Privacy Policy

Vital is an independently operated personal health-record application. Contact details for any question about this policy or your data are at the end of this page.

Vital holds only what you put into it, or what you connect it to:

• Health records you create or upload — lab results, medications, supplements, conditions, immunizations, imaging and vision reports, visits, providers, and the original documents behind them.
• Fitness and vitals — workouts, heart rate, sleep, steps and ECG recordings imported from Apple Health or Strava.
• Account information — your email address, display name, optional date of birth, sex and profile picture, and the identifier from whichever sign-in provider you used. Date of birth and sex are used only to choose which laboratory reference ranges apply to your results; many ranges differ by sex and by age.
• Emails and notes you import — message text from mail files you import, and notes (text, Word or web documents that are not laboratory or clinic records). They are stored so the assistant can search them, as described below.
• Your conversations with the assistant, and the sharing invitations you send or receive.

Vital does not use advertising or analytics trackers, does not build a profile of you for any purpose other than showing you your own records, and does not track you across other websites.

Connecting a Google service is entirely optional and Vital works fully without it. If you connect one, Vital requests only these scopes:

• Google Calendar (calendar.events) — to show upcoming and past medical appointments alongside your record.
• Gmail, read-only (gmail.readonly) — to find health-related attachments your providers email you, so you can import them without downloading and re-uploading each one.
• Google Drive, read-only (drive.readonly) — to import health documents from folders you choose to watch.

Vital never writes to, modifies or deletes anything in your Gmail, Drive or Calendar. What is copied into Vital is limited to: files in folders you choose to watch, and Gmail attachments you select or that match a health-document search you run. A watched folder is checked once a day and whenever you press “Check now”; the files it holds that Vital can read are copied in, and the ones it leaves out are listed with the reason. Nothing outside those folders and searches is read or retained.

Vital’s use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, Google user data is never sold, never used for advertising, and never used to develop, train or improve any generalized artificial-intelligence or machine-learning model.

You can disconnect any Google service at any time on the Integrations page. Gmail, Google Calendar and Google Drive are separate permissions, and disconnecting one deletes the key Vital holds for it and leaves the others working. When you disconnect the last one on a Google account, Vital also asks Google to cancel its access to that account. Documents already imported remain in your Vital record until you delete them.

Connecting Strava is optional. If you connect it, Vital reads your activities — the workout, its duration, distance, heart rate and power streams — and writes nothing back to Strava. Vital never posts, edits or deletes anything on your Strava account. You can disconnect it at any time on the Integrations page. When you do, Vital tells Strava it no longer has access and removes the activities that came through the connection, as Strava requires; anything you imported from a Strava export file stays in your record until you delete it.

There are two ways Apple Health data can reach Vital, both optional. You can upload an Apple Health export file yourself, which involves no connection to Apple. Or, in the Vital iPhone app, you can connect Apple Health: Vital then reads the kinds of data you allow on Apple’s permission screen — such as activity, heart rate, sleep, workouts and body measurements — and keeps your record up to date in the background. Vital only reads; it never changes your Apple Health data.

If your hospitals, clinics or labs send your Health Records to Apple Health, the app can also read those — lab results, medications, conditions, vaccines, allergies and procedures — once you allow them on Apple’s own Health Records permission screen. They are read on your iPhone and sent to Vital like the rest of your Apple Health data, and matched to what your record already holds so nothing is added twice. You can turn Health Records off in the app while keeping the rest of Apple Health on.

Apple Health data is used only to show you your own health and fitness and, if you choose, to share it with the people you pick. It is never used for advertising or marketing, never sold, and never stored in iCloud. Connecting Apple Health in the app also lets Ask Vital use that data to answer your questions — the app says so before you connect — and turning the connection off is how you stop it.

You can turn the connection off at any time in the app, or in the iPhone’s Settings → Health. Vital then stops reading. What it has already read stays in your record until you delete it or your account, and deleting your account removes it all.

