Vitaclaris Privacy Policy

2. What the app keeps on your device

Everything below is kept in the app's private storage on your iPhone or iPad, which iOS encrypts, and in your device's backups (iCloud Backup or your computer) if you've turned them on, except visit recordings (below). Vitaclaris never copies it to iCloud, and sends it to us only sealed: through sync, a doctor link or a shared family profile, when you use them (below and section 5).

• Apple Health data you allow, type by type: medications and doses; workouts, steps, distance, walking speed and steadiness, exercise minutes and active energy, including the workouts other apps save there, with the app's name; weight, body fat, lean mass, BMI and waist; sleep, with overnight blood oxygen, breathing rate, breathing disturbances and wrist temperature, and sleep apnea notifications; heart rate, resting and walking heart rate, heart rate variability, heart rate recovery and VO2 max; ECGs and AFib History; blood pressure, and Apple Watch's hypertension notifications; blood glucose; nutrition and water, including the meals other apps save there (their nutrients, food names and the app's name); cycle tracking (periods, spotting, the cycle deviations Apple flags, ovulation tests and basal body temperature, and contraception, pregnancy and lactation as context); the symptoms Apple Health logs (such as hot flashes, sleep and mood changes, abdominal cramps or headaches); from iOS 27, the menopause stage you logged in Apple Health and bleeding after menopause; hearing tests and the sound levels around you and in your headphones; State of Mind, and the mood and anxiety questionnaires (PHQ-9, GAD-7) saved there; alcoholic drinks; height, sex and date of birth.
• Health records from your providers, the kinds you allow when you connect Health Records (Settings → Apple Health → Health Records): allergies, conditions, immunizations, lab results, medications, procedures, vital signs, clinical notes and insurance coverage. Each is kept exactly as your provider sent it, along with what Vitaclaris reads from it. When Apple Health no longer has a record (some providers share only recent ones, and removing an account in the Health app removes its records), Vitaclaris keeps its copy, marked "Only in Vitaclaris", until you delete it in the app.
• Your profile and health background: name, goals, what you chose in the welcome questions, conditions, surgeries and injuries, allergies, family history, smoking and alcohol.
• What you log: medications and doses (taken, skipped or missed), side effects you note for a medication, how much of each medication you have left for refill reminders, meals with their photos, water, fasting, workouts, flares (such as gout, headaches or reflux), mood, your answers and scores in the wellbeing check (every two weeks, on the Wellbeing tab), your answers to the mood and anxiety questionnaires on the Longevity tab (PHQ-9, GAD-7), the women's health symptom log (each symptom, how strong, when, and an optional note) and the stage you chose, the bone density scans you enter, the readings you type (blood pressure, weight, glucose, resting heart rate and VO2 max, with an optional note) and the lab results you type (each value with its unit and date), kept and used like the ones Vitaclaris reads from your documents and Apple Health, what you mark as handled in Your plan and Labs to ask for (discussed with your doctor, with a note if you add one, not for you, or later), the tests you mark as done, and other wellbeing entries.
• Appointments and visits: your doctors and care team, with the details you enter or fill in from a contact you pick (the app sees only that contact), your questions and concerns, notes, action items and the follow-ups a visit left.
• Visit recordings, if you record a visit (below).
• Medical documents you add (from Files, Photos, the camera or other apps) and what's read from them.
• Your care circle: the names, emails and phone numbers you enter or pick from Contacts, and the updates and summaries written for them. When you pick a contact, the app sees only that contact.
• Family profiles, if you keep one for someone you care for (below).
• Your questions in Ask and the answers, and the explanations and insights you ask for in the app's screens, saved so they open again without being sent again until the information behind them changes.
• Files you import, such as a Vitaclaris records file someone sends you, or a health data export from your Oura account.
• Your Vitaclaris sign-in, kept in the device's Keychain.
• On your Apple Watch, if you use Vitaclaris's watch app: a copy of today's and tomorrow's summary (water, medications and doses, fasting, appointments and to-dos), which your iPhone sends to the watch over Apple's own watch connection, not through our server, and none of it is kept in iCloud. What you tap on the watch waits there until your iPhone has it. The watch app has no account, network access or AI.

