Consumer Health Data Privacy Policy

Last updated: September 11, 2026

Scope

This Consumer Health Data Privacy Policy applies to consumer health data that Vytal Path collects, processes, or shares and is intended to provide the disclosures required by applicable consumer-health privacy laws, including Washington's My Health My Data Act and Nevada's consumer health data law where those laws apply. It is separate from Vytal Path's general Privacy Policy.

Categories of consumer health data

Depending on the features you choose to use, Vytal Path may collect or process consumer health data such as health conditions and diagnoses; allergies; medications and medication history; surgeries and procedures; laboratory and imaging information; vital signs and other health measurements; appointments; clinical documents and notes; immunization information; reproductive or menstrual-cycle information; nutrition, sleep, activity, exercise, and wellness information; device and wearable readings; emergency-profile information; health-related reminders and tasks; information imported from a health-record, patient-portal, device, fitness, or other health-data service you choose to connect; and health-related information you submit to AI-assisted features.

Vytal Path may also process account identifiers and other information when necessary to associate health information with your account, authenticate you, secure the service, fulfill a request, or comply with law.

Sources of consumer health data

Consumer health data may come directly from you; from a caregiver or trusted person acting through permissions you have granted; from a healthcare organization, electronic health record system, patient portal, wearable, fitness service, device platform, or other health-data service you choose to connect; and from information generated or derived when Vytal Path organizes, summarizes, or analyzes information you provide in order to deliver a feature you request.

Purposes for collection and use

Vytal Path collects and processes consumer health data to provide the health-organization and tracking features you request; display dashboards and health histories; support reminders and wellness tools; import information from services you choose to connect; provide caregiver, Emergency Card, report, and sharing functions; process documents and AI-assisted requests you initiate; maintain account and service security; troubleshoot and maintain the service; respond to privacy or support requests; prevent misuse; and comply with applicable law.

Vytal Path limits consumer health data processing to purposes disclosed to you, purposes reasonably necessary to provide a product or service you request, or other purposes for which Vytal Path obtains any consent required by applicable law.

Categories of consumer health data shared

Vytal Path does not sell consumer health data.

Consumer health data may be shared only as needed with: service providers and processors that help operate Vytal Path; a healthcare, device, fitness, or other service you explicitly connect where information must be exchanged to provide the connection; a caregiver or trusted person according to permissions you grant; a recipient you choose when you share a report, health summary, or other information; or a government authority or other party when disclosure is required or permitted by applicable law.

The categories shared depend on the feature involved. For example, a cloud infrastructure provider may process stored health data; a communications provider may receive the minimum information needed to deliver an alert; an AI infrastructure provider may process the information needed for an AI request you initiate; and a recipient you select receives the information you choose to share.

Categories of third parties and processors

Vytal Path uses service-provider categories that may include cloud infrastructure, database and encrypted object-storage providers; AI infrastructure providers; communications and notification providers; payment processors for billing information; security, monitoring, and operational providers; and health-record, device, wearable, fitness, or other health-data services that you explicitly connect.

Current production infrastructure includes Amazon Web Services for applicable hosting, database, storage, backend, monitoring, and Amazon Bedrock AI processing. Communications and payment services are described in Vytal Path's general Privacy Policy. Vytal Path does not authorize these providers to use consumer health data for their own targeted advertising.

Consent

Where applicable law requires consent before Vytal Path collects or processes consumer health data, Vytal Path obtains affirmative consent unless the processing is otherwise permitted because it is necessary to provide a product or service you requested. Where applicable law requires a separate consent before sharing consumer health data, Vytal Path obtains that separate consent unless the sharing is otherwise legally permitted or necessary to provide the product or service you requested.

Vytal Path does not sell consumer health data. If Vytal Path were ever to propose a sale of consumer health data, it would first update its practices and obtain any separate, valid authorization required by applicable law before such a sale occurred.

Your consumer health data rights

Where applicable law provides these rights, you may request confirmation of whether Vytal Path is collecting, sharing, or selling your consumer health data; access that data; obtain information about the sources and recipients of the data; withdraw consent for future collection or sharing when processing is based on consent; and request deletion of consumer health data.

Vytal Path provides available self-service controls under My Account → Privacy & Data. You may also submit a request through support@vytal-path.com. Vytal Path may take reasonable steps to authenticate a request before acting on it. If applicable law gives you a right to appeal a denial, you may appeal by replying to the decision or contacting support@vytal-path.com and stating that you are appealing a privacy-rights decision.

Deletion

When an authenticated deletion request is valid under applicable law, Vytal Path deletes the covered consumer health data from active systems and instructs applicable processors or other parties as required by law. System-level disaster-recovery backups may require additional time to age out through the normal backup cycle where applicable law permits that approach; where a law requires deletion from archived or backup systems on a different schedule, Vytal Path follows that requirement.

Deleting your Vytal Path account removes account and health information from active Vytal Path systems subject to the Data Retention Policy and any specific legal retention obligation.

Geofencing

Vytal Path does not use geofencing around healthcare facilities to identify, track, infer information about, or target people seeking health care. Vytal Path does not use consumer health data for targeted advertising.

Changes to this policy

Vytal Path will update this Consumer Health Data Privacy Policy when its consumer-health data practices materially change or when required by law. Where applicable law requires notice or consent before a new category, purpose, or recipient is added, Vytal Path will provide that notice or obtain that consent before the new processing occurs.

Contact

For consumer health data privacy requests or questions, contact support@vytal-path.com. Vytal Path LLC, 30 N Gould St Ste N, Sheridan, WY 82801.