6. Referral to authorities — disclosure of relevant information to United States or foreign law-enforcement, regulators (the FTC, state attorneys general, and data-protection supervisory authorities including the Turkish KVKK), tax authorities, and where the matter concerns the safety of a child, INHOPE-network hotlines and NCMEC, in accordance with Section 11 below.

We respond to lawful requests for information from government and law-enforcement agencies, but we treat every request with the scepticism that protects our Users.

If we take an enforcement action against your Account that you believe was made in error, you may appeal by emailing legal@vitamedas.com within thirty (30) days of the action. Your appeal must identify the affected Account, the specific action you are contesting, and the facts and legal arguments on which you rely. VitaMedas will review the appeal and respond within a reasonable period; the decision on appeal is final and binding as between you and VitaMedas. Nothing in this Section limits any non-waivable right of action you may have under your local consumer-protection or data-protection law (e.g. complaints to KVKK, Tüketici Hakem Heyeti under Law 6502, or the supervisory authority of your habitual residence).

VitaMedas shall not be liable for, and shall not be deemed in breach of this AUP or our Terms by reason of, any failure or delay in performance caused by circumstances beyond our reasonable control, including but not limited to: acts of God; natural disasters (earthquakes, in particular those affecting the regions hosting our infrastructure); pandemics; war (declared or undeclared), terrorism, civil unrest, insurrection or sabotage; governmental actions, embargoes, sanctions, censorship, internet shutdowns, court orders or BTK directives; cyber attacks on VitaMedas, on our sub-processors (including Hetzner, Cloudflare, Google, Apple, Microsoft, MXroute), or on the underlying internet; power-grid failures; submarine-cable cuts; strikes, lockouts, and shortages of labour, equipment, fuel or essential inputs; and any other event that a reasonable person would consider beyond our control. During such an event we may suspend, modify or terminate affected portions of the Service without liability.

To the maximum extent permitted by applicable law, the Service is provided “AS IS” and “AS AVAILABLE”, without warranties of any kind, whether express, implied, statutory or otherwise, including (without limitation) implied warranties of merchantability, fitness for a particular purpose, title, non-infringement, accuracy, completeness, uninterrupted access, freedom from defects or absence of viruses. VitaMedas does not warrant that the Service will meet your requirements, that access will be timely, secure, error-free or uninterrupted, or that any defect will be corrected. Mandatory consumer-protection rights under Tüketici Kanunu No. 6502 and equivalent EU/UK regimes are unaffected.

You shall defend, indemnify and hold harmless VitaMedas, VitaMedas, Inc. and their officers, directors, employees, agents, contractors and sub-processors from and against any and all third-party claims, losses, damages, liabilities, regulatory fines, penalties, costs and reasonable legal fees arising out of or relating to: (a) your Content; (b) your breach of this AUP, the Terms of Service, the Data Processing Agreement or applicable law; (c) your warranties under Section 6; or (d) your wilful or negligent acts or omissions. This Section 15 survives termination of your Account.

VitaMedas may amend this AUP from time to time to reflect new abuse patterns, new regulatory requirements (in particular under the DSA, the AI Act, Law 5651 and KVKK secondary legislation), or new product capabilities. The version and effective date at the top of this page always reflect the current text. Material changes are announced in-product and, for account holders, by email at least thirty (30) days before they take effect. Continued use of the Service after the effective date constitutes acceptance of the updated AUP.

Questions, abuse reports and appeals:

• General legal: legal@vitamedas.com
• Abuse reports / Notice and Action: abuse@vitamedas.com
• Security disclosures: security@vitamedas.com
• Law-enforcement requests: legal@vitamedas.com

This AUP is governed by the laws of the State of Delaware, United States, without prejudice to any mandatory consumer-protection rights you have in your country of habitual residence. The state and federal courts located in the State of Delaware shall have non-exclusive jurisdiction. The English version of this document is the binding version; any translation is provided for convenience only.