Consumer Health Data Privacy Policy

This policy explains how The Vitality Project, LLC collects, uses, shares, and protects consumer health data. It is written to meet the Washington My Health My Data Act and Nevada Senate Bill 370, and it applies to everyone who uses our services, wherever you live. If you live in Connecticut, Nevada, or Washington, this policy is the notice those laws require.

This policy sits alongside our Privacy Policy. Where the two describe the same thing, this one governs consumer health data.

1. Who we are

The Vitality Project, LLC is a Utah limited liability company. We run a workplace wellness program for beauty and wellness professionals, the salons and spas they work in, and the schools that train them. The program includes education, coaching, community, wellbeing check ins and surveys, journaling, on demand practices, and AI features.

Contact us about health data:

• Email: support@jointhevitalityproject.com
• Request page: https://jointhevitalityproject.com/privacy-choices
• Mail: The Vitality Project, LLC, 525 E Amiata Way, Washington, Utah 84780

2. What we mean by consumer health data

Consumer health data means information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. Under the Washington and Nevada laws that definition is broad. It covers not only clinical information but also information about bodily functions, mental health, stress, and the products or services you seek out to support your health.

We are not a doctor, a therapist, a clinic, a health plan, or any other health care provider. We are not a HIPAA covered entity or a business associate, and nothing you give us is protected health information under HIPAA. That is exactly why this policy exists. State consumer health data law, and the commitments below, are what protect what you tell us.

3. The consumer health data we collect

We collect the categories below. Not every category applies to every member. What we hold about you depends on which features you use.

3.1 Wellbeing check in and survey answers

Your answers to our wellness instruments. Depending on the instrument, these answers describe:

• Stress and how often you feel it.
• Burnout, exhaustion, and depletion.
• Mood and emotional state.
• Energy levels.
• Sleep quality and sleep habits.
• Movement, physical activity, and rest.
• Mental and emotional wellbeing, including how supported and how overwhelmed you feel.
• Physical wellbeing, including pain, tension, and how your body feels at work.
• Social connection, isolation, and belonging.
• Spiritual and purpose related wellbeing, where an instrument asks.
• Occupational wellbeing, including workload, boundaries, and how work affects your health.
• What you need in order to feel well, and what gets in the way.

The instruments that collect this are the monthly Vital Check, Your Blueprint, Make Your Wellness Plan and Make Your Wellness Plan Solo, the Attitudes and Perceptions surveys for owners, team members, and solo professionals, the Deep Vital Check, the Year End Reflection, the Feedback Survey, and optional reflections offered inside Challenges.

3.2 Journal entries and written reflections

Anything you write in a journaling prompt, a ritual entry, a reflection exercise, a personal board, or a letter to your future self. These are free text. You decide what goes in them, and what goes in them is often about your health.

3.3 AI conversations that reveal health information

What you write to Victor, our AI wellness coach, and to our AI help desk assistant, together with the replies. People bring their health to a wellness coach, so we treat these conversations as health data whether or not any single message is clinical.

3.4 Inferred wellness scores and readings

Scores, bands, levels, dimension readings, movement indicators, and suggested focus areas that we calculate from your answers. These are inferences about your health, so we treat them as health data too.

3.5 Practice and activity information

Which on demand practices you use, such as breathwork and meditation, which wellness challenges you join, your self care streaks, and your completion of wellness activities. What a person seeks out to support their health is health data under these laws.

3.6 Information you volunteer elsewhere

Health related things you choose to put in your profile, in a community post, in a team chat, in a direct message, in a support ticket, or in a success story submission. We do not go looking for health information in these places, and we treat it as health data once it is there.

3.7 Identifiers attached to the above

The account identifier, device identifier, and approximate location that let us connect the information above to you.

3.8 What we do not collect

1. We do not collect precise device location, and we do not use location to infer that you visited a health care facility.
2. We do not collect information about reproductive or sexual health, gender affirming care, or any specific diagnosis, unless you volunteer it in free text.
3. We do not collect biometric identifiers.
4. We do not connect to wearables or health apps. Where our Settings page lists wellness integrations such as Apple Health or Oura, those are requests to be told when a setup exists, not live connections. If we ever switch one on, we will update this policy and ask for your consent before any data moves.
5. We do not buy health data about you from anyone.

4. Where the health data comes from

1. From you directly. Everything in Section 3 is something you typed, selected, recorded, or chose to do inside our service. This is the source of almost all health data we hold.
2. From our own systems. Scores and inferences that we calculate from your answers.
3. From your device. Identifiers and approximate location associated with your session.

