Privacy Policy

We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the VITALA mobile application.

By using VITALA, you agree to the collection and use of information in accordance with this policy.

Medical Disclaimer

Information We Collect

We collect the following types of information to provide and improve our service:

• Account information — your name and email address when you create an account
• Health & fitness data — steps, heart rate, sleep duration, and calories burned (only if you explicitly connect Apple Health or Google Fit)
• Nutrition data — meals you log, including calorie and macro information
• Body metrics — weight, height, age, and activity level you provide during onboarding
• Water intake — water consumption you log in the app
• Fasting data — fasting sessions you start and complete
• Medication data — medications and supplements you register (stored locally on your device only — never sent to our servers)

Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data under the following legal bases as defined by the General Data Protection Regulation (GDPR):

• Consent — for optional features such as Apple Health or Google Fit integration. You may withdraw consent at any time by disconnecting these integrations from within the app.
• Contract — to provide the core service you signed up for, including account creation, nutrition tracking, and goal calculation.
• Legitimate interests — for app security, rate limiting, and session management, where these do not override your fundamental rights.

How We Use Your Information

We use the information we collect solely to provide and improve the VITALA service:

• Calculate your personalized daily nutrition goals using the Mifflin-St Jeor formula
• Track your daily calorie, macro, and water intake
• Display your health metrics from Apple Health or Google Fit
• Sync your data securely across sessions
• Send you verification emails during account creation
• Provide meal suggestions based on your nutritional goals

Apple Health & Google Fit Integration

Integration with Apple Health and Google Fit is entirely optional and requires your explicit consent. If you choose to connect either service, VITALA requests read access to the following data types:

• Step count
• Heart rate
• Sleep analysis
• Active energy burned

You can disconnect Apple Health or Google Fit at any time from the Health tab in the app. Doing so immediately stops all future data reads from these services.

Data Storage & Security

Your data is stored securely using Supabase, a SOC 2 compliant cloud infrastructure provider. We implement the following security measures:

• Row Level Security (RLS) — you can only access your own data
• Session tokens stored in your device's secure keychain (iOS Keychain)
• Input sanitization on all user-provided data
• Rate limiting on authentication to prevent brute force attacks
• Encrypted connections (HTTPS/TLS) for all data transfers

Medication and supplement data is stored locally on your device only and is never transmitted to our servers.

While we implement strong security measures, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

International Data Transfers

VITALA uses Supabase for data storage and authentication. Supabase may store and process your data in data centers located outside your country of residence, including within the United States and the European Union.

If you are located in the EEA or UK, such transfers are conducted in accordance with applicable data protection laws, relying on standard contractual clauses or other lawful transfer mechanisms where required.

By using VITALA, you acknowledge and consent to the transfer of your data to servers outside your country of residence as necessary to provide the service.

Third-Party Services

VITALA uses the following third-party services to deliver its features. Each operates under its own privacy policy:

• Supabase — database, authentication, and secure storage
• USDA FoodData Central — food nutrition database (no personal data sent)
• Spoonacular — recipe data and meal suggestions (no personal data sent)
• Resend — transactional email for account verification
• RevenueCat — in-app purchase and subscription management
• Apple HealthKit — health data integration (optional, consent-based)
• Google Fit — health data integration (optional, consent-based)

We do not share your personal data with these services beyond what is strictly necessary to provide the feature they power.

Cookies & Analytics

The VITALA mobile app does not use cookies. We do not run any third-party analytics SDKs (such as Google Analytics or Facebook SDK) within the app. We do not track your behavior across other apps or websites.

Standard technical information such as device type and operating system version may be logged by Supabase as part of infrastructure security monitoring. This information may be indirectly linkable to your account through authentication logs, but is not used for profiling, advertising, or any purpose beyond security and service reliability.

Data Retention

We retain your personal data for as long as your account is active. If you delete your account, we will delete your personal data from our servers within 30 days, except where we are required to retain it for legal or compliance purposes.

Daily nutrition logs are reset each day as part of the app's normal operation. Historical data is retained to support calendar history and historical insights and progress tracking features within the app.

Account Deletion

You can request deletion of your account and all associated personal data at any time through either of the following methods:

• In-app — go to Profile → Settings → Delete Account (if available in your app version)
• By email — send a request to petalanoar@gmail.com with the subject line "Account Deletion Request" and your registered email address

We will process your request and confirm deletion within 7 business days. Once deleted, your data cannot be recovered.

Children's Privacy

VITALA is not intended for use by anyone under the age of 13. We do not knowingly collect personal information from children under 13. During onboarding, we enforce a minimum age requirement of 13 years. If you believe a child under 13 has created an account, please contact us at petalanoar@gmail.com and we will delete the account and associated data immediately.

Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate or incomplete data
• Deletion — request deletion of your account and all associated data
• Portability — request your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests
• Withdraw consent — withdraw consent for Apple Health or Google Fit access at any time within the app
• Restriction — request that we restrict processing of your data in certain circumstances

To exercise any of these rights, contact us at petalanoar@gmail.com. We will respond within 30 days.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the date at the top of this page. For significant changes, we may also notify you within the app. Continued use of VITALA after changes are posted constitutes acceptance of the updated policy.