Effective Date: July 23, 2026  Last Updated: October 5, 2026

This Privacy Policy explains how Vea Health, Inc. ("Vea," "we," "us," or "our") collects, uses, and protects the information you share with the Vea app (the "App"), written in plain English. For the wellness App described here, Vea is not acting as a HIPAA-covered entity. Other applicable privacy and consumer-protection laws still apply. This policy does not limit your statutory rights. If you separately pursue prescription care, that care is delivered by our partner medical group under federal health-privacy law (HIPAA) and is covered by our Privacy Policy for those services, not this one. Your use of the App is also governed by our App Terms of Use.

Correction notice, October 5, 2026: We have corrected our description of AI processing and clarified app records, exports and deletion. The previous statement that all Anthropic processing had a seven-day retention limit was incorrect. This notice does not authorize additional processing, replace any required consent, waive any prior commitment or limit your rights concerning earlier processing. Contact privacy@veahealth.co with questions or requests about earlier processing.

What we collect

The information depends on the features you use and the permissions you grant.

Account

Your phone number or email, used as your login identifier and to send you a one-time sign-in code, and a display name if you choose to set one.

Health & performance

Apple Health information you permit us to read; connected-band and scale readings; activity, heart rate, sleep, energy, weight and body composition; meals, liquids, workouts and goals; and optional symptoms, menstrual records and menopause check-ins. We also process profile details and preferences you provide, selected photos, and supported voice input when you choose those features.

Coach interactions

Your conversations, saved plans, coaching requests and Coach Memory, which contains summaries used to keep replies relevant. Turning AI off stops new AI requests; it does not by itself delete previously saved conversations, plans or memory. Use the available delete controls or contact us to request deletion.

Service and support records

Account and device identifiers, app events, notification preferences, support messages and security/access records help us operate, troubleshoot and protect the service. Please avoid including health information in a support message unless it is needed to resolve your request.

How we use it

We use what you share to deliver the product you signed up for.

• Personalize coach replies to your training and nutrition.
• Generate today's training recommendation and adjust as your week unfolds.
• Surface weekly and monthly trends and recaps.
• Send a one-time sign-in code by text, or a sign-in link by email.

We do not profile you for advertising. We do not sell your data. Your health data never leaves Vea's vendors for marketing purposes.

AI and our AI providers

With your AI permission, Anthropic processes Vea coach requests, plan generation and selected meal photos. Requests can include your messages, recent conversation, display name, saved goals and plans, and relevant profile and health summaries. We do not automatically send your complete Apple Health database or payment-card information. Personal information you put in messages can be included.

Anthropic states that commercial API data is not used for model training by default. Its standard API retention is up to 30 days, with exceptions for safety, legal requirements, certain services and contractual arrangements. See Anthropic's retention policy. This processing is separate from the conversations, logs and memory saved in Vea. There is no universal seven-day deletion period.

You can review or delete Coach Memory, or turn AI off in Settings. Turning AI off does not erase previously saved records. Voice transcription can use OpenAI or Deepgram, depending on the enabled configuration; the transcript can then be sent to Anthropic to prepare your entry. This update does not enable either transcription service or create permission to share audio with a new provider. When voice is unavailable, use typed input.

Decision routing with OpenRouter and TypeSafe

With your AI permission for this provider scope, Vea may send your current request and a limited recent conversation through OpenRouter to TypeSafe's Jev model. Jev helps choose an app action or model; it does not independently authorize changes to your records. The shared conversation can include health details or other information you put in messages. This routing request does not automatically include your raw Apple Health history, payment information, photos or audio files. You can withdraw AI permission in Settings. An earlier acceptance that covered only the existing AI service is not treated as acceptance of this additional provider scope.

Who we share with

The short list of vendors that help us run the App, one line per vendor.

• Supabase - authentication and the database that stores your account, logs, and coach transcripts.
• Twilio - sends the one-time sign-in code to your phone by text.
• Anthropic - the coach AI model. See the AI section above for what is sent and what is not.
• OpenRouter and TypeSafe - route and evaluate limited conversation context to help select an app action or model, as described above.
• Apple - the App Store handles subscription payments; Apple Push Notification service delivers push notifications you opt into. Vea never sees your card.
• RevenueCat - keeps track of whether your subscription is active across devices.
• Vercel - hosting for the Vea backend.

No advertising SDKs. No analytics SDKs that share with data brokers. We will share information when legally required, or to protect someone's safety in a genuine emergency.

Your rights and controls

Use the controls available in your app version, or contact privacy@veahealth.co. You do not need to create a new account to make a privacy request.

• Export - Settings, Your Data, Export downloads supported account and app records. Where a category exceeds the download limit, the file identifies it. Contact privacy@veahealth.co with the request identifier for the remaining records or other personal information. Download limits do not limit your legal access rights. We retain our commitment to provide your requested copy within 30 days.
• Delete - Settings, Your Data, Delete removes your account and linked app records. It does not cancel subscriptions or delete records separately held by a medical provider or payment provider. Support messages, security/access logs and records preventing a deleted account from being recreated are not erased by this app control. Contact privacy@veahealth.co to request review and deletion of remaining personal information, including processor-held copies. We retain our 30-day deletion commitment, subject only to applicable legal exceptions, which we will explain in our response. These clarifications do not waive earlier commitments or permit indefinite retention.
• Coach Memory - Settings, Privacy, Coach Memory. Delete individual entries, delete all, or turn the feature off.
• AI off-switch - Settings, Privacy, Vea AI, off.
• Apple Health per-category - iOS Settings, Health, Vea. Toggle each metric independently.

Depending on applicable law, you may request access, correction, deletion and information about recipients of your consumer health data, and withdraw consent. Email privacy@veahealth.co; we will use only information reasonably needed to verify your request. If we decline a request, reply with “Privacy appeal” for review and a written explanation. Washington residents may contact the Washington Attorney General. These options supplement, and do not limit, other state or federal rights.

Children

The App is for people 16 and up. We do not knowingly collect information from anyone under 16. If you believe someone under 16 has signed up, write to privacy@veahealth.co and we will remove the record.

This website

This app policy is hosted on our marketing website. Website cookies and advertising or affiliate technologies are described in the separate website Privacy Policy. The app statements above do not mean this marketing page is free of tracking.

Security

• Encryption in transit (TLS 1.2 or higher) and at rest.
• Least-privilege access, with access logged.
• An audit log for data-access events in our health and coach surfaces.
• Breach notification within 72 hours of confirming an incident affects you.

Changes and contact

Material changes get an in-app notice before they apply to you. Minor changes get a new date at the top. Contact: privacy@veahealth.co (privacy) or team@veahealth.co (general).