iOS Privacy Policy

The controller under Article 4(7) GDPR for processing described in this policy is:

No Data Protection Officer has been appointed. Privacy inquiries and requests can be sent directly to the controller using the contact details above.

Depending on the features you choose, Vitalstat processes:

• Account and technical identifiers: a Firebase anonymous user ID, Firebase installation identifiers, App Check attestations and tokens, IP address and user-agent information processed for authentication and security, app version, device and operating-system information, and timestamps.
• Profile and contact data: optional name, email, date of birth, biological sex, display name, nutrition profile, locale, units, and preferences you provide.
• Health and fitness data: workouts, activity, routes, heart rate, HRV, resting heart rate, sleep, recovery, readiness, respiration, oxygen saturation, blood glucose, temperature, blood pressure, body composition, nutrition, hydration, caffeine, symptoms, medications, conditions, allergies, mobility and lifestyle context, and related trends and derived scores.
• User content: journal entries, custom factors, habits, supplements, goals, meal descriptions, food photos, dictated audio, AI chat messages, feedback, imported workout files or spreadsheets, and support messages you choose to send.
• Commercial data: product identifiers, subscription or trial status, purchase and entitlement state, referral source, referral credits, and redemption records.
• Privacy-choice records: acknowledgments, consent grants, refusals and withdrawals; the applicable notice, policy and consent versions; a SHA-256 hash of the disclosure shown; selected AI or MCP data categories; app version, locale, and client and server timestamps. These records are associated with the pseudonymous Firebase user ID and do not contain the health data itself.
• Usage and diagnostic data: screens and features used, onboarding steps, selected health source, sync outcomes, quota events, error codes, crash traces, diagnostic logs, performance information, and limited support metadata. We do not intentionally put health values, journal content, food-log content, routes, photographs, or AI conversations in analytics or crash-report custom fields.

Data comes from you, your device and Apple frameworks, the health providers you connect, subscription information supplied through Apple StoreKit, and service providers that operate features on our behalf. Data received from Google APIs is handled in accordance with the Google API Services User Data Policy, including its Limited Use requirements.

Our legitimate interests are maintaining a secure, reliable app, understanding whether features work, preventing abuse, and improving the service without using health data for advertising. You may object as described in Section 15.

Consent is optional and may be withdrawn at any time. Withdrawal does not affect processing that was lawful before withdrawal. If you do not consent to an optional feature, that feature will be unavailable, but unrelated app functionality remains available subject to subscription requirements.

You decide which sources to connect and which permissions to grant. Provider authorization pages and Apple permission dialogs may provide additional information. Disconnecting a provider stops future retrieval and removes locally held credentials and caches as implemented for that integration; the provider may retain its own records under its policy.

Polar

Polar AccessLink may provide profile and physical information, exercises, routes and samples, activity, sleep, nightly recharge, heart rate, HRV, respiratory information, training load, and related fitness data. OAuth credentials are stored in the iOS Keychain. Data is normally cached on device.

Apple Health

HealthKit provides only the categories you authorize. Vitalstat may read workouts and routes, activity, sleep, heart rate and HRV, cardio fitness, respiratory and oxygen data, temperature, blood pressure, blood glucose, body measurements, nutrition and other authorized types. If you separately enable writing, Vitalstat may write user-selected workouts, workout routes, activity, mindfulness, nutrition, hydration, body measurements, and other supported records from connected services or entries you create. HealthKit permission can be changed in Apple Health or iOS Settings.

Oura

Oura may provide profile information, sleep, readiness, activity, workouts, heart rate, HRV, cardio fitness, oxygen saturation, stress, resilience, and related measurements. OAuth credentials are stored in the iOS Keychain and records are cached on device.

Garmin

Garmin uses a server-side connection. Garmin OAuth credentials, account mappings, and webhook-delivered dailies, sleep, activities, routes and streams, HRV, body battery, pulse oxygen, respiration, stress, body composition, blood pressure and other authorized Garmin data may be stored in Firebase Firestore under your Firebase user ID. Garmin health records are retained for a maximum of 180 days and pruned on a scheduled basis. The in-app Garmin deletion control removes stored health records while leaving the connection active; disconnecting also removes credentials and mappings.

Google Health (Fitbit)

Google Health APIs may provide profile data, activity, workouts, steps, calories, distance, heart rate, sleep, recovery-related measurements, health and body measurements, and workout GPS routes. OAuth credentials are stored in the iOS Keychain. Records are cached locally and limited snapshots may be shared with the on-device widget container. Disconnecting revokes the token and removes the integration's local caches and derived on-device AI artifacts.