We do not receive consumer health data about you from your employer, your school, your salon owner, a data broker, an advertising network, or any other outside source.

5. Why we collect it, and how we use it

We collect consumer health data for the purposes below and for nothing else.

1. To give you your own results. So you can see your own wellbeing over time, on your dashboard, your Vitality Wheel, and your progress views.
2. To build and update your wellness plan. Your answers shape the plan, the practices we suggest, and the next steps we show you.
3. To provide coaching. So Victor can respond to what you actually said.
4. To run the program. So the ninety day program, the challenges, the meetings, and the on demand library present the right content at the right time.
5. To produce anonymized group results for your organization. Strictly within the limits in Section 7.
6. To answer your support questions when you ask us about something in your own data.
7. To keep the service safe and working, including fixing errors and preventing abuse.
8. To comply with law and to establish or defend legal claims.
9. To improve the service and its AI features, and to produce statistics and insights we may publish. We use consumer health data this way only after it has been de-identified and aggregated, and never in a form that identifies you. Section 5.1 sets out exactly what that means, and it is one of the purposes the health data consent in Section 9 covers.

We do not use consumer health data to advertise to you, to build an advertising profile, to price your membership, to make employment decisions, or to make decisions about your standing in a school. Our AI providers process the messages you send to our AI features under agreements that do not permit the use of your conversations to train their models.

5.1 De-identified and aggregated use, including statistics we publish

De-identified means we remove names, contact details, and other identifiers, and we do not attempt to re-identify anyone. Aggregated means combined across many members so that no individual can be identified. Consumer health data is only ever used in the two ways below after both of those steps, and this is one of the disclosed purposes your consent under Section 9 covers.

1. Improving the service and the AI features. We use de-identified and aggregated information about how members use the service, including AI coach conversations, surveys, and check-ins, to make the service and its AI features better.
2. Statistics and insights we may publish. We turn survey and Vital Check responses, usage, wellbeing trends, and facts such as role and generation into statistics, for example the share of members in a generation who report a given experience. We may use them inside our business, share them with partners, publish them to support the beauty industry in research, white papers, and press, and use them in our own marketing. We do not publish a statistic for a group small enough that a person could be recognized: the same minimum group size we apply to organization dashboards in Section 7.2 applies to anything we publish.

Training an AI model is different, and needs your separate consent. We do not use identifiable journal entries, identifiable survey or Vital Check answers, or identifiable AI conversations to train or fine-tune any AI model unless you give us separate, specific opt-in consent for that, which is never bundled with the consent in Section 9 and which you can withdraw at any time in Settings. Nothing from a school-program account belonging to someone under 18 is used to improve or train any AI model, with or without consent.

No trackers where health data lives. No advertising pixel, no marketing tag, and no third-party analytics tool runs on any page that collects or displays health data, anywhere in the member app, at checkout, or on the AI coach and AI help desk. Advertising and analytics tools run on our marketing website only, and they are listed in Section 4 of our Cookie Policy. Health data is never shared with an advertising platform, never used to build an audience, and never used for advertising or marketing measurement. There is no consent path that turns that on.

6. Who we share it with, and why

We share consumer health data only with the categories of recipients below, only for the reasons stated, and only under a written contract that limits what they may do with it.

Affiliates of our company. The Vitality Project, LLC has no parent, subsidiary, or commonly controlled company today. If that changes, we will name the affiliated entity here before sharing any consumer health data with it.

Ask us at support@jointhevitalityproject.com and we will send you the current list of the companies we use.

We do not share consumer health data with advertising networks, data brokers, analytics companies for their own purposes, marketing platforms, or any other business for that business's own use.

7. What your employer, salon owner, or school can see

This is the section most people want. It is short on purpose.

Individual survey answers, journal entries, Vital Check responses and AI conversations are never shown to a salon owner, champion, school or franchise administrator. An organization sees aggregated results only, and only where at least three people answered.

7.1 Never shared with your organization

1. Your individual answers to any wellbeing check in or survey.
2. Your individual wellness scores, bands, levels, or dimension readings.
3. Your journal entries, reflections, personal board notes, and letters to your future self.
4. Your conversations with Victor or with the AI help desk.
5. Your direct messages.
6. Your private notes inside a challenge or tracker.

No role has a way to see these. Not an owner, not a champion, not a school administrator, not a teacher, not a franchise or enterprise administrator.

