Consumer Health Data Privacy Policy

Why this policy exists

When you upload medical information to Vital directly (rather than through your hospital or clinic), Vital Software Inc. ("Vital", "we") is acting as a direct-to-consumer personal health record provider, not as a HIPAA business associate. Your information is protected by consumer health data privacy laws rather than HIPAA. This policy explains what consumer health data we collect, how we use it, who we share it with, and the rights and consents that apply.

Information that is not consumer health data — such as how we handle contact details, cookies and analytics, and the privacy rights that apply to personal information generally — is covered by our Privacy Policy. Where that policy and this one differ with respect to consumer health data, this policy controls.

Consumer health data we collect

• Health-related search inputs, such as symptoms, conditions, specialty needs, reason for visit, insurance type, location, and care preferences.
• Information contained in documents, images, photos, or other content you submit.
• Information extracted or inferred from submitted materials, such as medical conditions, procedures, medications, lab values, specialties, or care needs.
• Provider matching and navigation outputs generated from health-related information.
• Consent records and records of disclosures to providers or service providers.

Sources of consumer health data

We collect consumer health data directly from you, from information you submit through an AI assistant or MCP-compatible platform, from materials you provide, and from derived or inferred information created to provide the Services.

How we use consumer health data

We collect and process consumer health data only as needed to provide the services you request and for the purposes described in this policy. This may include using consumer health data to:

• provide provider search, matching, comparison, and callback request services;
• extract limited information needed to support healthcare navigation and provider matching;
• generate informational summaries or explanations to help you understand provider options;
• transmit request information to a provider or clinic after any required consent;
• operate, secure, debug, support, and improve the Services in a manner consistent with this policy; and
• comply with law, enforce our terms, protect safety, and maintain required records.

We do not use consumer health data to train or fine-tune AI models unless you give separate, specific opt-in consent.

We do not sell consumer health data to clinics, data brokers, advertisers, or any other third party.

We may use automated processing to help match you with providers. This is a healthcare navigation and information-retrieval function. It does not provide a medical diagnosis, recommend a course of treatment, or replace the judgment of a licensed healthcare professional.

How we disclose consumer health data

• Providers and clinics you choose or match with, when you request outreach or appointment help and provide any required sharing consent.
• Service providers and processors under contract, such as hosting, storage, AI processing, fax, SMS, telephony, security, and support vendors.
• Legal and safety recipients, when required by law or necessary to protect rights, safety, or security.

Categories of consumer health data we share

We share only the categories needed by the recipient for the purpose above. Across all three recipient types, those categories are:

• Health-related search inputs — the symptoms, conditions, specialty needs, reason for visit, insurance type, and location you supply.
• Documents and images you submit — medical records, lab results, and photos, and the information extracted or inferred from them.
• Provider matching outputs — the matches, comparisons, and informational summaries generated from the above.
• Consent and disclosure records — the record of what you consented to and what was disclosed.

Affiliates

Vital does not share consumer health data with any affiliate.

Consent and withdrawal

We obtain consent where required before collecting, using, or sharing consumer health data. We use separate consent for sharing consumer health data with a provider or clinic when required by law.

You may withdraw consent at any time by contacting privacy@vit.al. Withdrawal will not affect processing that occurred before withdrawal, but we will stop future processing covered by the withdrawn consent unless another legal basis applies.

Sensitive categories

Consumer health data may include sensitive categories, such as reproductive or sexual health information, genetic information, mental health information, or substance use disorder information. Where applicable law requires separate consent or authorization for these categories, Vital will request it before the relevant collection, use, or disclosure.

Substance use disorder records

If information appears to include substance use disorder records subject to 42 CFR Part 2 and you ask us to disclose it to a provider, Vital will apply any required separate consent and include any required prohibition-on-redisclosure notice.

No sale, no targeted advertising, and no geofencing

• We do not sell consumer health data.
• We do not use consumer health data for targeted advertising or cross-context behavioral advertising.
• We do not use geofencing around healthcare facilities to identify, track, collect data from, or send targeted content to consumers based on proximity to a healthcare facility.

Your rights over consumer health data

You have the right to:

• Access or confirm whether we process your consumer health data.
• Correct inaccurate consumer health data.
• Delete consumer health data, subject to legal and operational limits.
• Withdraw consent where processing is based on consent.
• Receive a portable copy of covered data where required by law.
• Receive information about third parties or affiliates with whom consumer health data has been shared where required by law.
• Appeal a denied request where required by law.

How to exercise rights

Contact privacy@vit.al. We will respond within the timeframe required by applicable law.

Health breach notification

If a breach of unsecured health information occurs and we are required to provide notice under the FTC Health Breach Notification Rule or state consumer health data laws, we will notify affected individuals, regulators, and media where required and within applicable timeframes.

State-specific rights

Residents of certain states, including Washington, Nevada, Connecticut, California, Maryland, Virginia, Oregon, Colorado, and others, may have additional consumer health data or sensitive data rights. Where a state law grants greater protection, Vital will apply that protection as required.

Changes and contact

We may update this policy and will post the new effective date. Questions or requests:

Vital Software Inc.
Privacy: privacy@vit.al