Consumer Health Data Privacy Policy

1. Who we are

VitalYou is operated by RUBYNAV INC (“VitalYou”, “we”, “us”). Questions or requests: privacy@vitalyou.app. By post: RubyNav Inc, 15322 Marek Ln, Guy, TX 77444, USA.

2. Consumer health data we collect

Because VitalYou is a wellness app, much of what you add can be consumer health data, including:

• food, drink, calorie and nutrient logs; water; meal plans and eating patterns (such as fasting windows);
• body measurements and weight, goals, activity, sleep, heart and recovery readings you connect from Apple Health, Health Connect, a watch or a scale;
• medications you enter, doses you mark and reminders you set;
• symptoms and how-you-feel check-ins, conditions you choose to track, allergies, intolerances and food restrictions;
• health records, lab results and documents you upload, and anything health-related you tell or send the Coach (messages, voice during live calls, photos and files);
• information that could be used to infer health status, such as your age, and inferences the app makes for you (for example calorie targets, scores and nutrient gaps).

3. Sources

You (in the app and when you contact us), your devices and the apps you connect (Apple Health, Health Connect, Bluetooth scales), and AI estimates the app makes from what you enter.

4. Why we collect and use it

Only to provide the features you ask for: logging, nutrition estimates, plans and targets, reminders, progress, health records, family planning and the AI Coach; to keep your account secure and prevent fraud; and to meet legal obligations. We collect consumer health data only with your consent. At sign-up this is its own choice—a separate switch, distinct from accepting the Terms of Use and privacy notice—and you give further consent when you turn on the features that use it. AI features need a separate consent that you can withdraw any time (Menu → Settings → Your data → AI features).

5. Who we share it with

We do not sell consumer health data. We share it only with service providers (processors) that act on our instructions, for the purposes in section 4: Supabase (storage), Railway (our API), OpenAI and xAI (AI features, only when AI is on, and we don't add your name, email or phone number; anything in a photo, document or call, such as a name printed on a lab report, is sent as-is), Resend and Twilio (messages you choose, which never contain your health details), Apple and Google (only data you choose to sync with Apple Health or Health Connect, and push notifications), and RevenueCat (purchase records only). We may disclose it if the law requires it. We never use it for targeted advertising, and we don't use conditions you track to target messages.

6. Your rights

You can:

• Confirm and access whether we collect, share or sell your consumer health data, and get a copy (in the app: Menu → Your data → Export my data).
• See who received it: the list in section 5. Email us for the processors and third parties involved for your account.
• Withdraw consent to the collection of your consumer health data, or for any single feature including AI features, at any time: in the app (Menu → Your data) or by emailing privacy@vitalyou.app. Withdrawing stops new collection; you can also delete what we hold.
• Delete your consumer health data, including from our archives (Menu → Your data → Delete my health data, or Delete my account → Now). After deletion we keep only a minimal deletion record with no health information, for one year, to prevent fraud.

To make a request by email, write to privacy@vitalyou.app from the address on your account. We may ask you to confirm with a code sent to your phone. We respond within 45 days (extendable once by 45 days where the law allows, and we'll tell you why). If we refuse a request, you can appeal by replying “Appeal” to our response; we answer appeals within 45 days, and if you disagree you may contact your state Attorney General (in Washington: atg.wa.gov/file-complaint).

7. Security

Consumer health data is encrypted in transit and at rest, stored with access controls, and only owners and administrators of VitalYou can view it, with a one-time code at every sign-in and an audit log. Support staff see account and billing details only.

8. Changes

We'll update the effective date above when this policy changes, and tell you in the app or by email before a material change takes effect.