Privacy Policy

1. Overview

VitaSignal LLC ("we," "us," or "our") operates vitasignal.ai. This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you visit our website or interact with our services. By using vitasignal.ai, you agree to the practices described in this Policy.

2. Information We Collect

We collect the following categories of information:

• Contact information: Name, email address, organization, role, and message content submitted via contact forms, licensing inquiries, or demo access requests.
• Account data: Email address and authentication credentials for authorized dashboard users.
• Usage data: Pages visited, referral sources, browser user agent, timestamps, and approximate geographic region (country-level) collected automatically via server-side analytics.
• Cookie preferences: Your cookie consent choices (necessary, analytics, functional).
• Device information: Browser type, device type, screen resolution, and operating system.

We do not collect protected health information (PHI), Social Security numbers, financial data, or biometric identifiers. All data displayed on the technology demonstration dashboard is simulated and synthetic.

3. How We Use Your Information

• To respond to inquiries, licensing requests, and demo access requests.
• To provide and maintain authorized dashboard access.
• To analyze aggregate usage patterns and improve the website.
• To enforce our Terms of Service and protect intellectual property.
• To comply with legal obligations.

We do not sell, rent, or trade your personal information to third parties.

4. Cookies & Tracking Technologies

We use the following categories of cookies:

• Necessary cookies: Required for authentication, session management, and core functionality. Cannot be disabled.
• Analytics cookies: Help us understand site usage patterns. Opt-in only.
• Functional cookies: Enable enhanced features such as theme preferences and cookie consent memory. Opt-in only.

We do not use advertising trackers, pixel tags, or third-party ad networks. You can manage your cookie preferences at any time via the cookie consent banner that appears on your first visit.

5. Data Sharing & Third-Party Services

We may share limited information with the following categories of service providers, solely to operate our services:

• Infrastructure providers: Cloud hosting and database services used to store website and inquiry data.
• Authentication services: For user login and session management.
• Email services: To deliver transactional notifications (e.g., inquiry confirmations).

We do not share your personal information with advertisers, data brokers, or unaffiliated third parties. Service providers are engaged under their standard terms, which we do not independently audit.

6. Data Retention

Contact form submissions and licensing inquiries are retained for up to two (2) years or until you request deletion. Usage analytics are retained in aggregate form. Authentication session data is cleared automatically upon expiration. Client-side storage items (e.g., session tokens, preferences) are subject to automated TTL-based expiration.

7. Data Security

This section describes the public VitaSignal website and its research environment only. It does not describe a production clinical environment, and it does not describe controls for any future evaluation or partner environment, which would be defined in a separate written agreement.

Status labels follow the same bounded vocabulary used in the Trust Center: In place, Prototype, Planned, Not independently audited, or Not offered.

• In place: encrypted transport (TLS/HTTPS) for traffic to and from this public website.
• In place: provider-managed storage encryption for the research-environment database that backs this website. Provider-managed encryption is not an independent validation of our configuration.
• Prototype: database access rules, role separation, rate limiting, breached-password checks, application-level encryption of selected contact fields, and event logging for security-relevant operations in the research environment. These are prototype controls, are not uniformly applied, and are not represented as production safeguards.
• Planned: formal access-review, key-management, and log-retention procedures ahead of any pathway involving real clinical data.
• Not independently audited: no third party has assessed or attested to any of the controls described above.
• Not offered: multi-factor authentication enforcement, production clinical access control, and PHI handling. This website does not process protected health information.

Logs are retained for operational review and are not represented as unalterable or independently verifiable. No method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Data Breach Notification

If we determine that a security incident has affected personal information you provided, we intend to notify affected individuals without undue delay and within the timeframes required by applicable law. Notification would ordinarily be sent by email to the address on file and, where required, posted on this website. This is a description of intended practice for a research-stage website, not a contractual service commitment.

9. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal information.
• Portability: Request a machine-readable copy of your data.
• Opt-out: Opt out of non-essential cookies via the cookie consent banner.
• Do Not Sell: We do not sell personal information. No opt-out action is required.

To exercise any of these rights, email privacy@vitasignal.ai. We will respond within 30 days.

10. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), to:

• Know what personal information we collect and how it is used.
• Request deletion of your personal information.
• Opt out of the sale or sharing of personal information. We do not sell or share personal information.
• Non-discrimination for exercising your privacy rights.

To submit a verifiable consumer request, contact privacy@vitasignal.ai.

11. International Data Transfers

VitaSignal LLC is based in the United States. If you access this website from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction. By using this website, you consent to the transfer of your information to the United States.

For users in the European Economic Area (EEA) or United Kingdom, we process personal data under lawful bases including consent and legitimate interests. You may withdraw consent at any time by contacting us.

12. Children's Privacy (COPPA)

This website is not directed at individuals under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected such information, we will take immediate steps to delete it. If you believe a child under 13 has provided us with personal information, please contact privacy@vitasignal.ai.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last Updated" date. Material changes will be communicated via a notice on the website. Your continued use of the website after changes constitutes acceptance of the revised Policy.

14. Governance & Ethical Standards

VitaSignal maintains organizational governance policies that complement this Privacy Policy, including:

• Conflict of Interest Policy: Establishes disclosure requirements and recusal procedures for employees, contractors, and affiliates involved in clinical AI research, intellectual-property matters, and commercial partnerships. A copy is available on request from info@vitasignal.ai.
• Data Governance: All personal data processing activities are subject to internal review, documented in our Privacy Impact Assessment, and aligned with NIST SP 800-122 guidelines.
• Responsible AI: Research evaluation may include feature-attribution review and prespecified subgroup analysis where appropriate data, approvals, and sufficient cell sizes exist. These methods do not certify fairness, establish equitable benefit, or imply planned clinical deployment.
• Regulatory Alignment: Our data practices are designed for compatibility with HIPAA, FDA SaMD guidance, and applicable state privacy laws.

15. Contact Us

For privacy-related inquiries, requests, or complaints: