Privacy Policy

Vitex (“Vitex,” “we,” “us”) provides a personal health-protocol tracking application at vitexapp.com (the “Service”). Your health information is among the most sensitive data there is, and this policy explains — specifically and honestly — what we collect, how we use it, who processes it on our behalf, and the controls you have. If anything here is unclear, contact us through the Contact us form in Account Settings or at support@vitexapp.com.

The short version

• We collect the health information you choose to track, because tracking it is the product.
• We do not sell your data, run ads, or share your data with data brokers. Ever.
• AI features send relevant parts of your data to our AI provider to generate your insights — and our AI provider does not use this data to train its models.
• You can delete your account and all of your data yourself, at any time, permanently.

Information we collect

Account information

• Email address, name, and optional profile photo or avatar.
• Authentication data (managed by our infrastructure provider; we never see your password).

Health information you provide

• Your protocol: supplements, medications, injections, and peptide protocols, with doses, timing, and notes.
• Adherence history (what you checked off and when).
• Blood marker names, values, dates, and lab documents or photos you upload for extraction.
• Health profile details you choose to add: biological sex, date of birth, weight, height, health goals, pre-existing conditions, and practitioner name.
• Messages you send to the AI chat assistant.

Payment information

• Payments are processed by Stripe. We never receive or store your card number. We store your plan, and Stripe customer and subscription identifiers.

Technical information

• Service logs and AI usage metrics (for example, which feature was used and how many tokens it consumed) used for operating and securing the Service.
• We currently run no third-party analytics or advertising trackers on the Service.

How we use your information

• To provide the Service: storing your protocol, computing your checklist, charts, history, and reminders.
• AI features: when you use them, relevant data (such as your protocol items, blood markers, conditions, and questions) is sent to our AI provider, Anthropic, to generate the response. For some questions, the AI also searches a fixed list of trusted medical sources (such as PubMed, NIH, and Cochrane) to ground its answers; those search queries are topical and do not include your identity.
• Notifications and email: protocol reminders you enable, and transactional email (invitations, confirmations, password resets, replies to your messages).
• Support and safety: responding to your messages, preventing abuse, and enforcing limits.

AI outputs are informational only, can be inaccurate, and are not medical advice. Our AI provider does not use data submitted through its API to train its models.

Who processes your data (sub-processors)

We use a small number of service providers to operate Vitex. Each processes data only to provide their service to us:

• Supabase — database, authentication, and file storage (data encrypted at rest).
• Vercel — application hosting and serverless infrastructure.
• Anthropic — AI processing for the features described above.
• Stripe — payment processing and billing management.
• Resend — transactional email delivery.
• Apple, Google, and Mozilla push services — delivery of the push notifications you enable.

Beyond these providers, we disclose personal information only if you direct us to (for example, a share link you create), if required by law, or as part of a business transfer — and in that last case this policy’s protections would continue to apply to your data. We do not sell personal information and we do not share it for cross-context behavioral advertising.

Protocol share links

If you create a share link, the categories you select (by default supplements, skincare, and peptides — never medications or injections unless you explicitly enable them) become viewable by anyone who has the link, without signing in. Share pages are anonymous unless you turn on your first name. You can revoke or rotate a link at any time from My Protocol → Share; revocation takes effect immediately, though copies already saved by viewers are outside our control.

Your choices and rights

• Access and correction: your data is visible and editable in the app; profile details can be corrected at any time.
• Deletion: Account Settings → Delete my account permanently erases your protocol, markers, history, profile, and login. This is self-serve and irreversible.
• Notifications: reminders are off by default and controllable per time-of-day in Profile. Note that reminder notifications can include item names on your device’s lock screen.
• Export: usage history can be exported from the History page; contact us for a copy of other data.
• Consent: by creating an account and entering health information, you consent to the collection and processing described here; you can withdraw consent at any time by deleting your account.

Depending on where you live (for example Canada under PIPEDA, California under the CCPA/CPRA, or Washington under the My Health My Data Act), you may have additional statutory rights — including access, deletion, correction, and portability. We honor these rights regardless of jurisdiction: contact us and we will respond within the time required by the applicable law.

Retention

We keep your data while your account is active. When you delete your account, your data is removed from our production systems immediately, and residual copies in encrypted backups are purged on our provider’s standard backup rotation. AI requests are retained by our AI provider only per its API data-retention terms and are not used for model training.

Security

Data is encrypted in transit (TLS) and at rest (AES-256). Access is controlled with per-user authentication and row-level security; administrative access to health data is restricted and health data contents are not shown in our admin tools. No method of transmission or storage is 100% secure, but if a breach affecting your unsecured health information occurs, we will notify you and the relevant authorities as required by law, including the U.S. FTC Health Breach Notification Rule where applicable.

Children

Vitex is not intended for anyone under 18, and we do not knowingly collect data from minors. If you believe a minor has created an account, contact us and we will delete it.

International transfers

Our infrastructure providers store and process data primarily in the United States. Where your data originates elsewhere (for example Canada or the EU), it is transferred to and processed in the U.S. under our providers’ safeguards.

Changes to this policy

If we make material changes, we will notify you in the app or by email before they take effect, and update the date at the top of this page. For significant new uses of health data, we will ask for your consent rather than rely on a policy update.

Contact

Privacy questions or requests: the Contact us form in Account Settings, or support@vitexapp.com. See also our Terms of Service.