Privacy Policy

Vitalis is built and operated by a small independent team. For the purposes of the EU and UK General Data Protection Regulation, the data controller is the individual who runs the project — a team is not a legal person, so the responsibility has to sit with a person. You can ask who that is, and where they are established, through the contact form; we will answer, and any request under this policy is answered in that person’s name.

For any request under this policy — access, correction, deletion, export, or a complaint — use the contact form on this site. We answer within one calendar month, and if a request is unusually complex we will tell you why within that first month and say when to expect the answer.

We collect what the product needs, and nothing else.

• Account — email address, and a password stored only as a hash by our authentication provider.
• Profile — sex, year of birth, height, activity level, training goal, weekly training frequency, available equipment, and any injuries or constraints you choose to write down.
• Body measurements — weight, body-fat percentage, circumference measurements, and the date of each entry.
• Training — workouts, exercises, sets, loads, repetitions, RPE (perceived exertion) and session duration.
• Nutrition and sleep — meals with calories and macronutrients; sleep duration.
• AI conversations — messages you send to the in-app assistant and the replies, so your history stays available to you.
• Technical logs — IP address, timestamp, requested URL and user agent, kept by our hosting provider for security and fault diagnosis.

What is required, and what is not. Only an email address and a password are required to create an account. Every other field is optional, and the app tells you what stops working when a field is empty: without weight, there is no BMI, no energy estimate and no weight trend; without body-fat percentage there is no body-composition reading; without waist there is no waist-to-height ratio. You can use the app with no account at all, in which case nothing leaves your browser.

We do not collect your name, phone number, address, payment details, contacts, photos, precise location, or advertising identifiers. There is no free-text field in the app that is required to be filled with anything identifying.

Under GDPR, processing needs a lawful basis under Article 6. Because some of this data is health data, it additionally needs a condition under Article 9. Those are two separate questions, and we answer both:

Where we rely on legitimate interest for security logs, the interest is keeping the service available and free of abuse. The logs are minimal, retained briefly, and not used for anything else.

Weight, body-fat percentage, injuries, sleep and training load are special category data under Article 9. We rely on your explicit consent to process it, and on the contract to store and display it back to you.

You give that consent through a separate, unticked box that you must tick before we send you a sign-in code to create an account. It is not bundled into the terms, and it is not pre-selected. We record the time you ticked it, so we can show that consent was given. You can withdraw it at any time, and withdrawing consent for one purpose does not require you to give up the rest of the service:

• To stop sending data to the AI provider — stop using the assistant. Nothing else in the app depends on it, and no account action is needed.
• To withdraw consent for health data — delete the individual entries, or ask us to delete your account and its records through the contact form. There is currently no self-service account deletion; a request is handled by hand.

Withdrawal does not affect processing that already happened.

We do not use health data for advertising, profiling for commercial purposes, or automated decisions with legal or similarly significant effects.

• In your browser — local storage, so the app works offline and loads instantly. This copy exists whether or not you have an account.
• In our database — if you create an account, records are synced to a Postgres database hosted by Supabase.

When you ask the assistant a question, a summary of your recent data is sent to a third-party AI provider. The summary is built from your records over roughly the last 30 days: your profile (sex, birth year, height, activity level, goal, training frequency, equipment, any injuries you wrote down), your latest weight and derived values such as BMI and energy targets, your weight trend, a summary of your training volume and recent sessions, a summary of your meals and macronutrient totals, your sleep figures, and any computed scores. It also lists which of these are missing, so the model does not invent them. That is the point of the assistant — it answers using your numbers rather than generic advice — but it does mean health data leaves our systems.

The provider is Agnes AI, reached through an OpenAI-compatible API. Requests are processed on their infrastructure, which may be outside your country. We send the data needed to answer your question and nothing else. We do not send your email address, and we do not send your full record history — only a recent summary.

This processing rests on your consent, which you give by using the assistant. If you would rather not send data to a third party, simply do not use it. Everything else — recording, charts, derived values, locally computed trends — works without it.

We use a small number of service providers. Each sees only what it needs:

• Supabase — authentication and database hosting. Sees account and record data.
• Cloudflare — hosting, CDN and request logs. Sees technical data.
• Agnes AI — language model inference. Sees the data summary described above, and only when you use the assistant.

