Consumer Health Data Privacy Policy

Why this document exists

Several states regulate health data held by companies that are not covered by HIPAA. The Washington My Health My Data Act, Nevada Senate Bill 370, and the health data provisions of the Connecticut Data Privacy Act each require a specific notice about consumer health data and give residents rights beyond general privacy law.

HIPAA does not apply to Vitality's services in the ordinary course, and the data we hold is squarely within these state definitions. This policy is that notice.

It supplements our Privacy Policy at vitalityblueprint.com/privacy-policy and does not replace it. Where the two conflict on the treatment of consumer health data, this policy controls.

What Vitality is

Vitality is a technology company. It is not a clinical laboratory, a health care provider, or a telehealth service, and it does not practise medicine. Vitality does not diagnose, treat, cure, prevent or mitigate any disease, illness or medical condition.

Vitality's outputs are informational performance interpretation. They are not a diagnosis, a treatment plan, a prescription, medical advice, or a medical record, and they are not reviewed or approved by a licensed clinician. Protocols are performance guidance covering nutrition, training, lifestyle and supplementation. They are not prescriptions and they do not address the diagnosis or treatment of disease.

Laboratory testing, and any physician involvement in ordering a test or handling a result that requires urgent attention, is performed by independent third parties under their own licences and legal obligations. Vitality does not order tests, does not analyse specimens, and employs no clinicians.

Who this applies to

This policy applies if you are a resident of Washington, Nevada or Connecticut, or of any other state that adopts a comparable consumer health data law. If you are unsure whether it applies to you, you may rely on it regardless: we will honor the rights below for any individual who asks.

It applies to consumer health data we collect as a controller. Where a coach or an organization brought you to Vitality, that coach or organization is the controller and we act as their processor. We will still acknowledge your request, route it, and assist. Where you withdraw a consent we administer on your coach's behalf, we act on the withdrawal directly. See Section 9 of the Privacy Policy.

What we mean by consumer health data

Consumer health data is personal information linked or reasonably linkable to you that identifies your past, present or future physical or mental health status. For Vitality that includes:

• Bloodwork and biomarker data. Panel results, individual biomarker values, laboratory reports you or your coach upload, and reference range comparisons.
• Interpretive outputs. The Vitality Score, Performance Area scores and constraint zones, biomarker patterns and ratios, estimated biological age, your Personal Performance Plan and your Protocol. We generate these about you and they are consumer health data.
• Self-reported health information. Health history, symptoms, medications and supplements, sleep, nutrition, alcohol and caffeine intake, menstrual cycle information where you provide it, injury and illness history, and readiness and recovery questionnaire responses.
• Bodily and biological measurements. Height, weight, body composition, and any other measurement you provide or we receive.
• Wearable-derived health data. Sleep, heart rate, heart rate variability, activity, training load and recovery metrics from integrations you connect.
• Specimen and testing information. The fact that you sought or obtained laboratory testing, panel selection, collection appointments and locations, and testing status and history.
• Inferences. Any inference we draw from the above about your health status.

Data de-identified in accordance with the standard in our Privacy Policy is not consumer health data, and this policy does not apply to it.

Why we collect it

• To arrange laboratory testing you have requested, including providing a laboratory and its physician group the information required to issue an order, collect a specimen and return a result.
• To generate the interpretive outputs that are the product you purchased.
• To deliver those outputs to you, and to your coach or organization where you have consented or where your agreement with them provides for it.
• To administer your consent record, including applying the delivery gate and processing withdrawal.
• To manage your protocol cycle, retesting and recalibration.
• To provide support and respond to your questions.
• To secure the platform, prevent fraud, and detect and investigate misuse.
• To comply with law and to establish, exercise or defend legal claims.
• To improve our interpretation model and conduct research, using de-identified and aggregated data only.

We do not use consumer health data for advertising or marketing of any kind, and we do not use it to make or support decisions about your eligibility for employment, insurance, credit, housing or any similar benefit.

Where we get it

• Directly from you, through the platform, questionnaires, uploads and support conversations.
• From your coach, where a coach added you and you have consented.
• From laboratories, in the form of results, requisition records and collection status, released under the authorization you gave the laboratory.
• From wearables and third-party health applications you choose to connect.
• From an employer, team or other organization that enrolled you, limited to eligibility and roster information plus anything you subsequently provide.
• Generated by us, in the case of interpretive outputs and inferences.

