Privacy Policy

1.1 Which services the policy covers

This privacy policy applies to the VitalMetrics digital platform as well as the products, services, and features provided by or in connection with the platform.

The policy covers, among other things, processing of personal data in connection with your:

• visiting our website,
• creating or using a VitalMetrics account,
• identifying yourself with BankID or another identification method,
• purchasing or using a subscription,
• ordering a biomarker test or other test,
• receiving, registering, or displaying test results,
• using functions for diet, exercise, sleep, weight, supplements or lifestyle,
• connecting an external integration,
• using AI-powered functions,
• contacting our support, or
• otherwise communicating with VitalMetrics.

Certain functions may be subject to supplementary information or separate consents. Such information is presented in connection with the relevant function.

1.2 Who the policy applies to

The policy primarily applies to persons who:

• visit the VitalMetrics website,
• creating or using a VitalMetrics account,
• order or use VitalMetrics services,
• use the VitalMetrics mobile application,
• contact VitalMetrics,
• are involved in a support, security or communication matter, or
• otherwise come into contact with VitalMetrics.

VitalMetrics services are intended for persons who have reached the age of 18.

1.3 Data controller

VitalMetrics BioAnalytics AB is the data controller for the processing of personal data where VitalMetrics determines the purposes and essential means.

This means, among other things, that VitalMetrics is responsible for processing personal data for the purposes of:

• creating and administering user accounts,
• conducting identity verifications,
• managing orders, payments and subscriptions,
• organizing delivery and linking of test kits,
• receiving and linking test results to the correct user account,
• storing and presenting biomarker data,
• creating history, trends, analyses and summaries,
• providing functions for diet, exercise, sleep, weight, supplements and lifestyle,
• providing AI-powered functions,
• managing support and communication,
• protecting the security and functionality of the service, and
• developing and improving VitalMetrics services.

1.4 VitalMetrics role

VitalMetrics is a digital platform that helps users collect, understand and track their health data over time through biomarkers, lifestyle data and personal analyses.

VitalMetrics is not a healthcare provider and the service is not intended to replace healthcare, medical advice, diagnosis or treatment.

Information, analyses and summaries shown in VitalMetrics are intended to help the user understand and monitor their own data over time. The information should not be used as the sole basis for medical decisions.

If concerned about one’s own health or in need of medical assessment, the user should contact healthcare providers.

1.5 Responsibility of other parties

To provide certain parts of the service, VitalMetrics collaborates with external parties, for example:

• medical referrer or healthcare organization,
• laboratories,
• payment providers,
• transport and logistics partners,
• providers of identification services,
• technical providers, and
• providers of external integrations.

Some of these parties process personal data on behalf of VitalMetrics and only according to VitalMetrics' instructions. They are then data processors for VitalMetrics.

Other parties may be independently data controllers for processing for which they themselves determine the purposes and means. This may apply, for example, to processing that takes place within laboratory operations, medical referrals, payment handling, transport or external platforms.

When another party is independently a data controller, that party is itself responsible for its processing of personal data and the information to be provided about the processing.

More information about which recipients personal data is shared with and their respective roles is provided further below in this privacy policy.

1.6 Changes to the privacy policy

We may from time to time update this privacy policy when our services, processing of personal data, suppliers or legal obligations change.

The latest version of the privacy policy is always available on the VitalMetrics website and, when applicable, in the mobile application.

If we make changes that affect how your personal data is processed, we will inform you appropriately, for example via email, message in the service or on our website.

If a change requires new consent or new approval according to applicable law, we will request this before the relevant processing or function begins to be applied. If such approval is not provided, certain parts of the service may be affected or no longer available.

2.1 Directly from you

We collect personal data that you provide to us yourself when you use VitalMetrics services.

This may happen, for example, when you:

• create an account,
• identify yourself,
• order a test or subscription,
• complete your profile,
• register diet, exercise, sleep, weight or other lifestyle information,
• upload pictures or other information,
• contact support, or
• otherwise communicate with us.

In parts of the service where registration of data is voluntary, you choose which data you want to register.

2.2 When you use our services

When you use the VitalMetrics website, mobile application or other digital services, certain information is processed automatically to ensure the service functions securely, correctly, and efficiently.

This may include, for example:

• technical information about your device,
• IP address,
• login information,
• security logs,
• use of various functions,
• performance and error information,
• session information,
• information needed to detect, prevent and protect the service against unauthorized access, security threats or abuse.

For more information about cookies and similar technologies, see our cookie policy.

2.3 From external parties

To deliver certain parts of the service, VitalMetrics may receive personal data from external parties.

