01 · Plain-language summary
The default is local.
- The app does not require an account; optional passwordless email sign-in is available.
- Supabase processes account identity and session data, and Resend delivers the requested login code. Neither service receives the health records stored by the app.
- Saved tracker entries, profile information, record metadata, and imported documents are stored on your device.
- Vitals & Vices does not currently operate cloud synchronization for saved health records.
- Optional product analytics is off until you allow it and never includes health readings, notes, documents, voice content, or account identity.
- Assisted voice transcription is the explicit, per-recording health-data cloud-processing exception described below.
- Optional Apple Health sleep import is read-only and begins only when you request access from Sleep connections.
- Nothing is shared with a clinician or another person unless you initiate an export or share action.
On iPhone, Apple handles Premium subscriptions. Health-record synchronization is not available.
02 · Information saved locally
What the app stores on your device
Depending on how you use the app, local data may include profile details, Medical ID information, measurements, habits, symptoms, well-being entries, reproductive-health entries, notes, goals, reminder settings, medicines, vaccinations, custom templates, imported PDF/image documents, document metadata, generated clinician PDFs, and structured JSON exports.
Native database records are stored in an encrypted local database. Imported originals and generated files are kept in app-private storage. Device and operating-system security, backups, and access controls also affect the protection of local files.
Vitals & Vices does not operate its own cloud backup for saved health records. An encrypted iPhone backup may preserve the private app container and its protected database key when both restore successfully, but this is controlled by Apple and is not guaranteed by Vitals & Vices. Keep source documents and irreplaceable information elsewhere. Removing the app, clearing app storage, losing the device, or an incomplete restore may remove or make local data unavailable.
03 · Assisted voice
Cloud processing happens only after explicit consent for that recording.
When you choose assisted voice and enable secure transcription, the app records a short temporary audio file and sends it over an encrypted connection to the protected Vitals & Vices transcription gateway. The gateway authenticates and rate-limits the request, then sends the recording to OpenAI’s audio-transcription service.
The Vitals & Vices gateway is designed not to store or log recording or transcript bodies. OpenAI returns the transcript text; OpenAI publishes its API data controls and retention practices, which may change. See OpenAI API data controls.
The app deletes its temporary local recording after transcription. The editable transcript and proposed value remain on screen for your review. A transcript or value becomes part of your local health history only if you choose Save. If you save it, the transcript may be retained locally as provenance for that entry.
Operational metadata needed to secure and operate the gateway—such as request timing, status, rate-limit state, and privacy-safe provider/request identifiers—may be processed without logging recording or transcript bodies.
04 · Optional product analytics
Feature-use analytics starts only after you allow it.
If you choose Allow during onboarding or later in Data & privacy, the app may send a narrow allowlist of screen-flow and feature-completion events to Amplitude so we can understand adoption, funnels, retention, and where users stop. Amplitude uses a random installation identifier to connect events from one app installation. This makes the data pseudonymous, not fully anonymous.
Analytics never includes health readings or values, tracker or medicine names, notes, filenames, documents, photos, audio, transcripts, Medical ID, name, email address, account identifiers, advertising identifiers, precise location, or IP-derived location. Session replay and automatic interaction capture are not enabled.
You can withdraw permission at any time in Profile → Data and privacy. Withdrawing permission stops future analytics collection from the app. Testing data is kept separate from public-app analytics. Dashboard access is restricted. Retention details will be published before analytics is enabled for customers.
05 · Optional Premium subscriptions
Apple handles iPhone purchases and access.
On iPhone, the App Store displays subscription plans, processes purchases, and verifies Premium access through StoreKit. Optional email sign-in does not change Apple subscription access. The app does not send your health readings, notes, Medical ID, documents, filenames, or voice content to Apple purchase handling.
Premium access is separate from the optional login account and from locally saved health records. Cancelling or losing Premium does not delete records you already own. You can manage or cancel the subscription through your Apple Account; deleting the optional Vitals & Vices login account does not cancel Apple billing.
05 · Device permissions
You decide when the app can use protected capabilities.
| Permission | Purpose |
|---|---|
| Apple Health | Read sleep sessions from the period you choose after you explicitly connect it. The app does not write to Apple Health. |
| Microphone | Record a spoken entry only when you start assisted voice. |
| Camera | Photograph a paper health document you choose to store. |
| Photos | Select report images you choose to import. |
| Files | Select a PDF or image and share/save exports through operating-system controls. |
| Notifications | Schedule local reminders that you explicitly enable. |
You can change permissions in your device settings. Denying a permission disables the related feature but does not prevent ordinary manual entry.
06 · Exports and sharing
Generation is local; sharing is your action.
The app can generate clinician-readable PDFs and a structured JSON portability file on the device. The JSON file is not currently an in-app restore format. Original imported documents are not embedded in either export. Generated clinician PDFs can be retained locally in a five-report repository.
Information leaves the app only after you use the operating-system share sheet or save it to another location. The destination you choose—Mail, Messages, Files, a cloud drive, or another app—has its own privacy and security practices. Review the contents and recipient before sharing.
06 · This public website
No advertising cookies or behavioral analytics.
This documentation site is hosted on Cloudflare Pages. We do not currently add account login, contact forms, advertising trackers, or behavioral analytics to these pages. Cloudflare may process network and security information such as IP addresses, request metadata, and security events to deliver and protect the site under its own terms and privacy practices.
Links to third-party sites take you outside this website. Their policies apply once you leave.
07 · Your choices
Control, correct, export, or remove your record.
- Edit or delete individual tracker entries and supported record metadata inside the app.
- Delete stored documents and generated clinician PDFs you no longer want.
- Decline assisted voice and use manual entry.
- Disable reminders or revoke device permissions.
- Create a structured export before removing local data.
- Use Profile → Data & privacy to erase all local health data, documents, generated exports, reminders, and preferences from the device.
- Use Profile → Account to delete the optional Supabase account. Account deletion does not silently erase local health records; local erasure is a separate confirmation.
Vitals & Vices does not hold a synchronized server-side copy of your saved health history. Supabase retains optional account data until you delete the account or retention is otherwise required by law.
08 · Retention
Local data remains until you remove it.
Saved app data and documents remain locally until you delete individual content, clear app storage, or remove the app, subject to device backup and restoration behavior. The app retains no more than five generated clinician PDFs at a time and requires you to delete one before creating a sixth; it does not silently evict them.
Gateway security and rate-limit metadata is retained only as needed for security, reliability, abuse prevention, and legal obligations. Recording and transcript bodies are not intentionally included in gateway logs.
09 · Children
This product is not designed for unsupervised use by children.
Vitals & Vices is a personal record tool and is not designed to solicit information directly from children. A parent or guardian should supervise any use for a dependent and consider local law, clinical guidance, and the sensitivity of the information recorded.
10 · Changes
Material changes will be reflected here.
We may update this policy when product capabilities, service providers, or legal requirements change. The effective date at the top will change when a revised policy is published. Features that materially change data handling—such as accounts, synchronization, or new cloud processing—will require corresponding disclosure before release.
11 · Contact
Privacy and support questions
Visit the Support Center or email support@zeroentropylab.com. Do not send health documents or sensitive readings unless support specifically requests a safe, redacted example.