Your Data. Your Control.

2. What Data We Collect

2.1 Health & Measurement Data (Stored Locally)

When you use VitalXCare medical devices, the following health measurements are stored locally on your smartphone or tablet:

• Blood Pressure Readings: Systolic pressure (mmHg), diastolic pressure (mmHg), pulse rate (BPM), irregular heartbeat indicator, measurement timestamp, and WHO/AHA classification category
• Body Temperature: Temperature reading (°C/°F), measurement mode (forehead/ear), fever classification, measurement timestamp
• SpO2 (Pulse Oximetry): Oxygen saturation percentage (%), pulse rate (BPM), perfusion index (PI), signal quality indicator, measurement timestamp
• ECG Data (if applicable): Heart rhythm waveform data, heart rate, rhythm classification, measurement duration, timestamp
• Device Metadata: Device model identifier, firmware version, battery level at measurement time, Bluetooth connection quality

Important: All health data is stored locally on your device by default. It is NOT automatically uploaded to our servers. You maintain full ownership and control at all times.

2.2 Account Information (Optional)

If you choose to create an account for cloud backup, multi-device sync, or healthcare provider sharing, we collect:

• Required: Email address (used as your login identifier)
• Optional: Full name, date of birth (for age-based health reference ranges), biological sex (for gender-specific health norms), profile photo
• Authentication: Password (hashed using bcrypt with salt — we never store or see your plain-text password)

2.3 Contact Form & Communication Data

When you contact us through our website, email, or phone, we collect:

• Name and email address you provide
• Phone number (if provided voluntarily)
• Organization name (if provided)
• Nature of your inquiry and message content
• Communication history for support follow-up

2.4 Purchase & Transaction Data

When you purchase our products, we collect:

• Billing and shipping address
• Order details and purchase history
• Payment information (processed securely by Stripe — we never see or store your full card number, CVV, or other sensitive payment data)

2.5 Technical & Usage Data

To provide and improve our services, we automatically collect:

• Device Information: Device model, operating system version, app version, screen resolution
• Usage Analytics: App screens visited, features used, session duration, app crashes (anonymized and aggregated)
• Website Analytics: Pages visited, time spent, referral source, browser type, general geographic location (country/region level only — never precise GPS)
• Network Data: IP address (website visitors), connection type (Wi-Fi/cellular), Bluetooth connection logs for device pairing

Note: All analytics are anonymized and aggregated. We cannot and do not identify individual users from analytics data. You may opt out of analytics collection at any time in the app settings.

4. Legal Basis for Processing (GDPR Article 6)

We process your personal data based on the following legal grounds:

• Contract Performance (Art. 6(1)(b)): Processing necessary to provide you with the products and services you purchased — including device connectivity, health data display, and account management
• Consent (Art. 6(1)(a)): When you explicitly opt in to optional features — such as cloud backup, data sharing with healthcare providers, analytics collection, or marketing communications. You may withdraw consent at any time.
• Legitimate Interest (Art. 6(1)(f)): Improving our products and services, preventing fraud, ensuring network security, and providing customer support. We conduct a legitimate interest assessment to balance our interests with your rights.
• Legal Obligation (Art. 6(1)(c)): Compliance with applicable laws, including financial recordkeeping requirements, tax obligations, and responding to lawful requests from authorities

4.1 Special Category Data (Health Data)

Health data is classified as "special category" data under GDPR Article 9. We process health data based on:

• Explicit Consent (Art. 9(2)(a)): You explicitly consent when you pair a device and begin taking measurements
• Health Management (Art. 9(2)(h)): Processing necessary for health monitoring purposes under the responsibility of a healthcare professional (when you share data with your doctor)

6. When & How We Share Your Data

6.1 You Control All Health Data Sharing

VitalXCare will NEVER share your health data without your explicit, informed permission. Every instance of sharing is initiated by you, and you can revoke sharing at any time.

6.2 Healthcare Provider Sharing (Your Choice)

When you use the "Share with Doctor" feature in the VitalXCare app:

• You generate a professional PDF report or a time-limited secure link
• You choose the exact date range and which health metrics to include
• You select the delivery method: email, print, secure FHIR portal, or direct in-app share
• Shared links automatically expire after 7 days (configurable)
• All transmissions are encrypted end-to-end using TLS 1.3

6.3 Service Providers (Data Processors)

We work with a limited number of trusted service providers who process data on our behalf. All providers are bound by strict Data Processing Agreements (DPAs) and cannot use your data for their own purposes:

• Cloud Infrastructure: Amazon Web Services (EU-only region, for optional cloud backup)
• Payment Processing: Stripe (processes payment data only — has no access to health data)
• Email Delivery: Our own mail servers (for transactional emails and contact form confirmations)
• Website Analytics: Google Analytics with IP anonymization and consent-based activation via our cookie consent banner
• App Analytics: First-party analytics only, anonymized and aggregated, with opt-out available

6.4 Legal & Safety Disclosures

We may disclose personal data when required or permitted by law:

• To comply with a court order, subpoena, or valid legal process
• To prevent imminent harm to life or physical safety
• To comply with tax, financial, or medical device reporting obligations
• To enforce our Terms of Service or protect our legal rights

We will notify you of legal requests for your data unless legally prohibited from doing so, and we will challenge any overly broad or unjustified requests.

6.5 Business Transfers

If VitalXCare is involved in a merger, acquisition, or asset sale, your personal data may be transferred to the successor entity. We will notify you via email and/or prominent notice on our website before any such transfer, and this privacy policy will continue to apply.

6.6 We Do NOT Share With

8. Security Measures

We implement comprehensive technical and organizational measures to protect your personal and health data against unauthorized access, alteration, disclosure, or destruction.

8.1 Technical Security

• Encryption at Rest: AES-256 for cloud-stored data; SQLCipher for local databases on your device
• Encryption in Transit: TLS 1.3 (HTTPS) for all network communications; certificate pinning in our mobile apps
• Bluetooth Security: BLE 5.0 pairing with authentication; no health data stored on the device hardware itself (only transmitted to the paired app)
• Password Security: bcrypt hashing with per-user salts; minimum 8-character requirement; common password detection
• Two-Factor Authentication: Optional TOTP-based 2FA via authenticator apps (Google Authenticator, Authy, etc.)
• Infrastructure Security: Web Application Firewall (WAF), DDoS protection, intrusion detection systems, automated vulnerability scanning
• Code Security: Regular static code analysis (SAST), dependency vulnerability scanning, mandatory code reviews for all changes

8.2 Organizational Security

• Background checks and non-disclosure agreements for all employees
• Principle of least privilege — employees access only the minimum data necessary for their role
• Quarterly security awareness training for all staff
• Documented incident response plan with defined roles and escalation procedures
• Annual third-party penetration testing and security audits
• Physical security controls for office spaces and data center access

8.3 Data Breach Response Protocol

In the unlikely event of a personal data breach:

1. Detection & Containment: Immediate containment and investigation by our security team
2. Assessment: Determine scope, severity, and affected individuals within 24 hours
3. Authority Notification: Notify the relevant supervisory authority within 72 hours (as required by GDPR Art. 33)
4. User Notification: Notify affected users without undue delay, including: what data was affected, what steps we are taking, and recommended protective actions
5. Remediation: Implement fixes, conduct root cause analysis, and update security measures to prevent recurrence
6. Post-Incident Report: Publish a transparency report summarizing the incident (without disclosing details that could aid further attacks)

10. Children's Privacy

VitalXCare devices can be used to monitor children's health (e.g., fever tracking, oxygen saturation monitoring). We take children's privacy extremely seriously:

• Age Requirement: Users under 16 years of age (or the applicable age in your jurisdiction) must have a parent or legal guardian create and manage their account
• Parental Control: Parents/guardians have full control over all data sharing settings and account configuration
• No Direct Collection: We do not knowingly collect personal data directly from children without verified parental consent
• Parental Deletion: Parents can delete their child's data at any time from the app settings or by contacting us
• COPPA Compliance: We comply with the U.S. Children's Online Privacy Protection Act (COPPA) for users under 13

If you believe we have inadvertently collected personal data from a child without appropriate parental consent, please contact us immediately at [email protected] or call +1 657-999-1100. We will investigate and delete the data promptly.

12. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

12.1 Right to Know

You have the right to know what personal information we collect, the sources of collection, the business purposes for collection, and the categories of third parties with whom we share data. This information is detailed in the sections above.

12.2 Right to Delete

You may request deletion of your personal information, subject to certain exceptions (e.g., legal obligations, fraud prevention).

12.3 Right to Opt-Out of Sale

VitalXCare does NOT sell your personal information. We have never sold personal information, and we have no plans to do so. Therefore, there is no need to opt out of a sale.

12.4 Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. You will continue to receive equal service and pricing regardless of your privacy choices.

12.5 Categories of Information Collected (Last 12 Months)

• Identifiers: Name, email address, phone number, IP address
• Commercial Information: Product purchase history, order details
• Internet/Network Activity: Browsing history on our website, app usage data
• Sensitive Personal Information: Health data (collected with explicit consent, processed locally on your device)

To exercise your California privacy rights, contact us at [email protected] or call +1 657-999-1100. We will verify your identity and respond within 45 days.

14. Contact Us

We welcome your questions, concerns, and feedback about this Privacy & Security Policy. You can reach us through any of the following channels:

We are committed to working with you to resolve any privacy concern. If we cannot resolve your complaint directly, you have the right to lodge a complaint with your country's data protection authority.