Privacy Policy

• Sign-in details — your email address, how you sign in (Apple, Google or email) and the identifier that service gives us. If you use Sign in with Apple and hide your email, we receive Apple's relay address instead.
• Profile basics — your display name and the language you use.
• Country and time — the country you set as home, the country your connection appears to come from, and your time-zone offset. We use them so that answers, doctor pages, units, dates and emergency numbers fit where you are.
• Subscription — your plan, its status and renewal dates, and purchase identifiers from Apple or Google.
• Notifications — a push token for your device and your notification settings. On an iPhone that has never been asked, the app from version 3.6.3 turns on Apple's quiet notifications with no permission screen: they go to Notification Center only, until you choose. You can turn each kind off in Settings or by asking Vita in a chat. Notifications are written so they do not name a health topic, a medicine or a result.
• Website sessions — session and security cookies; see our Cookie Policy.

• What you ask and what Vita answers, and each conversation's title. We keep them so you can come back to them and so Vita can follow the conversation.
• Voice — when you speak to Vita, your recording is sent to Google to be turned into text. We keep the text (the transcript) in the conversation.
• Safety signals — whether a message was flagged as a possible emergency or a risk of self-harm. When that happens, Vita shows emergency or crisis numbers instead of a normal answer (see the Crisis Protocol).
• Ratings — in the iPhone app, version 3.6.3 and later, you can give an answer one to five stars and add a short note if you want. We keep the stars, the note and which answer they belong to, as a signal about the quality of answers. They do not change your account or your answers.

Lab reports, letters, prescriptions and pictures you attach to a question are stored on our server in Finland. They are encrypted at rest with a key that our server holds, so our systems can open them to answer you. They stay until you delete the conversation or the filed item, or your account. On a paid plan, Vita also files a copy under the person it is about, with a written summary of it.

In the iPhone app, version 3.6.3 and later, Vita can read one of these documents again: when you tap to read it again after giving a new detail, when you change your country, or when you ask for it to be read for another country. The document then goes to Google again (section 9), and the new answer is saved like any other. Sealed vault files are never read this way.

Vita keeps short facts from your conversations — about you and about each person you add — so that later answers fit. For example: an allergy, a medicine or a condition you mentioned. We call this “Vita's memory”. You can see these facts and remove them in the app.

Details you state go to the profile. In the iPhone app, version 3.6.3 and later, when you tell Vita a detail about yourself, or about the person a chat is about, a small AI call reads your words and saves the detail straight to that person's profile: weight, height, birth date or age, sex, blood type, allergies, long-term conditions and medicines. The same happens with words you type into a Vita card. The call reads only your own words, never Vita's answers. Code works out every height and weight from the number and unit you gave, and a number with no unit is not saved. If you give an age, we keep that number and the day you said it, and we never make a birth date from it.

Vita normally shows what it saved, with an Undo that works for 24 hours. You can change or remove any detail on the person's page at any time. Details saved this way, such as allergies and conditions, can appear wherever that profile is used, for example on a doctor link or a family link that covers them. Nothing is saved this way from an emergency or crisis message or from a “Someone else” chat, or onto a card someone shared with you. A pregnancy is saved only when you confirm it with a tap, and the call is built to leave out private topics such as sexual health and mental health.

• People you add — name or nickname, age or birth date, sex, height, weight, blood type, relationship to you, conditions, allergies, medicines, family history, smoking, alcohol, exercise and diet, notes, pregnancy details, and their care team with any guidance notes.
• Children's records — growth, feeding, sleep and daily logs, fever episodes, milestones and vaccines.
• Medicines cabinet — medicines, schedules, doses you mark as taken, and how much is left. If you scan a medicine box or a prescription to add it, we receive the photo.
• Period tracker — the days you log, flow, symptoms and your settings, including what Apple Health or Health Connect sends in if you turn on period sync. Fertility signals stay on your phone and are not stored on our server.

• Family links (Vita Family plan) — what you choose to share with a family member, and their access to it.
• Visit pages and doctor summaries you create, so you can use them at an appointment.
• Doctor links — when you create one, we store its details (an opaque token, its expiry and what it covers) and a log of each time it is opened (time, IP address, device). A doctor link that covers your whole vault opens on a patient brief built from your app records, for the people the link covers: profile details (such as date of birth, sex, allergies and conditions), current medicines and doses marked in the last 30 days, the care team, and questions from your latest visit page. It never includes Vita's memory.
• Intake links — when you create one so a clinic can send you records, we store its token, expiry and destination. Files uploaded through it are stored encrypted, like the rest of your vault.

