Privacy Policy

Last updated: September 11, 2026

Your privacy, our priority

Where HIPAA applies, we follow its privacy and security requirements, along with other applicable federal and state laws.

Vytal Path is a consumer health information service. Whether a particular privacy law, including HIPAA, applies can depend on the service, relationship, information, and circumstances involved. This statement is not a claim that every Vytal Path activity or every item of consumer health information is governed by HIPAA, and it is not a third-party certification. We maintain privacy and security safeguards intended to protect the information entrusted to us and apply applicable legal requirements to the circumstances in which they govern.

Information we collect and why

Vytal Path collects information you provide directly and, only when you choose to connect a supported service, information that service is authorized to share with Vytal Path. Depending on the features you use, this can include account and contact information; conditions; allergies; medications; surgeries; appointments; lab and imaging information; documents; notes; vitals and other readings; nutrition information; menstrual-cycle information; wellness check-ins; reminders; emergency-card information; caregiver and sharing settings; and data imported from supported health-record or device connections.

We use this information to provide the features you choose, organize and display your information, support reminders and summaries, operate connected-health features, enable sharing and caregiver functions, secure and troubleshoot the service, respond to requests, and comply with applicable law.

No sale or advertising use of health information

We do not sell personal health information. We do not share personal health information with advertisers for targeted advertising. Health information may be disclosed to service providers that help operate Vytal Path, to services you explicitly connect or recipients you choose, or when disclosure is required or permitted by applicable law.

Service providers

Vytal Path uses service providers to operate the platform. Current infrastructure includes Amazon Web Services for cloud infrastructure, database and storage services, backend processing, monitoring, and Amazon Bedrock-based AI processing; communications providers for account and notification messages; and supported payment processors for billing. Service providers receive only information reasonably necessary for their functions and are subject to contractual and legal obligations applicable to their role.

Where a Business Associate Agreement or other privacy/data-protection agreement is legally required for a particular relationship or use, Vytal Path's policy is to use the appropriate agreement before relying on that service for the covered activity.

Health information you choose to import

Where supported, Vytal Path may allow you to connect participating electronic health record systems, patient portals, wearable devices, fitness services, and other health-data services. Connecting is optional. You authorize the outside service directly and Vytal Path receives only information made available under that authorization.

Imported information may include demographics, allergies, conditions, medications, immunizations, laboratory results, vital signs, diagnostic reports, clinical documents, procedures, care-plan information, coverage information, activity, sleep, workout, and biometric readings, depending on the service and permissions involved.

Some integrations may support background synchronization; others may require periodic reconnection. Disconnecting stops future synchronization through Vytal Path but does not necessarily delete previously imported information. Where a dedicated delete control is available, you can use it to remove data imported from that connection. Account deletion removes imported information from active Vytal Path systems subject to the limited backup-retention process described in the Data Retention Policy.

Caregiver access

If you grant a caregiver or trusted person access, the information available to that person is controlled by the permissions and access period you select. Certain safety-relevant information may remain available through the Emergency Card or reports to a person who has active caregiver access, including current medications and selected emergency-profile information such as allergies, conditions, blood type, and emergency contacts. Review the permissions shown in the app before granting access. You can revoke caregiver access using the available account controls.

Sharing reports and health information

When you choose to share a report or health summary outside Vytal Path, the recipient may be able to access or retain that information outside your account. A shareable link may be accessible to anyone who possesses the link and may expire automatically after the period displayed by the product. A report sent as an email attachment cannot be recalled after delivery. Only share health information with people you trust.

Location and tracking

Vytal Path does not use geofencing around healthcare facilities to identify people seeking care or to target advertising. Vytal Path does not use third-party advertising pixels or cross-site behavioral advertising trackers in the health application.

Your privacy rights

Depending on where you live and the law that applies, you may have rights to access, confirm, obtain a copy of, correct, delete, or restrict certain uses of personal or consumer health information, withdraw consent, and appeal certain denied requests. Vytal Path provides self-service Privacy & Data controls for available access, export, correction, consent, and deletion functions, and accepts additional requests through Contact Us.

Vytal Path treats consumer health information as sensitive information and applies opt-in consent where required. Applicable state consumer-health and privacy laws may include Washington's My Health My Data Act, Nevada's consumer health data law, Connecticut's Data Privacy Act, and privacy laws in states such as California, Colorado, Virginia, and Oregon, depending on their scope and applicability. Vytal Path also follows applicable federal requirements, including the FTC Health Breach Notification Rule where it applies.

If you are in a jurisdiction outside the United States, additional local privacy requirements may apply. Vytal Path will apply those requirements where they govern the service provided to you.

Security and deletion

See the Security Statement for safeguards used to protect information and the Data Retention Policy for retention and deletion practices. Account deletion removes profile and health information from active Vytal Path systems, including connected-integration data and uploaded documents, subject to limited disaster-recovery backups that expire under the normal backup-retention cycle.