Privacy Policy

1. Scope and how HIPAA applies

Some of your information is protected health information ("PHI") under the Health Insurance Portability and Accountability Act ("HIPAA"). Your Providers and Pharmacies are HIPAA-covered entities. When we handle PHI on their behalf (for example, your consultation, prescription and pharmacy records), we do so as their business associate, and their Notice of Privacy Practices governs that information. You can request it at privacy@vytal-med.com.

This Privacy Policy covers all other personal information we process, including information you give us on our website, in our questionnaire and in our app, which may be "consumer health data" under state law (see Section 9).

2. Information we collect

Information you give us:

• Identity and contact: name, email, phone number, shipping and billing address, date of birth.
• Health information: answers to our eligibility questionnaire, height, weight, BMI, medical history, conditions, medications, allergies, goals, side effects, progress photos, measurements and lab results you upload or authorize.
• App and coaching data: food photos and logs, workouts, sleep, hydration, injection logs, messages with our AI guides and coaches, and data you choose to connect from Apple Health or Google Health Connect.
• Payment information: processed by Stripe. We receive limited details (for example, card type, last four digits and billing ZIP) but do not store full card numbers.
• Communications: support requests, survey responses, reviews and content you post.
• Identity verification: a photo of your government ID and/or a selfie, where required by your Provider or Pharmacy.

Information collected automatically:

• Device and usage data: IP address, device type, operating system, browser, pages and screens viewed, clicks, referring URL, approximate location derived from IP, and crash and performance logs.
• Cookies, SDKs and similar technologies (Section 5).

Information from others:

• Providers and Pharmacies (prescription status, shipment tracking).
• Lead-generation, marketing and referral partners (for example, contact details and how you heard about us).
• Payment processors and fraud-prevention services.

3. How we use information

• Provide the Services: check eligibility, create your account, coordinate consultations, route prescriptions to Pharmacies, arrange shipping and run the app.
• Personalize your program and AI guidance.
• Process payments, subscriptions, refunds, referral credits and promotions.
• Communicate with you about your account, orders, treatment reminders and support.
• Send marketing, with your consent where required (you can opt out anytime).
• Measure and improve the Services, using de-identified or aggregated data where possible.
• Protect safety and security, prevent fraud, and comply with law and regulatory requests.

We use health information only to provide the Services you request, for safety and legal compliance, or as you otherwise authorize. We do not use health information for targeted advertising.

4. How we disclose information

• Providers and medical groups, so they can evaluate and treat you.
• Pharmacies, so they can dispense and ship medication.
• Service providers under contract, who process data only on our instructions: cloud hosting, databases, AI model providers, payments, email and SMS delivery, customer support, analytics and error monitoring. Where they handle PHI, they sign business associate agreements.
• Shipping carriers, limited to name, address and package details.
• Professional advisers such as lawyers, auditors and insurers.
• Legal and safety: to comply with law, subpoenas or court orders, or to protect the rights, safety or property of you, us or others.
• Business transfers: in a merger, financing, acquisition or sale of assets, subject to this Policy.
• With your consent or direction, for example when you ask us to share a progress report with your own doctor.

We do not sell personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined in California law, except as described for non-health website data in Section 5, which you can opt out of.

5. Cookies, pixels and analytics

We use cookies, SDKs and similar tools to run the Services, remember preferences, measure performance and, on our public marketing pages only, measure advertising.

• Essential and analytics tools (for example, product analytics and error monitoring) help us operate and improve the Services.
• Advertising tools (for example, Meta, TikTok and Google) may be used on public marketing pages to measure ad campaigns. They are not placed on our questionnaire, checkout, account or app health screens, and we do not send them your health information.
• Your choices: you can manage cookies in our cookie settings and your browser. We honor Global Privacy Control (GPC) signals as an opt-out of targeted advertising and "sharing". We do not respond to "Do Not Track" signals.

6. AI features

Our app uses AI models provided by third parties (for example, Anthropic) to power our AI guides and food-photo analysis. We send these providers only the information needed to generate a response. AI responses are informational and are not medical advice.

7. Texts, calls and emails

If you give us your phone number and agree, we may send you texts and make calls about your account and treatment, and, with your separate consent, marketing messages. Reply STOP to opt out of texts. We do not share or sell your mobile number or text-messaging consent with third parties for their marketing. You can unsubscribe from marketing emails using the link in each email; we will still send service messages.

