Privacy Policy

Last updated: June 30, 2026

This policy explains what we collect, why, and the controls you have. We are GDPR-aligned and apply the same protections globally.

What we collect

• Account: email, display name, timezone.
• Logged data: events, biometrics, workouts, documents you upload, calendar events you sync.
• Usage: minimal product analytics and error logs to keep the service working.

How we use it

• Operate the service: dashboards, timeline, AI Coach, insights.
• Improve reliability and fix bugs.
• Generate aggregate community benchmarks only if you opt in, and only with k-anonymity (20+ contributors).

We do not sell your data. We do not use your logged health data to train third-party AI models.

AI processing

AI Coach, insights, and document OCR send relevant data to our AI provider (Google Gemini via the Lovable AI Gateway) for processing. Providers process the data ephemerally for inference; we do not authorize training on your content.

Storage and security

Data is stored encrypted at rest. Row-level security ensures only you can read your data. Uploaded medical documents live in a private storage bucket and are accessible only via short-lived signed URLs.

Sharing

Shareable profiles only expose aggregates (averages, counts, streaks) — never raw entries. Pulse posts you create are visible to other authenticated users.

Your rights (GDPR / CCPA)

• Access and export — Settings → Export.
• Delete — Settings → Delete account permanently removes your data.
• Correct, restrict, or object — email hello@vitalityalign.com.

Subprocessors

• Cloud hosting and database — Lovable Cloud
• AI inference — Google (via Lovable AI Gateway)
• Payments — Paddle / Stripe (when checkout is enabled)

HIPAA notice

VitalityAlign is a consumer product. It is not a HIPAA-covered entity and does not enter Business Associate Agreements. Don't use it to store PHI on behalf of patients.

Children

The service is not directed at children under 16.

Changes

Material changes will be announced in-app or by email at least 14 days before they take effect.

Contact

Data controller: VitalityAlign. Email: hello@vitalityalign.com