7.2 Shared with your organization, in aggregate only

1. Group level patterns and levels for the organization, never an individual's answer.
2. Released only when at least three people in that organization answered that question in that measurement wave. Below three, the organization sees "waiting for a few more voices" and receives no numbers at all, including no count of how many people responded.
3. Reported so that a leader cannot work backwards to identify who answered.
4. Instruments and challenges designated as health sensitive are excluded from every aggregate.
5. No one at your organization can reach your individual answers. Not anywhere, not in any form.

7.3 Shared with your organization about you individually

1. Whether you completed a check in, and when. That is participation, not content.
2. Whether you joined a challenge or attended a session.
3. What you chose to publish on your member profile.
4. Answers you gave in Your Blueprint that are labeled inside the survey as shared with your leadership. Those labels appear on the question before you answer it, so you always know which answers your owner or champion will read.

7.4 If you are a solo professional

You are the only respondent to your own check ins, so you see your own results in full. The three respondent threshold exists to protect team members from being identified. It does not stop you seeing your own answers.

8. We do not sell consumer health data

We do not sell consumer health data, and we never have. Under the Washington My Health My Data Act, a sale means exchanging health data for money or other valuable consideration. We do not do that.

Washington law allows a sale only with a signed, specific written authorization from you that is separate from any other document. We do not ask for that authorization, because we have no intention of selling health data. If that ever changes, we will present the separate authorization form the law requires, we will not bundle it with anything else, and using our service will never be conditioned on signing it.

Nevada law prohibits us from selling or sharing your health data without your separate authorization, and Connecticut law requires your consent before we sell health data. Our answer under all three laws is the same. We do not sell it, and we do not share it for anyone else's purposes. We also never share it with an advertising platform, and no advertising or analytics tracker runs anywhere health data is collected or displayed.

9. Your consent

9.1 We ask before we collect

We ask for your consent before we collect consumer health data, separately from anything else you agree to. The consent is specific, it is not bundled with our Terms of Service or Privacy Policy, and it requires an affirmative action from you. Silence, a pre ticked box, or continuing to browse is not consent.

9.2 The consent notice we show

The following text appears before the first screen of any wellbeing check in, survey, journaling prompt, or AI coach conversation, with a clear accept control and a clear decline control.

Before you start: your wellbeing answers

What you are about to share is health information. We use it to show you your own results, to build your wellness plan, and to personalize what the program offers you.

Your individual answers are never shown to your owner, your champion, your school, or your employer. They see group patterns only, and only once at least three people have answered.

We also combine answers across many members into statistics we may publish or use in marketing. Those statistics never identify you.

We never sell health information and we never share it for advertising.

You can withdraw this consent at any time in Settings, and you can ask us to delete what you have shared.

Read the Consumer Health Data Privacy Policy.

I agree to The Vitality Project collecting and using my health information for the purposes described above.

The two controls read I agree and Not right now.

Choosing "Not right now" does not close your account or cut off the rest of the membership. It means the wellbeing instruments and journaling stay closed until you change your mind.

9.3 The separate sharing authorization

We do not need this today, because we do not sell or disclose health data for anyone else's purposes. If that ever changes, the following separate authorization will be presented on its own, never combined with any other agreement, and never as a condition of using the service.

Authorization to share your health information

This is a separate request. You do not have to agree, and your membership does not change if you say no.

We are asking your permission to disclose the following health information: the specific categories.

To: the specific named recipient or recipients.

For this purpose: the specific purpose.

This authorization lasts until a stated date, and you can revoke it at any time by writing to support@jointhevitalityproject.com or using the request page. Revoking it stops future sharing. It cannot undo a disclosure already made.

Signed, with a printed name and the date.

9.4 Withdrawing consent

You may withdraw your consent at any time. To do it:

1. Open Settings in the app and turn off health data collection.
2. Or email support@jointhevitalityproject.com and say you are withdrawing your health data consent.
3. Or use the request page at https://jointhevitalityproject.com/privacy-choices.

What happens when you withdraw. We stop collecting new health data from you and we stop processing what we hold for the purposes that relied on your consent, within 15 days of your request. Wellbeing check ins, surveys, journaling, and the AI coach stop being available to you, because there is no way to run them without the data. Your wellness plan and progress views stop updating. Withdrawing consent does not by itself delete what we already hold. If you want it deleted, ask, as described in Section 10. Withdrawing consent does not undo processing that was lawful before you withdrew.

10. Deleting your health data

You have the right to have your consumer health data deleted, including data we shared with a service provider.

