Vitly Privacy Policy

Effective date: October 17, 2026

This Privacy Policy explains how Vitly ("Vitly", "we", "us") collects, uses, shares, and protects information when you use the Vitly mobile application and related services (the "App").

If you do not agree with this policy, please do not use the App.

1. Who We Are

Vitly B.V. provides a health and wellness app that helps users track nutrition, activity, and body metrics and receive personalised recommendations. In most cases, Vitly B.V. acts as the data controller for personal data collected through the App. If your employer provides the App to you, your employer may be the controller and Vitly B.V. may act as a processor on its behalf.

2. Scope

This policy applies to the Vitly mobile App and the related backend services that power it. It does not cover the InBody device you are measured on at your employer, or third-party services you choose to connect (such as Google Health Connect), except as described in Section 8.

We do not use cookies or tracking pixels in the App.

3. Information We Collect

We collect the following categories of information, depending on how you use the App:

• Account and identity data: email address, name, company domain, and user ID.
• Demographics and intake data: age, sex/gender, height, weight, activity level, goals, injuries, dietary preferences, and lifestyle inputs.
• Body-composition data: the results of the InBody measurements you take on a device at your employer's site - weight, body fat percentage and mass, skeletal muscle mass, BMI, visceral fat level, basal metabolic rate, segmental muscle and fat values, and the InBody score - together with the date of each measurement. These results are retrieved from the InBody measurement service using the PIN you enter during onboarding, as described in Section 8.
• Uploaded scan reports: if you photograph or upload a printed body-composition report, the image or PDF and the values read from it.
• Activity data from your device: on iPhone, your step count only, read from the device's motion sensor if you allow Motion & Fitness access. On Android, your step count from the phone's motion sensor if you allow Physical activity access, and the Google Health Connect categories you choose to share: steps, calories burned (active and total), distance, and workouts recorded by your watch or fitness app - each with its type, start and end time, distance, calories and average heart rate. Vitly does not read sleep, weight or any other Health Connect category.
• Voice and audio data: if you choose to speak rather than type in ‘Describe Meal’, the recording from your microphone is transmitted to OpenAI for transcription. Audio is not stored on our servers after transcription is complete.
• Nutrition data: meal logs (whether entered with ‘Scan Barcode’, ‘Take a Picture’ or ‘Describe Meal’), macros, restrictions, saved meals, and meal plans.
• Fitness data: workout plans, exercises, completions, and activity summaries.
• Behavioural data: in-app activity points, streaks, achievements, and gamification progress used to personalise your experience.
• Survey responses: if your workplace programme includes a pilot, the answers you give to the in-app check-ins - how energetic, healthy, fit and motivated you have felt, each on a 1-10 scale, together with any optional written comments. Your individual answers are analysed by Vitly only and are not shared with your employer.
• Notifications data: push notification token and preferences.
• Recommendation provenance: for each meal plan, workout plan or health tip we generate, a record of which passages from the published guideline documents were placed in front of the AI and which of them the recommendation cited. This is what the Sources & methodology screen in the App shows you.
• Usage and diagnostics: app error logs and diagnostics if enabled.
• Device and app data: basic device identifiers and app configuration needed for functionality.

4. How We Use Information

We use your information to:

• Provide core app functionality, including personalised meal plans, workouts, and progress tracking.
• Calculate your daily calorie, protein, carbohydrate, fat, fibre and water targets from your body-composition results using published methods.
• Process body-composition results and scan reports and generate health insights using AI.
• Retrieve passages from published health and nutrition guidelines and place them in front of the AI, so recommendations rest on a citable source, and record which passages were used so we can show them to you.
• Estimate the nutrition of a meal you log with ‘Take a Picture’ or ‘Describe Meal’, and transcribe what you say if you choose to speak rather than type in ‘Describe Meal’.
• Sync and display health data from connected device platforms, if you enable them.
• Send optional notifications and reminders.
• Maintain security, prevent abuse, and debug issues.
• Improve app performance and reliability.

5. AI Processing

Vitly uses AI services from OpenAI: GPT-4o-mini to read scan reports, to estimate the nutrition of a meal from a picture you take (‘Take a Picture’) or a description you give (‘Describe Meal’), and to write meal plans, workout plans and health tips; Whisper to transcribe what you say in ‘Describe Meal’; and a text-embedding model to find the guideline passages relevant to your situation.