Depending on which services you use, this may include, for example:

• laboratories,
• medical referrer,
• payment providers,
• logistics and transport partners,
• identification service providers,
• providers of external integrations,
• other providers necessary to deliver the service you have chosen to use.

VitalMetrics only receives the personal data necessary for the current purpose.

2.4 From external integrations

If you choose to connect external services, such as Apple Health or Google Health Connect, VitalMetrics may receive the data that you explicitly choose to share.

Which data is shared depends on:

• the specific integration,
• the permissions you grant,
• the features you activate.

You decide which integrations to connect and which data to share with VitalMetrics.

2.5 Through biomarker tests

When you order a biomarker test, personal data is processed throughout the entire testing process.

This may include, for example:

• registration of the order,
• linking the user and test kit,
• registration of samples,
• receipt of laboratory results,
• linkage of analysis results to the correct user account,
• storage and presentation of the results in VitalMetrics.

More information on how personal data is processed in connection with biomarker tests can be found further down in this privacy policy.

3.1 Identity data

To be able to identify you and link the correct information to the correct user account, we process identity data, such as:

• first name and last name,
• personal identity number or other national identification number when required,
• date of birth,
• gender when necessary for the specific service,
• user ID and internal identifiers.

For secure identification, such as through BankID, we also process the information required to verify your identity.

3.2 Account and profile data

To administer your account, we process data such as:

• email address,
• language,
• time zone,
• account status,
• security settings,
• notification settings,
• other account settings.

You can also choose to register voluntary profile data, such as:

• height,
• weight,
• goals,
• activity level,
• other data you choose to add.

3.3 Contact information

When you order services or contact us, we process contact data such as:

• email address,
• phone number,
• delivery address,
• postal code,
• city,
• country.

3.4 Order, payment and subscription data

To administer purchases and subscriptions, we process for example:

• order number,
• subscription,
• products and services,
• price information,
• payment status,
• transaction references,
• invoice documentation,
• subscription history.

Complete credit card details and other sensitive payment information are processed by our payment providers and are not stored in full by VitalMetrics.

3.5 Test, sample and delivery data

When you order biomarker tests, we process data required to administer the test process, such as:

• ordered test,
• kit ID,
• sample ID,
• referral references,
• laboratory references,
• delivery status,
• tracking information,
• date and status of sampling,
• status through the various steps of the test process.

3.6 Biomarker and other health data

VitalMetrics processes the health data necessary to provide the service's functions.

Depending on which services you use, this may include for example:

• laboratory results,
• biomarker values,
• reference intervals,
• historical measurements,
• trends,
• health summaries,
• health analyses,
• time series,
• other data about your health that you register yourself.

Health data is particularly sensitive personal data according to data protection legislation and is processed with special security measures.

3.7 Lifestyle and activity data

If you use VitalMetrics features for lifestyle tracking, we may process data such as:

• diet,
• meals,
• nutrient intake,
• exercise,
• physical activity,
• sleep,
• body measurements and composition,
• weight development,
• supplements,
• personal notes,
• other data you choose to register.

If you use camera-based functions, images or other information you choose to upload may also be processed in order to identify foods, nutritional information, or other features you actively use.

3.8 Data from external integrations

If you choose to connect external services, VitalMetrics may process the data shared from each respective service.

This may include data from:

• Apple Health,
• Google Health Connect,
• future approved integrations.

Which data is shared depends on the permissions you grant and the features you activate.

3.9 AI-generated analyses and summaries

VitalMetrics may create analyses, summaries, visualizations, and other AI-based features based on the data processed in the service.

These analyses do not constitute new categories of personal data but are processing of information already processed within the scope of your use of the service.

AI-generated analyses are based on the data available in the service and are used as support to present and explain information.

3.10 Technical information and usage data

To ensure operation, functionality, and security, we process technical information such as:

• IP address,
• information about browser and device,
• operating system,
• app version,
• login history,
• security logs,
• error reports,
• performance data,
• usage of different features.

3.11 Support and communication data

When you contact us, we process the information necessary to handle your case, such as:

• support messages,
• email communication,
• support cases,
• case numbers,
• support history,
• other information you choose to provide.

3.12 Aggregated and anonymized information

VitalMetrics may also process information that has been anonymized or aggregated in such a way that it can no longer be linked to an identified or identifiable person.

Such information may be used for statistics, quality work, research, as well as development, validation, and improvement of our analyses, algorithms, and AI-based functions.

5.1 Which health data we process

Depending on the services and functions you use, VitalMetrics may process, for example:

• laboratory results,
• biomarker values,
• reference intervals,
• historical measurements,
• health trends,
• body measurements,
• weight,
• body composition,
• diet and nutrition information,
• training and activity data,
• sleep information,
• supplement information,
• user-generated health logs,
• information from approved external health platforms,
• other health data that you choose to register or share with the service.

