How we protect your data

Your health data is the most personal record you have. Here is how Vitals handles it, in plain language. The formal version is in our Privacy Policy.

Your DNA and the AI

Vitals uses AI to explain your data in plain language. Your clinical genetic findings never reach it.

When you add a Circle DNA report, its clinical results — disease risk, cancer risk, carrier status and drug-response findings — are parsed on our servers and are never sent to any AI provider. This isn’t a policy we promise to follow; it’s built into the system so it can’t be bypassed. Every request to the AI passes through a single gate that checks for clinical genetic content and refuses to send it, failing safely on our servers rather than leaking to the provider.

Where your data is processed

Vitals’ AI insights are generated by a third-party AI provider based in the United States. We route every request with zero-data-retention and no-training settings, so the provider may not store your prompts or use them to train models — but the processing does happen overseas, and we tell you that plainly, here and in our Privacy Policy.

We never sell your data

Vitals makes money from subscriptions, not from your data. We do not sell it, we do not use it for advertising, and we never use your records to train anyone else’s AI.

You own it

Your record is yours. You can download everything Vitals holds about you, and you can delete your record whenever you want. See our Privacy Policy for how to do both.

If something goes wrong

If a data breach ever put your information at risk of serious harm, we’ll assess it promptly and notify you and the Office of the Australian Information Commissioner, as required by Australia’s Notifiable Data Breaches scheme.

Security researchers: please report anything you find to williamliu.yannaing@gmail.com before publishing it. We reply within three business days. Machine-readable details are at /.well-known/security.txt.

This page explains our approach in plain language. Your rights and our obligations are set out in full in our Privacy Policy.