Body scans and meal pictures: When you upload a body-composition report or take a picture of a meal with ‘Take a Picture’, the image is transmitted from our backend servers to OpenAI's API for analysis. We do not include direct identifiers such as your name or email in these requests. Body scan images may be downscaled before transmission, but the image content itself is shared with OpenAI as a third-party processor.

Describe Meal: When you describe a meal, the text you type is transmitted from our backend servers to OpenAI's API so it can estimate the nutrition. If you choose to speak instead, your audio recording is first transmitted to OpenAI's API for transcription; the audio is not stored on our servers after the transcription response is returned.

How recommendations are grounded: Meal plans, workout plans and health tips are not written from the model's own knowledge alone. Before each request, passages are retrieved from a fixed set of published guideline documents - among them the World Health Organization guidelines on physical activity and on carbohydrate and fat intake, the FAO/WHO statement on healthy diets, the Health Council of the Netherlands dietary guidelines, the EFSA reference values for water, and the position stands of the International Society of Sports Nutrition and the American College of Sports Medicine - and included in the request alongside a summary of your own data. Advice that cannot be tied to one of those passages is removed before you see it. Which passages were used is recorded against your account and shown to you on the Sources and methodology screen.

OpenAI data retention: Under our agreement with OpenAI, data submitted via the API is not used to train OpenAI's models and is not retained by OpenAI beyond the period needed to return a response (typically zero data retention for API calls under our API usage tier).

AI-generated recommendations are produced automatically based on your inputs. These outputs are intended as general wellness guidance and do not constitute medical advice. If you have questions about how a specific recommendation was generated, contact us using the details in Section 16.

6. Legal Bases (Where Applicable)

Depending on your location, we process data based on one or more of the following:

• Contractual necessity to provide the App and its features.
• Your explicit consent for special category data (health and biometric data, including your InBody measurements, scan images and voice recordings) and optional features such as connecting Google Health Connect or allowing access to your step count.
• Legitimate interests for security, fraud prevention, and service reliability.

You may withdraw consent at any time using either of the following methods:

• In the App: go to Settings → Delete Account to remove your account and associated data.
• By email: contact [email protected] to request withdrawal of consent for specific processing.

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

7. Sharing of Information

We do not sell your personal information. We do not share your health data - your InBody measurements, anything read from Google Health Connect, or your step count - with advertisers, data brokers, or any third party for advertising purposes.

We share data only with the following categories of service providers and partners who help us operate the App:

Each provider is permitted to process your data only to deliver their services to us and is required to protect it under a data processing agreement or equivalent safeguard.

You can request a current list of subprocessors by contacting [email protected]. If we add or replace subprocessors in a way that materially affects how your data is processed, we will update this policy and notify you in the App or by other appropriate means.

8. Body-Composition Measurements and Device Integrations

InBody body-composition measurements

Vitly is provided to you through your employer, which makes an InBody body-composition device available at its site. During onboarding you enter the PIN issued to you for that device. Vitly uses that PIN to retrieve your measurement results from the InBody measurement service (LookinBody Web) operated by InBody, and a new measurement is delivered to Vitly automatically shortly after you step off the device. We receive the measurement values and their dates; we do not receive measurements belonging to anyone else. Because the measurement service restricts access to known network addresses, our requests to it are routed through a proxy provider that gives us a fixed outbound address. Your relationship with the InBody device and service at your employer is governed by your employer's own arrangements; this policy covers what Vitly does with the results once we receive them. If you do not want Vitly to hold your measurements, you can delete your account in the App, which removes them.

Step count from your phone's motion sensor

On iPhone, Vitly can read your step count from the device's motion sensor if you allow Motion & Fitness access. Only the step count is read; Vitly does not use Apple Health / HealthKit, has no HealthKit entitlement, and reads no other health category on iOS. On Android, Vitly can count your steps with the phone's motion sensor if you allow Physical activity access, so the Home screen shows your steps as you walk. Steps are used to show progress toward your daily step goal, to count toward your weekly activity target, and to maintain your streak. They are not used for advertising. You can revoke access at any time in iOS Settings under Privacy & Security, Motion & Fitness, or in Android under the app's permissions (Physical activity).

Google Health Connect (Android)

On Android, if you connect Google Health Connect, you choose in your device permissions which of these categories Vitly may read: steps, active calories burned, total calories burned, distance, exercise (workouts) and heart rate. Vitly reads them only to show them to you in the App: your steps on the Home screen and in your weekly progress; the calories you burned, set against the calories you ate, in the Agenda; the day's distance and workout minutes; and the workouts your watch or fitness app recorded, which appear in your workout history with their start and end time, distance, calories and average heart rate. Heart rate is read only for those workouts, and only their average is kept. A workout you have already logged in Vitly is matched with the watch's record instead of being counted twice; to do this, Vitly keeps a log of which Health Connect workouts it has imported. Vitly does not read sleep, weight or any other category, and does not write to Health Connect. Health Connect data is never used for advertising, sold or shared. You can revoke access at any time in your Android device settings.

