Vhet Privacy Policy

Effective date: [DATE PUBLISHED]
Last updated: [DATE PUBLISHED]

This Privacy Policy explains how Vhet LLC ("we", "us", "our") collects, uses, shares and protects your information when you use the Vhet mobile app for iOS and Android and related services (together, the "App"). It also explains your choices and rights.

Where the App is available. The App is not currently offered in the European Union, the European Economic Area (including Norway, Iceland and Liechtenstein), the United Kingdom or Switzerland. The protections in this policy apply to every user, wherever they are.

Separate Consumer Health Data Privacy Policy. If you live in Washington State, Nevada or Connecticut, or your health data is collected there (and for anyone who wants the details), our Consumer Health Data Privacy Policy at https://vhet.app/health-data explains how we handle "consumer health data" as those state laws define it.

Summary (the short version)

• We collect your account details, your body and profile details (age, sex, height, weight, goals), your workouts and activity (exercises, steps, calories), health data you choose to connect from Apple Health (HealthKit) or Android Health Connect (for example heart rate and sleep) if and when we add that feature, and location (GPS for runs and routes, or approximate location). When the App connects to our servers, we also receive basic device and technical data, such as your IP address and app version.
• Health and fitness data is walled off. We use it only to provide the App's fitness features to you. We never use it for advertising or marketing, never sell it, and never give it to advertising or analytics companies. If we add HealthKit or Health Connect, data from them will never be used for ads and never shared with ad or analytics tools.
• No ads or tracking today. The App doesn't show ads, and we don't use any advertising, analytics or crash-reporting service. (On Android, Google's on-device barcode scanner may send Google basic diagnostic data about the scanner itself; see Section 2.) We don't track you across other companies' apps or websites, and we don't sell your personal information or share it for cross-context behavioural advertising. The free version may show ads in future. Before we add any ad, analytics or crash-reporting service, we will update this policy, name the service, and ask for any consent the law requires (see Section 5).
• Subscriptions are handled by Apple or Google. We never see your full card details.
• AI weekly plans (optional). If you turn on the AI weekly meal and workout plans, or an AI coach or recipe feature if and when one is available, prompts and related profile, workout or food information that feature needs may be sent to OpenAI so it can reply. We ask for separate permission first. By default, OpenAI does not use API data to train its models.
• You can delete your account at any time, in the App (Settings > Account > Delete Account) or by emailing support@vhet.app (see Section 13).
• You can download a copy of your data in the App (Settings > Privacy > Download my data), or ask by emailing support@vhet.app (see Section 12).
• You have rights to access, correct, delete and port your data. We don't sell or share your data for ads; if that ever changes, you'll be able to opt out. See Section 12.

1. Who we are

The App is provided by Vhet LLC, a limited liability company registered in the State of Washington, USA (UBI 606 303 446), with its address at 409 23rd Ave S, Seattle, WA 98144, USA. We are responsible for your personal information as described in this policy.

• Privacy contact: support@vhet.app

2. What information we collect

We collect only what we need to run the App and the features you choose to use. The table below lists each category, where it comes from, and whether you have to provide it.

Consent and permission records. We keep a record of your consent choices (for example, whether you gave health-data consent or AI-feature consent, and when) so we can respect them and show that we did.

Sensitive information. Several of these categories are treated as sensitive data under various laws: body and profile data, workout and activity logs, HealthKit and Health Connect data and food photos (if and when those features are available), food logs that reveal diet or health, and precise location. In this policy, "Health & Fitness Data" means body and profile data, workout and activity logs, and, if we add Apple Health / Health Connect, all data from HealthKit or Health Connect. We give this data extra protection (see Section 4). When Health & Fitness Data is included in an AI prompt with your separate AI permission, Section 4A also applies.

What we don't collect. We don't ask for government ID numbers. We don't collect your payment card details (Apple or Google process payments). We don't access your contacts. We don't access your photo library unless you choose to submit a food photo (or similar) for a feature that uses it.

2A. Website waitlist

Our website, vhet.app, has a waitlist page. It collects only your email address. To join, you must tick a box that starts unticked: "I'm 16 or older and want updates and launch news from Vhet. You can unsubscribe at any time." We save your email address and the date and time you ticked the box on our Supabase server in Canada.

