Consumer Health Data Privacy Policy

This policy applies to residents of Washington and anyone whose consumer health data is collected in Washington; to residents of Nevada and anyone whose consumer health data is collected in Nevada; and to residents of Connecticut. It describes the “consumer health data” that VivaLife AI Inc. (“VivaLife AI,” “we”) collects through the VivaLife AI app and website (the “Service”), and how you can exercise your rights under Washington’s My Health My Data Act, Nevada’s consumer health data law (SB 370) and Connecticut’s data privacy law. Our Privacy Policy describes all of our practices in more detail. This policy is effective as of October 9, 2026.

We also use consumer health data to keep the Service secure (for example, screening AI requests for signs of risk such as self-harm) and to meet our legal obligations. We don’t ask about reproductive, sexual or gender-affirming care, but if you enter related medications, conditions, symptoms or notes (for example a contraceptive), we process them like your other health data, as described here. We do not collect precise location or genetic data, we do not create face or voice templates (community videos you post contain your image and voice), and we do not use geofencing.

• You, when you enter it in the app
• Apple Health or Health Connect, if you allow the app to read it
• Bluetooth health devices you pair
• Your phone's motion sensor (step counting)
• Our AI features, which create reports, predictions and scores from the data above

We do not sell consumer health data. We share it with service providers (processors) that process it for us, under contract, to provide the Service you request:

Some limited information also goes to recipients that are not our processors:

We have no affiliates that receive consumer health data. We may also disclose consumer health data when legally required, as our Privacy Policy describes (Section 5.3). We don’t let third parties collect consumer health data about you over time and across different websites or online services through our Service. When you open a news article in the app, the publisher’s website and its partners may collect information under their own policies; we don’t send them your health data.

When you join, the app asks for your consent to collect and use your consumer health data, with its own checkbox, separate from accepting our Terms. We collect and share consumer health data only as necessary to provide the Service you request: we share it only with our processors, and with the other recipients in Section 4 when you use the feature that involves them. For that reason we don’t ask for a separate consent to share it. Optional uses are separate choices you can change at any time: the health details AI chat may use, AI memory and scheduled AI reports (all off until you choose them), backups, and what the app reads from Apple Health or Health Connect. Asking to delete your account in the app switches scheduled reports off straight away (for a request you email, once we record it), and they stay off if you cancel the deletion. To withdraw your consent entirely, delete your account (Section 6). Deletion in the app takes effect about 30 days (30 to 31 days) after you ask; to have your account deleted sooner, email us and we will delete it without the waiting period.

You have the right to:

• confirm whether we collect, share or sell your consumer health data (we do not sell it), and get a copy of it
• get a list of all the third parties and affiliates we have shared it with, with an email address or other way to contact each
• correct it, in the app or by emailing us
• withdraw your consent to our collection and sharing of it
• have it deleted

When we delete your consumer health data, we delete it from our database and file storage, including our storage provider’s copies of your videos and backups, and our subscription provider deletes your subscription record. Apple, Google and, for website purchases, Stripe keep their own records of your purchases. Some copies remain for a limited time: our hosting provider’s backups expire within 30 days, and our logs (which can include your account ID) and crash reports within 90 days (longer for records described in Section 7 of our Privacy Policy). Google keeps no copy of our AI requests, except the requests that create recipe pictures, which contain only our AI’s description of a dish and which Google may keep for a limited time to detect abuse. OpenAI, which screens AI messages for safety and handles recipe searches, doesn’t offer deletion for one person: it keeps requests for a limited time to detect abuse, then deletes them (after about 30 days, longer if flagged for a policy violation). Data stored only on your phone is removed when you sign out of the app and uninstall it.

To make a request, email privacy@vivalifeai.com (we will reply to your account’s email address to confirm it), or delete your account in the app under Settings → Delete account. Requests are free. We will complete your request within 45 days, and if we need up to 45 more days we will tell you why. Deletion requests made by email are carried out without the app’s 30-day waiting period. Nevada residents can send requests to our designated address, privacy@vivalifeai.com. Connecticut residents have further rights, described in Section 11.4 of our Privacy Policy.

Appeals. If we decline your request, you can appeal by emailing privacy@vivalifeai.com with the subject “Appeal”. We will respond in writing within 45 days, explaining our decision. If your appeal is denied, you can contact your state attorney general (in Washington, at atg.wa.gov; in Nevada, at ag.nv.gov; in Connecticut, at portal.ct.gov/ag).

We will post any update here and change the effective date in Section 1. For a material change, we will tell you in the app or by email, and ask for your consent where the law requires it.

Privacy Officer, VivaLife AI Inc.
privacy@vivalifeai.com
508-546 Beatty Street
Vancouver, BC V6B 2L3
Canada