Withings

Withings may provide body measurements and composition, blood pressure, pulse-wave velocity, sleep, activity, and related authorized data. OAuth credentials are stored in the iOS Keychain and records are cached on device.

Suunto, Wahoo, Intervals.icu, and WHOOP

These optional integrations may provide profile or athlete information, activities and workouts, planned workouts, routes, detailed workout streams, heart rate and recovery information, sleep, training load, fitness analytics, wellness information, equipment, and other data covered by the scopes you authorize. Depending on the provider, Vitalstat uses a first-party backend for OAuth exchange, refresh, revocation, or API proxying. Tokens and limited provider profile metadata are stored in the iOS Keychain or, where the integration requires a server-side connection, in protected backend storage. Retrieved records are normally cached on device.

Strava

Vitalstat is Compatible with Strava. With your OAuth consent, Vitalstat may retrieve your athlete identifier and permitted activity details solely to display them privately to you. Strava API data is kept separate from other customer data and is not used for analytics, analysis, AI or machine-learning features, model training, MCP access, advertising, or cross-source combinations. Vitalstat does not disclose Strava API data to other users or third parties.

Strava activity and profile caches are retained for no longer than seven days and are deleted sooner when you disconnect, revoke access, delete your account, or request deletion. Deleted Strava activities are removed when detected and within the period required by Strava. Strava may monitor and collect API usage data and use it for its own business purposes under the Strava API Policy and Strava Privacy Policy.

On-device storage

Vitalstat stores health-source caches, nutrition and hydration entries, journal data, workouts and plans, preferences, derived metrics, AI results and chat history, and local MCP files on your device. Deleting the app removes its ordinary app-container and App Group files. Records already synchronized to a provider, iCloud, HealthKit, or a backend are governed by the deletion controls described here and are not necessarily removed merely by uninstalling the app.

Keychain

OAuth credentials and limited connection metadata for supported sources are stored using the iOS Keychain with device-protection access controls. Use the provider's disconnect control to remove Vitalstat's stored credentials and revoke access where supported. Uninstalling an app is not a reliable substitute for disconnecting an account or deleting Keychain credentials.

App Group

The main app, widgets, and watch-related components use an App Group container for subscription state, selected source, and limited health snapshots. This is local inter-process storage. The main app may separately use information represented in local caches for an optional AI or MCP feature only after that feature is enabled as described in this policy.

Optional private iCloud sync

When iCloud sync is enabled and an iCloud account is available, Apple CloudKit and iCloud key-value storage may synchronize eligible app records across your Apple devices. Depending on what you use, this can include profile fields, food and hydration logs, recent foods and searches, journal entries and custom factors, habits, supplements, goals, body measurements, sleep overrides, gym plans and sessions, training plans, recaps, preferences, and certain AI memories, findings, or plans. AI chat history is designed to remain local; old CloudKit chat records from earlier versions are deleted when detected.

CloudKit records are stored in the user's private iCloud database and are subject to Apple's iCloud terms and privacy information. You can disable future Vitalstat iCloud sync in the app's iCloud settings; a restart may be required. Disabling sync does not necessarily erase copies already held in iCloud. To request assistance deleting Vitalstat cloud records, contact us.

Food logs can contain product names, brands, barcodes, amounts, nutrients, meal times, hydration, caffeine, and nutrition-profile information. These records are stored locally and may be included in private iCloud sync if enabled.

• Open Food Facts receives product barcodes or search queries used to return product data.
• Edamamreceives food queries, barcodes, ingredient or nutrition-analysis text and, when you choose its vision feature, a resized meal photograph. The request may go through Vitalstat's backend before reaching Edamam.
• Spoonacular receives product, recipe, or ingredient searches and barcode lookups.
• USDA FoodData Central receives nutrition database searches and barcode queries.
• OpenAI may receive a meal description or resized photograph when you affirmatively use AI food analysis.

Meal voice logging records audio only after you activate the recorder. The audio file is supplied to Apple's Speech framework for transcription and is removed from Vitalstat's temporary storage after the flow completes. Apple's processing is governed by Apple's applicable privacy information and your system Speech Recognition permission.

AI features are optional. When enabled, Vitalstat sends only the information needed for the requested feature through an authenticated Vitalstat backend to the OpenAI API. Depending on the feature, this may include health summaries, trends, sleep, workouts, recovery, nutrition, health background, goals, a meal description or photograph, recipe preferences, your prompt, and recent conversation context.