VitalMetrics only processes the health data that are relevant to the functions you use.

5.2 The purpose of the processing

Health data are processed in order to:

• present your biomarker results,
• show history and development over time,
• create personal analyses and summaries,
• give you increased understanding of how different parts of your health are developing,
• link biomarkers to diet, training, sleep, lifestyle and other data that you choose to register,
• provide AI-based analyses and explanations,
• develop and improve the functions included in VitalMetrics.

VitalMetrics does not use health data to make automated decisions that have legal or similarly significant consequences for you.

5.3 Processing of health data

VitalMetrics processes health data only when it is necessary to provide the functions that the user has chosen to use and when there is a valid legal basis under data protection legislation.

We never process more health data than is necessary for the current purpose.

The legal basis and the special conditions for processing health data may vary depending on the current processing and are described in more detail in this privacy policy as well as in the consents given when certain functions are activated.

5.4 Your control over health data

The health data processed in VitalMetrics are linked to your personal account.

You always have the possibility to:

• access your data,
• follow your history,
• export data to the extent permitted by data protection legislation,
• terminate your account,
• request that your personal data be deleted in accordance with applicable legislation.

If your subscription ends, your account will be paused. During this time, some functions may be limited, but you still have the possibility to access your historical information according to the terms applicable to the service.

If you choose to terminate your account, VitalMetrics will delete the personal data that can be linked to you, unless continued storage is required by law or other applicable legal obligation.

5.5 Anonymization and observation database

To develop, quality-assure and improve VitalMetrics analyses, statistical models and AI-based functions, VitalMetrics may use anonymized observation data.

An observation record is normally created in connection with a new biomarker result being registered and represents a consolidated health picture at that point in time. If the same user performs several tests over time, several separate observations are created. Each observation is treated as a standalone data point in the observation database.

Before an observation is transferred to the observation database, it undergoes an anonymization process. The purpose is to ensure that the observation can no longer be linked to an identified or identifiable person.

The anonymization process includes, among other things, that:

• direct personal data, such as name, personal identification number, contact information and address, are removed,
• internal user identifiers, account references and other data that could link the observation to a specific user account are not transferred,
• no separate linkage table or other information enabling re-identification is saved in the observation database,
• exact personal data, such as date of birth, are not saved,
• variables such as age, height, weight and other relevant measurements are converted into predefined intervals or categories before the observation is saved, for example age groups, weight intervals and height intervals,
• only the data necessary for statistical analyses, research, quality assurance and development of the service are transferred,
• certain types of personal data, such as registered diseases, medications and other identifying or especially sensitive free-text data, are not transferred to the observation database.

Each observation is assigned a separate random observation ID that cannot be linked back to a user account or any other identifier in VitalMetrics’ personal systems.

The observation database does not contain personal data used to identify individual persons nor information enabling VitalMetrics to recreate the link between an observation and a specific user account.

The anonymized observation database is used exclusively for statistics, quality assurance, research as well as development and improvement of VitalMetrics analyses, algorithms and AI-based functions.

No individual observation is used to draw conclusions about a specific user. The purpose of the observation database is to identify patterns and correlations at the group level to develop and improve VitalMetrics services.

5.6 AI and health data

VitalMetrics uses both proprietary analyses and external AI services to help the user understand their health data.

AI is used as support to analyze and present information already available in the service.

AI is used, for example, to:

• summarize health data,
• identify patterns and trends,
• explain biomarker results,
• analyze diet, training and lifestyle information,
• generate personal summaries based on the user's registered data.

AI functions as a decision support and does not replace medical assessment, diagnosis or treatment.

When external AI providers are used, personal data are processed only to the extent necessary to perform the current function and according to the protective measures applicable to each processing.

5.7 Our fundamental principle

VitalMetrics is built on the principle that the user shall have control over their personal data.

Personal data linked to your account are used to provide the personal service and are processed in accordance with this privacy policy.

When personal data are no longer needed or when an account is terminated, they are processed according to VitalMetrics routines for deletion and purging.

Anonymized observation data, which can no longer be linked to an identified or identifiable person, may however be retained and used for statistics, research, quality assurance, product development as well as further development of VitalMetrics analyses, algorithms and AI-based functions.

6.1 External providers and services

To provide our services, VitalMetrics uses external providers within a number of different service areas.

