Consumer Health Data Privacy Policy

This policy applies to consumer health data as that term is defined by the Washington My Health My Data Act (MHMD), the Nevada consumer health data law (SB 370) and the health-data provisions of the Connecticut Data Privacy Act. It also covers Virginia’s protection for reproductive and sexual health information.

It applies to you if you are a resident of Washington, Nevada, Connecticut or Virginia, and — because we would rather run one honest process than four — we extend the rights described in section 10 to every user in the United States, whichever state you live in.

Virginia. Virginia law protects reproductive and sexual health information. In Vita, that means your period record and your pregnancy details. We collect them only when you enter them or turn on period sync. Apart from the service providers in section 6.1, which process them for us only to answer you, we never disclose them to anyone without your consent.

This document sits alongside our Privacy Policy and does not replace it. It is published separately because MHMD requires a distinct link, and because health data deserves to be described in its own document rather than buried in section 14 of another one. Where this policy and the Privacy Policy differ on consumer health data, this policy governs.

MHMD defines consumer health data extremely broadly: personal information that is linked or reasonably linkable to a consumer and that identifies their past, present or future physical or mental health status. That includes inferences. In practice, for a service like ours, it means:

What you ask

The text or speech of a health question is itself health data. Asking about a symptom reveals that you have it, or fear you do.

What you store

Documents and photos you attach in a chat or keep in the vault — test results, letters, prescriptions, medicine boxes — and the labels you give them.

Who you ask about

The people you add, children included, and their ages, conditions and relationships to you. A parent's data is health data about the parent, not only about you.

What your phone sends

Readings and records from Apple Health or Health Connect that go with a question, Medicare claims if you connect Medicare, and, if you connect a hospital's patient portal, a short summary of those records with the lines a question is about.

What we infer

Anything the assistant derives from the above, including remembered facts, life-stage cohort, the topics you return to, and which details are missing from a profile.

Bodily functions and measurements

Anything you record about sleep, diet, exercise, pain, medicines, periods, pregnancy, or reproductive and sexual health.

We treat all of it as consumer health data. We do not run the exercise of arguing that a given field falls outside the definition.

We do not collect precise geolocation, contacts, advertising identifiers, or biometric identifiers. We do not read your photo library: we receive only the photos you choose to attach or scan. Face ID and Touch ID unlock the vault on your device; the biometric never leaves your phone and we never receive it.

• You, directly — everything you type, say, attach, scan or enter into a profile or a Vita card. This is most of it.
• Documents and photos you attach — lab reports, letters, prescriptions, and photos of medicine boxes.
• Apple Health, if you connect it — health metrics, and, if you also allow Health Records, the records your hospitals and clinics send to Apple Health: lab results, medications, immunizations, allergies, conditions, vital signs and procedures. They are read on your iPhone and kept there. A short digest goes with a question; we do not keep it as a record. From app version 3.6.3 a connection belongs to one Vita account: only that account’s own tap connects it, and Vita deletes its copy from the phone when you sign out or another account signs in. If you sign back in on that phone, Vita builds its copy again without asking; disconnecting takes that yes back.
• Apple’s Medications list — when you pick medicines “From Apple Health”, the ones you tick become entries in your medicines cabinet on our server.
• Period sync — when you turn it on, your period data from Apple Health or Health Connect.
• Health Connect on Android, if you connect it — health metrics, read on your phone in the same way. Android has no hospital records.
• Your vault, when you choose — if you let Vita learn from a vault document, a summary of it (findings, values, medicines, report text) becomes remembered facts (section 12).
• A family member — through a family link, we receive what they choose to share with you, under their control and revocable by them.
• Medicare, if you connect it — see section 4.1.
• A hospital or clinic, if you connect its patient portal — see section 4.2.
• Your device — app language, operating-system version, push token, time zone, and the short report described in section 3. We work out a country from your network connection, never from GPS.
• Your identity provider — if you sign in with Apple or Google, the email address and identifier they assert. If you use Apple Private Relay, we receive only the relay address.
• Your app store — the App Store or Google Play tells us that a subscription is active. They do not tell us your payment details and we never see them.