Connecting a health system is optional. If you connect one, you sign in on that organisation’s own website — Vital never sees your portal password — and approve Vital reading your record. Vital asks for read-only access to your results, diagnostic reports, medications, conditions, immunizations, allergies, visits, procedures and clinical documents, and to the basic details of the record (name, date of birth) so it can confirm it is yours. Vital writes nothing back to the health system and never changes, orders or sends anything there. Records Vital reads are stored in your account like any other record and are read by the automated steps described below only when they arrive as documents.

How long Vital’s access lastsdepends on the health system, and the Integrations page shows you which of the two you have. With most, access is short-lived: it ends within the hour of each sign-in, and to fetch anything new you sign in again. With some — today, organisations using Oracle Health — you can grant ongoingaccess when you sign in. Vital then keeps a renewable key to that record and can fetch new results on its own, without you being present, until you end it. Vital syncs each such connection once a month so it stays connected; if it goes unused for three months anyway, the health system ends it and you sign in again to reconnect. Either way, records already copied stay in your account. The connection’s card on the Integrations page says which it is in as many words, and Disconnect ends it immediately: Vital forgets the key and, where the health system offers a way to hand it back, hands it back too. Deleting your Vital data or your account does the same. You can also remove Vital from the health system’s own list of connected apps, which ends access from their side whatever Vital does. Records already copied stay in your account until you delete them. Health systems use different software; Vital currently connects to organisations using Oracle Health, and Epic (MyChart) is being added. MyChart is a trademark of Epic Systems Corporation.

When you upload a document — or import one from Gmail or Drive — its contents are sent to Anthropic’s Claude API to be read, so that values like a cholesterol result or a medication dose can be pulled out as structured records. The same applies to the assistant: the parts of your record relevant to a question are sent with it so the answer can be grounded in your own data.

This means medical information leaves Vital’s systems and is processed by Anthropic. Anthropic acts as a processor on Vital’s behalf under its commercial terms and does not use data submitted through the API to train its models. No other third party receives your health information for any purpose.

Values read from a document are written into your record automatically, and each one keeps a link to the original document, which is always stored and viewable so you can check any value against it. Automated extraction can misread a document, which is one of several reasons Vital is not a diagnostic tool.

Reference ranges.When a result arrives without a reference range and none is already on file, Vital may look up a typical adult range from published clinical references (reference laboratories, the NIH, the CDC and similar) using Anthropic’s web search. That lookup sends only the name of the test, its unit, and whether a range for men, women or both is wanted — never your name, your results or your documents. Where a range did not come from your own laboratory report, Vital says so beside it.

Emails and notes. The text of emails and notes you import is stored so the assistant can search it when it is relevant to a question, and anything it quotes is labelled as correspondence or as your own notes rather than as a result. Notes are never read into your record as results. Email text is read for results only if you turn that on for that mailbox.

Vital runs on a small number of named providers:

• Neon — the PostgreSQL database holding your records.
• Vercel — application hosting, and the private storage holding your uploaded files.
• Google Firebase Authentication — sign-in. Vital never sees or stores your password.
• Anthropic — document reading, the assistant, and reference-range lookups, as described above.
• Resend— delivery of sharing invitations. It receives only the recipient’s email address and the invitation itself, never health data.

Each processes data only to provide its part of the service. Vital does not sell, rent or trade personal information to anyone, and there is no advertising business attached to it.

Every record is tied to the account that owns it, and separation is enforced by the database itself through row-level security rather than by application code alone. One person’s records cannot be read by another account, including by accident.

Data is encrypted in transit, and encrypted at rest by the database and storage providers. No system is perfectly secure, and Vital does not claim otherwise.

If your information is ever accessed or disclosed without authorisation, Vital will tell you what happened, what was involved and what is being done about it, in writing, within 60 days of discovering it and sooner where it can. Vital is a personal health record rather than a healthcare provider, so the rule that governs this is the U.S. Federal Trade Commission’s Health Breach Notification Rule, which also requires Vital to notify the FTC, and in some cases the media, when a breach affects 500 or more people. Vital keeps a written breach plan so that this happens in order rather than in a panic.