Visit recordings. If you record a visit (Visits → Record the visit), the app keeps the audio, the transcript Apple's speech recognition makes from it on your device, and when you confirmed that everyone in the room agreed to be recorded.

• They stay on that iPhone or iPad only. Unlike everything else here, they're left out of your device's backups, the backup file and sync.
• The audio never leaves the device. The transcript's text goes to Anthropic only if you ask Claude for the summary (section 4).
• While you record, it keeps recording with the screen locked or in another app, only after you started it, with the system's microphone indicator on. It never starts by itself, and it stops after 2 hours.
• How long: the audio is deleted once you save the visit's summary, unless you turn on Keep the audio after the summary. The transcript stays until you delete the recording. Delete one recording, or all of them, in the Visits tab's settings.

Family profiles. If you keep a profile for someone you care for (Settings → People on this iPhone), the app keeps their name, who they are to you and, if you add them, their birth year and sex, and their own records, medications, visits and documents.

• Kept apart from yours, in its own place on your device. Widgets never show it, and it's never read from your Apple Health or saved to it.
• Not in your backup file: each profile has its own.
• Not synced to your other devices, unless you share the profile (below).
• Sharing a family profile: a profile you share (a parent's, a child's) syncs between the people you invite. It's end-to-end encrypted with the profile's own key, never your account's. Our server only passes the sealed copy along: it sees which accounts and devices share it, sizes and times, never what's in it.
• Invites: the key travels in the invite link's private part, which never reaches our server. Each invite works once and expires after 48 hours.
• Removing someone changes the key, and their app deletes its copy. We can't guarantee that copies made before are gone.

Simple view. If you turn it on (Settings → Turn on Simple view), Vitaclaris shows the same records in bigger, simpler screens.

• Its choices are this device's own: whether it's on, which readings show and the text size are kept on this iPhone or iPad and never synced. A family member's phone can show your shared profile in the full app while your own phone shows it in Simple view.
• Assistive Access: if your iPhone uses Apple's Assistive Access, Vitaclaris opens there in Simple view, on the same data.
• The passcode, if one is set: kept only as a salted hash in this device's Keychain, never the digits, and never in backups or iCloud Keychain. It only keeps Simple view from being turned off by accident. If you forget it, a family member who shares your profile can set a new one or remove it from their phone (the new hash, or the removal, travels in your shared profile, end-to-end encrypted); if no one shares it, your iPhone's own passcode, Face ID or Touch ID opens it, through iOS.
• Your family's numbers: the names, relations and phone numbers your family adds for Simple view's Call buttons and health card are kept in your shared profile, end-to-end encrypted.
• Setting up a parent's phone: the invite says only whether to start in Simple view. The passcode's salted hash (never the digits) and the check-in's time travel in your shared profile's settings, end-to-end encrypted, and the shared profile notes which account's phone is the person's own.
• Nothing goes to an AI from Simple view, and nothing new leaves the phone except "I'm OK today" (section 5).

When you make a backup (Settings → Your data), the app writes all of the above, except the sign-in and visit recordings, into one file and saves it where you choose, such as a folder in Files or a drive. That file isn't encrypted: keep it somewhere private.

Sync and backup are off until you turn them on in Settings → Your devices; until then, each iPhone or iPad keeps its own copy. With them on:

• What's sent: everything above as it changes, except your sign-in, visit recordings, each device's own settings (such as its reminders) and the Apple Health data in the first item above: each device reads Apple Health itself, with your permission, and what the app read from it travels only inside your records, such as the readings an Ask answer used. The health records from your providers do go in the copy, sealed like everything else and never in iCloud, so all your devices have them, even one that isn't connected to Health Records.
• How it's sealed: each device seals what it sends before it leaves, with keys made on your devices and kept in each one's Keychain. Vitaclaris's server keeps only the sealed copy: it can't read your records, their kinds, your file names or your devices' names, and neither can we or Cloudflare.
• Your recovery key opens the copy on a new device when no other one is at hand. You keep it; if you choose, the app also keeps it in your iCloud Keychain, which Apple encrypts end to end, so your devices on the same Apple Account find it there. Your health records never go to iCloud. If you lose every device and the recovery key, nobody can open the copy, us included.
• Turning sync off on a device stops it there only; that device keeps its data. Deleting the copy (Settings → Your devices) stops sync on every device, each keeping its own data, and deletes the copy from our server (section 13).