How to ask. Email support@jointhevitalityproject.com, use the request page at https://jointhevitalityproject.com/privacy-choices, or use the delete control in Settings.

What we do. We will confirm your identity, then delete the health data we hold about you from our active systems and from our backup systems. We will tell every service provider and contractor that received it to delete it too, and we will notify you when it is done. We will complete deletion within 30 days of receiving your request, faster than our other requests in Section 11, because the law asks us to, and we will tell you if we need the one time extension of 30 additional days the law allows.

What deletion means in practice.

1. Your survey and check in answers are erased, so your history, your scores, your Vitality Wheel, and your progress views are gone and cannot be recovered.
2. Your journal entries, reflections, and letters are erased.
3. Your AI coach and help desk conversations are erased.
4. Your wellness plan and its inferences are erased.
5. Aggregated results that were already released to your organization stay released. Once results have been rolled up across at least three people and stripped of identifiers, they are no longer linked to you and we cannot pull your contribution back out. Your answers will not be included in any aggregate calculated after your deletion.
6. Content you posted in a shared space, such as a community post, may remain visible to that space. Ask us and we will remove specific posts.
7. Deletion of health data does not close your account. Say so if you also want your account closed.
8. We may retain a minimal record that a deletion request was made and honored, because the law requires us to be able to show that we complied.
9. Anything left in a backup is out of use and gone within 90 days.

No penalty. We will not deny you service, charge you a different price, or give you a lower quality of service because you asked us to delete your health data or withdrew your consent.

11. Your other rights

In addition to withdrawing consent and asking for deletion, you may:

1. Confirm whether we are collecting, sharing, or selling your consumer health data.
2. Access the health data we hold about you, including a list of every third party and affiliate with which we have shared it, with contact details for each one.
3. Correct health data that is wrong.
4. Obtain a copy of your health data in a portable format.

How to use them. Email support@jointhevitalityproject.com, or use https://jointhevitalityproject.com/privacy-choices, or the controls in Settings.

Our response time. We acknowledge your request within 10 business days and complete it within 45 days. If we need more time we will tell you within that 45 days and take one extension of up to 45 additional days, where the law allows it. We tell you if we extend. There is no charge for a reasonable request.

Verifying you. We will verify your identity before acting, usually through the email address on your account or by asking you to make the request while signed in. We will not use what you give us for verification for anything else.

Authorized agents. You may use an authorized agent. We will ask for written permission signed by you and may ask you to confirm it directly.

If we say no, you can appeal. Reply to our decision, or write to support@jointhevitalityproject.com with "Appeal" in the subject line. We will respond in writing within 45 days with our reasoning. If we still deny your request we will give you a way to complain to your state attorney general.

• Washington residents: the My Health My Data Act includes a private right of action under the state Consumer Protection Act. You may also contact the Washington State Attorney General.
• Nevada residents: you may contact the Nevada Attorney General.
• Connecticut residents: you may contact the Connecticut Attorney General.

12. How we protect health data

We encrypt your health data in transit and at rest. It never goes into our logs or error reports. Only the few people who need it can reach it. Every provider that touches it is under written contract to delete it when we say. If a breach affects you, we tell you.

13. Employees, contractors, and our own people

Everyone here who could reach your health data is under a written confidentiality obligation. Our coaches and educators do not read members' individual survey answers, journals, or AI conversations.

14. Children and students

Some members are students at partner beauty schools, and some of those students may be minors.

1. A teacher or school administrator sees exactly what Section 7 describes. A student's individual answers, journals, and AI conversations are never shown to a teacher or to a school.
2. You must be at least 18 to create an account or purchase a membership. Students under 18 may use The Vitality Project only through a school program under a signed agreement between the school and The Vitality Project, LLC, and that agreement governs their participation, the consent obtained for them, and what the school can see. No one under 13 may use the services.
3. We do not sell or share the health data of anyone under 18, and we do not sell or share anyone's health data at all.
4. Nothing from a school-program account belonging to someone under 18 is used to improve or train any AI model, with or without consent.

15. Changes to this policy

We may update this policy. When we do we will change the updated date at the top and publish the new version at the canonical URL. If a change would use your health data in a materially different way than we described when you gave consent, we will ask for your consent again before making that change. We will not apply a new use to health data you already gave us without asking.

16. Contact

• Health data questions and requests: support@jointhevitalityproject.com
• Request page: https://jointhevitalityproject.com/privacy-choices
• Support: support@jointhevitalityproject.com
• Mail: The Vitality Project, LLC, 525 E Amiata Way, Washington, Utah 84780