8. Your choices

• Update your account and health profile in the app or by contacting us.
• Opt out of marketing emails, texts and push notifications at any time.
• Disconnect Apple Health or Google Health Connect in your device settings.
• Request access, correction or deletion as described in Sections 9 and 10. Some records must be kept by Providers and Pharmacies under medical and pharmacy record laws.

9. Consumer Health Data Privacy Notice (Washington, Nevada, Connecticut and similar laws)

This section applies to "consumer health data" as defined by the Washington My Health My Data Act, Nevada SB 370, Connecticut law and similar laws.

• Categories we collect: health conditions, symptoms, medications, weight and body measurements, eligibility answers, progress photos, food, activity and sleep data, injection logs, and inferences about your health status derived from this data.
• Sources: you, your devices and connected health apps, Providers and Pharmacies.
• Purposes: to provide the Services you request (eligibility, consultations, prescriptions, shipping, app features), to process payments, for safety, security and fraud prevention, and to comply with law.
• Sharing: with Providers, Pharmacies and service providers acting on our behalf, as described in Section 4. We do not share consumer health data with third parties for their own purposes without your consent.
• Consent: we collect consumer health data only with your consent or as necessary to provide the Service you request. We ask for separate consent before sharing it beyond that.
• No sale and no geofencing: we do not sell consumer health data and do not use geofences around healthcare facilities.
• Your rights: you may confirm whether we collect, share or sell your consumer health data; access it, including a list of third parties and affiliates it was shared with; withdraw consent; and request deletion. Use the methods in Section 10. We respond within 45 days and you may appeal any denial.

10. Your state privacy rights

Depending on where you live (including California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia), you may have the right to:

• know and access the personal information we hold about you, and get a portable copy;
• correct inaccurate information;
• delete your information, subject to legal exceptions;
• opt out of targeted advertising, "sale" or "sharing", and profiling with significant effects;
• limit the use of sensitive personal information (we use it only as permitted to provide the Services);
• not be discriminated against for exercising these rights.

How to submit a request: email privacy@vytal-med.com or use Account > Privacy in the app. We will verify your identity by matching information in your account. You may use an authorized agent with your signed permission. We respond within the time required by law (generally 45 days).

Appeals: if we deny your request, you may appeal by replying to our decision or emailing privacy@vytal-med.com with "Appeal" in the subject. If you are not satisfied with the outcome, you may contact your state Attorney General.

California notice at collection (last 12 months). For each category: examples, and who we disclose it to for a business purpose.

• Identifiers (name, email, phone, address, IP address): Providers, Pharmacies, service providers, carriers.
• Customer records (billing details, payment confirmation): payment processor, service providers.
• Characteristics of protected classifications (age, sex): Providers, Pharmacies.
• Commercial information (plans purchased, orders, referrals): service providers.
• Internet activity (pages viewed, app usage): analytics providers; ad partners (public pages only).
• Approximate geolocation (location from IP or shipping address): service providers, carriers.
• Audio, electronic, visual (progress and food photos, support calls): service providers, Providers.
• Sensitive personal information (health data, account login, government ID): Providers, Pharmacies, service providers.
• Inferences (recommended plan, progress insights): service providers.

We retain each category as described in Section 11. California residents may also request information about disclosures for direct marketing under California Civil Code 1798.83; we do not make such disclosures.

11. Data retention

We keep personal information only as long as needed for the purposes in this Policy: generally for the life of your account, and longer where medical, pharmacy, tax or other laws require (medical and pharmacy records may be kept by Providers and Pharmacies for 7 years or more). App data you delete is removed from active systems, and from backups on their normal cycle.

12. Security

We use administrative, technical and physical safeguards, including encryption in transit and at rest, access controls and audit logging. No system is completely secure. If a breach affects your information, we will notify you and regulators as required by law, including HIPAA and the FTC Health Breach Notification Rule.

13. Children

The Services are not intended for anyone under 18, and we do not knowingly collect personal information from children under 13. If you believe a minor has given us information, contact us and we will delete it.

14. Where we process data

We are based in the United States. Where information is processed outside the U.S., we use contractual and technical safeguards and, for PHI, comply with our agreements with Providers and Pharmacies.

15. Changes to this Policy

We may update this Policy. We will post the new version with its date and notify you of material changes by email or in the app before they take effect. We will ask for your consent where the law requires it.

16. Contact

VYTAL MED HEALTH & WELLNESS CORP (Vytal & Co.), Attn: Privacy, 8012 NW 68th St, Miami, FL 33166

Email: privacy@vytal-med.com