Vitaclaris saves to Apple Health the meals (calories and nutrients) and the water you log, the symptoms in your women's health symptom log if you allow it, your answers to the Longevity tab's mood and anxiety questionnaires (PHQ-9, GAD-7) if you allow it, the blood pressure, weight, glucose, resting heart rate and VO2 max readings you type if you allow it when Vitaclaris first asks, marked as entered by you, and, when you ask, data another device recorded but didn't save there, such as sleep and heart rate from an Oura export. Typed readings go to Apple Health only for you: your own profile, or a shared profile that is yours on your own iPhone (readings your family typed for you there included), never someone else's. Changing the reading in Vitaclaris changes it there too, and Undo, or deleting it, takes it back out of Apple Health. What's in Apple Health is kept by Apple Health, under Apple's privacy policy.

Read, not kept: food from other apps and the blood pressure and glucose programs read Apple Health each time they're shown, and don't store what they read, so it's not in the backup file or sync: the meals other apps saved there for the last 45 days, blood pressure readings for the last 120 days, and glucose readings for the last 14 days. A meal you delete in the other app disappears here too. You can stop counting other apps' food in Nutrition's settings, for every app or app by app.

Widgets and the watch's complications show the numbers and items you choose on your Home Screen, Lock Screen and watch face, where anyone who can see your device can see them. What the women's health and bone health programs show on the Health tab stays inside the app, never in widgets.

3. What we receive

We don't receive your health records or anything the app reads from Apple Health, except what passes through our server, without being kept, when you use an AI feature (section 4), and, sealed so we can't read them, the copies you choose to keep with us: your sync copy (section 2), doctor links and shared family profiles (section 5). We receive and keep only:

• Your account, if you sign in with Apple to use Vitaclaris Plus: Apple's identifier for you in Vitaclaris, the name and email that Apple shares the first time you sign in (if you choose Hide My Email, we get an address that forwards to yours), and a token from Apple, kept encrypted and used only to cancel your sign-in when you delete your account.
• Sync and backup, if you turn them on: the sealed copy of your records, photos and documents, with its recent history (section 13); how big each sealed piece is, rounded up so sizes say little, and when it was sent; and your devices, each with a random identifier, its public key, when it was added and the day it last synced. Everything else about your devices, their names included, is sealed.
• Shared family profiles, if you share one: the profile's sealed copy, kept like your sync copy, and who shares it (the members' accounts and devices, with sizes and times).
• Doctor links, if you make one (section 5): the summary sealed on your device, which we can't read. For each link: your account, a random id, the sealed copy's size (rounded up so it says little), when it was made, updated and opened (the newest 50 times, and a count), and when it ends or was turned off. We don't keep the IP address or browser of anyone who opens it. To limit misuse, opens are counted under a scrambled form of the IP address, deleted within a day.
• Missed-dose alerts and check-in notices, if you turn them on for a shared profile: your devices' push addresses from Apple, which of the two each device wants, and when alerts were sent (for 30 days).
• "I'm OK today" check-ins, if a shared profile uses them: for each check-in, the shared profile, the account that sent it, when, and a key that only tells one day from another (made on the phone under the profile's key), kept 30 days, to send one notice a day and to limit misuse. Never what the check-in says.
• Your plan and purchases: Apple handles payment and never gives us your card details. We receive the records of your purchases (which plan or pack, when, renewals, refunds and Apple's transaction numbers) from the App Store and from Apple's notifications, to give you your questions.
• Your balance and AI usage: your questions left, and for each AI request, the feature, the model, its size and number of pages, the tokens Anthropic counted and what it cost, whether it worked, the questions it counted and when. Never its content.
• Look-ups of public health sources (section 5): how many you make each minute and each day, to prevent misuse, deleted after a day. Which codes were looked up is kept only in a shared cache of public information, never with who asked.
• Messages you send us: your email address and what you write, to answer you. They're kept in our email, which Google Workspace provides.
• What you send on our website, if you do: your email for news about Vitaclaris, and the features you suggest (section 10).
• Beta testing: if you test Vitaclaris with TestFlight, Apple gives us the name and email you were invited with, your device model and iOS version, crash reports, and the feedback and screenshots you choose to send.
• App Store statistics: Apple gives us download and sales figures in aggregate, and crash reports and usage statistics only from people who chose in iOS Settings to share analytics with app developers.
• Which of our ads brought you, if one did: the first time you open the app, it asks Apple's attribution service, from your device, whether you downloaded Vitaclaris after tapping one of our ads in the App Store. If you did, the app keeps the ad's campaign, ad group and keyword (Apple's numbers for them) and the country on your device, and adds one to that ad's counts on our server when you sign in, start a free trial and first pay for Vitaclaris Plus, so we can see which ads bring people who stay. We keep only those counts, never with your account or anything about you, and your device forgets the ad after your first payment or 60 days. You can turn it off in Settings → Account and plan → Apple Ads.

