Privacy Policy

OpenVitals ("we," "us," or "our") operates the OpenVitals platform, a personal health data management service. This Privacy Policy describes how we collect, use, disclose, and protect your information when you use our website, applications, and services (collectively, the "Service").

By using the Service, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.

Account Information

When you create an account, we collect your name, email address, and password. If you sign in through a third-party provider (e.g., Google), we receive your name and email from that provider.

Health Data

The core of our Service involves health data you provide, including lab results, vital signs, medication information, medical records, and data from connected wearable devices and health platforms. We treat all health data with the highest level of care.

Device and Integration Data

When you connect third-party services (such as Whoop, Fitbit, or other wearable devices), we receive health and fitness data from those services on your behalf. We store encrypted authentication tokens to maintain your connection and sync data.

Usage Data

We collect information about how you interact with the Service, including pages visited, features used, and general usage patterns. This helps us improve the platform.

We use your information to:

• Provide, maintain, and improve the Service
• Parse, normalize, and display your health data
• Sync data from connected devices and integrations
• Generate AI-powered health insights (when you request them)
• Send service-related notifications
• Detect and prevent fraud or abuse
• Comply with legal obligations

We do not sell your personal or health data to third parties. We do not use your health data for advertising purposes.

Your health data is stored in encrypted databases. Authentication tokens for third-party integrations are encrypted at rest using AES-256-GCM. We use industry-standard security practices including TLS encryption in transit, regular security audits, and access controls.

Despite our efforts, no method of electronic storage is 100% secure. We cannot guarantee absolute security but we strive to use commercially acceptable means to protect your data.

We may share your information in the following circumstances:

• At your direction: When you use our sharing features to grant access to healthcare providers, family members, or others you designate.
• Service providers: With trusted vendors who help us operate the Service (e.g., cloud hosting, email delivery), under strict confidentiality agreements.
• Legal requirements: When required by law, subpoena, or valid legal process.
• Safety: To protect the rights, property, or safety of OpenVitals, our users, or the public.

When you connect third-party services, their own privacy policies govern their collection and use of your data. We encourage you to review the privacy policies of any service you connect. We only access the data you authorize through the scopes you approve during the connection process.

We retain your account and health data for as long as your account is active. You may request deletion of your account and associated data at any time by contacting us. Upon account deletion, we will remove your personal and health data from our active systems within 30 days, though some data may persist in encrypted backups for up to 90 days.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your data
• Export your data in a portable format
• Withdraw consent for data processing
• Object to certain processing activities

To exercise any of these rights, contact us at [email protected].

The Service is not intended for individuals under the age of 18. We do not knowingly collect data from children. If we learn that we have collected data from a child under 18, we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Service and updating the effective date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or our data practices, contact us at:

Email: [email protected]