The backend authenticates and forwards the request. Vitalstat is designed not to log prompt content, chat text, health summaries, or meal photographs in application logs. Generated recipes, briefings, narratives, insights, plans, and conversations are normally saved locally; eligible non-chat records may participate in optional iCloud sync as explained in Section 5.

OpenAI processes API customer content under its business terms and Data Processing Addendum. OpenAI states that API data is not used to train its models unless the customer opts in. Vitalstat requests use store: false; by default, content may nevertheless appear in abuse-monitoring logs for up to 30 days, and may be retained longer where legally required or where an endpoint has a separate operational requirement. Review OpenAI's API data controls and Data Processing Addendum.

You can withdraw AI consent in Settings. Withdrawal stops future AI API requests but does not automatically delete an output you kept locally or data already retained by a processor under its applicable retention period. AI outputs are wellness information, not medical diagnosis, treatment, prescribing, or emergency guidance.

Model Context Protocol ("MCP") access is optional and off by default. It gives a compatible AI client read-only access to a user-selected Vitalstat snapshot. Vitalstat does not operate the AI conversation or pay for the external model.

Local MCP

On a compatible local setup, Vitalstat writes a protected JSON vault file that a local Vitalstat MCP server and same-filesystem AI client can read. Revoking local MCP deletes Vitalstat's local export. Files copied by another app are controlled by that app.

Hosted AI Access

When you enable Hosted AI Access, the app shows the selected categories, history range, estimated record count and upload size, encryption information, and the connected AI provider warning. The recommended first sync covers 90 days of dated history and includes Core health, Sleep, Workouts, Recovery, and Connected data sources. You may choose a different range or any of the following 17 categories:

1. Core health metrics
2. Sleep
3. Workouts and training
4. Raw workout streams
5. Routes and location
6. Recovery and readiness
7. Vitals
8. Body composition
9. Blood pressure
10. Nutrition and foods
11. Hydration and caffeine
12. Journal and custom factors
13. Health background
14. Habits
15. Supplements
16. Goals
17. Connected data sources

The selected history range is enforced for dated records. Selected current values, active goals, unit and locale context, source availability, freshness, counts, routing metadata, and safety metadata may be included outside that dated window because they represent current state.

MCP schema v2 never exports AI memory or chat history, the former AI Findings collection, AI feedback, AI-generated plans or training-plan payloads, app preferences, weather context, provider-native raw payloads, credentials, tokens, secrets, or Firebase identifiers. A selected nutrition or body-composition category can include an AI-assisted value that belongs to that health domain, such as a pending food analysis or domain briefing.

Hosted processing and security

The app compresses changed segments and sends them over HTTPS/TLS to Vitalstat's Vercel-hosted MCP service using Firebase Authentication and App Check. The service validates the request, encrypts each segment at rest with AES-GCM using a random per-user data-encryption key, wraps that key with Google Cloud KMS, stores ciphertext in Firebase Storage, and stores lifecycle, authorization, hash, wrapped-key and entitlement metadata in Firestore. The service decrypts only the segments needed to answer an authenticated, authorized tool request. This is encryption in transit and at rest; it is not end-to-end encryption from the connected AI provider.

Privacy-minimized MCP telemetry may record the tool or operation, provider identifier, duration, storage-read and missing-segment counts, byte counts, schema or transport version, and fixed error codes. It must not contain health values, journal text, route points, vault payloads, token values, pairing codes, provider secrets, Firebase UIDs, or another stable raw user identifier.

Connected AI providers

A provider such as ChatGPT, Claude, Gemini, Notion AI, or another MCP client receives selected data only when it calls an allowed Vitalstat tool. Each provider may receive a subset smaller than your main Vitalstat selection. Once the provider receives data, its own account, workspace, model, retention, training, and privacy settings apply. The provider generally acts independently from Vitalstat for its conversation and model processing. Revoking Vitalstat MCP access cannot delete a conversation, response, or copy already held by that provider; use the provider's deletion controls as well.

Revocation and lifecycle

Pairing codes last 10 minutes and are one-use; authorization codes last 5 minutes; access and manual bearer tokens last 1 hour; refresh tokens expire after 60 days of inactivity; and dynamic OAuth clients expire after 180 days of inactivity. A hosted vault is scheduled for deletion after 30 days without a successful refresh or seven days after Premium entitlement ends. Entitlement loss revokes credentials immediately.

Revocation blocks reads and credentials immediately and normally deletes hosted objects in the same operation. If object deletion temporarily fails, the vault is marked deletion-pending and a scheduled cleanup retries. Account deletion attempts MCP revocation before account records are removed and reports an error rather than presenting an incomplete cleanup as successful.

