Privacy Policy

1. Who we are

Company name: Vita OS Ltd
Company number: 16629540
Registered office: 20 Wenlock Road, London, England, N1 7GU
ICO registration number: ZC106524

Vita OS Ltd is the data controller responsible for your personal information.

2. Key definitions

• Personal Data: information that relates to an identified or identifiable individual
• Special Category Data: sensitive personal data (including health related data) requiring additional protection under UK GDPR
• Service: our website, app, and related services
• You/User: any individual who accesses or uses the Service

3. Information we collect

3.1 Information you provide. We may collect:

• Name or username
• Email address
• Phone number
• Delivery and billing address
• Account credentials
• Customer support communications
• Health and lifestyle information you choose to provide (such as goals, preferences, nutrition, training, sleep, recovery, stress and wellbeing inputs)

3.2 Information we collect automatically. We collect limited data automatically, including:

• Usage data (pages/screens viewed, feature usage, session activity)
• IP address and device information
• Approximate location inferred from IP address
• Cookie and similar technology data (where applicable)

We do not collect precise GPS location unless we clearly ask for it.

3.3 Payments. Payments are processed by Stripe. We do not store full payment card details. Stripe processes payment data in accordance with its own privacy policy.

3.4 Connected devices and wearables. You can choose to connect a wearable device or health platform to the Service (for example a Fitbit connected through the Google Health API, Apple Health on iPhone and Apple Watch, and in future Garmin). This is entirely optional.

If you connect a device, we receive health and fitness data from the relevant platform with your permission. Depending on your device, this may include:

• Steps, distance and floors climbed
• Calories burned and active minutes
• Heart rate data, including resting heart rate
• Sleep duration and sleep patterns
• Recorded exercise sessions (such as runs)

Our access is read only. We can never change, add to, or delete anything on your device or in your device account.

We use this data solely to display your metrics within the Service and to personalise your plans, targets and recovery guidance. We do not use it for advertising, we do not sell it, and we do not share it with third parties except with the service providers who host and operate the Service as described in this Policy.

You can disconnect a device at any time in the app (Settings, then Devices). Disconnecting stops all further collection immediately.

3.5 Sleep sounds. This is optional and off unless you turn it on. If you turn on Count sounds, VitaOS listens overnight through your iPhone's microphone to count sounds such as snoring, coughing and talking. Short sound clips are kept on your iPhone only, for 7 days, and are never uploaded to us or to anyone else. The counts and the times they happened are saved to your account.

If you also turn on Write down what I say, anything you say in your sleep is turned into text on your iPhone by Apple's on-device speech recognition. Only the text and its time are saved to your account. You can turn either setting off at any time in the app.

4. How we use your information

We use your personal data to:

• Create and manage your account
• Provide the Service and generate personalised outputs (such as meal plans, workouts, and tracking insights)
• Display and analyse data from wearables you choose to connect, and use it to personalise your plans
• Process purchases and deliver care packages
• Provide customer support
• Improve and maintain the Service (including analytics and troubleshooting)
• Protect the Service from fraud, misuse, and security risks
• Send service related communications
• Send marketing communications where permitted
• Comply with legal obligations

Some features of the Service involve automated processing, including artificial intelligence systems, to generate personalised recommendations and insights based on the information you provide and the data from any device you connect. This does not involve solely automated decision making that produces legal or similarly significant effects.

5. Legal bases for processing

We rely on the following legal bases under UK GDPR:

• Contract: where processing is necessary to provide the Service
• Legitimate interests: for improving the Service, analytics, and security, where your rights do not override those interests
• Consent: where required (for example, marketing, non essential cookies, and connecting a wearable device)
• Legal obligation: where required by law
• Vital interests: in rare circumstances to protect life

6. Health and lifestyle data (special category data)

Some information you provide, and data received from connected devices (such as health, wellbeing, or lifestyle data), may constitute special category data.

We process this data solely to provide personalised features within the Service.

Where required, we rely on your explicit consent to process this data. For connected devices, you give this consent through the device platform's permission screen when you connect. You may withdraw your consent at any time, including by disconnecting your device, although this may limit your ability to use certain features.

We do not use special category data for advertising or marketing purposes.

7. Photos, video and body images

Some features of the Service are optional and use your device camera or photo library. These are the AI Form Coach, which gives technique feedback on an exercise; the 360 degree body scan, which estimates body composition and tracks visual progress; and meal photo logging.

The AI Form Coach runs entirely on your device. The pose analysis happens in the app itself, and no video, images or frames of your workout are uploaded to us or to anyone else.

The 360 degree body scan, progress photos and meal photo logging do send images to us. We use them only to produce your results, meaning your measurements, your progress record and your food log. We do not keep them for longer than we need to for that purpose.

Meal photos and the still frames from a body scan are analysed by Anthropic's Claude AI, acting as our processor. Anthropic do not use them to train their models. A meal photo is sent only once you have allowed AI in the app, and a body scan only after you agree on the scan screen.

We do not use your photos or video to train third-party AI models, we do not use them for advertising, and we do not sell them. We do not share them with anyone other than the service providers who host and operate the Service on our behalf.

These features run only when you choose to start them and grant camera or photo access. You can withdraw those permissions at any time in your device settings, and you can delete your account and all associated data from Settings.

