This Privacy Policy explains what personal information we collect, why we collect it, who we share it with, how long we keep it, and the choices and rights you have. It is a notice about our practices. It is not a contract, and it does not change the Terms of Service.
1. Who we are
The Vitality Project, LLC is a Utah limited liability company doing business as The Vitality Project. We provide workplace wellness education, coaching, community, and measurement tools for beauty and wellness professionals, the salons and spas they work in, and the schools that train them.
We are the business responsible for the personal information described in this policy. In privacy laws that use the term, we are the controller of that information.
How to reach us about privacy
- Email: support@jointhevitalityproject.com
- General support: support@jointhevitalityproject.com
- Online request form: https://jointhevitalityproject.com/privacy-choices
- Mail: 525 E Amiata Way, Washington, Utah 84780
2. What this policy covers
This policy applies to:
- Our public marketing website at https://jointhevitalityproject.com.
- Our member web application, where you sign in to use the program, community, surveys, journaling, on demand practices, and AI features.
- Email, text messages, in-app notifications, forms, events, and other interactions that link to this policy.
This policy does not cover websites, apps, or services run by other companies, even when we link to them. Their own privacy policies apply to what they collect.
If you use The Vitality Project because your employer, salon, spa, school, or franchise bought a membership, please also read Section 8. It explains exactly what your organization can and cannot see.
3. Information we collect
The short version first. The table below is a summary of what we hold, where it comes from, why we have it, who sees it, and how long it stays. The sections that follow it, and Sections 5, 7 and 13, are the full description and they govern.
| Category | Where it comes from | Why we use it | Who we share it with | How long we keep it |
|---|---|---|---|---|
| Identity and contact information | You, when you register or edit your profile | To create and run your account, sign you in, and reach you about your membership | Our hosting, email, and support providers | While your account is active, then deleted within 30 days of closure |
| Account and role information | You, and the organization that enrolled you | To give you the right access and the right view of the program | Your organization, limited to what Section 8 allows | While your account is active, then deleted within 30 days of closure |
| Organization and employer affiliation | Your salon, spa, school, or franchise, and you | To place you on the right roster and bill the right account | Your organization, limited to what Section 8 allows | While the organization's membership is active, then deleted within 90 days |
| Payment and billing information | You, and our payment processor | To take payment, send receipts, and meet tax and accounting law | Our payment processor and our accountants. We do not store full card numbers | As tax and accounting law requires, generally seven years |
| Wellness and survey responses | You, when you answer them | To show you your own results, build your plan, and personalize the program | Nobody sees your individual answers. Your organization sees group patterns only, and only once at least three people have answered | While your account is active, then deleted or de-identified within 30 days of closure |
| Journal entries and private reflections | You | So that you can keep and reread your own reflections | Nobody | While your account is active, and deleted when you delete them or close your account |
| AI conversation content | You, when you use an AI feature | To answer you, and to route a safety topic to a person | Our AI provider, under a contract that forbids training on it | 12 months rolling, and sooner if you delete a conversation |
| Community posts, chats, and messages | You, when you post or send them | To run the community spaces | Other members, according to the audience you chose | While your account is active, subject to the shared content note in Section 12 |
| Usage, device, and log information | Your browser or device, automatically | To keep the service working and secure, and to improve it | Our hosting, analytics, and error monitoring providers | 13 months, then aggregated or deleted |
| Approximate location for the member map | You, when you add yourself to the map | To show you members near you | Other members, as a pin on the map | Until you remove yourself from the map or close your account |
| Affiliate, referral, and tax information | You, when you join the affiliate program | To credit referrals, pay commission, and file the tax forms we must file | Our payment and tax providers, and the tax authorities | As tax law requires, generally seven years from the tax year concerned |
| Support messages and correspondence | You, when you contact us | To answer you, and to fix what made you write | Our support and email providers | 24 months |
We collect the categories below. Not every category applies to every person. What we actually hold about you depends on your role and on which features you use.
3.1 Identity information
Your first and last name, display name, pronouns if you choose to give them, date of birth or age confirmation where we need it, and your profile photo if you upload one.
3.2 Contact information
Your email address, phone number if you provide one, mailing address where we need it for shipping or tax purposes, and your social media handles if you add them to your profile.