Authentication and account metadata

Firebase Anonymous Authentication creates a pseudonymous account without requiring a name, email, or phone number. Firestore may store the Firebase UID, account creation and last-seen timestamps, first-connection timestamps for supported sources, current health source, subscription or trial state, subscription dates, referral source, App Store account token, and optional email used for subscription support. A pseudonymous identifier is still personal data; it is not anonymous in the GDPR sense.

Privacy acknowledgments and consent evidence

The app keeps a local record of privacy acknowledgments and optional-feature choices and synchronizes a minimal, append-only receipt to Firestore when Firebase Authentication is available. Client access is limited to receipts belonging to the same pseudonymous Firebase user. Clients cannot edit or delete a historical receipt. The server receipt timestamp is generated by Firebase; the disclosure text is represented by a SHA-256 hash rather than stored in full. We use these records to apply your current choices, demonstrate when and under which version a choice was made, and establish, exercise, or defend legal claims.

Firebase Analytics

Production builds use Firebase Analytics to measure product interaction, including screen and feature use, onboarding, selected source, AI or food-feature use, subscription funnel, permissions, quotas, and categorized errors. Firebase Analytics uses installation and device information and may derive general location such as country from IP address. Vitalstat disables ad personalization signals and does not use advertising or tracking SDKs. We do not intentionally send HealthKit values or the content of health records, journals, food logs, photos, routes, or AI conversations to Analytics.

Firebase Crashlytics

Crashlytics receives crash and non-fatal error reports to diagnose reliability. Reports may include Crashlytics and Firebase installation identifiers, session identifiers, app and OS version, device model and technical state, timestamps, stack traces, exception names and messages, loaded binary information, and limited custom diagnostic keys such as app version, selected source, subscription segment, launch phase, service, endpoint, error category, and HTTP status. Support diagnostics generated by the app are designed to tokenize or omit health content and secrets.

To object to Analytics or Crashlytics processing, contact us. Where an in-app privacy control is available, using it is the fastest way to change future collection. Apple's separate "Share iPhone Analytics" setting controls analytics sent to Apple and does not by itself disable Firebase services.

Weather and location

If you grant location access for weather-aware recommendations, Vitalstat requests an approximate location and sends the location to Apple WeatherKit to obtain forecast conditions. Vitalstat caches a weather snapshot and a coarsened cache key on device. MCP schema v2 does not export weather context. Exact workout routes obtained from a health provider or HealthKit are separate from this approximate weather location and are shared through Hosted MCP only if you select Routes and location.

Leaderboards

If you join a group after the privacy consent screen, Firestore stores the group name, membership, display name, and selected metric scores. Other group members can see the information shared in that group. Leaving stops future sharing; contact us if a deletion control does not remove the remaining group record.

Referrals

If you participate, Firestore stores referral codes, credits, redemption history, referral source, and pseudonymous IDs of the referrer and referred account. Participants do not receive one another's email or health data.

Purchases

Apple StoreKit processes payment credentials and purchase transactions. Vitalstat receives product, entitlement, renewal, expiration, trial, and transaction-related status needed to provide subscriptions, restore access, prevent abuse, and support purchases. Vitalstat does not receive your full payment-card number.

Support

If you email, message, or send a diagnostic report to support, we process your contact details, message, attachments, and diagnostic information to answer the request, investigate the issue, and maintain necessary support records. Do not include health details or credentials unless they are necessary for your request.

Personal data is disclosed only as needed for the selected feature, security, legal obligations, or a request you make. The following recipients or categories may receive data:

• Google and Firebase: Authentication, App Check, Firestore, Cloud Storage, Remote Config, Analytics, Crashlytics, and Google Cloud KMS.
• Vercel: hosting and execution of Vitalstat backend and optional Hosted MCP services.
• OpenAI: optional AI processing described in Section 7.
• Apple: HealthKit, iCloud/CloudKit, StoreKit, WeatherKit, Speech Recognition, push notifications, and platform security services.
• Connected health providers: Polar, Oura, Garmin, Google Health/Fitbit, Withings, Suunto, Wahoo, Strava, Intervals.icu, WHOOP, or another provider you authorize.
• Food-data providers: Open Food Facts, Edamam, Spoonacular, and USDA FoodData Central.
• Your selected AI client and its operator: only when you authorize and use MCP access.
• Other users: members of an optional leaderboard group receive the profile and score information shown before you join.
• Authorities, courts, advisers, or successors:where disclosure is legally required, necessary to establish or defend legal claims, or part of a lawful reorganization with appropriate safeguards.