Files you put in the vault — on vitamedas.com or in the app — are encrypted on your device before they are uploaded, with a key made from a passphrase or a device key that only you hold. We store the encrypted file and the little we need to deliver it: its size, its file type, the upload time, your account ID, an encrypted file name, and the encrypted key that unlocks it. We never receive your passphrase or your key. Section 7 explains what this means, and the few cases where you choose to make a vault file readable.

If you connect Apple Health (iPhone) or Health Connect (Android), Vita reads your health data on your phone. On iPhone this can include records from your hospitals and clinics — lab results, medications, immunizations, allergies, conditions, vital signs and procedures — and metrics such as sleep and steps. On Android, Vita reads metrics only.

This data stays on your phone, in a sealed file. When you ask a question, a short summary goes with it so the AI can answer: up to 12 medicines, your allergies and conditions, 6 lab results, 90 days of vital signs, sleep and steps. We do not store that summary as a record. But note:

• an answer that quotes a reading is saved as part of that answer;
• “Explain my results” sends the readings as your question, and the question is saved;
• a medicine you pick from Apple Health becomes an entry in your medicines cabinet on our server only when you tick it;
• period data comes into the period tracker only if you turn on period sync.

From iPhone app version 3.6.3, a connection to Apple Health belongs to one Vita account, not to the phone. Only that account's own tap connects it. When you sign out, or another account signs in on the phone, Vita stops reading Apple Health for you and deletes its copy and its summary from the phone. If you sign back in on that phone, Vita builds its copy again from Apple Health without asking, because the phone keeps a coded note that you said yes. Disconnecting takes that yes back. Apple's own permission belongs to the phone, so another account may see no Apple screen when it taps Connect, but nothing connects without that tap.

We never use Apple Health or Health Connect data for advertising or marketing, and we never sell it.

• Your next step in Vita — in the iPhone app, version 3.6.3 and later, Vita shows one suggested next step at a time, such as a detail to add or a report to bring, and a ring showing how much of your profile is filled in. For this we keep a log of which steps were offered, shown, answered or turned down, with the time and where in the app, and of when an answer read a document (its ID, not its content). A step's name can show what kind of detail it asked about, so we treat this log as health data.
• What your phone reports — with the same app, your phone tells our server whether Apple Health and a hospital are connected, whether notifications are allowed, and whether Apple Health already holds your height and weight. The report holds no health values and no hospital name, and we keep only the latest one.
• Server logs — time, IP address, request path, response code, response time and device type (user agent). Kept up to 30 days, for security and reliability only.
• Security events — IP address, device, refused sign-ins and similar signs of misuse. Kept 30 days.
• Audit log — a pseudonymous record of actions, such as a file uploaded, a link opened or an account deleted. It holds no content. Kept 5 years.
• App analytics and crash reports — only if you allow analytics in the app. Google's Firebase then receives app usage events, device type, app version and crash reports. You can turn this off in Settings.

You pay for Vita through Apple's App Store or Google Play. We never see your card. We receive your plan, the purchase and renewal dates, the subscription status and the store's transaction identifiers. Apple's and Google's own privacy policies cover the payment itself.

If you write to us, we receive what you send — your email address, name, message and any attachments. We use it to answer you and to keep a record of the case.

In the iPhone app, version 3.6.3 and later, you can ask Vita in a chat to change your language, country, notifications, marketing emails, appearance or any profile detail, or to read a report for another country without changing yours. The AI reads your request, our server makes the change inside your own account, and the chat shows what really happened, with an Undo that works for 24 hours.

So that Undo can work, we keep a log of each change: what was asked, the value before it, and when. The log can hold health details, such as an earlier allergy entry or a fact you asked Vita to forget. Removing Apple Health or a hospital, deleting files, signing out, deleting your account and turning Personalize Vita for me on or off (section 6.1) always need your own tap. Other requests, such as adding a medicine, open the right screen.

From iPhone app version 3.6.3, if you said yes on the consent card (section 6.1), Vita keeps each value an answer read from a report: the test's name as printed, the value and its unit, the printed range, any high or low mark, and the date printed on the report if there is one. Each value is linked to the person, the document and the answer. If the report gives no date, the date stays unknown; Vita never uses the upload date in its place.

These values come only from answers Vita wrote. Vita never reads sealed vault files for this. Hospital results stay on your phone and are not uploaded for this.

The values are kept on every plan, a free account included, so they are there if you choose a plan later. Comparing them over time is part of a paid plan: Vita shows whether a value went up, went down or stayed about the same, beside the printed range. Code works this out from the saved values, and two values are compared only if their units can be converted. On a paid plan, your earlier values for the same tests go to Google with a new report, so the answer can compare them. Vita does not call a value improving or worsening, and it predicts nothing.

