GDPR Art. 5(1)(e) + Art. 17 · UK GDPR · KVKK Art. 7

Data Retention Policy

Version: v2.5
Effective: 4 November 2026
Binding language: English

1Purpose and scope

This Data Retention Policy applies to all personal data processed by VitaMedas in connection with the Vita app (iPhone, Apple Watch and Android), vitamedas.com (the Health records vault, doctor links and intake links), and any API that forms part of them (together, the “Service”). It satisfies the storage-limitation principle in Article 5(1)(e) GDPR and UK GDPR, and the corresponding obligations under Article 4(2) and Article 7 KVKK to delete, destroy or anonymise personal data when the lawful grounds for processing cease to exist.

It applies to data VitaMedas processes as a controller (the Vita app, account, billing, support, security and product data) and to data VitaMedas processes as a processor on behalf of Customers (vault ciphertext, share tokens, intake payloads). For data processed as processor, any conflicting written instruction issued by the relevant controller under the Data Processing Agreement takes precedence, save where it would breach applicable law.

Our servers are in Helsinki, Finland (EU), with Hetzner Online GmbH. Backups stay on the same host.

2Retention principles

Three principles drive every retention decision VitaMedas makes:

Necessity. Personal data is retained only for as long as it is necessary to fulfil a specific, documented purpose. A new purpose does not automatically extend retention — it requires a fresh lawful basis under Article 6 or Article 9 GDPR (or the KVKK equivalents in Article 5 and Article 6).
Minimum legal viability. Where a legal obligation requires retention beyond the operational need, VitaMedas retains the minimum data necessary for the minimum period required and ring-fences it from further use.
You decide how long your health data stays. Health data in the Vita app and in the vault stays until you delete it or your account. We do not keep it after that, except in backups that roll off on a fixed schedule.

3Retention schedule

The tables in this Section are authoritative. Where a category of data is not listed, it is kept no longer than your account and is deleted with it.

3.1Vita app: your conversations and health records

Our app server can read this data. That is how the assistant answers. See the Security Statement for how it is protected.

Data	Retention	Trigger to delete	Legal basis
Conversations: your questions, Vita's answers, voice transcripts, conversation titles	Until you delete the conversation or your account	Your deletion; account deletion	GDPR Art. 6(1)(b) contract + Art. 9(2)(a) explicit consent
Documents and photos attached in chat (stored encrypted with a key our server holds)	Until you delete the conversation or your account	Your deletion; account deletion	GDPR Art. 6(1)(b) contract + Art. 9(2)(a) explicit consent
Filed copies of documents for a person, and their written summaries	Until you delete the filed item, the person, or your account	Your deletion; account deletion	GDPR Art. 6(1)(b) contract + Art. 9(2)(a) explicit consent
Vita's memory: facts remembered about you and each person you add	Until you delete the fact, the person, or your account	Your deletion; account deletion	GDPR Art. 6(1)(b) contract + Art. 9(2)(a) explicit consent
People and profiles: name or nickname, age or birth date, sex, height, weight, blood type, relationship, conditions, allergies, medicines, family history, smoking, alcohol, exercise and diet, notes, pregnancy, care team and guidance notes	Until you delete the person or your account. Deleting a person also removes their medicines, reminders and filed documents. Chats about them stay until you delete those chats	Your deletion; account deletion	GDPR Art. 6(1)(b) contract + Art. 9(2)(a) explicit consent
Details you state in a chat and saved to a profile (weight, height, birth date or age with the day you said it, sex, blood type, allergies, long-term conditions, medicines)	Same as the profile they were saved to	Your change or deletion; deleting the person; account deletion	GDPR Art. 6(1)(b) contract + Art. 9(2)(a) explicit consent
Children's records: growth, feeding, sleep and daily log, fever episodes, milestones, vaccines	Until you delete the entry, the child's profile, or your account	Your deletion; account deletion	GDPR Art. 6(1)(b) contract + Art. 9(2)(a) explicit consent
Medicines: medicines, schedules, doses ticked, supply; photos of medicine boxes or prescriptions scanned to add them	Until you delete the medicine, the person or your account	Your deletion; account deletion	GDPR Art. 6(1)(b) contract + Art. 9(2)(a) explicit consent
Period tracker: logged days, flow, symptoms, settings	Until you delete the entries, the person or your account	Your deletion; account deletion	GDPR Art. 6(1)(b) contract + Art. 9(2)(a) explicit consent
Doctor visit pages and doctor summaries you create	Until you delete them or your account	Your deletion; account deletion	GDPR Art. 6(1)(b) contract + Art. 9(2)(a) explicit consent
Family links: what you chose to share with a family member	Until you end the link or delete your account	Ending the link; account deletion	GDPR Art. 6(1)(b) contract + Art. 9(2)(a) explicit consent
Safety signals: whether a message triggered the emergency or crisis check	No longer than your account	Account deletion	GDPR Art. 6(1)(f) + Art. 9(2)(a) — safety of the service
Your numbers over time: each value an answer read from a report, with the test's name as printed, its unit, the printed range, any high or low mark and the date printed on the report if there is one	Until you delete the conversation, the document, the person or your account. Reading a report again replaces its values. If you take back your yes on the consent card, no new values are saved and those already saved stay until you delete them	Your deletion; account deletion	GDPR Art. 6(1)(b) contract + Art. 9(2)(a) explicit consent
Ratings of answers, with any note you write	Until you delete the conversation, the person it was about, or your account	Your deletion; account deletion	GDPR Art. 6(1)(b) contract + Art. 9(2)(a) explicit consent
Next-step log: which suggested steps were offered, shown, answered or turned down, the time, and when an answer read a document (its ID, not its content)	400 days (about 13 months), so a yearly step is not repeated. A document's ID leaves the log when you delete the document or its conversation. A step you turned down twice can be offered once more after that time	Rolling deletion; account deletion	GDPR Art. 6(1)(b) contract + Art. 9(2)(a) explicit consent
Log of changes made from a chat: what was asked, the value before it and when. It can hold health details, such as an earlier allergy entry or a fact you asked Vita to forget	What was asked and the value before it: cleared within about 30 hours, once the 24 hours of Undo end, whether or not you used Undo. The rest of the line, which shows that a change happened and when: 400 days	Rolling deletion; deleting the person or the conversation; account deletion	GDPR Art. 6(1)(b) contract + Art. 9(2)(a) explicit consent
Apple Health or Health Connect readings quoted in a saved answer, or sent as the text of an "Explain my results" question	Saved as part of that question or answer	Same as the conversation	GDPR Art. 6(1)(b) contract + Art. 9(2)(a) explicit consent