We don't use advertising or analytics tools from other companies, and we don't track you across other apps or websites.

4. AI features: what's sent, and to whom

Vitaclaris's AI features use Claude, made by Anthropic, PBC, except a few short texts written on your device (below). They're optional, they come with Vitaclaris Plus (including its free week) and extra questions, and they run only after you allow them in the app. Everything else in Vitaclaris works without them.

When you use an AI feature, the app sends the request to Vitaclaris's server (api.vitaclaris.com, which runs on Cloudflare; versions before 1.5.1 use its earlier address, api.vitaspan.app). The server checks that you have questions left and passes the request on to Anthropic under Vitaclaris's account, and the answer comes back the same way. The server doesn't store or log the content of requests or answers: no questions, documents, photos or replies. It keeps only the usage details in section 3. With each request, Anthropic receives a random identifier for your Vitaclaris account (not your name or email), which it can use to detect misuse.

No explanation or insight gets your wellbeing check. Each one is saved on your device (and in your sealed sync copy, if you use sync) and opens again without anything being sent, until the information behind it changes.

Women's health stays out of AI. No AI feature, with Claude or on your device, gets the cycle tracking and symptoms Vitaclaris reads from Apple Health, the menopause stage, your symptom log, or the plan items and questions the women's health and bone health programs make from them. This doesn't change what you choose to send yourself, such as a document you ask Claude to read.

On a family profile, an AI feature sends that person's information the same way, only when you use it on their profile, under your permission and counting your questions. The wellbeing check is off for family profiles.

Anthropic handles these requests as our service provider, under its commercial terms and privacy policy, which give them the same or equal protection as stated in this policy: it doesn't train its models on them, and it deletes them within 30 days, unless they're flagged for a safety review (then up to 2 years) or the law requires keeping them longer.

To stop the AI features, take back your permission in Settings → Account and plan, or simply don't use them; to stop paying for them, cancel Vitaclaris Plus in your device's Settings → your name → Subscriptions.

Written on your device with Apple Intelligence. If your iPhone or iPad has Apple Intelligence turned on, in a language it supports, Vitaclaris uses Apple's on-device model for a short recorded visit's summary and the medications mentioned in it, for the sentence at the top of What changed, and, without Vitaclaris Plus or when you're offline, to combine a visit's questions that ask the same thing.

• Nothing is sent. The model runs on your device. Vitaclaris doesn't use Apple's Private Cloud Compute, so nothing goes to Apple, to our server or to Anthropic, and these texts are free.
• The app checks each text first. A text with a number, a condition or advice about a dose that isn't in your information, or in the wrong language, isn't shown. In a summary of your own words, a sentence that isn't in them is left out. Instead of a text that isn't shown, you get the app's own text, or the choice to use Claude, with its cost.
• Labelled: these texts say they were written on your device with Apple Intelligence.
• They never use your wellbeing check or your women's health data.
• Kept like the feature's data: a text you save is kept like the rest of that feature's data.

Voice questions. Apple's speech recognition turns what you say into text, on your device when your language allows it and otherwise on Apple's servers, under Apple's privacy policy. We don't receive the audio. Spoken answers are produced on your device. A recorded visit is transcribed on your device only, with Apple's speech model for its language, which iOS downloads once.