We do not buy consumer health data, we do not obtain it from data brokers, and we do not scrape it.

1. To answer the question you asked, in the language you asked it.
2. To store, index and show back the records you chose to keep, and to render a share you created for a clinician.
3. To keep answers consistent with what you have already told us, so you are not starting from zero every time.
4. To run the safety pipeline that stops the assistant diagnosing, prescribing, or missing a crisis signal.
5. To operate the account: sign-in, subscription status, reminders and notifications you have not turned off, and support you contacted us about. On an iPhone that has never been asked, the app from version 3.6.3 turns on Apple’s quiet notifications until you choose.
6. To keep the service secure and working — rate limits, abuse detection, error diagnosis.
7. To comply with a law that obliges us, or to establish or defend a legal claim.
8. If you said yes on the consent card (section 11), to show you one suggested next step in the app, such as a detail to add or a report to bring. Code picks it, from your profile, what you have done in the app and what your phone reports.
9. If you said yes on the consent card (section 11), to offer you a Vita plan inside the app. This looks at how many answers you have had, whether you reached the free limit, how many details Vita holds and whether a report is on file. It never looks at what a question or a report says.
10. If you said yes on the consent card (section 11), to keep the values an answer read from a report, and on a paid plan to compare them over time. On a paid plan your earlier values for the same tests go to our AI provider with a new report. Vita calls a value neither better nor worse, and it predicts nothing.

“Share” here means disclosure to another company, whether or not money changes hands. We share consumer health data only with service providers who process it on our written instructions, under a contract that forbids them using it for their own purposes, and only the minimum each one needs.

We have never sold consumer health data and we do not sell it now. “Sale” under MHMD is broad — it covers exchange for anything of value, not only money — and our answer covers that breadth.

MHMD requires a signed, specific valid authorization before any sale, separate from consent to collect. We have never sought one, we have no mechanism to collect one, and no revenue in our business depends on it. Our revenue is subscriptions, paid by users, and nothing else.

There is no advertising in VitaMedas. We run no advertising SDK, set no advertising cookie, and share no identifier with an ad network or measurement partner. We do not participate in cross-context behavioural advertising, and there is consequently nothing for you to opt out of.

We do not sell inferences drawn from your health data, and we do not disclose them to data brokers. We honour the Global Privacy Control signal as an opt-out where any state law gives it effect — see US State Privacy Rights.

MHMD makes it unlawful to operate a geofence around a facility that provides in-person health-care services in order to identify, track or advertise to people near it. Nevada prohibits the same.

VitaMedas operates no geofence of any kind. The app does not request precise location. Where we show a country-appropriate emergency number, we work it out on our server from the country on your account and the country your network connection comes from — never from device GPS. We store a country, not a location. Security records keep IP addresses for 30 days, to protect accounts.

You have the right to:

1. Confirm whether we are collecting, sharing or selling your consumer health data.
2. Access it, together with a list of every third party with which we have shared it and an active contact address for each. Section 6.1 is that list, published in advance.
3. Withdraw your consent to our collection and sharing of it.
4. Delete it, including from backups and from every processor that holds it for us.
5. Appeal if we refuse any of the above.
6. Not be discriminated against for exercising any of them. We will not degrade the service, change your price, or close your account because you asked.

We collect and share consumer health data only for the purposes listed in section 5, which are the purposes necessary to give you the service you asked for. For anything beyond that, MHMD requires separate, opt-in, unbundled consent, and we will ask for it in clear language at the moment it matters — never buried in a document like this one.

You may withdraw consent at any time by emailing privacy@vitamedas.com or by deleting your account in the app. Withdrawal is not retroactive: it stops future collection and sharing, and it does not by itself delete what we already hold. If you want deletion too, ask for both — or just say “delete everything” and we will treat that as both.

