Privacy policy

Effective September 7, 2026

This policy covers Vital Health (“Vital”), its public information website, private web journal and native Android companion. Vital is a personal project operated by Manny Herrera, not a healthcare provider. Contact: osmany.m.herrera@gmail.com.

Information handled by Vital

The private journal stores entries you record: meals and nutrients, workouts and exercise results, fasting preferences, injuries or conditions, symptoms, remedies, weight, water and other health measurements. It also stores settings, goals and an account identifier used to keep your records associated with your signed-in account.

Health Connect imports are retired. Previously imported records remain stored and available in your data export. Current watch charts use Google Health API measurements only. Vital does not infer missing measurements.

Google Health account authorization

When you choose Connect Google, Google handles authorization. Vital requests read-only activity and fitness, health metrics and measurements, and sleep permissions. Vital checks your Google Health identity and imports daily steps, heart-rate summaries, resting heart rate, sleep duration and available sleep-stage durations, distance, total energy burned and heart-rate variability when available. Imported summaries are stored in your private journal and synchronized with Android. Automatic imports use your saved history start date (initially 90 days ago), refresh recent days and catch up in batches while the webapp is open or the Android background job runs. You can pause imports and change the history range in Settings. This is not a continuous live watch stream or a phone-independent server schedule.

Client credentials and authorization tokens are retained securely on the server; stored account tokens are encrypted. Tokens let Vital verify access and renew an expired access token without asking you to sign in each time. They are not included in the Android app or returned by the connection settings API. Vital does not receive your Google password.

How information is used

Vital uses journal and permitted health data to save your history, synchronize your devices, display charts, and support the tracking features you choose. Google user data is used only for the disclosed connection and health-tracking functionality. It is not sold, used for advertising, credit or insurance decisions, or used to train general-purpose AI models. Vital's use and transfer of Google API information follows the Google API Services User Data Policy, including its Limited Use requirements, and the Google Health API Developer and User Data Policy.

Storage and service providers

The web application is hosted through OpenAI Sites, with server and database infrastructure provided through Cloudflare. These services process information needed to operate the app. The Android app keeps a private local journal; Android app backups are disabled. Network connections use HTTPS. Health records are not included in this public website.

Hosting services may process technical request information such as IP addresses, browser details and security logs. The public site adds no advertising, analytics scripts or tracking cookies. The private app uses sign-in and security cookies. Provider infrastructure may process data outside your location; Vital does not promise storage in a particular country.

Phone reminders

If enabled on your Android device, Vital uses your reminder preferences and last synced journal records to schedule meal, water, workout and recovery notifications locally. Preferences synchronize with your account. Notifications may appear on your phone; Android notification settings control their visibility. Delivery does not automatically create a health log.

Food searches and camera

Food search terms and decoded product barcodes are sent to Open Food Facts. Vital does not send your journal entries, portion history or account details to that catalogue. Camera images used for barcode scanning are processed on your device and are not uploaded by Vital.

Sharing and access

Journal access is restricted to the owner account. Information is shared with the service providers needed to operate authorized features, or when you intentionally export or share it. Information may also be disclosed where legally required or necessary to address security abuse. Vital does not publish your health records.

Retention, deletion and control

Journal entries remain until you delete them. Use the journal's edit and delete controls to remove records, and export records you want to keep. Clearing the phone's local data is separate from deleting web records. For removal of remaining account configuration or stored connection information, contact the operator at the email above. Service-provider backup and security-log retention may differ from the live application's records.

You can revoke Health Connect permissions in Android Settings and pause automatic imports. Disconnect Google in Vital clears stored authorization tokens and attempts to revoke access with Google. You can also remove Vital under Google account connections. Disconnecting does not delete previously saved journal entries or the OAuth client configuration. Remove those separately when no longer needed.

Children and changes

Vital is intended for adult personal use and does not offer public registration or knowingly solicit children's information. Changes to data practices will be reflected here with an updated effective date. New access to health data requires the applicable permissions.