We do not sell personal data and we do not share it with advertisers or data brokers. We disclose it otherwise only where a law or a valid legal process requires it, or where it is necessary to stop clear abuse of the service — and in that case only the minimum involved.

Our providers process data in several countries, including the United States, so your data may be transferred outside the EEA or the UK. Where that happens we rely on the contractual data-protection commitments those providers publish for their standard terms, and on their own technical safeguards.

If you need the specific mechanism and the countries involved for a particular transfer, ask through the contact form and we will set out what applies to your data.

• Records: kept while your account exists. Deleting an entry removes it from your browser and, on your next sync, from the server copy.
• Account data: kept until you ask us to delete the account. Deletion is currently handled by hand on request; there is no self-service button.
• Local browser copy: kept until you clear site data for this domain, or use the reset option in settings. There is no automatic expiry.
• Technical logs: held by our hosting provider, not by us. We do not keep a separate log archive and do not use logs for analysis.

• Access — a copy of the personal data we hold about you.
• Rectification — correct anything wrong; most of it you can edit directly in the app.
• Erasure — delete your data, including your account.
• Portability — export your data in a machine-readable format.
• Restriction — ask us to stop processing while a question is resolved.
• Objection — object to processing based on legitimate interest.
• Withdraw consent — at any time, without affecting processing already carried out.
• Complaint — lodge a complaint with your local supervisory authority.

Use the contact form to exercise any of these. We will not charge you, and we will not treat you differently for asking.

This section applies if the CCPA, as amended by the CPRA, applies to us. Its thresholds are revenue- and data-volume based, and this is a free service operated by an individual; we do not claim that we meet them. If it does apply, health information is sensitive personal information, and in addition to the rights to know, delete, correct and port, California residents have:

• The right to limit the use and disclosure of sensitive personal information, where it is used beyond the purposes permitted without a limit.
• The right not to be discriminated against for exercising any privacy right.
• The right to opt out of the sale or sharing of personal information — we do neither, so there is nothing to opt out of.

We use sensitive personal information only to provide the service — storing it, computing the estimates you asked for, and sending a summary to the AI provider when you use the assistant. The app does derive characteristics from it (body-fat estimates, trends, scores); it does not use them for advertising, and it does not build a profile for any purpose other than showing you your own data.

Voluntary commitment. Whether or not the CCPA applies to us, we will honour the three rights above on request.

We set one cookie — vitalis.locale — to remember whether you prefer English or Chinese. It is strictly functional and contains no identifier.

Your records live in browser local storage, not in a cookie. There are no advertising or analytics cookies, no pixels, and no third-party scripts.

Data is encrypted in transit. Passwords are stored only as hashes by our authentication provider. Access to the database is restricted to the application itself.

No system is perfectly secure. If a breach affects your personal data, we will tell you without undue delay, describing what happened and what we are doing about it. We will also notify the relevant supervisory authority within 72 hours where GDPR requires it.

We apply the FTC Health Breach Notification Rule standard whether or not it is legally binding on us. That means, for affected US residents:

• Direct notice without unreasonable delay, and no later than 60 calendar days after discovery.
• Notice to the FTC at the same time as individual notice where 500 or more people are affected; below 500, an annual aggregated filing within 60 days of the end of the calendar year.
• Notice to prominent media serving any state or jurisdiction where 500 or more residents are affected, within the same 60-day window.

Sixty days is a ceiling, not a target. The rule also covers unauthorised disclosure that is not a hack — for example data exposed through a misconfiguration — and our internal process treats both the same way.

We do not make automated decisions that produce legal or similarly significant effects about you. The app computes estimates and generates suggestions; you decide what to do with them. There is no profiling for advertising, credit, insurance or eligibility.

Vitalis is not intended for anyone under 16, and we do not knowingly collect data from children. If you believe a child has created an account, contact us and we will remove it.

If we change how we handle data in a way that affects you, we will update this page and change the date at the top. Material changes will be announced in the app at least 30 days before they take effect, so you have time to object or delete your data.

Use the contact form on this site for any question, request or complaint about this policy. If you are not satisfied with our response, you have the right to complain to your local data protection authority.