Processors acting for Vitalstat are contractually required to process data only on documented instructions, maintain suitable security, assist with rights and deletion, and provide the protections required by applicable law. Services you connect for your own account, including health providers and external AI clients, may also act as independent controllers under their own terms.

Some providers process data in the United States or other countries outside the European Economic Area. Depending on the provider and transfer, Vitalstat relies on an adequacy decision such as the EU-US Data Privacy Framework, the European Commission's Standard Contractual Clauses, supplementary technical and organizational measures, or another lawful Chapter V GDPR transfer mechanism. Provider infrastructure and subprocessors can change; current provider documentation and contractual terms determine the specific locations and mechanism.

You may request information about the applicable safeguards or a copy of relevant transfer clauses, subject to necessary redactions, by contacting us.

Deletion can require time to propagate through active systems, encrypted backups, caches, and processors. Where GDPR applies, we answer rights requests without undue delay and ordinarily within one month. We may retain a narrowly limited record where required by law or necessary to establish, exercise, or defend legal claims.

Vitalstat uses measures appropriate to the sensitivity of health data, including iOS sandboxing and data protection, Keychain storage for credentials, HTTPS/TLS, Firebase Authentication and App Check, scoped access controls, Firestore and Storage security rules, provider authorization scopes, server-side validation, bounded uploads, encryption at rest, per-user MCP encryption keys protected by Google Cloud KMS, privacy-minimized operational telemetry, credential expiry, and deletion/revocation controls.

No method is guaranteed to be completely secure. Protect your device with a passcode and biometrics, keep provider and AI accounts secure, review connected apps, and revoke credentials if you suspect unauthorized access. If a personal-data breach is likely to create a risk, Vitalstat will follow applicable notification and supervisory-authority requirements.

Subject to applicable conditions and exceptions, GDPR rights include access (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18), portability (Article 20), objection (Article 21), withdrawal of consent (Article 7(3)), and the right to lodge a complaint (Article 77). You also have the right not to be subject to a qualifying solely automated decision under Article 22.

• Disconnect a health source or change HealthKit permissions.
• Withdraw AI consent in Settings.
• Revoke local or Hosted MCP access in Connect Your Own AI.
• Leave a leaderboard group.
• Disable future Vitalstat iCloud sync in the app.
• Use the in-app account deletion control.
• Contact support to access, correct, export, object to, or delete data not covered by a self-service control.

We may need information to verify that a request concerns your account. We will not discriminate against you for exercising a privacy right. Authorized agents may submit requests where local law permits and sufficient authority is provided.

Additional US state privacy disclosures

Where a US state privacy law applies, the categories collected in the preceding 12 months are the categories listed in Section 2, including identifiers, optional contact and profile data, commercial information, internet or app activity, precise or approximate location where enabled, audio and visual content, health information and other sensitive data, inferences, and diagnostics. Sources, purposes, recipients, and retention are described in Sections 2, 3, 11, and 13. Vitalstat does not sell personal data or share it for cross-context behavioral advertising and does not use sensitive data to infer characteristics for advertising. Applicable rights may include access, correction, deletion, portability, appeal, and limitation of certain sensitive-data uses. Submit a request using the contact details in Section 1.

Complaints

You may complain to the supervisory authority for your habitual residence, workplace, or the alleged infringement. If Vitalstat's main establishment is in Hamburg, the competent authority is generally the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI). You may also use the German Data Protection Conference authority list.

Vitalstat calculates scores, correlations, trends, readiness, estimated nutrition, coaching suggestions, and AI-generated summaries. These processes personalize wellness information but do not make decisions that produce legal or similarly significant effects under Article 22 GDPR. You can disregard recommendations and continue using non-AI portions of the app.

Vitalstat is not an emergency service and its outputs are not a medical diagnosis or substitute for a qualified clinician. Seek professional care for medical concerns and contact local emergency services in an emergency.

Vitalstat is not directed to children under 16 and we do not knowingly request their personal data. If you believe a child has used the service without valid authorization, contact us so we can investigate and delete applicable data. App Store age ratings do not replace parental-consent rules that may apply where the user lives.

We update this policy when features, providers, laws, or data practices change. The current version and effective date appear at the top. For a material change affecting the purposes, data categories, recipients, retention, or user rights, we will provide a prominent in-app notice or email notice where an email is available. Where the change requires consent, we will request new consent before the changed processing begins. Merely continuing to use the app is not treated as explicit consent to process health data for a new purpose.

For questions, objections, complaints, or privacy-rights requests, contact: