Consumer Health Data Privacy Policy
Effective date: September 29, 2026
Last updated: September 29, 2026
This Consumer Health Data Privacy Policy explains how Thea LLC, doing business as Vectis Bio (“we,” “us,” or “our”), handles consumer health data. It supplements our main Privacy Policy and applies to everyone who uses Vectis Bio, including residents of Washington, Nevada and Connecticut.
Vectis Bio is a wellness app, not a healthcare provider, and is not a medical device.
1. The health data we collect
Only what you choose to provide or connect. Depending on what you use, this can include:
- •Apple Health data you authorize — such as heart rate variability, resting heart rate, sleep, steps, workouts, active energy, VO₂ max and similar measures
- •Data from wearables you connect, such as WHOOP or Oura
- •Meals you log — foods, calories, protein, carbohydrates, fat and timing
- •Daily check-ins — for example mood, focus and energy ratings
- •Body measurements and body-composition entries
- •Supplements you log
- •Lab reports you upload and the biomarker values in them
- •Genetic (DNA) reports you upload, only after you give separate consent
- •Profile details — date of birth, gender, height and weight
- •Your messages to the in-app AI assistant
- •A ZIP or postal code, only if you use the IV Recovery finder or nearby-store suggestions. We do not track your precise location.
2. Where it comes from
Directly from you (what you type, log or upload), from Apple Health, and from wearable services you connect. We do not buy health data and we do not collect it from data brokers.
3. Why we collect and use it
- •To calculate your NAV score and show your six pillar scores
- •To generate your personal insights, recommendations, plans and AI assistant answers
- •To keep your history, trends and Bank balance
- •To share context with a specialist — but only when you book one and confirm the sharing yourself
- •To operate, secure and improve the app
We do not use your health data for advertising or marketing, we do not sell it, and we do not give it to data brokers.
4. Who we share it with
- •Specialists you choose. When you book a consultation, you are shown what will be shared and you confirm it. You are asked again at each booking.
- •Service providers that help us run Vectis Bio: cloud hosting (Amazon Web Services) and AI processing (currently OpenAI). They process data only to provide the service to you. Your DNA file is sent to our AI provider only if you give the DNA consent, and only to generate your insights.
- •Payment services (Apple, Stripe and RevenueCat) handle billing. We do not send them your health data.
- •Where the law requires it, or to protect people's safety.
We do not share health data with advertisers, social-media platforms or analytics tools. We do not use advertising pixels in the app.
5. Your consent
We ask for your consent in separate, unticked steps, and we record when you give or withdraw it:
- •Collect and use my health data to run the app — needed to use the app
- •Share my data with specialists I choose — optional, and confirmed again at each booking
- •Process my DNA file with our AI provider to generate insights — asked before your first DNA upload
You can withdraw any consent at any time in the app under Settings → Privacy & data. Withdrawing the DNA consent stops DNA analysis. Withdrawing the specialist-sharing consent stops future sharing.
6. Your rights
You can:
- •Confirm whether we collect your health data and access it — most of it is visible in the app, and you can ask us for a copy
- •Withdraw your consent
- •Delete your data (see section 7)
- •Ask for a list of the third parties and affiliates we have shared your health data with
Send requests to info@vectis-bio.com. We respond within 45 days. If we decline a request you can appeal by replying to our answer, and residents of some states may contact their state attorney general.
7. Deleting your data
In the app, go to Settings and choose Delete account. This permanently deletes your logged and uploaded health data right away — meals, health data, lab reports, DNA reports, check-ins, chat history and settings — and clears your name, date of birth, gender, height, weight and location from your account. We also ask our payment providers (Stripe and RevenueCat) to delete their records of you.
We keep only what we need for payments, tax and disputes (subscription and consultation records) and the record of your consents. That information does not include your logged health data, and your account no longer identifies you.
Deleting your account does not cancel an Apple subscription. Cancel it in your Apple ID settings so you are not charged again.
8. Security
Your data is encrypted in transit (TLS) and at rest. Access is limited to what is needed to run the service. If a breach affecting your health data ever occurs, we will notify you without unreasonable delay and within the time the law requires.
9. Changes
If we change this policy in a way that affects how we use or share health data, we will ask for your consent again where the law requires it. The “Last Updated” date shows the current version.
10. Contact
Thea LLC
3436 Goldfinch Dr, Naperville, IL 60564