We use your email only to send you Vhet launch news and updates. Every email has an unsubscribe link. The website has no analytics or tracking cookies, but Cloudflare, which hosts the site, keeps standard hosting and security logs (see Section 9).

We keep your waitlist details until you unsubscribe or ask us to delete them, or until 6 months after the App launches if you never create an account, whichever comes first. "Launch" means the public release of the App on the App Store or Google Play. To be removed at any time, email support@vhet.app.

The waitlist is for people aged 16 or older. If we learn someone under 16 has joined, we delete their email.

3. How we use your information and our legal bases

We use your information for the purposes below. Where the privacy law that applies to you requires a legal basis (for example, Brazil's LGPD or Nigeria's NDPA), we rely on the one shown.

No advertising or analytics. We don't use your information for advertising or analytics. If that changes, we'll add the purpose and its legal basis here first (see Section 5).

Legitimate interests. Where we rely on legitimate interests, we have weighed our interests against your rights. You can object at any time (see Section 12).

No automated decisions with legal effects. We use your data to personalise workout suggestions and goals, but we don't make decisions that have legal or similarly significant effects on you based solely on automated processing.

No new purposes without telling you. We won't use your data for a purpose that is materially different from those listed here without telling you first and, where required, asking for your consent.

4. Special rules for health and fitness data

We know Health & Fitness Data is personal. These commitments apply to everyone, wherever you live:

1. Explicit, separate consent. Before we collect Health & Fitness Data, we ask for your explicit consent on a dedicated screen. That screen explains what we collect and why. It is separate from our Terms and from any other permission we ask for. If we add Apple Health / Health Connect, we will ask separately before connecting it, and the operating system will then ask you to approve each data type.

2. Used only to provide the App to you. We use Health & Fitness Data only to provide and improve the fitness features you use: logging, tracking, insights, progress and personalised plans. We also use it for security and legal compliance where necessary.

3. Never used for advertising or marketing. We don't use Health & Fitness Data, including anything derived from it, to choose, target or measure ads, or for marketing or data mining. This applies whether we do it or a third party does.

4. Never sold, and never shared for advertising. We don't sell Health & Fitness Data, share it for cross-context behavioural advertising, or give it to data brokers.

5. Walled off from ad and analytics tools. The App has no advertising or analytics tools. If we ever add any, HealthKit and Health Connect data (if we add those connections), and the other Health & Fitness Data we hold, will not be sent to them, and no analytics event will contain health or fitness values.

6. Not stored in iCloud. If we add Apple Health, we will not store health information obtained through HealthKit in iCloud.

7. Not used for credit, insurance, employment or lending decisions, and not provided to anyone for those purposes.

8. Accuracy. If we add Apple Health / Health Connect, we will not write false or inaccurate data to them.

9. Who receives it. Health & Fitness Data is processed only by us and by service providers that host and operate the App for us (for example cloud hosting and database providers). They are bound by contract to use it only on our instructions. If you give separate AI permission for a feature that needs it (see Section 4A), the Health & Fitness Data included in that request may also be sent to OpenAI solely to answer the request. It is never sent to advertising or analytics companies. We share it with anyone else only if you ask us to, or if the law requires it (see Section 7).

10. Your control. You can stop collection at any time:

    • If you have connected Apple Health or Health Connect (if and when this feature is available), turn off individual data types in the iPhone Health app (Sharing > Apps > Vhet), or in Android Health Connect settings.
    • Withdraw your in-app health-data consent in Settings > Privacy > Health Data.
    • Delete your data or your account (Section 13).

    Withdrawing consent stops future collection and use. We will then delete the Health & Fitness Data we hold about you, as described in Section 9, unless you tell us to keep your existing logs. If you connected Apple Health or Health Connect, data already stored there stays there, under your control.

4A. AI features and OpenAI

Some optional features — your weekly fitness and meal plan and its weekly adjustment based on what you logged, and, if and when they are available, an AI coach, recipe suggestions and related insight helpers — use a third-party AI provider so we can generate replies for you.

What is sent. For each request, we send only what is needed for that feature to work. That can include your prompt and related information you submit or that the feature needs to answer you (for example goals, recent workouts, food-log details, or, if and when food photo analysis is available, a food photo you submit for that request). If so, food photos will be sent as the image itself, with location and other embedded photo data removed first. We never send OpenAI data for advertising.

Provider. These features use the OpenAI API. OpenAI's privacy policy is at https://openai.com/policies/privacy-policy. How OpenAI handles API data is described at https://developers.openai.com/api/docs/guides/your-data.

No training by default. As of OpenAI's stated API data practices (API inputs and outputs are not used to train or improve OpenAI models unless a customer opts in), we will not opt in to training on your customer content. OpenAI may retain customer content in abuse-monitoring logs for up to about 30 days by default. Zero Data Retention is available only with OpenAI's approval; if we enable it later, we will update this policy.

Separate permission first. Before any of your personal data is sent to OpenAI, we ask for your explicit permission on a dedicated in-app screen (Apple App Store Review Guideline 5.1.2(i)). You can say no and still use the rest of the App. Turning AI features off, or withdrawing permission in Settings > Privacy > AI Features, stops future sends to OpenAI. It does not undo processing that already happened for earlier requests.

Not medical advice. AI replies are informational fitness and nutrition suggestions only. They are not medical advice, diagnosis or treatment. Talk to a qualified clinician about health decisions.

5. Advertising and tracking

No ads, analytics or tracking today. The App doesn't show ads and contains no advertising, analytics or crash-reporting software. We don't collect your device's advertising identifier (Apple IDFA or Google Advertising ID). We don't "track" you as Apple's App Tracking Transparency (ATT) rules define it, so the App doesn't show Apple's tracking prompt.

We don't sell or share your personal information. We don't sell your personal information, and we don't share it for cross-context behavioural advertising, as US state privacy laws use those terms.

If this changes. The free version may show ads in future. Before we add any ad, analytics or crash-reporting service, we will update this policy, name the service, and ask for any consent the law requires (for example, Apple's ATT prompt on iPhone). If we ever start selling or sharing personal information for advertising, you'll be able to opt out in the App and by emailing support@vhet.app with "Do Not Sell or Share" in the subject line, and we'll honour Global Privacy Control (GPC) signals as the law requires. If we add ads to the free version, paying subscribers won't see them.

Health data and location are never used for ads. Even if we add ads in future, we will never use Health & Fitness Data or your precise (GPS) location to choose, target or measure ads, and we will never give them to advertising partners.

Always optional. Saying no to tracking, personalised ads or analytics will never block access to the App or to paid features.

6. Subscriptions and payments

Vhet offers auto-renewing monthly and yearly subscriptions, which may start with a free trial.

• Payments go through Apple or Google. When you subscribe, your payment is processed by Apple (App Store) or Google (Google Play) under their own terms and privacy policies. We don't receive or store your full card number or other payment-card details. We receive limited information from them, such as your subscription status, product, transaction ID, dates, country and whether a trial or refund applies. We use it to unlock features and keep records.
• Free trials and renewals. The length of any free trial, the price, and the date the trial turns into a paid subscription are shown in the App Store or Google Play before you subscribe. Unless you cancel before the end of the free trial or the current billing period, your subscription renews automatically, and the store charges you. To avoid being charged, cancel before the trial ends: on the App Store, at least 24 hours before the trial ends; on Google Play, any time before the trial ends.
• Cancelling. You manage and cancel subscriptions through your Apple ID settings (https://apps.apple.com/account/subscriptions) or Google Play (Play Store > Profile > Payments & subscriptions). Deleting the App or your account doesn't cancel your subscription. Please cancel with Apple or Google too.
• Refunds are handled by Apple or Google under their policies.

7. How we share information

We don't sell your personal information or share it for cross-context behavioural advertising, and we never will for your Health & Fitness Data or precise location. We share personal information only as follows:

1. Service providers (processors). Companies that act on our behalf and only on our instructions, under written contracts requiring confidentiality, security, and use only for the services they provide to us. They include:

   • cloud hosting and database providers (Supabase, for our database, sign-in, file storage and website waitlist, in Canada; Cloudflare, for our website)
   • authentication providers
   • customer support tools
   • OpenAI, for optional AI features (weekly plans and adjustments and, if and when available, AI coach, recipes and related suggestions), only when you have given separate AI permission

   Only hosting, database and core infrastructure providers can access Health & Fitness Data in the ordinary course. When Health & Fitness Data is included in an AI prompt with your separate AI consent, OpenAI may process that data solely to answer the request. It is still never sent to advertising networks or analytics companies for ads or marketing.

2. No advertising or analytics partners. The App has no advertising or analytics partners. If we add any, we'll update this policy first (see Section 5).

3. Apple and Google. To process subscriptions and sign-in, and (at your direction, if and when this feature is available) to read from and write to Apple Health or Health Connect on your device.

4. At your direction. When you ask us to share or export data, for example when you download a copy of your data in the App (Settings > Privacy > Download my data).

5. Legal and safety reasons. If we reasonably believe disclosure is required by law, regulation, legal process or an enforceable government request, or is necessary to protect the rights, property or safety of our users, the public or us. Where lawful, we will tell you about such requests. We will push back on requests for Health & Fitness Data that we believe are overbroad or unlawful.

6. Business transfers. In a merger, acquisition, financing, reorganisation, bankruptcy or sale of assets, information may be transferred to the successor. The successor must continue to honour this policy, and we will notify you of any change in who controls your data.

7. Affiliates. Companies under common control with us, who must follow this policy. We currently have no affiliates that receive personal information.

Third-party SDKs we use. The current list of third-party software development kits (SDKs) in the App, what each does, and links to their privacy policies is below. We'll update it whenever we add or remove one. The App contains no advertising, analytics or crash-reporting SDKs.

Same protection. We require every third party that receives user data from us, including SDK providers, service providers, any related companies, and any analytics or advertising provider we may add in future, to protect that data at least as well as this Privacy Policy does and as the App Store and Google Play rules require.

8. International data transfers

We are based in the United States (Washington State), and our service providers may process data in the United States, Canada and other countries. This means your data may be processed outside the country where you live, for example outside Brazil, Canada or Nigeria. While your information is in another country, it is subject to that country's laws and may be accessed by its courts, law enforcement or national security authorities.

When the law where you live requires it, we use appropriate safeguards for these transfers, such as contracts with our service providers that require them to protect your data. These include the mechanisms required by Brazil's LGPD and Nigeria's NDPA. You can ask for a copy of the relevant safeguards by contacting support@vhet.app.

9. How long we keep information

We keep personal information only as long as we need it for the purposes in this policy, and then we delete or anonymise it.

We may keep limited data longer where the law requires it, or to resolve disputes, prevent fraud or abuse, or enforce our agreements. If so, we keep only what is necessary and protect it.

10. Security

We use administrative, technical and physical safeguards designed to protect your information, including:

• encryption in transit (TLS) and at rest
• access limited to staff and service providers who need it
• stricter access controls for Health & Fitness Data
• secure development practices and vulnerability management
• monitoring

No system is completely secure. If a data breach affects your personal information, we will notify you and the authorities as the law requires.

11. Your choices at a glance

12. Your privacy rights

Depending on where you live, you may have some or all of the rights below. We extend the core rights (access, correction, deletion, export, and withdrawing consent) to all users, wherever they live.

Getting a copy of your data in the App. If you're signed in, go to Settings > Privacy > Download my data to download a .zip file of your data, once a day. Before each download, you must confirm it's you, using your password or a fresh Sign in with Apple or Google, whichever you signed up with. The download link works for 7 days, and the file is deleted within a day after the link expires. Deleting your account deletes any downloads. The .zip file contains your profile (name, email, sign-in method, body details and goals, injury notes and food restrictions), your workouts and weekly plans with their changes, your run and walk activities, your food logs and My foods, your food lookup records, and your AI consent choices.

