Privacy Policy

1. Who we are

Vitals ("we", "us") is an educational health risk-assessment application. This policy explains what personal and health information we collect, why we collect it, how it is protected, and the choices you have. It applies to the Vitals web app and any account you create in it.

2. Information we collect

We only collect information you give us or that your account needs to work.

• Account data: your email address and authentication credentials, handled by our authentication provider. We never see or store your password in readable form.
• Profile data: name (optional), date of birth or age, sex, height, weight, ethnicity, smoking status and activity level.
• Health metrics: blood pressure, pulse, fasting glucose, HbA1c, lipid panel, BMI, waist and hip measurements, cancer biomarkers and any notes you add.
• Family and genetic history: conditions you flag for relatives in the Family Health Tree, plus genetic flags such as BRCA1/2, Lynch syndrome and APC.
• Lab report uploads: images or PDFs you choose to scan, processed to extract values.
• Consent records: the date, version and text of the disclaimers and consents you accept.
• Subscription data: your plan tier and payment status. Card numbers are handled by our payment providers and never reach our servers.

3. Why we use it

We use your information only for the purposes below.

• To calculate and display your educational risk estimates and screening reminders.
• To show your history and trends over time.
• To generate reports and optional, expiring read-only share links for a clinician you choose.
• To send the reminders and alerts you enable in settings.
• To operate accounts, subscriptions and support.

4. What we never do

• We do not sell your personal or health information.
• We do not use your health data for advertising or profiling outside the app.
• We do not share your records with employers, insurers or other users.
• We do not use your data to train AI models.

5. Legal basis and consent

Where data protection law such as the UK/EU GDPR applies, health data is special category data. We process it on the basis of your explicit consent, which you give during onboarding before any health metric is stored, and which you can withdraw at any time by deleting your data or your account.

6. Service providers

We use a small number of processors that are contractually limited to acting on our instructions:

• Our cloud backend provider, for authenticated database storage and hosting.
• An AI text-extraction service, used only when you scan a lab report, to read values from the file you upload.
• Email delivery and payment providers, for account emails and subscriptions.

7. Security

Every table that holds your data has row-level security enabled, so a query can only ever return rows that belong to your authenticated user ID. Traffic is encrypted in transit. Share links use unguessable tokens with an expiry date and can be revoked instantly.

No system is perfectly secure. Please use a strong, unique password and keep your device locked.

8. Retention and deletion

We keep your records for as long as your account exists so your trends stay meaningful. You can delete any individual record, or use the wipe-all option in History & Trends to permanently remove all stored health data. Deleting your account removes your profile and health records. Consent records may be retained where we are required to evidence that consent was given.

9. Your rights

Depending on where you live, you may have the right to access, correct, export, restrict or delete your data, to withdraw consent, and to complain to your data protection authority. Most of these are available directly in the app; for anything else, contact us.

10. Children

Vitals is not intended for anyone under 18. We do not knowingly collect health data from children. If you believe a child has created an account, contact us and we will delete it.

11. Changes and contact

We may update this policy. Material changes will be shown in the app and will require your renewed consent where required by law. Questions or requests: privacy@preventivehealthcheck.com.