Privacy Policy

Last updated: August 15, 2026

Vaitalo is for informational and wellness purposes only and is not a substitute for professional medical advice, diagnosis, or treatment. Always consult a qualified healthcare provider.

Overview

This Privacy Policy explains what information Vaitalo ("we", "us") collects, how we use it, who we share it with, and the choices you have. By using the app you agree to this policy.

Information we collect

• Account & profile — your name, age, sex, height, weight, activity level, and goals, plus the login identifier from our authentication provider.
• Nutrition data — food and beverage entries, saved foods, meals, and hydration you log.
• Health & vitals data — metrics you log or that are synced read-only from Apple Health (HealthKit) or Google Health Connect, such as steps, distance, heart rate, heart-rate variability, resting heart rate, respiratory rate, and sleep, as well as body measurements, blood pressure, and lab results you enter.
• Supplements & medications — the supplements and medications you add to your regimen (name, dose, schedule, and whether each was taken), and any Supplement Facts label you capture by photo or barcode.
• Workout & activity data — the exercises, sets, weights, durations, and workout sessions you log.
• Assistant conversations & AI analysis — messages, and any images or documents you send to the in-app AI assistant, food-photo analysis, supplement-label scanning, or lab-report analysis.
• Usage & device data — basic technical data needed to operate and secure the service (e.g. app version, request logs).

Health data read from HealthKit / Health Connect is used only to provide the features you enable and is never used for advertising.

How we use your information

• To provide the app's features — logging, trends, insights, and the AI assistant.
• To calculate goals and analyze your data at your request.
• To operate, secure, debug, and improve the service.
• To process subscriptions and comply with legal obligations.

Service providers we share data with

We do not sell or share your personal information for advertising. We share the minimum necessary with providers that help us run the app:

• Clerk — authentication and account management (email, login credentials, session identifiers).
• RevenueCat and the Apple App Store / Google Play — subscription billing (an account identifier and purchase/receipt data; no health data).
• OpenAI — powers food-photo analysis and supplement-label scanning; it receives the meal photos and supplement or medication label images you submit for those features.
• Anthropic — powers the Vaitalo chat assistant and lab-report analysis. When you use these features, the messages, images, and documents you send — which may include health information such as vitals, lab results, and metrics synced from Apple Health / Health Connect — are processed by Anthropic to answer you or extract your results. You can turn off AI processing of your health data in Settings → Privacy & Data.
• Amazon Web Services (AWS) — cloud hosting, our encrypted database, and encrypted backups store your data on our behalf.
• USDA FoodData Central, Open Food Facts, and the NIH Dietary Supplement Label Database (DSLD) — public food and supplement databases used for text search and barcode lookups; they receive only your search term or a scanned barcode, never your personal or health data.
• PostHog — privacy-first product analytics that help us understand feature usage and improve the app. It receives usage and basic device data only; your health data, logs, and assistant conversations are never sent to it. You can opt out in Settings → Privacy & Data.
• Sentry — crash and error diagnostics used to keep the app stable; it receives technical error and device data, not your health records.
• GitHub — when you send feedback through the app, your message, basic diagnostics (app version, operating system, device model), and any screenshot you attach are filed as a private issue in our product-tracking repository so we can act on it. Only what you choose to write and attach is sent; we don't include your email or health records.

Health data is never shared with analytics or advertising services.

Data retention

We keep your data while your account is active so you can use the app. Specifically:

• Your profiles, logs, vitals, lab results, saved foods, and assistant conversations are retained until you delete them or delete your account.
• When you delete your account, your associated data is permanently and immediately purged from our database, and your login is deleted from our authentication provider.
• Encrypted database backups are retained on a rolling window (currently up to 7 days) for disaster recovery, after which residual copies age out automatically.
• Operational request logs, which do not include your health records, are retained for a short period (currently about 30 days) to operate and secure the service.

Your rights & choices

• Access & correction — you can view and edit your data in the app.
• Data export (portability) — you can download a machine-readable copy of all your data from Settings → Download My Data.
• Deletion — you can permanently delete your account and all associated data from Settings → Delete Account. This removes your profiles, food log, vitals, lab results, saved foods, custom biomarkers, supplements and medications, workout history, and assistant conversations, and deletes your login.
• Consent controls — from Settings → Privacy & Data you can opt out of AI processing of your health data, control product-analytics participation, and exercise the "Do Not Sell or Share My Personal Information" choice.
• Health permissions — you control HealthKit / Health Connect access from your device settings at any time.
• Depending on your region, you may have additional rights (e.g. GDPR/CCPA) — contact us to exercise them.

California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect and why, to request access to or deletion of it, and to not be discriminated against for exercising these rights.

• Categories collected & purpose — identifiers (login id) and account details; health and wellness data you log or sync (including nutrition, vitals, lab results, supplements, and medications); workout and activity data; and basic technical/usage data — all used solely to provide and secure the app's features as described above, not for advertising. Product-analytics and crash-diagnostics providers receive usage and device data only, never your health data.
• Do Not Sell or Share — we do not sell or share your personal information. A "Do Not Sell or Share My Personal Information" control is available in Settings → Privacy & Data and is honored if any such sharing is ever introduced.
• Exercising your rights — use the in-app controls above, or contact us at support@vaitalo.com.

Security

We use industry-standard measures to protect your data in transit and at rest. No method of transmission or storage is completely secure, but we work to protect your information.

Children

Vaitalo is not directed to children under 13, and we do not knowingly collect data from children. You must be at least 13 years old to use Vaitalo.

Vaitalo lets an account holder create additional profiles to track information for other members of their household — for example, a parent logging a child's meals. These profiles are managed entirely by the account holder; the individuals themselves do not use or access the app, and we collect nothing from them directly. The account holder is responsible for any information they choose to enter about others and confirms they have the authority to do so.

Changes

We may update this policy; material changes will be reflected by the "Last updated" date above.

Contact

Questions about this document? Email support@vaitalo.com.