How to make a request. You can also email support@vhet.app from the email address you use to sign in to Vhet (the App's Settings > Privacy screen can start this email for you). To ask for a copy of your data by email, use the subject "Vhet data copy request". We'll reply within one month, and send a download link to that sign-in email address. The link works for 7 days and needs you to be signed in. Your copy is a .zip file of machine-readable JSON files. You don't need to create an account to make a request, but if you have one, we may ask you to make the request through it. We'll verify your identity before acting. Usually we do this by confirming you control the account or email address, and we may ask for more information if needed. We won't discriminate against you for exercising your rights.

Authorised agents. Where the law allows, you can use an authorised agent to make a request for you. We may ask for proof that you authorised the agent, and ask you to verify your identity directly.

Appeals. If we decline your request, you can appeal by replying to our decision or emailing support@vhet.app with "Privacy Appeal" in the subject line. We'll respond in writing within the time the law requires, for example 45 or 60 days depending on the state. If we deny your appeal, we'll tell you how to contact your state Attorney General.

12.1 Rights for all users

Wherever you live, you can ask us to:

• access your personal information and get a copy
• correct inaccurate information
• delete your information
• restrict how we use it
• data portability: receive the information you gave us in a structured, machine-readable format, or have it sent to another company
• object at any time to our use of it based on legitimate interests, and to direct marketing
• withdraw consent at any time, without affecting processing that happened before you withdrew
• not be subject to decisions based solely on automated processing that have legal or similarly significant effects

We respond within one month, or sooner if the law where you live requires it. Where the law allows, we can extend this for complex requests, and we'll tell you if we do.

You also have the right to complain to the data protection or privacy regulator where you live. We'd appreciate the chance to address your concern first at support@vhet.app.

12.2 California residents (CCPA as amended by the CPRA)

This section applies to California residents and supplements the rest of this policy.

Categories of personal information we collected in the last 12 months, using the CCPA's categories:

• Identifiers: name, email, account ID, IP address.
• Customer records: name, email.
• Characteristics of protected classifications: age and sex.
• Commercial information: subscription and purchase history.
• Internet or other electronic network activity: technical data about the App's connections to our servers and visits to vhet.app.
• Geolocation data: precise and approximate.
• Inferences: fitness level, goals and preferences used to personalise plans.
• Sensitive personal information: account log-in credentials; personal information collected and analysed concerning your health (Health & Fitness Data); precise geolocation.

Sources. You (including through our website waitlist); your device; Apple Health and Health Connect (if and when available, with your permission); Apple and Google (sign-in and subscriptions).

Purposes. As described in Section 3.

Disclosed for a business purpose (last 12 months) to service providers and contractors: all the categories above, as needed to host, operate, secure, support and improve the App. Sensitive personal information is disclosed only to hosting and core infrastructure providers.

"Sold" or "shared" (last 12 months). We have not "sold" or "shared" (for cross-context behavioural advertising) any personal information in the last 12 months, and we don't sell or share it now. That includes Health & Fitness Data, precise geolocation, account credentials and all other sensitive personal information, and the personal information of consumers under 16.

Sensitive personal information. We use and disclose sensitive personal information only for purposes the CCPA allows without offering a right to limit: to provide the services you request, for security and integrity, for short-term transient use, to maintain service quality, and as the law permits. We don't use it to infer characteristics about you beyond providing the App.

Your California rights:

• know or access: the categories and specific pieces of personal information we collected, the sources, our purposes, and the categories of third parties we disclose to
• delete
• correct
• opt out of the sale or sharing of your personal information. We don't sell or share personal information. If that changes, we'll update this policy first, and you'll be able to opt out in the App or by emailing support@vhet.app with "Do Not Sell or Share" in the subject line. We'll also honour GPC signals (see Section 5).
• non-retaliation: we won't discriminate against you for exercising your rights

We don't use automated decision-making technology to make significant decisions about you.

Responses. We confirm requests within 10 business days and respond within 45 calendar days. Where permitted, we can extend this by another 45 days and will tell you if we do.

Retention. See Section 9.

Shine the Light. We don't disclose personal information to third parties for their own direct marketing purposes as defined by California Civil Code § 1798.83.