3.2Kept only on your phone

Data	Where it is kept	What reaches our servers	Legal basis
Apple Health records and metrics (labs, medications, immunizations, allergies, conditions, vitals, procedures, sleep, steps); Health Connect metrics on Android	Only on your phone, in a sealed file. Not stored on our servers. From iPhone app version 3.6.3 it belongs to one Vita account: Vita deletes its copy and summary from the phone when you sign out, when another account signs in, and when you disconnect. Signing back in builds the copy again.	A short summary goes with a question so Vita can answer it. It is processed for that answer and not stored as a record. Medicines you pick from Apple Health become medicine entries (3.1) only when you tick them.	GDPR Art. 9(2)(a) — explicit consent
Fertility signals from the period tracker	Only on your phone	Nothing	GDPR Art. 9(2)(a) — explicit consent
Hospital and clinic records (US accounts, if you connect a hospital)	Only on your phone, in a sealed file; the sign-in tokens, a short summary and a searchable list of the record stay in your phone's secure storage, so a question can use them without Face ID. Deleted when you choose that on disconnecting, when you delete the person in Vita, when you sign out or switch account, and when you delete your account.	A short summary goes with a question, as with Apple Health. An answer that quotes it is saved with your conversation, and Vita can remember a short fact from that answer. You can delete both.	GDPR Art. 9(2)(a) — explicit consent
Medicare claims summary (when available, if you connect Medicare)	Only on your phone	Our server holds only the access tokens Medicare issues, for up to 13 months, then you must reconnect. Disconnecting revokes them at Medicare and deletes them; the copy on your phone is deleted at the same time. A short summary goes with a question, as with Apple Health.	GDPR Art. 9(2)(a) — explicit consent