8. The Vita coach

Vita is the coach inside our app. When you type or speak to it, or log food by describing it, and you have allowed this in the app, we send your message together with the parts of your account it needs in order to answer (your plan, meals, workouts and readings such as sleep, heart rate and weight) to Anthropic, who provide the AI model behind it. Anthropic act as our processor for this and do not use your conversations to train their models. Nothing is sent until you tap Allow, and you can turn this off at any time in the app (Settings, then Privacy).

If you use the voice version, your speech is turned into text by your own device, and Vita's spoken replies are produced by ElevenLabs, who act as our processor for that purpose only.

We store your conversations with Vita and the changes it makes to your plan, so that it remembers context between sessions, so you can undo any change it makes, and so we can investigate problems. You can ask us to delete them at any time using the contact details in this policy.

Vita gives general fitness and nutrition guidance. It is not a medical service and does not replace advice from a qualified professional. Please do not tell it anything you would not want recorded.

9. Apple Health and the Apple Watch

If you install the VitaOS Apple Watch app and give permission, we read health and fitness data from Apple Health, including steps, heart rate, heart rate variability, sleep, workouts and activity.

We use this only to show you your own metrics inside VitaOS and to shape your training, nutrition and recovery guidance.

We never use Apple Health data for advertising or marketing, we never sell it, and we never share it with third parties for their own purposes. We do not use it for data mining.

You can withdraw permission at any time in the Health app on your iPhone. To have data VitaOS holds deleted, contact us using the details in this policy.

10. Google API Services and Limited Use

Where you connect a device through Google (including Fitbit), our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements, and to the Google Health API User Data Policies.

In particular:

• We only request read access to the data types needed to provide the features described in this Policy
• We use Google user data only to provide and improve user facing features of the Service
• We do not use Google user data for advertising, and we do not sell it
• We do not allow humans to read this data except with your explicit consent, where necessary for security or to comply with law, or where the data has been aggregated and anonymised

You can review and revoke the Service's access to your Google data at any time at myaccount.google.com/permissions, or by disconnecting your device within the app.

11. Sharing your information

We only share personal data where necessary to operate the Service or comply with legal obligations.

We may share data with:

• Payment processors (Stripe)
• Hosting and infrastructure providers (Supabase, which hosts our database and backend, and Netlify, which hosts the app)
• Artificial intelligence providers (Anthropic) that process the information needed to generate your personalised plans, answer you in Vita and analyse meal and body scan photos; our AI providers are contractually restricted from using your data for their own purposes, including training their models
• Device and health platforms you choose to connect (such as Google), solely to operate the connection you have authorised
• Delivery partners (e.g. Royal Mail, Evri)
• Analytics providers
• Advertising and marketing platforms (such as Meta, Google, TikTok, YouTube), where permitted and subject to consent where required; this never includes your health, wellbeing or connected device data
• Professional advisers
• Regulators and authorities where required by law

We ensure that third party service providers process personal data in accordance with appropriate contractual and data protection obligations.

We do not sell your personal data.

12. Cookies and similar technologies

We use cookies and similar technologies to:

• Operate the Service
• Maintain sessions and preferences
• Analyse usage
• Support marketing and advertising (where applicable)

Where required, we obtain your consent for non essential cookies. You can manage cookie preferences through your browser or our cookie settings.

13. Marketing communications

You can opt out of marketing communications at any time using the unsubscribe link or by contacting us.

14. International transfers

Some service providers may process data outside the UK.

Where this occurs, we ensure appropriate safeguards are in place, such as UK adequacy regulations or approved contractual safeguards (including the UK International Data Transfer Agreement or equivalent measures).

15. Data retention

We retain personal data only for as long as necessary for the purposes described in this Policy.

Typical retention periods include:

• Deleted accounts: retained until the end of the next calendar month, then deleted or anonymised (unless legally required otherwise)
• Support communications: retained until the end of the next calendar month
• Analytics data: retained for up to 3 months
• Health and lifestyle data: retained only as long as necessary to provide the Service and typically no longer than 3 months after inactivity
• Connected device data: collection stops immediately when you disconnect your device; stored device data is deleted on the same schedule as deleted accounts, and earlier on request
• Purchase and invoice data: retained for 6 years

Where data cannot be immediately deleted (e.g. backups), it will be securely isolated and deleted as soon as practicable.

16. Security

We implement appropriate technical and organisational measures to protect personal data, including access controls, encryption where appropriate, and monitoring systems designed to prevent unauthorised access, loss, or misuse. Credentials for connected devices are stored server side and are never exposed to your browser or to other users.

However, no system is completely secure and we cannot guarantee absolute security.

17. Your rights

You may have rights under UK data protection law to:

• Access your personal data
• Correct inaccurate data
• Request deletion
• Restrict processing
• Object to processing
• Request data portability
• Withdraw consent (including by disconnecting a connected device, or via myaccount.google.com/permissions for Google connections)

You may also lodge a complaint with the UK Information Commissioner's Office (ICO).

To exercise your rights, contact: support@vitaos.com

18. Under 18s

The Service is not intended for individuals under 18. We do not knowingly collect personal data from children. If this occurs, we will take steps to delete it.

19. Third party services

Our Service may link to third party services. We are not responsible for their privacy practices.

20. Changes to this policy

We may update this Privacy Policy from time to time. The latest version will always be available on the Service. Where changes are material, we will take reasonable steps to notify you.

21. Contact us

Email: support@vitaos.com
Post: Vita OS Ltd, 20 Wenlock Road, London, England, N1 7GU