Deleting a conversation, a document or a person deletes its values, and reading a report again replaces them. They go with your account. If you take back your yes, no new values are saved; those already saved stay until you delete them or ask us to.

From iPhone app version 3.6.3, some features use your health data in a new way, so they need your own yes first: saving what you tell Vita to a profile (section 4.4), keeping the values an answer read from a report (section 4.13), the suggested next step (section 4.9) and plan offers inside the app (section 5). Two more come with the same yes, and they only happen when you ask: changes from a chat (section 4.12) and reading a document again (section 4.3).

A new account is asked at sign-up, on its own screen right after the health-data consent, and a yes there starts at once. If your account is older, the card comes up the next time you open the app on or after 4 November 2026: one screen says what is new and asks for a yes, and a yes starts at once, never before that date. Either way it is its own tap, separate from any terms, and nothing new happens for your account until you say yes. We keep your answer, with where you gave it, the date, the version of the wording and the app's language.

A no keeps today's Vita. Those features stay off. Your answers, your records and your plan stay as they are, and the plans are still there in the app, as they are today. After a no on the consent card, it will not come up again within a month. After any no, a card on the Today screen says that personalization is off; it opens the consent card only if you tap it, and you can close it.

Changing your answer. The Personalize Vita for me switch in Settings › Health-data consent changes it at any time, in one tap each way. Turning it on is a yes, the same as on the card. Turning it off is a no, and those features stop at once. It does not delete what was already saved; section 12 says how long each kind is kept. If you turn it off with the switch, the consent card will not come up again on its own. You can also write to privacy@vitamedas.com. We keep the time of each change. A chat cannot turn it on or off. Withdrawing your consent to health data ends this yes too, and consenting again later does not bring it back.

Our servers are run by Hetzner Online GmbH in Helsinki, Finland (EU). The following is stored there in a form our systems can read:

• your questions, Vita's answers and voice transcripts;
• documents and photos attached in a chat (encrypted at rest with a key our server holds);
• Vita's memory;
• people, children's records, medicines and period-tracker data;
• values read from your reports (section 4.13);
• visit pages, doctor summaries and family links;
• ratings and notes on answers, the next-step log and the log of changes made from a chat;
• your account, device and subscription data.

An assistant cannot answer a question it cannot read, so this data is not end-to-end encrypted. Backups of this database are kept on the same server in Finland: one copy a day, kept for 30 days, and, when needed, an extra copy just before a software change, which is removed within 35 days. Something you delete can therefore remain in a backup for up to 35 days. After that it is gone.

Files in the Health records vault are encrypted on your device, in your browser or the app, with XChaCha20-Poly1305. The key comes from your passphrase (through Argon2id) or from a device key, and only you hold it. Our server stores only the encrypted file. It holds no key. As a result:

• We cannot recover a lost passphrase for you. You can get back in with a recovery method you set up — your 24-word recovery phrase, a passkey, or recovery shares held by people you trust. Without your passphrase or a recovery method, the files cannot be opened.
• We cannot hand over the contents. If a court orders us to disclose vault content, we can give only the encrypted file and the details in section 4.7. We will tell you about the request unless the law forbids it.

A vault file becomes readable only when you choose:

• AI description, summary or translation. Your device opens that one file and sends it through our server to the AI (section 9). We keep only a fingerprint (hash) of it.
• Letting Vita learn from a document. If you choose to let Vita learn from a vault document, a summary of it — findings, values, medicines and report text — is sent to our server and stored as readable facts (section 7.1).
• Doctor links. Whoever holds a link and its code can open the records it covers, until the link expires or you revoke it.
• Documents first attached in a chat. If you attach a document in a chat and then save it to your records, our server already holds a readable copy (section 4.3). The sealed vault copy is added to it; it does not replace it.

Records and metrics read from Apple Health or Health Connect, and Medicare and hospital records if you connect them, are kept on your phone, not on our servers. A short summary travels with a question only to get you an answer (sections 4.8 and 8). Your phone also tells our server whether Apple Health and a hospital are connected (section 4.9), with no health values.

Only authorised staff, and only when needed: to answer a request you make, to investigate a security issue, or to check the safety and quality of Vita's answers. Every such read of another person's health data is logged. No one at VitaMedas can read your vault.

If you are enrolled in Medicare in the United States and you connect it, Vita receives data from the Centers for Medicare & Medicaid Services (CMS): your Medicare claims — Part A (hospital), Part B (medical) and Part D (prescription drugs) — and your coverage details. Claims show things like dates of care, the providers you saw, the diagnoses and procedures recorded, and prescriptions filled. We do not ask Medicare for your name, date of birth or address, so they are not shared with us.