5. Other services the app uses for you

• Apple: Sign in with Apple, the App Store for purchases, subscriptions and refunds, if you choose, iCloud Keychain for your sync recovery key, Apple's push notification service for missed-dose alerts to family, Apple Ads attribution (which of our App Store ads, if any, led to the download; section 3), and, if you've turned it on, Apple Intelligence, whose on-device model writes some texts on your device (section 4), under Apple's privacy policy.
• Cloudflare runs Vitaclaris's server, its database, the storage that keeps the sealed copies (sync, shared family profiles, doctor links), and this website.
• Open Food Facts, a public food database: when you scan a food barcode, only the barcode number is sent, to find the product.
• Public health information: MedlinePlus and RxNorm, from the U.S. National Library of Medicine, and drug labels from the U.S. Food and Drug Administration (openFDA). When an explanation uses them, when you tap Show what the label says on a medication, or when you tap Find the generic name, the app asks Vitaclaris's server for the code of the test, condition or medication (a LOINC, ICD-10, SNOMED or RxNorm code), or for the name of a medication you typed. The server looks it up and keeps the public answer by that code for a day, for anyone who asks, so these services never receive your IP address or anything about you, and we don't keep who asked for what. What a label says about when to take a medication is kept on your device.
• Your calendar: when you add an appointment to your calendar, iOS's own calendar screen saves it. Vitaclaris doesn't read your calendar.
• Reminders and notifications are scheduled on your device, with no server except for missed-dose alerts and "I'm OK today" notices to family (below), and planned again there in the background. They show on your Lock Screen, so they say only short medication names and what to do, never results or conditions; a family profile's reminders also show that person's first name, Simple view's reminders also say the amount and when to take it, and, on a shared profile, the first names of the family who can see it, and the weekly brief's notification shows counts only (such as "1 visit · 3 things due"). If you turn on Say them out loud, the system's voice makes each reminder's words into a short sound on your device, kept in the app's storage until it's no longer needed: nothing leaves your device, and anyone nearby can hear it. You choose which ones you get, and you can turn them off in your device's Settings.
• Missed-dose alerts. If the members of a shared profile turn them on, a missed dose sends them a short alert: the profile, the dose's time and the medication's short name. It's sealed with the profile's key and goes through our server and Apple's push notification service to their devices. Our server sees the shared profile, the recipients' devices and the time, never what the alert says; it doesn't keep the alert after delivery, and it keeps the send times for 30 days to limit how many go out. Each device's push address from Apple is kept until that device is removed. On a Lock Screen, the medication's name shows only if that phone allows notification previews.
• "I'm OK today." If it's turned on for a shared profile, the person taps it once a day on their own phone. The tap (the day, the time and the time zone) is kept in the shared profile, end-to-end encrypted, so the family sees it when their app syncs. Members who turn on "Tell me when … checks in" also get a quiet notification, sealed with the profile's key and sent through our server and Apple's push notification service. If it isn't tapped by the chosen time, the person's own phone shows one gentle reminder; nobody else is told. It isn't an emergency service: in an emergency, call your local emergency number.
• Updates and summaries for your care circle go out through your own Mail, Messages or WhatsApp, from your accounts, not ours.
• Your medical summary, the PDF of your history, medications and latest results, is made on your device, without AI. It includes Research estimates (Heart risk and Blood age, with the values they used) unless you leave them out before making it. The app deletes its copy when you close the summary, and the PDF goes only where you share it. The request sheet in Labs to ask for (the tests, why, and the sources) and the blood pressure log for your doctor (your readings with their averages) are made on your device the same way; the app keeps only the latest blood pressure log.
• A doctor link shows your medical summary as a web page instead. You need to be signed in. It's sealed on your device with a new key for each link, and kept on our server only sealed. The key is in the link itself, in the part after the #, which browsers don't send to a server, so we, Cloudflare and anyone without the whole link can't read it. Anyone with the whole link can read it in a browser until it ends: your doctor, or anyone you or they pass it on to. It ends after 1, 7 or 30 days, as you choose, or when you turn it off, from any of your signed-in devices, and its sealed copy is deleted then. While it's on, the device that made it updates the sealed copy when your summary changes. The page sets no cookies, has no analytics and loads nothing from other companies; its code comes from our server, as with any page that opens sealed data in the browser.
• Lab portals: Vitaclaris never signs in to a lab's portal or app and never sees those passwords. You download your results there and add the PDF to Documents, where it's read like any document, only when you say so.
• Calls and links open your Phone app or your browser, and Directions opens Apple Maps with the appointment's place, as you typed it. The FRAX calculator (fraxplus.org), linked from Bone health, opens in your browser, and Vitaclaris sends it nothing.

6. Your account and Vitaclaris Plus

• Vitaclaris is free. Vitaclaris Plus, an auto-renewing subscription sold by Apple (monthly or yearly, with a free week the first time), adds the AI features that use Claude, with a monthly allowance of questions; packs of extra questions are one-time purchases. Apple bills them, and you manage or cancel the subscription in your device's Settings → your name → Subscriptions. Refunds are requested from Apple. You can also redeem an offer code from Vitaclaris in Settings → Account and plan; it's handled like a purchase.
• Deleting your account: in Settings → Account and plan → Delete account. We delete your account, your balance, your sign-in sessions and your AI usage records right away, delete the sync copy, your doctor links and the family profiles you share (section 13), and ask Apple to cancel your Sign in with Apple. Purchase records are kept, without your account, because tax and accounting law requires it. Deleting your account doesn't cancel an App Store subscription: cancel it in Settings → your name → Subscriptions. The records on your device aren't affected.

7. How we use and share information

We don't sell your information or share it for advertising. We don't use health information, including Apple Health data, for advertising, marketing or data mining, and we don't use it to train AI models.

We use what we receive only to provide Vitaclaris Plus (your account, purchases and balance), to keep the sealed copies you choose to keep with us (sync, doctor links, shared family profiles), to answer AI requests, to send the missed-dose alerts you turn on, to prevent misuse, to count which of our ads bring people who try or subscribe (counts by ad only, section 3), to answer you, to send the news you sign up for (section 10), to fix and improve the app (from usage counts, crash reports and what you choose to tell us, never from your records or the content of your AI requests), and to meet legal obligations.

Service providers process it for us, only for these purposes: Cloudflare (our server, database, storage and website), Anthropic (AI requests), Apple (sign-in, payments, push notifications and beta testing) and Google Workspace (email). Each of them is bound, by its agreement with us and its own privacy terms, to give your information the same or equal protection as stated in this policy. We'd disclose it otherwise only when the law requires it, to protect someone's safety, or as part of a sale of Vitaclaris, where the new owner must keep the promises in this policy and we'd tell you first.

8. Your choices and rights

• Delete any entry, document, recording or conversation in the app, or delete the app to remove everything it keeps on your device. Copies in your backups remain until those backups are replaced, and what Vitaclaris saved to Apple Health stays there until you delete it in the Health app. With sync on, a deletion reaches your other devices, and the sealed copy keeps the earlier version for a while (section 13).
• Turn sync off on a device, or delete the copy on Vitaclaris's server, in Settings → Your devices (section 2). Deleting your account deletes the copy too.
• Turn a doctor link off from the medical summary on any of your signed-in devices: its sealed copy is deleted at once.
• Remove a family profile in Settings → People on this iPhone: their records, documents, medications and settings on that device are deleted. For a shared profile, you can also remove anyone you invited.
• Turn "I'm OK today" off in Simple view's Settings, or stop being told about it on your phone, at any time.
• Delete your account in Settings → Account and plan → Delete account (section 6).
• Stop the AI features by taking back your permission in Settings → Account and plan.
• Turn Apple Ads attribution off in Settings → Account and plan → Apple Ads: your device forgets the ad, and nothing more is counted.
• Stop sharing Apple Health data, or stop Vitaclaris saving to it, at any time: your device's Settings → Privacy & Security → Health → Vitaclaris. The health records Vitaclaris already has stay until you delete them in the app (section 2).
• Turn notifications off in your device's Settings → Notifications → Vitaclaris.

You can also ask us to confirm what we hold about you (section 3), and to give you a copy, correct it or delete it. Write to privacy@vitaclaris.com. We answer within 45 days, and we won't treat you differently for asking. If we turn down a request, you can appeal by replying to our answer; if we deny the appeal, you can contact your state's attorney general.