The consent card. From iPhone app version 3.6.3, saving what you tell Vita to a profile, keeping the values an answer read from a report, the suggested next step and plan offers inside the app need your own yes first. Changes from a chat and reading a document again come with the same yes, and they only happen when you ask. A new account is asked at sign-up, on its own screen right after the health-data consent, and a yes there starts at once. If your account is older, the card comes up the next time you open the app on or after 4 November 2026, and a yes starts at once, never before that date. Either way it is its own tap, separate from any terms, and nothing new happens for your account until you say yes. We keep your answer with where you gave it, the date, the version of the wording and the app’s language. A no keeps today’s Vita: those features stay off, and your answers, your records and your plan stay as they are. After a no on the consent card, it will not come up again within a month. After any no, a card on the Today screen says that personalization is off; it opens the consent card only if you tap it, and you can close it.

You can change your answer at any time with the Personalize Vita for me switch in Settings › Health-data consent, in one tap each way: turning it on is a yes, the same as on the card, and turning it off is a no that stops those features at once. If you turn it off with the switch, the consent card will not come up again on its own. You can also take a yes back by writing to privacy@vitamedas.com. A chat cannot turn it on or off. Withdrawing your consent to health data ends this yes too, and consenting again later does not bring it back.

If someone else added you. If another person keeps your details in their Vita account and you want them removed, write to privacy@vitamedas.com. We will check who you are, then remove your card, your saved details and the chats pinned to you from that account, without reading them. We cannot reach records kept on that person’s phone, words about you in their other chats, anything already shared or exported, or backups until they age out.

Files you put in the vault are encrypted on your device — in your browser or in the app — with a key only you hold, derived from your passphrase or kept on your device. We store ciphertext. We do not hold the key, and no employee, contractor, court order or subpoena can make us produce plaintext we do not have.

This is a mathematical property of the system, not a promise about our conduct. It also has a consequence you should understand: if you lose your passphrase and your recovery material, we cannot recover your files. For your rights above, unreadable data is still your data — we will confirm it exists, tell you what we hold, and delete it on request.

A vault file becomes readable in four cases, and each one starts with you:

• An AI description. If you ask for an AI description, summary or translation of a vault file, your device decrypts that one file and sends it through our server to the AI service in section 6.1. We keep only a fingerprint (a hash) of it.
• Letting Vita learn from a document. If you choose this, a summary of the document — findings, values, medicines, report text — is sent to the app server and stored there as readable remembered facts, like anything else you tell Vita.
• A doctor link. The records you choose become readable to whoever holds the link and its code, until it expires or you revoke it.
• Saving a chat attachment to your records. A document you first attached in a chat is already held by the app server in readable form (section 3). The sealed vault copy is an extra copy; it does not replace the readable one.

The conversational assistant is different and we will not blur the two: the questions you ask it are processed in plaintext, because a model cannot answer text it cannot read. Section 3 says exactly what that involves and section 6.1 says exactly who sees it.

VitaMedas is for adults. You must be 18 or older to hold an account. We do not knowingly collect consumer health data from anyone under 13, and the federal Children’s Online Privacy Protection Act rules for under-13s therefore do not arise in normal operation.

Adults do ask us about children in their care, and those answers are the point of the product. Data about a child — a profile, growth, vaccines, the daily log — is entered by the adult account holder, belongs to that account, and is deleted with it. If you believe a person under 18 has created an account, tell us at privacy@vitamedas.com and we will close it and delete the data. If you give Vita an age or birth date under 18 for yourself, in a chat or on your profile, Vita does not save it. We note only that it happened and how many times, with none of your words. Someone at VitaMedas reviews that note, and if the account belongs to a person under 18 we close it and delete its data.

We never sell the personal information of anyone, and so we never sell the personal information of a consumer under 16 — the case in which several state laws require opt-in consent.

If we change the categories of consumer health data we collect, the purposes we use it for, or the parties we share it with, we will update this page, change the version and effective date, and — because MHMD does not let us apply a new purpose to data already collected — obtain your consent before the new use begins. For material changes we email account holders at least 30 days beforehand.

VitaMedas, Inc.
2261 Market Street STE 69554
San Francisco, CA 94114
United States

Privacy requests: privacy@vitamedas.com
Appeals: legal@vitamedas.com