Privacy Policy

General Privacy Policy

Who we are and what this covers

This Privacy Policy explains how Vital Software Inc. ("Vital", "we") handles personal information collected through https://vit.al, and the Vital Care Finder application inside third-party AI assistants such as Claude and ChatGPT.

Health information you upload is also governed by our Consumer Health Data Privacy Policy. Where this Policy and the Consumer Health Data Privacy Policy differ with respect to consumer health data, the Consumer Health Data Privacy Policy controls.

Information we collect

• Contact information — such as your name, phone number, and email, primarily so a provider can return your callback request.
• Search and request details — the specialty, location, insurance type, symptoms or conditions, and other inputs you provide to find a provider, and the callback or appointment requests you submit.
• Information you upload — medical documents, lab results, and photos you choose to submit through Vital Care Finder. This is consumer health data and is described in detail in our Consumer Health Data Privacy Policy.
• Device and usage information — limited technical information such as browser type, general location derived from IP for functionality, and pages viewed. We do not use device GPS, precise geolocation, Bluetooth, or similar signals to detect your proximity to a health facility.
• Information from the AI assistant — when you use Vital inside Claude or ChatGPT, we receive the relevant content of your request from that platform so we can respond.

How we use information

We use information to provide the Services: to return relevant provider matches, to submit your callback or appointment requests to providers you choose, to operate and secure the Services, to comply with law, and to communicate with you about your requests. We use the minimum information necessary for each purpose.

Cookies and analytics

We use Google Analytics to measure basic traffic — how many people visit, which pages they reach, and where they arrived from — so that we can improve the site. It sets first-party cookies in your browser so that several pages viewed in a row count as one visit rather than several.

You can block these cookies with your browser's cookie controls or with Google's own opt-out browser add-on; nothing on the site depends on them.

No advertising or analytics trackers on health pages

We do not place advertising pixels or marketing SDKs anywhere on the Services, and we do not place any advertising or analytics tracker — including the Google Analytics measurement described above — on pages where you upload or view health information. We do not share health information with advertising or analytics platforms. We do not use third-party software development kits that transmit health data.

How we share information

• With providers and clinics you choose — to fulfill a callback or appointment request, and (for health information) only after you give the consent described in our Consumer Health Data Privacy Policy.
• With service providers (processors) under contract.
• For legal and safety reasons — to comply with law, enforce our terms, or protect rights and safety.

We do not sell personal information, and we do not sell consumer health data in any form. We do not 'share' personal information for cross-context behavioral advertising.

AI processing

Vital may use AI systems and automated tools to support provider matching, extraction, summarization, routing, and user assistance. These tools are used for healthcare navigation and information purposes, not to provide diagnosis or treatment.

We do not use consumer health data to train or fine-tune foundation AI models unless we obtain a separate, specific opt-in consent. We require service providers that process consumer health data for us to use it only as instructed by Vital and under appropriate contractual protections.

Health breach notification

If your unsecured health information held by Vital is acquired or disclosed without authorization, we will notify affected individuals, and the FTC and/or media where required, within the timelines required by the FTC Health Breach Notification Rule (generally within 60 days) and the fastest applicable state deadline (for example, 30 days in Colorado and Florida, and 45 days for Washington consumer health data under MHMD). 'Breach' includes unauthorized disclosure, not only external hacking.

Data retention and deletion

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including providing the Services, completing requests, maintaining security and audit records, complying with legal obligations, resolving disputes, and enforcing agreements. When retention is no longer needed, we delete, de-identify, or aggregate the information according to applicable law and operational requirements.

When you request deletion, we delete covered information from active systems where required by law and instruct applicable service providers to delete the information from their systems. Deletion from backups and logs may take additional time, but the information will be protected and retained only as required for security, legal, or operational purposes.

Your privacy rights

Depending on your state of residence, you may have the right to:

• Know / access the personal information we hold about you and how we use it;
• Correct inaccurate personal information;
• Delete your personal information (cascading to our processors);
• Portability — receive a copy in a portable format;
• Opt out of any sale or sharing for targeted advertising (note: we do not sell or share for these purposes); and
• Limit the use and disclosure of sensitive personal information, including health data.

Global Privacy Control (GPC). Where required by law, we honor Global Privacy Control and similar legally recognized browser opt-out signals as an opt-out of sale or sharing for targeted advertising. Because Vital does not sell consumer health data or use it for targeted advertising, this mainly applies to any non-health-data processing that may be subject to those laws.

How to exercise your rights. Contact us at privacy@vit.al. We will verify your request and respond within the timeframe required by your state's law. You may use an authorized agent where the law allows. If we decline a request, you may appeal by contacting privacy@vit.al (Attn: Privacy — Appeals).

Non-discrimination. We will not deny you service or charge you differently for exercising your rights.

Children's privacy (COPPA)

The Services are intended for adults. We do not knowingly collect personal information from children under 13 without required parental consent. If you believe a child has provided information without required consent, contact us and we will take appropriate steps.

Security

We use administrative, technical, and physical safeguards designed to protect personal information. No system is perfectly secure. You should use caution when submitting information online, including through third-party AI assistant platforms.

Consumer Health Data

Health information you upload — medical documents, lab results, photos, and the health details you give us to find a provider — is consumer health data, and it is governed by our Consumer Health Data Privacy Policy. That policy sets out the consumer health data we collect, how we use it, who we disclose it to, and the consents and rights that apply to it.

Changes and contact

We may update this Policy and will post the new effective date. Questions or requests:

Vital Software Inc.
Privacy: privacy@vit.al