9. Consumer health data (Washington, Nevada, Connecticut and other states)

This section is our consumer health data privacy policy.

• What we collect and why: when you use an AI feature, the health information that request needs (section 4) passes through our server to Anthropic, to produce the answer you asked for. When an explanation uses public health information, or you look up a medication's generic name, the code of the test, condition or medication, or the medication's name, passes through our server too (section 5), and is kept only in a cache of public information, not linked to you. It can include health conditions, symptoms you describe, medications, test results and medical documents, measurements such as weight, blood pressure and glucose, nutrition, exercise, sleep, mood and wellbeing check scores, and reproductive or sexual health information only if it's in what you wrote, the documents you added or the health records you connected, never from the women's health program (section 4). We don't keep it. If you turn on sync or share a family profile, we also keep a sealed copy of those records, which can hold all of that (section 2), only to keep your devices, or the people you invited, in step and back them up for you; it's sealed on your device with keys we don't have, so we can't read it. If you make a doctor link, we keep your summary sealed until the link ends, only to show it to whoever has the link; we can't read it. If a shared profile uses "I'm OK today", each check-in passes through our server sealed, and we keep only that one was sent, by which account and when, for 30 days. We don't collect consumer health data in any other way, and if a suggestion sent from our website includes some, we delete it when we read it (section 10).
• Where it comes from: you (about yourself, or about someone whose family profile you keep), Apple Health (with your permission), your health care providers, whose records reach Vitaclaris through Health Records in Apple Health (also with your permission), the documents you add, and the files you import.
• Who we share it with: only Anthropic, our service provider, to answer the request (section 4). The public health services in section 5 receive only a code or a medication's name from our server, never anything that identifies you. Cloudflare, our service provider, stores the sealed copies and can't open them. A doctor link is shared by you, with whoever you give it to, and a shared family profile with the people you invite. We never sell it.
• Your consent: the AI features run only after you allow them, and you can take that back at any time in Settings → Account and plan. Sync runs only after you turn it on, on a screen that says what's sent; you can turn it off and delete the copy at any time in Settings → Your devices. Doctor links, shared family profiles, missed-dose alerts and "I'm OK today" work only after you make or turn them on, each on a screen that says what it does, and you can end them at any time.
• What the app keeps on your device (section 2) stays there, and reaches us only sealed, as described above.
• We don't use your location or geofencing.
• Your rights: you can ask us to confirm whether we collect, share or sell your consumer health data, to see it, and to delete any we have, at privacy@vitaclaris.com. The sealed copies hold your own records, which you see in the app; we can't open them, but you can delete them yourself (Settings → Your devices, the medical summary or People on this iPhone), or ask us to. Appeals work as in section 8.

10. This website

vitaclaris.com is a static website hosted by Cloudflare (vitaspan.app and vitaclaris.app forward to it), which processes visitors' IP addresses and browser details to deliver and protect it. The site sets no cookies, has no analytics or trackers, and loads nothing from other companies. Its forms send what you type in them to Vitaclaris's server.

Updates. If you leave your email on the site to get news about Vitaclaris, Vitaclaris's server keeps that email, your language, the page you signed up on and the date. We use it only to send you news about Vitaclaris, such as new versions and features, and never share or sell it. Each email tells you how to leave the list, and you can also write to privacy@vitaclaris.com; when you leave, or if we stop sending news, we delete your address. If you joined the launch list, you're on this list and can leave it the same way.

Suggestions. If you suggest a feature, Vitaclaris's server keeps what you wrote, your email if you add it, your language, the page you sent it from and the date. We read suggestions to decide what to add or improve, and use your email only to reply about your suggestion. Please don't include health information: we delete any suggestion that has some when we read it. We delete suggestions after 12 months, or sooner if you ask at privacy@vitaclaris.com.

To stop abuse, the forms count what's sent from each IP address under a scrambled form of the address, deleted within a day. We never keep the address itself, and nothing you send on the site is linked to an account.

11. Children

Vitaclaris is meant for adults 18 and older and isn't directed to children. We don't knowingly receive information from children under 13, or under 16 where the law sets that age; if we learn that we have, we delete it.