We do not request substance-use disorder claims.

• You sign in on Medicare's website, not in Vita. We never ask for, see or store your Medicare.gov username or password.
• Medicare then gives us access tokens. Our server keeps only these tokens.
• The connection is ongoing, for up to 13 months. During that time Vita fetches your claims only when you ask for them. After 13 months the access ends, and you must connect again if you want to keep using it.
• Your claims stay on your phone. When you ask, our server fetches your claims from Medicare, turns them into a summary and passes it to your phone. Your phone keeps it. Our server does not keep a copy.
• When you ask a question, the summary goes with it so the AI can answer, as with Apple Health (section 9). This happens only for questions you ask, and only with your consent.

We share your Medicare data with no one. The only exception is the AI processing described above, which happens only to answer a question you ask, with your consent. We never sell Medicare data, never use it for advertising, and never use it to train AI.

• You can disconnect at any time in the app. We then revoke Vita's access at Medicare, delete the tokens from our server, and delete the Medicare copy on your phone at the same time.
• If you stop using Vita, the connection ends by itself when its time runs out — at most 13 months after you connected. We cannot renew it without you.
• If you delete your Vita account, we revoke Medicare access and delete the tokens as part of the deletion. Removing the app from your phone removes the copy on your phone.

Your rights over this data are in section 14, how we tell you about changes is in section 20, and what we do after a breach is in section 13.

This product uses the Blue Button APIs but is not endorsed or certified by the Centers for Medicare & Medicaid Services or the U.S. Department of Health and Human Services.

In the United States, many hospitals and clinics let patients connect an app of their choice to their patient portal. If you connect one, you sign in on the hospital's own sign-in page with your own portal login. We never ask for, see or store that password.

• What arrives: the records the hospital releases to you through its patient-access service — lab results, vital signs, conditions, medicines, allergies, immunizations, procedures, visit and report summaries, and the identifying details on your record that come with them.
• Where it goes: straight to your phone. Your phone signs in, downloads the records and seals them with a key only that phone holds. The access tokens are kept in your phone's secure storage. Our servers never receive the records or the tokens. Your phone tells our server only that a hospital is connected, not which one (section 4.9).
• When you ask a question while “Use my health data in answers” is on, a short summary goes with that question to the AI service (section 9), as with Apple Health, with the lines of your record the question is about, which your phone finds itself. The summary is not saved as a record. An answer that quotes it is saved with your conversation on our servers, and Vita can remember a short fact from that answer. If you tap Ask on a record, its name and value are written into your question for you to send or change; a question you send is saved with your conversation like any other. You can delete all of these.
• Vita only reads. It never writes to or changes your hospital record.
• Disconnecting: Vita stops updating, stops using those records in answers and asks the hospital to end its access, and you choose whether the records stay on your phone or are deleted. Signing out of Vita, switching to another account, deleting the person in Vita or deleting your account deletes the records and the tokens from your phone and asks the hospital to end its access. In the app from version 3.6.3 this also holds when another account signs in with no sign-out first. If you delete the person or your account on another device, it happens the next time Vita opens on that phone. Some hospitals do not let an app end the access for you: remove Vita in your patient portal's settings.
• Apart from what goes with your questions as described above, we share hospital records with no one. We never sell them, never use them for advertising and never use them to train AI.
• Someone else's records. From app version 3.6.3, before you sign in to anyone else's portal you confirm with one tap: “I have permission to view this person's records.” Connect them only if that is true, for example as a parent or legal guardian, or through your own proxy access at the hospital.
• If someone connected your records without your permission. This goes for a parent, or for anyone else, and you do not need a Vita account. Remove Vita in your patient portal's settings: that ends the app's access. Then write to privacy@vitamedas.com, with the email address of the Vita account if you know it. We will check your request. We can delete you as a person on that account, with what our servers hold about you there. If the records were connected for you as that person, this also deletes them from the phone the next time Vita opens there. We hold no copy of the records, and we cannot reach a phone in any other way.

• We tell you without unreasonable delay, and no later than 60 days after we discover the breach, as the US Federal Trade Commission's Health Breach Notification Rule requires. We tell you what happened, what data was involved, and what you can do.
• We tell regulators: the FTC (and the media where that rule requires) and US state authorities where state law requires; in the EU and the UK, the data protection authority within 72 hours where Article 33 GDPR or UK GDPR requires; in Türkiye, the Personal Data Protection Board within 72 hours (Article 12(5) KVKK).
• Where a breach is likely to put you at high risk, we tell you directly and without undue delay (Article 34 GDPR).