9. Company and Employer Relationship

Vitly is made available to users through their employer or company. Your company's email domain is used to verify eligibility. Vitly does not share individual user health or biometric data with your employer. Company administrators may have access to account-level information (such as whether an account exists) for the purpose of managing access, but they do not have access to your personal health data, body scans, voice recordings, or activity within the App.

10. Data Retention

We retain your information while your account is active, and a scheduled job deletes records that have passed their retention period each day:

• Uploaded scan images and PDFs are deleted 90 days after upload, together with the stored file. The values read from them are kept as body-composition records.
• Body-composition records, nutrition logs, water logs, workout completions and activity points are kept for 24 months, so you can see your progress over time.
• Daily activity read from your device (steps, calories burned, distance and workout minutes) and the log of which Health Connect workouts were imported are kept for 24 months.
• Recommendation provenance (which guideline passages a plan or tip used) is kept for 90 days.
• Pilot survey answers are kept for 24 months, so the pilot can be evaluated after it ends.
• Generated plans, daily tips and notification history are kept for 30 days.
• Voice recordings are not stored on our servers after transcription is complete.
• The record of the consents you gave is kept for five years, including after you delete your account. This is the one exception to deletion, and it is explained below.

On account deletion, your profile and all of the records above are removed from our active database immediately, and uploaded files are removed from file storage. Backups may retain data for up to 90 days before being overwritten as part of routine backup cycles.

The single exception is the record of the consents you gave. We keep it so that we can show what you agreed to and when, if that is ever questioned — a consent record is worth nothing if it disappears the moment someone asks whether it existed. It holds only the type of consent, whether you granted or withdrew it, which version of this policy was in force at the time, the date, and a one-way cryptographic fingerprint of your email address. It does not hold the address itself, your name, or any health data, and the fingerprint cannot be turned back into your email. We rely on Article 17(3)(e) of the GDPR for this (establishing, exercising or defending legal claims), and we delete these records automatically after five years.

We may retain certain data longer where required to comply with legal obligations or resolve disputes.

11. Security

We use administrative, technical, and physical safeguards to protect your data, including:

• Encrypted data transmission (HTTPS/TLS) between the App and our servers.
• Encrypted on-device storage for authentication tokens (using device-level secure storage).
• Access controls limiting who can access your data within our systems.

No system is completely secure. In the event of a personal data breach that is likely to result in high risk to your rights and freedoms, we will notify affected users without undue delay and will report the breach to the relevant supervisory authority within 72 hours as required by applicable law.

12. Your Choices and Rights

Depending on your location, you may have the right to access, correct, export, restrict, or delete your data, and to object to or withdraw consent for certain processing. You can:

• Update your profile information in the App.
• Control notification preferences in the App.
• Revoke Motion & Fitness access in your iOS device settings, or Google Health Connect access in your Android device settings, at any time.
• Export your data using the self-service Data Export button in App Settings, which downloads a copy of your personal data in a portable format (GDPR Article 20).
• Delete your account in App Settings → Account → Delete Account.
• Contact us at [email protected] to request access, correction, deletion, or a portable copy of your data.

If you are located in the European Union, you also have the right to lodge a complaint with your local data protection supervisory authority if you believe your data has been processed unlawfully.

13. International Transfers

We aim to process your data within the European Economic Area. If any transfer outside the EEA occurs, we will ensure appropriate safeguards are in place, such as standard contractual clauses approved by the relevant authority.

14. Children's Privacy

Vitly is intended for adults and is not directed at children. Given that the App collects health and biometric data, we require users to be at least 18 years old, or the minimum age required by your local laws if higher. We do not knowingly collect data from anyone below this age.

15. Changes to This Policy

We may update this policy from time to time. If we make material changes, we will notify you in the App or by other appropriate means. The effective date at the top will reflect the latest version.

16. Contact Us

If you have questions or requests about this policy or your data, contact us at:

Legal entity: Vitly B.V.

Address: De Boelelaan 1095-A, 1081HV Amsterdam, The Netherlands

Email: [email protected]

Website: https://www.vitly.work/