Cookie Policy

This Cookie Policy explains how VitaMedas (operated by VitaMedas, Inc., commercial name VitaMedas, 2261 Market Street STE 69554, San Francisco, CA 94114, United States) uses cookies and other client-side storage technologies on vitamedas.com, its sub-domains, and any native or web application that displays a link to this policy (collectively, the “Service”).

The Health records vault on vitamedas.com is zero-knowledge: your files are encrypted on your device and we cannot read them. We take the same minimal approach to cookies: we use the smallest number of cookies necessary to keep you signed in safely, to remember your language and theme, and to defend against cross-site request forgery. We do not use cookies to profile you, to retarget you with advertising, or to feed third-party analytics platforms.

For the purposes of this policy, “cookies and similar technologies” means any of the following:

HTTP cookies

Small text strings (name, value, attributes) that a server asks your browser to store and replay on subsequent requests. May be session (deleted when you close the browser) or persistent (deleted on an expiry date).

localStorage

Key-value storage scoped to the origin (vitamedas.com), persisted across browser sessions, accessible only to JavaScript running on the same origin. Capacity around 5–10 MB.

sessionStorage

Like localStorage but cleared when the tab is closed. We use it for a single flag that tells the page it is running inside our native mobile app.

The European ePrivacy Directive 2002/58/EC, as amended, and its national transpositions (and, in the UK, the Privacy and Electronic Communications Regulations) treat all of the technologies above the same way: storing or accessing information on a user’s terminal equipment is permitted only on the basis of strict necessity or informed consent.

We rely on the following legal bases under Article 5(3) of the ePrivacy Directive, Articles 6 and 13 GDPR, UK GDPR, and KVKK Articles 5 and 10:

• Strict necessity — for storage that is technically required to deliver a service that you have explicitly requested (e.g. signing in, keeping you signed in, defending against CSRF). No consent is required under Article 5(3) second sentence of the ePrivacy Directive.
• Consent — for any cookie or storage that is not strictly necessary, where consent has been obtained through a clear affirmative act before the storage is created or accessed. You can withdraw consent at any time using the Cookie settings link in the site footer and at the top of this Cookie Policy.
• Legitimate interests — Article 6(1)(f) GDPR is not used as a basis for cookies that are not strictly necessary on this Service, in line with EDPB Guidelines 2/2023.

VitaMedas places cookies and similar technologies in four categories. We declare each category openly even when we do not currently use it, so you have an unambiguous picture of what we do and do not do.

The following table lists every cookie and similar storage object the Service may set on your device. Items marked “conditional” are set only when the relevant feature is used.

We do not use any of the following:

• Canvas, WebGL, AudioContext, font-enumeration or device-sensor fingerprinting to identify users without cookies.
• Tracking pixels (1×1 GIFs, transparent images, beacon scripts) on the Service or in transactional email.
• ETag, cache-busting parameters, or HSTS “supercookies” used as identifiers.
• Cross-site identifiers, Federated Learning of Cohorts (FLoC), Topics API, FedCM ad measurement, or any other browser ad-relevance API.
• Session-replay tools (Hotjar, FullStory, LogRocket, Smartlook, etc.).

Cloudflare’s bot-management may derive aggregate signals from your TLS handshake, IP and user-agent for the sole purpose of telling a browser from a script. We do not receive or process those signals as fingerprints, and we do not combine them with anything else.

We try hard to avoid third-party cookies entirely. The only third-party cookies you may encounter on the production Service are Cloudflare’s bot-management cookies (__cf_bm, cf_clearance), which are necessary to deliver the Service at all. Cloudflare acts as our processor under a GDPR-compliant Data Processing Addendum and does not use these cookies for advertising.

When you sign in with Apple, Google, or Firebase Authentication, the sign-in pop-up may transiently set cookies on appleid.apple.com, accounts.google.com or related Google domains. Those cookies are set by Apple Inc. or Google LLC respectively, governed by their own cookie policies, and are outside VitaMedas’s control. VitaMedas never receives those cookies.

Several of the items in our inventory live in browser-side storage APIs (localStorage and sessionStorage) rather than in HTTP cookies. This is a deliberate design choice: it keeps zero-knowledge cryptographic state on the device and out of the network. It does not exempt those items from Article 5(3) of the ePrivacy Directive — we apply the same consent or strict-necessity rules as we do for cookies.

The Service does not use IndexedDB, Service Workers, the Cache Storage API, or any offline cache of your records. There is no offline mode: when you are not connected, your encrypted records are not available.

You can inspect and erase these stores yourself through your browser’s developer tools (Application or Storage tab), or by clearing site data for vitamedas.com in your browser settings.

You have several independent ways to refuse or remove our cookies.

Erasing vita.session.v1 from localStorage will lock the vault and force you to re-enter your passphrase on next use. The Service has no offline cache, so there is nothing further to erase for offline access.

Some browsers send a Do Not Track (DNT) header or a Global Privacy Control (GPC) signal. By default VitaMedas sets no advertising, analytics, or cross-context behavioural tracking storage at all, so a GPC signal has no additional non-essential storage to suppress: a visitor sending GPC and a visitor who has not is treated identically, with only strictly necessary storage in use unless you opt in otherwise. We do not sell or share personal data, so there is nothing for GPC to opt you out of.

VitaMedas, Inc. is a US company. Our servers are in Helsinki, Finland (EU). We serve users in the United States, Canada, the European Economic Area, the United Kingdom, Switzerland and other countries. We comply with:

• ePrivacy Directive 2002/58/EC as amended, Article 5(3) (EU);
• GDPR (Regulation (EU) 2016/679), Articles 6, 7 and 13;
• UK GDPR and the Privacy and Electronic Communications Regulations (PECR) 2003;
• the California Consumer Privacy Act (CCPA/CPRA) for users in California, and equivalent US state laws where applicable;
• KVKK No. 6698 (Türkiye), Articles 5, 10 and 12, and BTK secondary legislation on electronic communications, the Brazilian LGPD, and equivalent instruments where applicable.

We may update this Cookie Policy from time to time to reflect new cookies, new technologies, or regulatory changes. The version number and effective date at the top of this page always reflect the current text. Material changes (any new category, any new sub-processor that places cookies, any change in retention) will be announced in-product and, for account holders, by email at least thirty (30) days before they take effect. Continued use of the Service after an update constitutes acceptance of the updated policy to the extent permitted by applicable law.

Questions about cookies should be sent to privacy@vitamedas.com. You may also lodge a complaint with your local data-protection authority:

• EU/EEA — your national supervisory authority (list at edpb.europa.eu/about-edpb/board/members_en).
• United Kingdom — Information Commissioner’s Office, ico.org.uk.
• Türkiye — Kişisel Verileri Koruma Kurumu (KVKK), kvkk.gov.tr.

This Cookie Policy is governed by the laws of the State of Delaware, United States, without prejudice to any mandatory consumer-protection rights you have in your country of habitual residence. The English version of this document is the binding version; any translation is provided for convenience only.