Depending on which functions you use, personal data may be processed by providers in, for example:

• cloud infrastructure,
• database services,
• operations and hosting,
• AI-based functions,
• identification and authentication,
• payment services,
• communication and customer support,
• logistics and delivery,
• laboratory analysis,
• security and monitoring services,
• other technical services required to provide VitalMetrics.

When external providers process personal data on behalf of VitalMetrics, this occurs only to the extent necessary to provide the respective service and with appropriate contractual, technical, and organizational safeguards.

6.2 Laboratories and medical referrals

To be able to carry out biomarker tests, personal data may need to be shared with laboratories and the medical referrer or healthcare organization responsible for medical referral management.

More information about each actor's role is provided as needed in connection with the respective service or processing.

Such sharing occurs only to the extent necessary to:

• administer the testing process,
• issue and manage referrals when required,
• conduct the laboratory analysis,
• report laboratory results,
• provide the service you have ordered.

The different actors may have different roles and responsibilities for their processing of personal data depending on the respective processing and applicable legislation.

6.3 Payment providers

When you make a purchase, necessary payment details are processed by our payment providers.

VitalMetrics does not store complete payment card information.

Payment providers process personal data to the extent necessary to execute payments, fulfill legal obligations, prevent fraud, and ensure secure transactions.

6.4 Delivery, logistics, and distribution partners

To be able to administer, pack, and deliver test kits and other products, VitalMetrics may share personal data with delivery, logistics, and distribution partners.

Depending on the specific service and distribution process, this might include for example:

• name,
• personal identity number or other identifier when required to link the correct test kit to the correct referral or order,
• email address,
• phone number,
• delivery address,
• delivery references,
• details about the order, referral, or test necessary to administer, execute, and follow up on the distribution and delivery.

VitalMetrics only shares the personal data relevant to the respective distribution and delivery process and related administration, for example to ensure correct handling, enable tracking and notification of shipments, and provide the service you have ordered.

6.5 External integrations

If you choose to connect external services or health platforms, for example Apple Health or Google Health Connect, only the data you choose to share through the respective integration is processed.

VitalMetrics does not share personal data with such services beyond what is necessary to provide the integration you have chosen to activate.

6.6 Authorities and legal obligations

VitalMetrics may disclose personal data to authorities or other authorized recipients when required by law, court order, or administrative decision.

In such cases, only the personal data necessary to fulfill the respective legal obligation is disclosed.

6.7 Corporate transfer

If all or parts of VitalMetrics' business are sold, reorganized, merged, or otherwise transferred, personal data may be transferred to the new operator.

Such a transfer only occurs to the extent permitted under applicable law and provided that the personal data continues to be subject to appropriate protection.

6.8 What we never share

VitalMetrics never sells your personal data.

We do not disclose or sell personal data to advertisers, ambassadors, partners, or other third parties for their own marketing or commercial purposes.

We also do not share personal data beyond what is necessary to:

• provide our services,
• fulfill legal obligations,
• protect VitalMetrics or our users, or
• when you have explicitly requested or consented to a specific processing or sharing.

8.1 Security principles

VitalMetrics works based on the following security principles, among others:

• only authorized persons shall have access to personal data,
• access to personal data is limited based on duties and needs,
• personal data is processed according to the principle of least privilege (need-to-know principle),
• personal data is protected during transfer and storage through appropriate security measures,
• systems and suppliers are continuously evaluated from a security and privacy perspective,
• backup and recovery routines are used to protect information against accidental loss,
• security-related incidents are monitored and handled according to internal routines.

8.2 Access control

VitalMetrics limits access to personal data to persons who need the data to perform their work duties or to provide the respective service.

All persons granted access to personal data are subject to confidentiality or equivalent confidentiality commitments.

8.3 Ongoing security work

Information security is a continuous process.

VitalMetrics therefore continuously works to:

• develop and improve security measures,
• identify and manage security risks,
• review suppliers and technical solutions,
• evaluate and improve our internal routines for data protection and information security,
• follow developments in information security and data protection.

8.4 Personal data incidents

If VitalMetrics discovers or becomes aware of a personal data incident, it is handled according to our internal incident management routines and applicable data protection legislation.

VitalMetrics also works to identify, limit, and prevent similar incidents in the future.

When required by law, affected authorities and affected users will be informed within the time frames and manner prescribed by applicable law.

9.1 Account Data

Personal data linked to your user account is stored as long as the account is active.

If your subscription ends, the account may be paused. During this time, the personal data necessary for you to access your historical information and to reactivate the service if you choose to subscribe again is retained.

During the period the account is paused, only the personal data necessary to provide access to historical data, manage the account, and comply with legal obligations is processed.

9.2 Health Data

Biomarker results, history, and other health data are stored as long as your account exists, as they form the basis for the service’s functions and enable history, trend analysis, and personal compilations.

If the account is closed, health data is deleted or anonymized according to VitalMetrics’ procedures, unless continued storage is required by law or other legal obligation.

9.3 Orders and Payments

Personal data contained in orders, payments, and accounting documentation is stored as long as required by applicable accounting, tax, and other relevant legislation.

9.4 Support and Communication

Personal data processed within support and communication matters is only retained as long as necessary to handle the matter, ensure quality, follow up previous contacts, fulfill legal obligations, or manage any legal claims.

9.5 Security Logs

Security-related information and logs are retained for the time required to maintain security, detect and investigate incidents, protect VitalMetrics and our users from misuse, as well as to comply with applicable security requirements.

9.6 Backups

Personal data may remain for a limited time in backups used to ensure system and information recovery in the event of operational disruptions or technical errors.

Such backups are not used for day-to-day operations and are subject to special protective measures.

When backups are no longer needed, they are deleted or overwritten according to VitalMetrics’ internal procedures.

9.7 When You Close Your Account

If you choose to close your account, VitalMetrics will delete or anonymize personal data that no longer needs to be processed.

Certain data may need to be retained for a longer period if required by law or to establish, exercise, or defend legal claims. When such obligations cease, the data will be deleted or anonymized according to our procedures.

9.8 Anonymized Observation Data

When a new biomarker result is registered, VitalMetrics may create an anonymized observation used for statistics, quality assurance, development of analyses, algorithms, and AI-based functions.

These observations undergo an anonymization process before being transferred to the observation database and do not contain personal data that can be linked to an identified or identifiable person.

Because the observation database is not linked to individual user accounts, it is unaffected when an account is closed or personal data is deleted.

Anonymized observation data may therefore continue to be preserved and used for statistics, quality assurance, research, development of analyses, algorithms, and AI-based functions even after the user's personal data has been deleted.

10.1 Right to Information

You have the right to receive information about how VitalMetrics processes your personal data.

This privacy policy describes which personal data we process, why we process it, how long it is retained, and what rights you have.

If you have questions, you are always welcome to contact us.

10.2 Right of Access

You have the right to request information about which personal data VitalMetrics processes about you.

You also have the right to receive a copy of the personal data processed, to the extent you are entitled under data protection legislation.

10.3 Right to Rectification

If any personal data is inaccurate or incomplete, you have the right to request that it be corrected or supplemented.

You may also update certain information yourself directly via your account.

10.4 Right to Erasure

You have the right to request that your personal data be deleted when the conditions under data protection legislation are met.

If you choose to close your account, VitalMetrics will delete or anonymize personal data that no longer needs to be processed, unless continued storage is required by law or to establish, exercise, or defend legal claims.

Anonymized observation data that can no longer be linked to an identified or identifiable person is not subject to the right to erasure, since it no longer constitutes personal data under applicable data protection legislation.

10.5 Right to Restriction of Processing

Under certain conditions, you have the right to request that the processing of your personal data be restricted.

During the time such a request is processed, some functions in VitalMetrics may be limited.

We will inform you if such a restriction affects access to any of the service's functions.

10.6 Right to Object

You have the right to object to processing of personal data based on VitalMetrics’ legitimate interests if there are reasons related to your particular situation.

You always have the right to object to processing of personal data for direct marketing.

10.7 Right to Data Portability

When processing is based on a contract or consent and is automated, you have the right to receive the personal data you have provided to VitalMetrics in a structured, commonly used, and machine-readable format, to the extent provided by data protection legislation.

Where technically feasible, you may also request that the data be transferred directly to another data controller, if the conditions under data protection legislation are met.

10.8 Right to Withdraw Consent

If the processing of personal data is based on consent, you have the right to withdraw that consent at any time.

A withdrawal does not affect the lawfulness of processing carried out before the consent was withdrawn.

If a withdrawn consent means that VitalMetrics can no longer provide certain functions, those functions may become partially or completely unavailable. This will be stated in connection with the relevant service or function.

10.9 How to Exercise Your Rights

If you wish to exercise any of your rights or have questions about how VitalMetrics processes your personal data, you are welcome to contact us.

To protect your personal data, we may need to verify your identity before processing your request. This is done to ensure that personal data is not disclosed to unauthorized persons.

We process your request without undue delay and in accordance with the deadlines applicable under data protection legislation.

10.10 Complaints

If you believe that VitalMetrics processes your personal data in violation of applicable data protection legislation, you have the right to file a complaint with the Swedish Authority for Privacy Protection (IMY) or the data protection authority competent in the country where you reside, work, or where the alleged violation has taken place.