Privacy Policy

• Account data. When you create an account we collect your email address and name. If you sign in with Apple or Google, we receive basic profile information (name and email) from that provider.
• Health data you provide. When you upload a lab report (as a document or image) or enter results manually, we collect and store the report file and the biomarker values, dates, and related information it contains.
• Preferences. Your language and reminder settings.
• Device / notification data. If you enable reminders, we register a notification permission on your device. Local reminder settings are stored on your device.
• Technical data. Basic technical information (such as app version and error logs) needed to operate and secure the service.

• To create and manage your account and authenticate you.
• To store your lab reports and results so you can access them.
• To process your reports — including automatically extracting biomarker values from uploaded documents and generating educational insights about your results.
• To send you the retest reminders you enable.
• To provide support, maintain security, prevent abuse, and comply with legal obligations.

To extract biomarkers from your uploaded documents and to generate insights, your report data is processed by automated systems, which may include third-party artificial-intelligence providers acting as our processors (OpenAI). These providers process the data on our instructions to return the extracted values and insights, and do not use it to train their own models. Insights are informational and educational only.

We use the following service providers to run Vytals:

• Supabase — authentication, database, and file storage (hosting of your account and report data).
• Apple — Sign in with Apple (if you use it).
• Google — Google Sign-In (if you use it).
• OpenAI — biomarker extraction and insight generation.

These providers process your data on our behalf under data-processing agreements. Your data may be processed in Brazil, the United States, and other countries where our processors operate; where data is transferred internationally, we rely on appropriate safeguards (such as Standard Contractual Clauses).

Where the GDPR (EU) or LGPD (Brazil) applies, we process your data on these bases:

• Consent — for processing your health data and for sending notifications. You may withdraw consent at any time.
• Performance of a contract— to provide the app's core features.
• Legitimate interests / legal obligation — for security, abuse prevention, and legal compliance.

Health data is treated as sensitive personal data; we process it only with your consent and only as described here.

We do not sell your personal data. We share it only with the processors listed in Section 4, or when required by law, or to protect the rights and safety of users and the service.

We keep your account and report data for as long as your account is active. You can delete individual reports in the app at any time, and you can request deletion of your entire account and associated data (see Section 8). We may retain limited records where required by law.

Depending on your location, you have the right to access, correct, delete, restrict, or export your data, and to withdraw consent or object to processing. To exercise any of these, or to delete your account, contact us at suporte@vytals.app. You also have the right to lodge a complaint with your data-protection authority (in Brazil, the ANPD).

Vytals is not intended for children under 18. We do not knowingly collect data from children.

We use industry-standard measures (encryption in transit, access controls) to protect your data. No system is perfectly secure, but we work to protect your information and will notify you and the relevant authorities of a breach where required by law.

We may update this policy. We will post the new version here and update the "Last updated" date; significant changes will be communicated in the app.

Questions or requests: suport@vytalsapp.online.