3.3Account-level data

Data	Retention	Trigger to delete	Legal basis
Profile and settings: email, sign-in method, display name, language, home country and the country you connect from, time-zone offset, notification settings	Life of account	Account deletion	GDPR Art. 6(1)(b) — contract
Device push token	Until it changes or you delete your account	Token change; account deletion	GDPR Art. 6(1)(b)
The latest report from your phone: whether Apple Health and a hospital are connected, whether notifications are allowed, whether Apple Health holds your height and weight. No health values and no hospital name	One row, replaced by the next report, until you delete your account	Next report; account deletion	GDPR Art. 6(1)(b) contract + Art. 9(2)(a) explicit consent
Plan and subscription status (from the App Store or Google Play)	Life of account	Account deletion	GDPR Art. 6(1)(b)
Records of purchases and refunds	7 years	Statutory retention period elapses	26 U.S.C. § 6001 and 26 C.F.R. § 1.6001-1 — US tax books and records
Marketing email choice: yes or no, when, how and from which country you made it	Life of account	Account deletion	GDPR Art. 7(1) — proof of consent
Your answer on the consent card or the Personalize Vita for me switch: yes or no, where you gave it, the date, the version of the wording and the app's language	Life of account	Account deletion	GDPR Art. 7(1) — proof of consent

3.4Sign-in and security records

Data	Retention	Trigger to delete	Legal basis
Sign-in identifiers (Apple, Google or email account, via Firebase)	Life of account	Account deletion	GDPR Art. 6(1)(b)
Vault recovery factors (passkey and recovery-share wrappings; all encrypted, unreadable to us)	Life of account	Your removal; account deletion	GDPR Art. 6(1)(b); Art. 32 — security
Security events in the Vita app (IP address, device, refused sign-ins, records requested that were not yours)	30 days	Rolling deletion	GDPR Art. 6(1)(f) — security
Wrong access-code attempts on doctor, intake and emergency links (vitamedas.com)	7 days	Rolling deletion	GDPR Art. 6(1)(f) — security

3.5Encrypted vault files

Data	Retention	Trigger to delete	Legal basis
Ciphertext blobs (XChaCha20-Poly1305)	Until you delete the file or your account	Your deletion (immediate); account deletion	GDPR Art. 6(1)(b)
Object-level metadata (content-type hint, size, label hash)	Same as parent blob	Same as parent blob	GDPR Art. 6(1)(b)
EXIF / DICOM headers	Stripped client-side prior to upload where possible; otherwise stored as part of ciphertext	Same as parent blob	Privacy by design — Art. 25 GDPR
AI description of a vault file you asked for	We keep only a hash of the file sent	Account deletion	GDPR Art. 9(2)(a)

Vault files are encrypted on your device. We cannot read them. Deleting a vault file removes the encrypted object, its metadata and its wrapped keys from primary storage.

If you let Vita learn from a vault document, a summary of it is stored on the app server as readable facts. Those facts follow Section 3.1 (Vita’s memory), not this Section.

3.6Wrapped keys

Data	Retention	Trigger to delete	Legal basis
Per-file data-encryption keys, wrapped by your key	Same as parent ciphertext	Same as parent ciphertext	GDPR Art. 32 — security
Your public keys (X25519, libsodium sealed_box)	Life of account	Account deletion	GDPR Art. 6(1)(b)
Keys sealed for a doctor link or a family delegate	Until the link expires, you revoke it, or you delete your account	Expiry, revocation or account deletion	GDPR Art. 6(1)(b)

3.7Doctor links

Data	Retention	Trigger to delete	Legal basis
Doctor link (encrypted bundle, hashed access code)	Until the expiry date set when the link is made, or until you revoke it	Expiry or revocation; account deletion	GDPR Art. 6(1)(b)
Link access records (when it was opened, the name the viewer gave, hashed IP address and browser)	No longer than your account	Account deletion	GDPR Art. 6(1)(f) — audit and dispute resolution
Viewer unlock cookie	8 hours	Expiry	GDPR Art. 6(1)(b)

3.8Intake links

An intake link lets a clinic or another person upload files into your vault. The files are encrypted before they reach us.

Data	Retention	Trigger to delete	Legal basis
Intake link and its label	Until it expires or you revoke it	Expiry, revocation or account deletion	GDPR Art. 6(1)(b)
Files received through the link	Join your vault and follow Section 3.5	Per 3.5	Per 3.5

3.9Audit logs

Data	Retention	Trigger to delete	Legal basis
Vault audit log — what happened in your vault, when (no content)	Life of account	Account deletion	GDPR Art. 6(1)(f) — accountability under Art. 5(2)
Rekor anchor — one signed hash per hour covering new vault audit entries	Indefinite (public transparency log; not personal data)	n/a	GDPR Recital 26 — no identifiable information
Our own audit log — actions by our team and systems, including every time a team member opens a person's health data	5 years, without content	Time elapses	GDPR Art. 6(1)(c) + 6(1)(f) — legal obligation and accountability under Art. 5(2)

3.10Logs and diagnostics

Data	Retention	Trigger to delete	Legal basis
Server logs (IP address, request, status, browser or app)	Up to 30 days	Rolling deletion	GDPR Art. 6(1)(f) — operating and securing the service
App diagnostics linked to your account (error reports, app health checks such as device model and security checks, session times)	Currently kept while your account exists	Account deletion	GDPR Art. 6(1)(f) — finding and fixing faults
App analytics in Google Analytics for Firebase, only if you allowed analytics in the app	Held by Google under our Google Analytics retention setting	Turning analytics off stops collection	GDPR Art. 6(1)(a) — consent
Visit counts on vitamedas.com (page, step, language; no user ID, no IP address stored)	Kept as counts	n/a — not personal data	GDPR Recital 26
PDFs, and images over 9 MB, held by Google's file service so Gemini can read them	About 48 hours	Deleted by Google	GDPR Art. 6(1)(b) contract + Art. 9(2)(a) explicit consent

3.11Backups

The Vita app database is backed up as a full, compressed copy. We keep one copy a day for 30 days, on the same host in Finland, and we can make an extra copy just before a software change. All of them are removed within 35 days, so something you delete can remain in a backup for up to 35 days. Any copy of the vitamedas.com server's vault database and encrypted vault files stays on the same host, holds vault ciphertext only, and is removed within 35 days. We do not delete single items from inside a backup, save where a valid order from a competent authority requires it.

Data	Retention	Trigger to delete	Legal basis
Vita app database backups (one a day for 30 days, and any extra copy made before a software change)	Up to 35 days	Rotation	GDPR Art. 32(1)(c) — resilience
Any copy of the vault server (ciphertext and vault database)	Up to 35 days	Removal within 35 days	GDPR Art. 32(1)(c) — resilience

3.12Short-lived tokens

Data	Retention	Trigger to delete	Legal basis
Sign-in link (magic link) token	15 minutes on vitamedas.com; 30 minutes for the Vita app	Use or expiry	GDPR Art. 6(1)(b)
Password-reset link token	1 hour	Use or expiry	GDPR Art. 6(1)(b)
App session cookie (tai_session) and CSRF token (tai_csrf)	14 days	Sign-out or expiry	GDPR Art. 6(1)(b); Art. 32 — security
vitamedas.com session cookie (vita_session) and CSRF token (vita_csrf)	90 days	Sign-out or expiry	GDPR Art. 6(1)(b); Art. 32 — security

3.13Cookie consent records

Data	Retention	Trigger to delete	Legal basis
Record of consent / refusal of optional cookies (including timestamp, version of banner, set of categories accepted)	2 years	Time elapses or new consent given (older record archived)	GDPR Art. 7(1) — proof of consent; ePrivacy Directive Art. 5(3)

3.14Support correspondence

Data	Retention	Trigger to delete	Legal basis
Support emails to support@, hello@, privacy@, security@, legal@ and replies	3 years	Time elapses	10 Del. C. § 8106 — 3-year limitation period for contract claims; GDPR Art. 6(1)(c) and 6(1)(f)
Bug-report attachments where supplied by user	1 year	Time elapses	GDPR Art. 6(1)(f) — legitimate interest in product quality

4Controller-vs-processor: how the schedule applies

The same data category may be subject to different retention rules depending on whether VitaMedas is the controller or merely a processor for that data. The table below makes that explicit.

Category	VitaMedas acts as	Whose retention rule applies
Vita app data (conversations, documents, memory, people, medicines, period data, visit pages)	Controller	This Policy, Section 3.1
Customer account profile (admin user of a hospital tenant)	Controller	This Policy, Section 3.3
End-user patient profile (a VitaMedas direct consumer)	Controller	This Policy, Section 3.3
End-user patient profile (a patient onboarded by a hospital Customer)	Processor for the Customer; Controller for the corresponding account credentials	The Customer's retention rules govern the clinical ciphertext; this Policy governs the credentials
Ciphertext blobs uploaded by an end-user direct consumer	Controller of the metadata; technically unable to read content	This Policy, Section 3.5
Ciphertext blobs uploaded by a hospital intake API	Processor	Customer's retention rules under the DPA; this Policy serves as default where the Customer is silent
Audit-log entries	Controller (own accountability obligation under Art. 5(2) GDPR)	This Policy, Section 3.9 — applies irrespective of the underlying data
Logs and diagnostics	Controller	This Policy, Section 3.10
Support emails received at support@ / hello@ / privacy@ / security@ / legal@	Controller of the inbox; processor where the email contains clinical context attached by a Customer	This Policy, Section 3.14 — for the inbox itself

Where VitaMedas acts as processor, no retention rule in this Policy overrides a contrary written instruction from the relevant Controller given under the Data Processing Agreement, save where giving effect to that instruction would breach applicable law.

5Legal-hold override

Notwithstanding any retention period stated in this Policy, VitaMedas may retain personal data for longer where, and only for so long as:

compelled by a valid order of a competent United States court or, in respect of data subject to the law of another jurisdiction, by a valid order of a competent court or supervisory authority of that jurisdiction;
preservation is necessary for the establishment, exercise or defence of legal claims (Article 17(3)(e) GDPR);
preservation is required by a specific statutory obligation, including without limitation 26 U.S.C. § 6001 (US tax books and records) and applicable health-sector record-keeping rules.

A documented legal hold is recorded in the VitaMedas legal-hold register; held data is segregated from live operational systems and is not used for any purpose other than satisfying the hold. Holds are reviewed quarterly and lifted as soon as the basis for the hold ceases.

6Right to erasure (Art. 17 GDPR / Art. 7 KVKK)

You may delete single items at any time in the Vita app: a conversation (with its messages and attached files), a fact Vita remembers, a person, a medicine, log entries. To remove a rating, a note or an entry in the log of changes, email us. To delete everything, use Delete account (Section 8). You may also exercise your right to erasure under Article 17 GDPR, UK GDPR, US state privacy and consumer health data laws, and Article 11(d) KVKK by emailing privacy@vitamedas.com. Where the request is from an end-user of a Customer who is acting as Controller, VitaMedas will forward the request to the Customer and assist in accordance with Section 5.5 of the Data Processing Agreement.

6.1Exceptions to erasure

VitaMedas may decline to erase personal data, in whole or in part, only where one of the exceptions in Article 17(3) GDPR (or an equivalent exception in the law that applies to you) applies. In practice the exceptions VitaMedas relies on most often are:

compliance with a statutory retention obligation under United States or other applicable law (Article 17(3)(b));
reasons of public interest in the area of public health (Article 17(3)(c)) — for example, where local pharmacovigilance law requires preservation of a serious-adverse-event record;
the establishment, exercise or defence of legal claims (Article 17(3)(e)).

Where an exception applies VitaMedas will tell the data subject which exception, why, and for how long the data will remain.

7Special-category and health data

Almost all content stored on VitaMedas is special-category personal data within the meaning of Article 9(1) GDPR (data concerning health), consumer health data under US state laws, and özel nitelikli kişisel veri under Article 6(1) KVKK. Three retention-relevant consequences follow.

No Article 9(2)(j) research carve-out. VitaMedas does not process user health data for scientific, historical or statistical research purposes and therefore does not rely on the extended-retention exception in Article 5(1)(b) read with Article 89 GDPR. Where, in future, any research processing is offered, it will be a separate opt-in programme governed by its own consent, retention rules and DPIA — not a quiet extension of these schedules.
No re-purposing. Health data is retained only to deliver the service you use and to discharge legal obligations. It is not used to train any machine-learning model, to enrich third-party profiles, or to drive marketing. The closure of the lawful basis for the original processing triggers deletion in accordance with the schedule above.
How deletion works depends on the service. Vault files stay encrypted on your device’s key for their whole life; we retire them by destroying the ciphertext and wrapped keys, never by reading them. Vita app data is readable by our server so the assistant can answer; we retire it by deleting it from the database and deleting attached documents from storage.

Where a Turkish Customer’s processing falls within the scope of the Regulation on Personal Health Data (21 June 2019), additional sector-specific retention rules may apply (for example, the rules on patient files of the Ministry of Health). Where these conflict with the schedule above, the longer of the two applies, on the basis that erasure cannot lawfully precede the end of a binding statutory retention period.

8Account deletion

You can delete your account in the Vita app: open Settings › Help & account, then choose Delete account in the support panel. You can also email privacy@vitamedas.com from the email address registered to the account.

Stage	When	What happens
1. Request	Day 0	We record your request.
2. Time to change your mind	Day 0 to day 7	You can cancel the request in the app.
3. Deletion	By day 30	We delete your account and everything listed in Section 3.1 from our live database and storage: conversations, messages, attached documents and filed copies, memory, people and their records, medicines, period data, visit pages and links, ratings, the next-step log, the log of changes made from a chat and the latest report from your phone. Your vault ciphertext, wrapped keys and vault audit log are deleted with it.
4. Backups roll off	Within a further 35 days	Backups that still contain your data are overwritten on the normal schedule (one copy a day for 30 days; any extra copy within 35 days).
5. What remains	As set out in Section 9	A pseudonymous record that an account existed and was deleted, records a law requires us to keep, and an email address on our unsubscribe list if you used an unsubscribe link.

9What survives deletion — and what does not

Once an account is deleted and the backup window has passed, the only categories of data that may continue to exist are those listed below — each retained on a specific legal basis and ring-fenced from further use.

Category	What remains	Why	How long
Deletion record (part of our own audit log)	A pseudonymous record that an account existed and was deleted	GDPR Art. 5(2) accountability; proof that the request was honoured	5 years
Our own audit log	Pseudonymous ID + action + timestamp, no content	GDPR Art. 5(2) accountability	5 years
Billing records	Records of purchases and refunds	26 U.S.C. § 6001; 26 C.F.R. § 1.6001-1	7 years
Support correspondence	Email thread (subject + body + attachments)	10 Del. C. § 8106	3 years
Unsubscribe list	An email address that used an unsubscribe link, the date and the reason, not hashed	So that we do not email that address again	No fixed end. Ask us at privacy@vitamedas.com to remove it
Anonymised aggregates	Counts and percentiles only; no identifier remains	GDPR Recital 26 — anonymous information is outside scope	Indefinite (no longer personal data)

Nothing else survives. Conversations, documents, memory, people, medicines, period data, visit pages, values read from your reports, ratings, the next-step log, the log of changes made from a chat, vault ciphertext, wrapped keys, doctor links and intake links are gone from live systems within 30 days of the request and from backups within a further 35 days.

10Anonymisation as a retention exit

Where VitaMedas needs to preserve operational or business intelligence beyond the retention periods set out above (for example, year-on-year storage-volume trends, average time-to-claim for hospital intakes), it does so by anonymisation rather than by extended retention. Anonymisation, where successfully achieved, brings the resulting dataset outside the material scope of GDPR per Recital 26 and outside the scope of KVKK per Article 28(1)(b).

Anonymisation techniques applied include irreversible aggregation, salting-then-hashing of identifiers with discarded salts, and k-anonymity / l-diversity thresholds where statistical re-identification risk is non-trivial. The VitaMedas Privacy Office tests anonymisation outputs against the Article 29 Working Party motion test (singling-out, linkability, inference) before such outputs are retained outside this Policy.

11Review and changes

This Policy is reviewed at least annually and on each material change to the law or the Service. Material changes are notified to account holders at least thirty (30) days before they take effect, by email to the address registered to the account and by notice in-product. Older versions of this Policy are archived and will be provided on request to privacy@vitamedas.com.

RStatutory references

Statutory references

GDPR Art. 5(1)(e) · Storage limitation principle
GDPR Art. 17 · Right to erasure ('right to be forgotten')
GDPR Art. 32(1)(c) · Ability to restore the availability and access to personal data in a timely manner
GDPR Recital 26 · Anonymous information falls outside scope
26 U.S.C. § 6001 / 26 C.F.R. § 1.6001-1 · US federal tax books-and-records retention obligations
10 Del. C. § 8106 · Delaware three-year limitation period for contract claims
KVKK Art. 7 · Silinme, yok etme veya anonim hale getirme
KVKK Art. 11 · Data subject rights, including the right of erasure
Health Data Regulation (TR) · Kişisel Sağlık Verileri Hakkında Yönetmelik (21 June 2019)

Questions, requests, or complaints?

VitaMedas is operated by VitaMedas, Inc. (commercial name VitaMedas), 2261 Market Street STE 69554, San Francisco, CA 94114, United States.

General enquiries: hello@vitamedas.com
Data-protection requests (KVKK / GDPR): privacy@vitamedas.com
Security disclosures: security@vitamedas.com
Legal notices: legal@vitamedas.com

Document last updated 4 November 2026 · Version v2.5 · Previous versions available on request.