Vital’s administrators run and improve the service. They can see account details — email address, name, whether an account is approved, and its role — and information that contains no health data: for example, how many files of a given type were left out of imports, and the names of new kinds of document the app has come across. They cannot see your health records or your documents unless you turn on support access. Every administrative action is recorded in an audit log.

Support access.If you need help, you can let Vital’s support team view your record from Settings. It lasts 72 hours and ends by itself, and you can end it sooner at any time. It is read-only: they can see your record, including your conversations with the assistant, but cannot change or delete anything, add documents, or ask the assistant questions. Every page they open while it is on is recorded in the audit log. Nobody at Vital can turn it on for you.

Some reference information is shared by every account, such as typical reference ranges. It holds test names, units and ranges, never your name, your results or anything taken from your documents.

You may grant another person read-only access to your record — a doctor, a partner, a parent. They can never change or delete anything in it, and you choose separately whether they can use the assistant on your record. If you let them ask it questions, those conversations are kept in your record, labelled with the name of the person who asked, so you can always tell their questions from your own. You can revoke access at any time in Settings, which takes effect immediately. Nothing is shared unless you set it up yourself.

Vital is chosen by you and works for you. It is a personal health record: a copy of your own information, drawn from the sources you connect or upload, under your control. It is not an electronic health record system used by clinics, and it is not operated for, paid for, or provided by any doctor, hospital, laboratory or health plan. Because your information reaches Vital at your own direction, Vital is not a “business associate” of any healthcare provider under HIPAA; the consumer-protection rules named on this page apply to it instead.

A clinician may look at what you choose to share with them, exactly as any other person you invite may. No clinician documents your care in Vital, orders anything from it, or is a party to it. If a practice ever wanted to offer Vital to its patients as part of its own service, that would be a different arrangement with different legal duties, and this policy would be changed and re-published before it began.

Export. You can download your entire record — every table and every uploaded file — as a single archive at any time, from Settings.

Deletion.You can delete your data and keep your account, or delete your account entirely. Either removes your records and your uploaded files; deleting your account also removes your profile and your sign-in. It is not a hidden flag on a row that keeps the data; the rows are removed. Deletion is permanent and cannot be undone, so export first if you want a copy. Copies in the hosting providers’ backups expire within 30 days. One thing stays with other people: if you asked the assistant questions about someone else’s record while they shared it with you, those conversations are part of their record, and they keep your name as the person who asked — not your email address or any link to your account. A security audit log is also kept after deletion: it records that events happened (for example, that an export or a deletion took place) using internal identifiers, and holds none of your health information. Vital also keeps running totals of how much AI processing the service uses (counts and sizes of requests, never their content); when you delete your account those totals are kept only as anonymous figures that no longer point to you.

Vital keeps your data for as long as your account exists. There is no separate retention period, because the record is the point of the product.

Depending on where you live you may have rights to access, correct, export or delete your personal information, and to object to certain processing. The export and delete tools in Settings satisfy most of these directly and immediately. For anything they do not cover, use the contact details below.

Vital is not intended for children under 13, and accounts are not knowingly created for them. A parent or guardian who believes a child has created an account should get in touch using the contact details below, and it will be deleted.

If this policy changes, the date at the top of the page changes with it. A change that materially affects how your information is handled will be notified in the app before it takes effect.

For a question about this policy or your data, a problem with Vital, or a value in your record you believe is wrong, email edmondjay@gmail.com. A wrong value that came from a health system or lab should also be reported to them, since they hold the original record.

You do not need to write to anyone to exercise the rights above. Export and Delete in Settings act immediately on your own account: the export hands you every record and every file you have stored, and the delete removes them.

If Vital moves to a new owner — for example a company its founder sets up — your records move with it under this same policy. You will be told in the app before it happens, and you can export or delete your data before the change.

Vital organises and displays information you already have. It is a personal health record and a research and analysis tool, not a diagnostic tool, not a medical device, and not a replacement for a qualified clinician. The assistant tells you what your own records say; it does not diagnose, prescribe or advise treatment. See the Terms of Service for the full statement.