Vitality Privacy Policy

Last updated: July 20, 2026 · Status: founding beta

Vitality (the trade name of the operating company currently being formed — the legal entity name will be inserted here upon formation; “Vitality”, “we”, “us”) is a personal data vault: you connect accounts you own (like a WHOOP wearable or your Google Calendar), we keep a fresh copy of that data in a vault only you can open, and we serve it back to you through one read-only key or an AI connector. This policy says exactly what we collect, why, where it lives, and what your rights are — in plain words first, because you should not need a lawyer to know what happens to your health data.

The short version

We collect your account email, the health data from devices you choose to connect, and billing status.
Your data is served to exactly one party: you (via your key and connectors you set up).
We never sell your data. We never share it for advertising. There is no ad tech here at all.
Member data is isolated at the database level — the database itself refuses to serve one member’s rows to another.
You can disconnect a device, kill your key, or ask us to delete everything, at any time.

1. What we collect

Account data. Your email address and name, received from Google when you sign in. We do not see or store your Google password.
Health and wellness data you connect. When you connect a device provider (for example WHOOP), we import and store the data that provider makes available for your account: sleep, recovery/readiness, workouts, daily activity, and body measurements (height, weight, max heart rate), plus your name/email as the provider reports it. We only receive read access, and only after you approve the connection on the provider’s own login page. We never see your provider password.
Calendar and schedule data you connect. If you connect Google Calendar, we read events from your primary calendar: the title, start and end times, all-day flag, status (such as confirmed or cancelled), the number of attendees (a count only, never names or emails), and whether you organized the event. We never read event descriptions, locations, attachments, or attendee identities; we never write to or change your calendar; and we only receive read access after you approve it on Google’s own consent screen.
Other sources you connect. When you connect a source such as GitHub, Todoist, Notion, or WakaTime, we read only the minimal facts it provides for the feature you connected (for example a daily count of code contributions, task titles and due dates, page titles and edit times, or daily coding-time totals), never the underlying content such as your code, your files, or the body of your notes.
Connection credentials. The provider issues us access tokens for your account. We store them encrypted (AES-256-GCM) and use them only to refresh your data.
Billing data. Payments are processed by Stripe. We store your subscription status and Stripe customer reference. Your card number never touches our servers.
Technical logs. We log events like “this key read the sleep shelf at this time” — who, what, when. Log entries do not contain the health values themselves.
Support messages. If you email us, we keep the thread so we can help you.

2. What we use it for

Running the service you pay for: keeping your vault fresh and serving it back to you.
Operating, debugging, and securing the pipes (the technical logs exist for this).
Billing and account management.
Responding when you contact us.

That is the whole list. We do not use your data for advertising, we do not build profiles for third parties, we do not train AI models on your data, and we never sell personal data — including consumer health data — to anyone.

3. Who your data is shared with

No one, except the infrastructure that runs the service (our “processors”), and any consumer you point your own key at:

Supabase — our database and authentication infrastructure (this is where your vault lives).
Vercel — application hosting.
Stripe — payments.
Google — sign-in.
Sentry — error monitoring (receives technical error reports, not your health values).
Whatever you connect your key to. If you paste your key into Claude, ChatGPT, a dashboard you built, or any other tool, that tool receives your data because you directed it there. That sharing is under your control, governed by that tool’s terms — revoke your key at any time to cut it off everywhere at once.

We may also disclose data if the law genuinely compels us to, and we will tell you it happened unless we are legally barred from doing so.

4. Google user data and Limited Use

If you connect Google Calendar, we access your calendar event data through Google APIs using the calendar.events.readonly scope, and only after you grant it on Google’s own consent screen. Vitality’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Concretely: we use Google Calendar data only to provide the feature you connected it for — serving your own schedule back to you and to the AI connectors you set up. We do not transfer this data to others except as necessary to provide that feature, to comply with applicable law, or in connection with a merger or acquisition. We do not use Google user data for advertising. We do not allow humans to read it, except with your explicit consent for support you have asked us for, to comply with the law, or for security. We never sell Google user data, and we never use it to develop, improve, or train generalized AI or machine-learning models.

5. Consumer health data (Washington My Health My Data Act and similar laws)

The health data described in Section 1 is “consumer health data.” We collect it only with your explicit consent — the act of connecting a provider on its own consent screen — and use it only for the purposes in Section 2. We do not sell consumer health data, we do not share it for advertising, and we do not use geofencing. You may withdraw consent at any time by disconnecting the provider (which deletes our copies of its access tokens and purges the data we synced from it) and may request deletion of any remaining data as described in Section 8.

6. Where your data lives and how it is protected

Data is processed on Supabase and Vercel infrastructure in the United States. If you use Vitality from the EU/UK, you consent to this transfer; formal transfer mechanisms will be finalized with counsel as the company completes formation.
Provider tokens are encrypted at rest with application-level encryption (AES-256-GCM). Your synced vault data is stored on infrastructure that encrypts data at rest, and all traffic is encrypted in transit (TLS).
Your Vitality key is never stored — only its fingerprint (SHA-256 hash). It is shown to you once; even we cannot read it back.
Member isolation is enforced by the database itself (row-level security): every read runs as you, and the database refuses to return another member’s rows.
If a breach affecting your personal data ever occurs, we will notify you and regulators as applicable law requires.

No system on earth can honestly promise perfection, and we will never use the words “100% secure.” What we promise is the architecture above, maintained as the core of the product.

7. How long we keep it

Vault data: for as long as your account is active and the provider stays connected.
Provider tokens: deleted when you disconnect the provider.
Synced data: when you disconnect a provider, the data we synced from it is purged from your vault along with the tokens.
Revoked keys: only the fingerprint remains, marked revoked.
On account deletion (Section 8): vault data is deleted, and residual copies in infrastructure backups purge within a commercially reasonable period (typically ~30 days).
Billing records: kept as long as tax and accounting law requires.

8. Your rights

Access & portability — built into the product: your key returns every field we hold, in clean machine-readable JSON, any time you want. That is the product.
Withdraw consent — disconnect any provider; its tokens and everything we synced from it are deleted immediately.
Cut off downstream access — revoke or regenerate your key; every copy dies the same second.
Deletion — email from your account email and we will delete your account and vault within 30 days, confirming when done.
Correction — your health data mirrors your provider; correct it at the source and the vault follows. Account details can be corrected on request.
Complaint — EU/UK/Washington and other residents may also complain to their local supervisory authority; we would rather you email us first so we can fix it.

We respond to rights requests within 30 days and do not discriminate against you for exercising them.

9. What Vitality is not

Not a medical service: Vitality is not a healthcare provider, your data here is consumer wellness data, and we are not a HIPAA covered entity.
Not for children: Vitality is for adults 18 and older. We do not knowingly collect children’s data; if you believe a minor has an account, contact us and we will delete it.
Not an advertising business: there are no trackers, no ad pixels, and no data brokers here.

10. Changes to this policy

If we change this policy in any meaningful way, we will post the new version here with a new date and email active members before it takes effect. Quiet edits to substance are not how we operate.

11. Contact

, a founder reads every message.