A parent or guardian can keep a family profile for their child on their own device (section 2). The child doesn't use Vitaclaris, and what's in the profile is the parent's to manage. It reaches us only as section 4 describes, when the parent uses an AI feature on it, or sealed, if the parent shares the profile.

12. Outside the United States

Your health records stay on your devices wherever you live. Our server runs on Cloudflare's network, with its database and the sealed copies in North America; Anthropic, Google Workspace and Apple may process information in the United States and other countries. If you live in the European Union, the United Kingdom or another place with data protection laws: we provide your account and purchases under our contract with you; we send health information to the AI features only with your explicit consent, which you can take back; we keep the sealed copies (sync, doctor links, shared family profiles) only if you turn them on, with your explicit consent, which you can take back by ending them; we keep purchase records to meet legal obligations; we send news from our website's list only with your consent, which you take back by leaving it; and we rely on our legitimate interest to prevent misuse, to answer your messages and to read your suggestions. You have the rights in section 8, and you can complain to your data protection authority; in Argentina, that's the Agencia de Acceso a la Información Pública (Law 25,326).

13. How long we keep it

• Your account, plan, balance and AI usage records: while you have an account, then deleted (section 6).
• Apple Ads attribution: on your device, until your first payment, 60 days or until you turn it off; on our server, only counts by ad, which hold nothing about you.
• The sync copy: while sync is on. The earlier versions of what changed, and deleted entries, photos and documents, stay in it for about 30 to 45 days while your devices sync (longer if they stop syncing), so devices that were away can catch up; then they're deleted. When you delete the copy or your account, it's deleted from our database at once, so nothing can be fetched from that moment, and from storage within a few days, usually within hours.
• Shared family profiles: the sealed copy, as for sync, while the profile is shared; deleted with its owner's account.
• Doctor links: the sealed summary, until the link ends or you turn it off (at the latest 30 minutes after it ends); the link's id, size and times, for 30 days after that; all of it at once when you delete your account. Signing out removes the links' keys from that device; the links stay on until they end, unless you turn them off first.
• Missed-dose alerts: send times for 30 days; push addresses until the device is removed.
• "I'm OK today": the record of each check-in (the shared profile, the sending account, the time and the day's key) for 30 days.
• Purchase records: as long as tax and accounting law requires, without your account once you've deleted it.
• Messages you send us: as long as needed to help you.
• The website's forms: your email for news, until you leave the list or we stop sending it; suggestions, 12 months, or less if you ask; the scrambled IP addresses that stop abuse, a day.
• Look-ups of public health sources: the public answers, by code, for a day (6 hours when nothing was found), not linked to anyone; the counts of your look-ups, for a day.
• Backups: our database's backups keep deleted records for up to 30 days before they're gone for good. For sync, those records are an index of the sealed copy (sizes and times) and your devices' sealed details: nothing that can open it.

14. Security

iOS encrypts the app's storage, and your sign-in stays in the device's Keychain. Sync is end-to-end encrypted with Apple's CryptoKit: your devices seal everything before it leaves, with keys made on them and kept in each one's Keychain, and pass the key to a new device sealed to it. Our server holds only a key that lets it check that a device belongs to your account, which opens nothing; without one of your devices or your recovery key, nobody can open the copy or recover it for you, us included. Shared family profiles are sealed the same way with each profile's own key. Doctor links are sealed on your device with AES-256-GCM and a new key for each; the key stays in the link and in your device's Keychain, on that device only. The Simple view passcode is kept as a salted hash (PBKDF2-SHA256), never the digits. Everything between the app, our server, Anthropic, the public health services and Open Food Facts is encrypted in transit. On the server, the content of AI requests isn't stored, Apple's token is kept encrypted, sign-in sessions expire and are renewed, and the number of requests is limited. A passcode or Face ID on your device protects what it keeps. No system is completely secure; if a breach affected information we hold, we'd notify you and the authorities as the law requires.

15. Changes and contact

If we change this policy, we'll post the new version with a new effective date, and the app will ask you to agree again before a significant change takes effect.

Questions and requests: privacy@vitaclaris.com. Vitaclaris is made by Julio Hartstein.