12.3 Other US states

Residents of states with comprehensive privacy laws may have rights similar to those described above, depending on their state and on whether the law applies to us. These states include Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia and others as their laws take effect. The rights can include:

• confirming whether we process your data
• accessing, correcting and deleting it
• getting a portable copy
• opting out of targeted advertising, the sale of personal data, and profiling that has legal or similarly significant effects (we don't currently do any of these)
• appealing our decision on your request

We treat Health & Fitness Data and precise location as sensitive data. We process sensitive data only with your consent and only as needed to provide the App features you request. We never sell sensitive data, and we don't process personal data we know belongs to a minor for targeted advertising. Use the methods above to exercise your rights. We honour recognised opt-out preference signals (such as GPC) where the law requires.

Washington, Nevada and Connecticut consumer health data. See our separate Consumer Health Data Privacy Policy at https://vhet.app/health-data.

HIPAA. Vhet is a consumer app that you use directly. We are not a healthcare provider, health plan or healthcare clearinghouse, and we don't provide the App on behalf of one, so the US federal HIPAA law generally doesn't apply to the data you give us. We protect your health data as described in this policy and as other laws require.

12.4 Other countries

• Brazil (LGPD). You have the rights in Article 18 of the LGPD, including confirmation, access, correction, anonymisation, blocking or deletion, portability, information about sharing, and withdrawal of consent. We process sensitive data (health) only with your specific and prominent consent, or on another basis the LGPD allows. You may complain to the ANPD.
• Canada (PIPEDA and provincial laws). You can access and correct your personal information and withdraw consent, subject to legal or contractual limits. We obtain express consent for sensitive information such as health data. You may complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner (in Quebec, the Commission d'accès à l'information du Québec).
• Nigeria (NDPA 2023). You have rights including access, correction, deletion, restriction, portability, withdrawal of consent and objection. We process sensitive personal data such as health data on the basis of your explicit consent. You may complain to the Nigeria Data Protection Commission.
• Everywhere else. Contact us at support@vhet.app to exercise the rights in Section 12.1 and any other rights you have under your local law. You can also complain to your local data protection or privacy regulator.

13. Deleting your account

You can delete your account and associated data at any time:

• In the App: Settings > Account > Delete Account
• By email (even if you've uninstalled the App): email support@vhet.app from the email address you use to sign in to Vhet, with "Delete my account" in the subject line. We'll confirm the request with you before deleting.

What happens:

• We delete your account and the personal data associated with it, including Health & Fitness Data, from our active systems within 30 days.
• Your routes, distance and pace are stored only on your device, never on our servers. They're deleted from that phone when you delete your account in the App, or when you uninstall the App.
• Any data download files are deleted immediately.
• Backups are overwritten within 90 days.
• We ask our service providers to delete it too.
• We keep only what the law requires, or what we need for security, fraud prevention or legal claims (for example purchase records for tax purposes; see Section 9). We tell you in the deletion flow what we keep and why.
• If you used Sign in with Apple, we revoke our access tokens with Apple.
• If you connected Apple Health or Health Connect, data stored on your device in those apps isn't deleted by us. You control it in those apps.
• Deactivating or freezing an account isn't the same as deleting it. We offer true deletion.
• Subscriptions: deleting your account does not cancel billing by Apple or Google. We'll remind you to cancel in the deletion flow.

We'll confirm when deletion is complete.

14. Children

The App is not directed to children. You must be at least 16 years old to use it. We don't knowingly collect personal information from anyone under 16. If we learn that we have, we'll delete the account and its data promptly. If you believe someone under 16 has given us personal information, contact support@vhet.app.

If you are 16 or 17, we will not show you personalised ads or use your information for targeted advertising, we will not sell or share your personal information, and your privacy settings start at the most protective options.

We don't knowingly sell or share the personal information of anyone under 18, or use it for targeted advertising.

15. Changes to this policy

We may update this policy from time to time. We'll post the new version with an updated "Last updated" date. If we make material changes, we'll notify you in the App or by email before the change takes effect. These include using your data for new purposes, collecting new categories of health data, or sharing it with new categories of recipients. Where the law requires, we'll ask for your consent again. Previous versions are available on request.

16. Contact us

Vhet LLC
409 23rd Ave S, Seattle, WA 98144, USA
Email: support@vhet.app
In-app: Settings > Help > Contact Us