--- title: "Privacy Policy | Vitals Vault" description: "Learn what information Vitals Vault collects, why we use it, when we disclose it, and the choices and privacy rights available to you." canonical: "https://www.vitalsvault.com/privacy-policy" last-updated: 2026-08-22 --- # Privacy Policy | Vitals Vault > Learn what information Vitals Vault collects, why we use it, when we disclose it, and the choices and privacy rights available to you. # Privacy Policy What we collect, how we use it, who receives it, and the choices you have. Effective August 28, 2026 ## The short version We collect the information needed to run Vitals Vault, coordinate the services you request, keep your account safe, and meet our legal duties. We do not sell personal or health information as “sale” is defined by applicable privacy law, and we do not give lab results, medical records, or treatment information to third parties for their own advertising. The full Policy below explains what we collect, where it comes from, when we disclose it, and the choices you may have. ## 1. When does this Policy apply? This Privacy Policy explains how Vitals Vault Inc. collects, uses, discloses, and protects personal information when you use our websites, platform, products, and services. A licensed medical professional, medical group, laboratory, or pharmacy may give you a separate privacy notice for information it handles in providing its services. ## 2. What information do we collect? - **Account and identity:** name, contact details, date of birth, address, login details, and identity-verification information. - **Health and service information:** health history, symptoms, goals, medications, allergies, lab orders and results, provider messages, appointments, and information you choose to add. - **Purchases:** products, services, subscriptions, transaction status, billing address, and limited payment details from our payment processor. - **Device and usage:** IP address, browser, device, cookies, pages viewed, actions taken, and diagnostic logs. - **Communications:** emails, texts, calls, support messages, surveys, and feedback. - **Derived information:** scores, summaries, trends, recommendations, and other inferences created from information available to the service. ## 3. Where does the information come from? We collect information from you; from professionals, labs, collection providers, pharmacies, and other partners involved in a service you request; from payment, communications, security, and technology providers; from devices or services you choose to connect; and from your use of Vitals Vault. ## 4. How do we use information? - Create and secure your account. - Process purchases and coordinate requested tests, appointments, products, and services. - Receive, organize, display, and help you understand health information. - Communicate about orders, results, appointments, safety, support, and account activity. - Operate, maintain, troubleshoot, and improve our services. - Prevent fraud, misuse, security incidents, and harm. - Meet legal, regulatory, audit, and recordkeeping obligations. - Send marketing where permitted and honor your communication choices. ## 5. When do we disclose information? We may disclose information: - To independent professionals, medical groups, laboratories, collection providers, pharmacies, and fulfillment partners involved in a service you request. - To vendors that host, secure, analyze, support, communicate, or process payments for the services under contract with us. - At your direction or with your consent. - To protect you, another person, Vitals Vault, or the public from fraud, misuse, security threats, or harm. - When required by law, legal process, or a lawful government request. - In a financing, merger, acquisition, reorganization, bankruptcy, or sale of assets, subject to applicable privacy obligations. We do not sell personal or health information as "sale" is defined under applicable privacy law. We do not disclose lab results, medical records, or treatment information to third parties for their own advertising. ## 6. How do cookies and public-site analytics work? We use cookies and similar technology to keep you signed in, remember settings, measure public-site performance, prevent fraud, and understand how the services are used. Browser controls and any cookie controls we provide let you manage optional cookies. Blocking necessary cookies may prevent parts of the service from working. ## 7. How do public MCP and agent queries work? Vitals Vault offers a public, read-only Model Context Protocol (MCP) service that software agents can use without a Vitals Vault account. The service processes the tool name and query or other tool arguments needed to return public information, such as biomarker education, panel descriptions, public prices, and current catalog availability. Public MCP requests do not create an account, cart, order, payment, consultation, or health record. The controlled recommendation tool may transiently process a selected broad wellness concern, broad age band, and biological-sex context when provided. It does not accept free-text symptoms or use those controlled selections to identify a person. Our application diagnostic logs are designed not to record the full public MCP query or tool arguments. We and the providers that host, secure, and monitor the service may process technical metadata such as IP address, user agent, requested path, timestamp, response status, rate-limit events, and security signals to deliver the response, maintain reliability, prevent misuse, and investigate security incidents. Routine public MCP application and edge-security technical logs are currently configured to expire after 30 days. Sanitized error, trace, and log telemetry sent to Sentry may be retained for up to 90 days under our current service plan. If we create a separate incident or legal record, the general retention rules in Section 10 apply. The public MCP is not designed to receive protected health information (PHI), private lab results, account details, or other sensitive personal information. Do not submit that information in a public MCP query. Use the authenticated Vitals Vault service or contact support when a request involves your account or health records. ## 8. What about consumer health data? Our separate [Consumer Health Data Privacy Policy](https://www.vitalsvault.com/consumer-health-data-privacy) explains the categories, sources, uses, disclosures, and rights that apply to consumer health data under Washington's My Health My Data Act and similar laws. ## 9. Which rules apply to clinical records? Vitals Vault is a technology and administrative-services company, not a health care provider. Some information may be protected by HIPAA when a covered medical professional, medical group, lab, or pharmacy handles it. That party's Notice of Privacy Practices governs its use of protected health information. Other health information held by Vitals Vault remains protected under this Policy and applicable consumer-health, privacy, and security laws. ## 10. How long do we keep information? We keep information for as long as reasonably needed to provide the services, maintain business and security records, resolve disputes, enforce agreements, and meet legal duties. Retention varies by the type of information and the service. Independent clinical parties may have separate medical-record retention duties. ## 11. How do we protect information? We use administrative, technical, and physical safeguards designed for the sensitivity of the information we handle. No system is perfectly secure. You can help by using a unique password, protecting your devices, and telling us promptly about suspected unauthorized access. ## 12. What choices and rights do you have? Depending on where you live and the information involved, you may have the right to access, correct, delete, or obtain a copy of information; withdraw consent; limit certain uses or disclosures; or appeal a denied request. We may need to verify your identity. Some information cannot be deleted when law requires us or a clinical party to keep it. Email support@vitalsvault.com to make a request. You may unsubscribe from marketing email through the link in the message and reply STOP to marketing texts. We may still send nonmarketing messages needed for your account or a service you request. ## 13. Can children use Vitals Vault? Vitals Vault is not intended for children to use on their own. When a service allows it, a parent or legal guardian may request a service for a minor and provide the minor’s information. The parent or guardian must have legal authority to do so and complete the required consents and authorizations. ## 14. What happens when this Policy changes? We may update this Policy and will post the new version with a new effective date. If a change materially affects how we handle information already collected, we will provide reasonable notice and obtain consent when required by law. ## 15. How can you contact us? - Email: [support@vitalsvault.com](mailto:support@vitalsvault.com) - Mail: Vitals Vault Inc., 1700 7th Ave, Suite 2100, Seattle, WA 98101 --- Canonical HTML: https://www.vitalsvault.com/privacy-policy - [llms.txt](https://www.vitalsvault.com/llms.txt) - [sitemap.xml](https://www.vitalsvault.com/sitemap.xml) - [Developer portal](https://www.vitalsvault.com/developers)