VIDAYA – PRIVACY POLICY
Healthcare App
Vidaya LLC, a limited liability company organized under the laws of the State of Delaware, operates the website www.vidaya.ai and a web-based platform (MVP) and other web and mobile applications (hereinafter collectively referred to as the “Platform”). The Platform currently operates as a business-to-consumer (B2C) application and may, in the future, engage in business-to-business (B2B) partnerships, including but not limited to collaborations with wellness providers and insurers.
Vidaya LLC is dedicated to protecting the privacy and security of Users’ Personal Data. This Privacy Policy sets forth how Personal Data provided on the Platform is collected, gathered, stored and used by Vidaya LLC. In addition, this Privacy Policy outlines the rights granted to Users in connection with their Personal Data.
DEFINITIONS
Any capitalized terms defined in this Privacy Policy shall have the meaning assigned to them in the Terms of Service applicable to the Platform, as published on the Platform.
- “AI Coaching” shall refer to personalized recommendations, insights and feedback generated by AI Models in response to Users’ health data.
- “AI Models” shall refer to the proprietary Artificial Intelligence (AI) models and tools used by Vidaya for purposes of providing the Services.
- “Non-Personal Data” shall refer to information that cannot be used to personally identify an individual person. Non-Personal Data may include anonymous usage data, demographic information, preferences selected and preferences generated based on data submitted and previous behavior.
- “Personal Data” shall refer to personal and health data provided by or shared by Users on the Platform.
- “Privacy Policy” shall refer to the latest version of Vidaya’s Privacy Policy, as published on the Platform, and shall include updates and amendments made thereto from time to time.
- “Services” shall refer to the aggregation of data generated from wearable devices and medical or health records, and the provision of AI Coaching based on such analysis.
- “Terms of Service” shall refer to the latest version of Vidaya’s Terms of Service, as published on the Platform.
- “Third Party Services” shall refer to third-party websites, applications, services and resources that are referenced, integrated or otherwise linked on the Platform.
- “User Account” shall refer to the individual user account created by a User on the Platform.
- “Users” shall refer to users of the Platform collectively, and “User” shall refer to any one individual user of the Platform.
- “Vidaya” shall refer to Vidaya LLC, the limited liability Delaware company that manages and operates the Platform.
APPLICATION OF THIS PRIVACY POLICY
Upon accessing and using the Platform, Users agree to be bound by and subject to this Privacy Policy. By providing Personal Data on the Platform, Users understand and agree that Vidaya shall collect, use, store, disclose and maintain such Personal Data in accordance with the terms of this Privacy Policy.
Users further agree that Vidaya may send marketing emails and materials pursuant to the terms of this Privacy Policy.
This Privacy Policy explains how Vidaya handles and treats Personal Data gathered from the Platform. This Privacy Policy shall apply only to the Platform, and not to any third-party websites, sites or applications.
LEGAL FRAMEWORK
The present Privacy Policy has been prepared based upon privacy and data protection laws applicable in the United States and Canada, including, without limitation, the Children's Online Privacy Protection Act (COPPA). This Privacy Policy also considers the applicable data protection and privacy laws in the United Kingdom, including, without limitation, the General Data Protection Regulation (Regulation (EU) 2016/679).
This Privacy Policy shall apply solely to Personal Data and Non-Personal Data submitted and collected in connection with the Platform, unless otherwise indicated.
The processing of Personal Data based in Canada shall be in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA). Vidaya shall process Personal Data of Users based in the United States in compliance with applicable laws, including, where applicable, the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Users based in the European Union and the European Economic Area shall be subject to the protections granted by the GDPR.
COLLECTION OF PERSONAL DATA
Vidaya may collect both Non-Personal Data and Personal Data from Users. Personal Data consists of information that can be used to personally identify a User, such as the User’s name, email address, and IP address, health information, and other sensitive information, without limitation.
Voluntarily Provided Personal Data
Vidaya shall collect Personal Data that Users voluntarily provide on or in connection with the Platform.
Users may provide Personal Data to Vidaya when creating a User Account on the Platform. Accordingly, Users shall specify the following information, which is mandatory for User Account setup:
- full name;
- email address;
- date of birth; and
- gender.
User Accounts require login credentials, namely the email address and password.
Additional details are optional to provide as part of a User Account.
It shall be optional for Users to provide the following Personal Data as part of their User Accounts:
- Health and medical data, including but not limited to heart rate, blood pressure, lab results, medications and symptoms;
- Wearable data, including but not limited to sleep quality, exercise, nutrition, step count, and other metrics obtained from devices, such as Fitbit, Garmin and WHOOP;
- AI Coaching data, including but not limited to chat inputs, wellness reports, emotional assessments, and feedback generated by the AI Models.
By submitting Personal Data on the Platform, Users:
- agree to the collection, use, and processing of their information in compliance with this Privacy Policy and Terms of Service, and
- consent to the verification and storage of their personal details for (a) identity verification, (b) the provision of the Services, and (c) any other purposes outlined in the Platform's Terms of Service.
COLLECTION OF NON-PERSONAL DATA
Vidaya may obtain Non-Personal Data regarding Users, such as the type of browser used, the device used, and the date and time at which Users used the Platform. This Non-Personal Data does not allow Users to be identified.
Vidaya may, periodically, conduct surveys in connection with the Platform. Participation in surveys shall be voluntary and information provided as part of the survey shall remain anonymous and not allow for identification.
USAGE OF PERSONAL DATA
Users acknowledge and agree that Vidaya shall use Personal Data to fulfill the purpose for which it was collected. Vidaya may use Personal Data to personalize Users’ experience and improve the Platform. Vidaya’s usage thereof shall be based on this Privacy Policy.
Consent, Communication and Support
Vidaya may use Personal Data to fulfill the purpose for which the Users provided the same. As such, Vidaya may use Users’ Personal Data to respond to their questions, support requests and other inquiries with respect to the Platform.
Accordingly, Vidaya may use Users’ Personal Data to satisfy their requests in the manner and as authorized by such Users.
Vidaya may use Users’ Personal Data to communicate with them regarding the Platform, any applicable updates, modifications and other matters in connection with the Platform.
Marketing and Promotional Purposes
Vidaya may use Personal Data, particularly Users’ email addresses, to send marketing materials, a newsletter and other promotional communications. Users shall have the option of unsubscribing from Vidaya’s marketing newsletter or promotional communications by clicking the unsubscribe link in the email or emailing Vidaya directly to opt out.
Service Provision and Account Management
Vidaya may use Personal Data for purposes of account management and to deliver the Services offered on the Platform. As such, Personal Data may be used for purposes of registering and managing User Accounts.
Personal Data may also be used for purposes of providing Services and AI Coaching on the Platform to the requesting Users.
Legal Purposes
Vidaya’s use of Users’ Personal Data shall be limited to the extent required by Vidaya’s legitimate business interests, and in accordance with the requirements set forth by applicable data privacy laws. Accordingly, Vidaya may disclose Users’ Personal Data if required to do so by law. Users’ Personal Data may be used to comply with a binding court order, legal obligation or applicable legislation.
Further, Vidaya may use Users’ Personal Data if Vidaya finds that such Users violated or attempted to violate any of Vidaya’s policies in effect, including but not limited to the Terms of Service.
In compliance with applicable legislation, Vidaya shall not use Personal Data for purposes beyond those specified in this Privacy Policy, unless Users provided their prior written consent or with prior written notice.
Improvements and Efficiency
Vidaya may use Non-Personal Data to improve the Platform and provide customized experiences. Vidaya may also aggregate Non-Personal Data to establish patterns of usage with respect to the Platform to monitor usage information.
Vidaya may analyze and interpret data to improve the Platform’s functionality, User experience and efficiency.
Vidaya may also use information gathered from surveys and reviews to identify User needs and improve the Platform.
Analytical and Statistical Purposes
Vidaya may use Non-Personal Data for analytical and statistical purposes, and more particularly, to:
- analyze performance data and statistics relating to Users;
- assess the effectiveness of the Platform, its features, the Services and other relevant data;
- improve the Services;
- refine the AI Coaching;
- perform research and development in compliance with HIPAA and privacy laws, where applicable; and
- determine aggregated health trends.
Vidaya may also use such Non-Personal Data to assist with optimizing the Platform by understanding how Users interact with the Platform.
To mitigate privacy risks and safeguard security, Personal Data shall be de-identified or aggregated before being used for statistical purposes.
Third Party Providers
Vidaya shall not sell, trade, rent or otherwise share Personal Data with third parties except with Users’ prior consent. Notwithstanding the foregoing, Vidaya may share Personal Data with third-party providers who perform services for Vidaya in connection with the Platform. The vendors and third-party providers Vidaya uses shall only collect, use and disclose Personal Data to the extent necessary to allow them to perform the services they provide in connection with the Platform.
Vidaya reserves the right to share Personal and Non-Personal Data with authorized third-party providers and processors, including, without limitation, OpenAI, Stripe, and Google OAuth for the following purposes;
- Facilitating AI Models inference;
- Payment processing;
- Providing authentication services; and
- Enabling integrations with device application programming interfaces (APIs), such as Fitbit and Garmin.
All third parties who receive Personal and Non-Personal Data from Vidaya shall be bound by strict confidentiality obligations no less stringent than those set forth in this Privacy Policy and subject to an agreement in place with Vidaya. All such third parties shall use such data solely on a need-to-know basis and exclusively for the purposes of performing the services on behalf of Vidaya. All third parties who receive Personal and Non-Personal Data from Vidaya shall be required to comply with applicable laws and regulations, including HIPAA and GDPR.
THIRD-PARTY AI DATA PROCESSING
Vidaya uses Google's Gemini artificial intelligence service ("Google Gemini") to power certain features within the application. When you use these features, specific data is transmitted to Google Gemini for processing. No data is sent to any AI service until you have reviewed and explicitly consented to this data sharing within the app.
What data is sent and when:
| Feature | Data Transmitted to Google Gemini |
|---|---|
| Blood Work Analysis | The contents of uploaded blood work PDF files, including biomarker names, values, reference ranges, and lab information |
| Vaya Health Chat | Your chat messages, conversation history, and relevant health context used to generate responses |
| Medication Insights | Medication names, dosages, frequency, and associated health conditions |
| Supplement Analysis | Supplement names, dosages, and usage details |
| Body Assessment | Symptom and pain descriptions associated with body regions |
Who the data is sent to:
Your data is sent to Google LLC via the Google Gemini API (generativelanguage.googleapis.com). Google processes this data in accordance with their Google API Terms of Service and Google Privacy Policy.
How the data is used:
- Data purpose: Data is sent solely for the purpose of generating AI-powered health insights, analysis, and recommendations within the app
- No training usage: We do not use your data to train AI models
- Encryption: Data is transmitted securely via encrypted HTTPS connections
- Limited retention: We do not store AI-generated responses beyond what is displayed in your account
Your rights and controls:
- Explicit consent: You must provide explicit consent before any data is sent to Google Gemini
- Withdrawal: You may withdraw your consent at any time from the Settings page, which will disable all AI-powered features
- Legacy data: Withdrawing consent does not delete previously generated AI insights stored in your account
- Account deletion: You may request deletion of all your data, including AI-generated content, by using the Delete Account feature in Settings
Data retention:
AI-processed results (such as blood work analysis summaries and chat responses) are stored in your Vidaya account for your continued access. The raw data sent to Google Gemini for processing is not retained by Google beyond the processing session, in accordance with Google's data handling policies for API usage.
PROTECTION OF PERSONAL DATA
Vidaya has implemented safeguarding measures to protect Personal Data against unauthorized access and disclosure, damages or other breaches. Security audits shall be conducted on a regular basis to ensure data safety.
Personal Data shall be stored in Vidaya’s secure servers and secure third-party servers. To safeguard Personal Data, Vidaya utilizes the following encryption: AES-256 for storage and TLS for transmission.
Vidaya has established access controls, ensuring that only authorized personnel may access Personal Data. To maintain privacy and comply with applicable laws and regulations, Vidaya shall engage in audit logging, whereby access to Personal Data is logged and subject to review.
While these safeguarding and protective methods comply with industry best practices, these measures do not guarantee that Personal Data shall not be unlawfully accessed, disclosed, altered or destroyed. Unfortunately, the transmission of Personal Data over the Internet is never fully secure.
USER RIGHTS
Right to be Informed
Users shall have the right to be informed of Vidaya’s collection and usage of their Personal Data, namely Users’ names, email addresses, health data, wearable data, and User Account details.
Right to Rectification
If Users find or believe that the Personal Data contained in their User Accounts is erroneous or false, Users may request the rectification or correction of the information. If Users determine that the Personal Data Vidaya holds is incomplete or erroneous, Users may request additions or supplements to such information. All correction requests shall be transmitted to Vidaya by email.
Users may also make the necessary corrections directly through their User Accounts.
Right to be Forgotten
Users may delete their User Accounts on the Platform at any time. Users may proceed with the deletion of their User Accounts via the Platform’s settings or by emailing Vidaya’s support team.
The deletion shall result in the removal of User Account data and health records from Vidaya’s systems.
Notwithstanding the foregoing, even following the deletion of their User Accounts, certain Personal Data may remain retained by Vidaya subject to the terms of this Privacy Policy. Vidaya’s retention of Users’ Personal Data following the deletion of their User Accounts may be necessary to fulfill legal, regulatory, or contractual obligations, including but not limited to, compliance with financial regulations, regulatory matters, tax purposes and dispute resolution. However, such Personal Data shall be anonymized if so retained following the User Account deletion.
Exercise of Rights
To exercise any rights granted by this Privacy Policy or applicable laws, Users shall send Vidaya’s support team a request by email. For the request to be valid, it must clearly identify the User, allowing for the validation of the User’s identity. The request must also include supporting details.
All requests shall be handled based on the timeframes set by applicable data privacy laws and regulations. Vidaya shall promptly fulfill all valid requests. Vidaya may process Personal Data to validate Users’ identity and satisfy the request. Vidaya reserves the right to refuse to fulfill a request if it is unfounded or does not comply with the terms of this Privacy Policy.
PERSONAL DATA OF CHILDREN
The Platform is not intended for Users who are under the age of eighteen (18). Vidaya does not knowingly target children or collect Personal Data from children. Minor Users may only use the Platform with the consent of their parent or legal guardian and solely under the supervision of their parent or legal guardian.
If Vidaya learns that a child under the age of eighteen (18) has provided Personal Data on the Platform, Vidaya shall delete the child’s Personal Data as soon as reasonably possible. If Users have reason to believe a child provided Personal Data on the Platform, such Users are invited to notify Vidaya by sending an email or a written notice on the Platform.
RETENTION AND STORAGE OF PERSONAL DATA
Vidaya shall maintain and store Users’ Personal Data for the duration during which the Users have an active Account, or for the duration required by Vidaya to provide the Services, as applicable. As such, Vidaya shall retain Users’ Personal Data until the Users’ User Accounts become dormant.
Vidaya shall retain Personal Data on secure third-party cloud servers. All Personal Data shall be encrypted both in transit and at rest. After a reasonable time, the Personal Data shall either be securely deleted or anonymized, in compliance with applicable laws and Vidaya’s data retention policies.
Vidaya may retain Users’ Personal Data for a longer period to comply with legal and financial obligations. In addition, Vidaya may hold Personal Data in Vidaya’s servers for payment purposes until all funds owed have been paid or to resolve disputes.
Once a User Account is deleted, the Personal Data shall be retained for a limited period for backup and security purposes. After which, the Personal Data shall be anonymized or destroyed.
Further, Vidaya reserves the right to store and maintain Personal Data on file for a longer duration if permitted by applicable laws and regulations. Once Vidaya has de-identified or aggregated the data, such data may be retained indefinitely, for analytical and research purposes.
DESTRUCTION OF PERSONAL DATA
Vidaya may destroy or anonymize Personal Data after the retention period, or sooner if the Personal Data is no longer required for the purposes for which it was collected. Personal Data shall be securely deleted or irreversibly anonymized once the applicable retention period has expired or the data is no longer required. Individual notices of data destruction are not routinely provided to Users, unless such notification is expressly required under applicable law.
LINKS TO THIRD PARTY WEBSITES AND APPLICATIONS
This Privacy Policy shall apply solely to the Platform and Personal and Non-Personal Data collected from the Platform and in connection therewith. This Privacy Policy shall not apply to Third Party Services. Any links or references to Third Party Services on the Platform are provided for reference or convenience purposes.
Any Personal Data submitted via a Third Party Service shall be governed by the Third Party Services’ privacy policy, and not by the present Privacy Policy. Users are encouraged to thoroughly review the Third Party Services’ privacy practices. Vidaya shall not be responsible for the use and collection of Users’ Personal Data by Third Party Services. The submission of Users’ Personal Data to such Third Party Services shall be at Users’ risk.
GENERAL DATA PROTECTION REGULATION (GDPR)
Residents of the European Union (EU) and the European Economic Area (EEA) benefit from the protections provided in the GDPR. The GDPR governs the collection, usage and transfer of Personal Data. The GDPR grants its data subjects additional rights regarding the use, collection and handling of their Personal Data.
To exercise any of the rights granted to Users under this Privacy Policy or by applicable laws, Users may send Vidaya a written request by email. For the request to be valid, it must identify the User in a clear manner, thereby allowing Vidaya to validate the User’s identity. Additionally, the request must specify the Personal Data requested and the reason for such request. Vidaya shall fulfill all valid requests.
BREACH NOTIFICATION
In the event of a data breach involving Personal Data, Vidaya shall comply with all applicable breach notification obligations, such as providing timely notice to affected Users without undue delay and, where possible, no more than seventy-two (72) hours after becoming aware of the breach, in accordance with the GDPR, and within sixty (60) days in accordance with HIPAA and, where required, to relevant regulatory authorities within the timeframes mandated by applicable laws and regulations. Notifications shall include, to the extent required, information regarding the nature of the breach, the steps taken to mitigate potential harm, and protective measures.
UPDATES TO THIS PRIVACY POLICY
Vidaya may update this Privacy Policy, at any time, at Vidaya’s convenience or for compliance purposes if any laws or industry standards change. If Vidaya were to update this Privacy Policy, the updated Privacy Policy shall be published on the Platform.
Any updates to this Privacy Policy shall be effective as of the date indicated in the header of this Privacy Policy. As Vidaya may not notify Users of certain changes to this Privacy Policy, it is the responsibility of Users to review this Privacy Policy periodically to remain aware of the latest version.
Any use of the Platform by Users following the publication of the updated Privacy Policy signifies agreement with the updated Privacy Policy. If Users do not agree with any updates made to this Privacy Policy, Users’ sole and exclusive recourse shall be to cease using the Platform.
QUESTIONS AND COMMENTS
If Users have any questions regarding this Privacy Policy, or wish to withdraw consent for the continued collection, use or disclosure of their Personal Data, Users are invited to contact Vidaya in writing. Any requests in connection with the present Privacy Policy should be sent to Vidaya by email to [email protected].