Who we share it with

We disclose consumer health data only to the recipients below, and only for the purposes above. Other vendors that support the Services, for communications, customer support, error monitoring, website analytics on public pages, payment and e-signature, do not receive consumer health data; the full vendor roster is on our Subprocessor List at vitalityblueprint.com/subprocessors. We may also disclose information to professional advisers, to authorities where legally required, and to a successor or acquirer in a business transfer, as described in our Privacy Policy.

Laboratories are independent controllers of the information they hold. They are not Vitality's processors or subprocessors. Each laboratory is separately licensed and accredited, performs testing under its own regulatory framework, engages its own physicians, and retains its own records under its own legal and accreditation obligations. Vitality receives a result from a laboratory only where the individual has authorized that laboratory to release it.

We do not sell your consumer health data

We do not sell consumer health data. We have not sold consumer health data, and we will not sell it. If that ever changes we will not do so without first obtaining your valid written authorization, separate from any other consent, in the form the applicable law requires, and you will be free to refuse or to revoke.

"Sell" here means exchanging your consumer health data for money or other valuable consideration, as those state laws define it.

We do not use geofencing

We do not use a geofence around any health care facility, laboratory, pharmacy, provider office or other health-related location to identify or track you, to collect consumer health data from you, or to send you advertising or notifications. Where the Services help you find a specimen collection location, that feature operates from a search you initiate and does not track your location.

How long we keep it

We keep consumer health data for the life of your account so that we can support protocol iteration, retesting and longitudinal comparison. On account closure or a valid deletion request we delete or de-identify it within 90 days, subject to legal holds and to records we are required to retain.

Two limits apply. Laboratories retain their own records of testing under their own legal and accreditation obligations, and deletion by Vitality does not reach those records. De-identified data cannot be re-associated with an individual and therefore cannot be retrieved or removed from an aggregate set.

How we protect it

Consumer health data is subject to the safeguards in Section 13 of our Privacy Policy, including encryption in transit and at rest, role-based access on a least-privilege basis, multi-factor authentication for administrative access, audit logging of access to health data, automated vulnerability scanning on every release, and written incident response procedures. Access within Vitality is restricted to personnel who need it to deliver, support or secure the Services.

Your rights

You have the following rights in relation to your consumer health data. We do not charge for exercising them and we will not discriminate against you for doing so.

• Confirm and access. Ask us to confirm whether we are collecting, sharing or selling your consumer health data, and to give you a copy, together with a list of all third parties and affiliates with whom we have shared it and an active contact for each.
• Withdraw consent. Withdraw your consent to our collection and sharing of your consumer health data at any time.
• Delete. Ask us to delete your consumer health data. On a valid request we will delete it from our live systems, where it becomes immediately inaccessible, and we will instruct our processors to do the same. A copy may persist in an encrypted database snapshot until that snapshot expires on its rolling schedule, after which it is permanently deleted. We do not restore a snapshot in order to recover data you have asked us to delete.
• Appeal. Appeal a denial of any request.

How to make a request

Submit a request by email to privacy@vitalityblueprint.com with “Consumer Health Data Request” in the subject line. We will acknowledge your request and respond generally within 45 days. If we need more time we will tell you, and we may extend where the law permits.

We will take reasonable steps to verify your identity, which may include asking you to authenticate to your account. You may use an authorized agent, and we may ask for proof of their authority.

If we deny your request

We will tell you why and how to appeal. To appeal, email privacy@vitalityblueprint.com with “Consumer Health Data Appeal” in the subject line within 60 days of our decision. We will respond in writing, generally within 45 days.

Adults only

The Services are for adults. They are available only to individuals aged 18 or over, and Vitality does not knowingly collect personal information from anyone under 18. A coach may not add a client under 18 to the Services, and no data relating to any individual under 18 may be submitted. Where Vitality provides services involving individuals under 18, it does so only under a separate written agreement negotiated for that arrangement, and those services are outside the scope of this document.

Changes to this policy

We may update this policy. We will change the "Last Updated" date and post the revised policy. Where a change would materially affect how we handle consumer health data we already hold, we will notify you and, where the law requires, obtain your consent before the change applies to that data.

How to contact us

• Privacy questions and requests: privacy@vitalityblueprint.com
• General support: support@vitalityblueprint.com
• Legal notices and service of process: Vitality Blueprint, Inc., c/o The Corporation Trust Company, 1209 Orange Street, Wilmington, Delaware 19801