Privacy & Health Data Policy

1. Introduction

At VitaWell, your health and privacy are our highest priorities. This Privacy & Health Data Policy explains how we handle the personal information and protected health information (PHI) you share with us when you access our wellness programs, consultations, digital platforms, and related services. We are committed to complying with applicable privacy laws, including GDPR, CCPA, and HIPAA where applicable.

2. What Health & Personal Data We Collect

We collect information to deliver personalized, safe, and effective wellness services. This may include:

• Personal Identifiers: Name, email, phone number, date of birth, and address for account creation and billing.
• Health & Wellness Data: Medical history, dietary preferences, fitness goals, sleep patterns, stress levels, mental health notes, biometric data (e.g., heart rate, weight, blood pressure), and progress metrics.
• Session & Usage Data: Records of consultations, therapy sessions, class attendance, app/website interactions, and communication preferences.
• Device & Technical Data: IP address, browser type, device identifiers, and crash logs to improve platform stability and security.

3. How We Use Your Information

We use your data strictly to support your wellness journey and operate our services:

• Deliver personalized nutrition, fitness, and mental health programs
• Schedule and conduct consultations with licensed practitioners
• Track progress, generate wellness reports, and adjust recommendations
• Process payments, issue receipts, and manage subscriptions
• Improve our platforms, services, and user experience
• Comply with legal obligations and protect against fraud or liability

We do not sell, rent, or trade your personal or health data to third parties for marketing or advertising purposes.

4. Data Security & Protection

VitaWell implements industry-leading safeguards to protect your information:

• End-to-end encryption for all data in transit and at rest
• Strict access controls, role-based permissions, and multi-factor authentication for staff
• Regular security audits, vulnerability assessments, and penetration testing
• Secure, HIPAA-compliant cloud infrastructure with redundant backups
• Staff training on data privacy, confidentiality, and ethical handling of PHI

While no system is 100% immune to breaches, we maintain continuous monitoring and incident response protocols to detect and mitigate risks promptly.

5. Sharing & Third-Party Disclosures

We may share your data only in the following circumstances:

• Service Providers: Trusted vendors (e.g., payment processors, cloud hosting, telehealth platforms) bound by strict data processing agreements and confidentiality clauses.
• Professional Referrals: Only with your explicit written consent, such as sharing relevant wellness metrics with your primary care physician or specialist.
• Legal Requirements: When required by law, court order, or government investigation.
• Emergency Situations: If there is an immediate threat to your health or safety, or to prevent harm to others.

6. Your Rights & Control

Depending on your jurisdiction, you may have the following rights regarding your personal and health data:

1. Access: Request a copy of the data we hold about you
2. Correction: Update or amend inaccurate information
3. Deletion: Request erasure of your data, subject to legal retention requirements
4. Portability: Receive your data in a structured, machine-readable format
5. Opt-Out: Unsubscribe from marketing communications or withdraw consent at any time
6. Restriction: Limit how we process your information under certain conditions

To exercise these rights, please contact our Data Protection Officer using the information provided at the end of this document. We will respond within 30 days, as required by applicable law.

7. Data Retention & Deletion

We retain your personal and health data only as long as necessary to fulfill the purposes outlined in this policy, comply with legal obligations, resolve disputes, and enforce agreements. Health records are typically retained for a minimum of 7 years or as mandated by local healthcare regulations. Upon account deletion or request, we will securely anonymize or permanently erase your data within our control systems, except where retention is legally required.

8. Children’s Privacy

VitaWell’s services are not designed for individuals under the age of 18. We do not knowingly collect personal or health information from minors. If we discover that a minor has provided data without verifiable parental consent, we will promptly delete it. Parents or guardians who believe their child’s information has been shared with us should contact us immediately.

9. Updates to This Policy

We may update this Privacy & Health Data Policy to reflect changes in our services, technology, or legal requirements. Material changes will be communicated via email or through a prominent notice on our platform. The "Last Updated" date at the top of this page will be revised accordingly. Your continued use of our services constitutes acceptance of the updated policy.

10. Contact Us

If you have questions, concerns, or requests regarding this policy or your health data, please reach out to our Privacy Team: