Privacy Policy

Effective date: 6 September 2026

Vitalis is a general wellness service, not a medical service or emergency provider. This policy explains how we handle personal data; it is not medical advice.

Who we are

Vitalis is operated by Sully'z World Ltd. (“we”, “us”). Contact us about privacy at hello@meetvitalis.com.

Information we collect

We use a random browser/device identifier and essential cookies to keep a session and apply scan allowances. If you choose to provide an email address, we use it to unlock or restore access, send requested service communications, billing-related messages, and—where you opt in—wellness or product updates. Scan results, measurements, history, preferences, and optional AI-generated illustrations may be stored on our servers to provide the service.

Camera, microphone and AI processing

When you choose a camera-based scan, photos or video frames travel transiently to Vitalis servers and Google Gemini to generate the requested wellness interpretation. We do not persist raw camera images or video frames. If you use voice features, microphone input is sent transiently for transcription and the resulting transcript may be stored with your scan; we do not retain the raw audio recording. Derived results—not raw imagery—may be retained as described above.

Payments and service providers

Stripe processes Premium subscription payments; we do not receive or store full card details. We use Brevo to send email, Google Gemini for AI-assisted interpretation and voice transcription, and Replit for application hosting and related infrastructure. These providers process data for the purposes above under their applicable terms and safeguards.

How we use and share data

We use data to operate, secure, improve and support Vitalis, administer entitlements and subscriptions, and meet legal obligations. We do not sell personal data. We do not use raw images for advertising because we do not retain them.

Retention, deletion and your choices

We retain derived records while needed for the service, legitimate operational needs, or legal obligations. You may request access, correction, export or deletion by emailing us. Clearing browser data may remove the local identifier or cookies but does not erase server-side results, measurements, history, billing records, or optional illustrations; please make a deletion request for those records.

UK data protection

Vitalis is designed to support UK GDPR principles, including data minimisation and appropriate safeguards. Controller/processor roles, international transfers, and any data processing agreement are determined by the applicable contract and service context; this statement is not an absolute compliance certification.

Children

Vitalis is not for children under 13. Users under 18 must have permission from a parent or legal guardian. If we learn that we hold personal data from an ineligible child, we will delete it as appropriate; please contact us.

Changes

We may update this policy as the service changes. We will post the updated version here with a revised effective date.