3.3 Account information
Your username or login email, your sign-in details, stored so nobody here can read your password, your role in the platform (for example owner, champion, team member, solo pro, teacher, student, affiliate, partner, or retreat guest), your membership tier and status, your language and time zone, your notification preferences, and your privacy settings.
3.4 Organization and employer affiliation
The salon, spa, school, franchise, or other organization you belong to, your seat or title inside it, your team or cohort assignment, who invited you, and your start and end dates on that organization's membership.
3.5 Payment and billing information
Plan, term, renewal dates, invoices, receipts, payment status, and billing contact. Card numbers and bank details are collected and stored by our payment processor, not by us. We hold a token or reference plus the last four digits and card brand so you can recognize your own payment method.
Our payment processor is Stripe, Inc. Stripe collects and stores your card and bank details under its own security program. We never receive or store your full card number.
Memberships are purchased only on our website, through Stripe. Nothing is sold inside our app, we do not use Apple billing or Google billing, and no app store ever collects a payment from you on our behalf or sends us your payment details.
3.6 Profile and community content
Your bio, specialties, languages, interests, connection tags, what you are looking for, links you add, and anything else you choose to put on your member profile. It also includes what you post in the community feed, in team chats and group spaces, in comments and reactions, in direct messages to other members, and in shared meeting notes.
3.7 Wellness and survey responses
Your answers to our wellness instruments, which include:
- The monthly Vital Check.
- Your Blueprint, the getting to know you survey.
- Make Your Wellness Plan, for owners, and Make Your Wellness Plan Solo, for solo professionals.
- The Attitudes and Perceptions surveys for owners, team members, and solo professionals.
- The Deep Vital Check.
- The Year End Reflection.
- The Feedback Survey.
- Optional reflection exercises offered inside Challenges.
These answers cover stress, burnout, energy, mood, sleep, movement, work life balance, mental and emotional wellbeing, sense of belonging, and how you feel about your workplace culture and leadership. We also derive scores, bands, and wellness dimension readings from those answers.
Because these answers describe your physical and mental health, we treat them as sensitive personal information. Our separate Consumer Health Data Privacy Policy describes them in more detail and gives you additional rights.
3.8 Journal entries and private reflections
What you write in journaling prompts, ritual entries, reflection exercises, personal boards, and letters to your future self. This is private member authored content. Section 8 explains who can and cannot see it.
3.9 AI conversation content
The messages you send to Victor, our AI wellness coach, and to our AI help desk assistant, together with the replies you receive and the context we attach to your request. Section 6 explains how this processing works.
3.10 Usage and device information
Pages and screens you open, features you use, buttons you press, content you play or complete, challenge and streak activity, points and badge activity, dates and times of those actions, your IP address, browser type and version, operating system, device type, screen size, language settings, and referring page. We collect some of this through cookies and similar technologies, which our Cookie Policy describes.
Four of these sit closest to your own device, so here they are in plain words.
- Device permissions. Our app may ask your device for permission to use the camera, the microphone, your photo library, notifications, or another device feature. Each one is optional, we ask only when a feature needs it, and we use it only for that feature: the camera and microphone to record or upload a story or a video, the photo library to choose a photo you want to add, notifications to send the reminders you turned on. Saying no leaves the rest of the app working, and you can change or withdraw any permission at any time in your device settings.
- Device and installation identifiers. An identifier for your browser, or for your installation of our app, and the mobile network your device tells us it is using. We collect these to run the app: to keep you signed in on the devices you actually use, to tell one of your devices from another, and to keep your account secure.
- Notification tokens. If you turn notifications on, we store a notification token for that browser or device so we can deliver the notifications you asked for. We collect it for that reason only. You can revoke it at any time in your browser or device settings, and we delete it when you turn notifications off.
- Crash and error reports. When something breaks we receive an error report, sometimes called a crash report. It records what the software was doing at that moment and may include your account identifier. We use it to fix the problem, and for nothing else.
We keep each of these only as long as we need it for the purpose described here. Section 13 sets the period for usage, device, and log information.
3.11 Approximate location
We collect approximate location, meaning city, state or region, and country, for two purposes only:
- To place a pin on the member map when you choose to appear there.
- To show you meetups, events, and members near you when you ask us to.
Appearing on the member map is optional. You choose whether to appear and at what level of detail. We do not request precise device location, and we do not track your movements. Your IP address may indicate an approximate region as a technical side effect of connecting to any website.
3.12 Affiliate, referral, and tax information
If you join our affiliate or referral program we collect your referral code, the clicks and sign ups attributed to it, the sales credited to you, your commission ledger, your payout method and payout history, and the tax information the law requires before we can pay you.
United States affiliates complete a Form W-9. Affiliates outside the United States complete the applicable Form W-8. That form includes your legal name, business name if any, mailing address, taxpayer identification number, and signature. Your taxpayer identification number and your signature are collected by our payments and tax provider, not stored in our own database. We retain a provider reference, your tax form status, and the payment totals we must report. We report payments as the law requires: if you are a United States person and we pay you $600 or more in a calendar year, we issue you an IRS Form 1099-NEC. If you are not a United States person you complete the applicable Form W-8, you are paid in United States dollars, and you are responsible for your own taxes.
Our payments and tax provider is Stripe, Inc., which collects tax forms, verifies taxpayer identity, sends payouts, and files the information returns the law requires.
3.13 Success story submissions
If you submit a success story we collect your story text, any video, audio, or photo you upload, your name and role as you want them to appear, your Instagram handle if you give it, your email address, and your acknowledgement of the Permission and Release that appears on the submission form. That release explains how your story can be used.
3.14 Support and correspondence
Support tickets, help desk chats, emails to us, survey feedback about our own service, and notes our team makes when resolving your issue.
3.15 Information about other people
If you invite a teammate, name a champion, add a team member, or refer a friend, we collect the name and contact details you give us for that person so we can send the invitation. Please only share someone else's contact details when you have a good reason to believe they will welcome the message.
4. Where the information comes from
- Directly from you, when you fill in a form, create an account, answer a survey, write a journal entry, post in the community, chat with our AI features, or contact support.
- From your device, automatically, through cookies, browser storage, and server logs.
- From your organization, when a salon owner, school, franchise, or enterprise buys a membership and provides a roster, invites seats, or assigns roles.
- From another member, when they invite you, refer you, or name you in a team structure.
- From our service providers, for example payment status from our payment processor, delivery status from our email provider, or payout status from our payments and tax provider.
- From public or third party sources, in limited cases, for example a business address you have published or an event registration list you completed.
5. Why we use your information, and our legal bases
The table below lists each purpose, the main categories of information it uses, and the legal basis we rely on. Where we rely on consent you may withdraw it at any time, as described in Section 12.
| Purpose | Information used | Legal basis |
|---|---|---|
| Create and run your account, authenticate you, and keep you signed in | Identity, contact, account | Performance of our contract with you |
| Deliver the membership you or your organization paid for, including the program, calendar, on demand content, challenges, and community | Account, organization, usage | Performance of our contract |
| Take payment, issue invoices and receipts, manage renewals, and handle failed payments | Payment and billing, contact | Performance of our contract, legal obligation for tax records |
| Provide surveys and Vital Checks, show you your own results over time, and build your wellness plan | Wellness and survey responses | Consent for the sensitive elements, plus performance of our contract for the feature itself |
| Provide journaling, reflections, and personal boards | Journal entries | Consent for the sensitive elements, plus performance of our contract |
| Provide community, team chats, direct messages, the member map, and meetups | Profile and community content, approximate location | Performance of our contract, consent for map placement |
| Provide AI coaching and AI help desk answers | AI conversation content, account, and the context you supply | Consent for the sensitive elements, plus performance of our contract |
| Produce aggregated and de-identified culture and wellbeing results for an organization | Wellness and survey responses, in aggregate only | Our legitimate interest in delivering the organization's program, with the member protections in Section 8 |
| Send service messages, reminders, and account notices | Contact, account, usage | Performance of our contract, and our legitimate interest in keeping you informed |
| Send marketing emails about our own products and events | Contact, usage | Consent where required, otherwise our legitimate interest, with an unsubscribe link in every message |
| Run the affiliate and referral program, calculate commissions, and pay them | Affiliate and referral, payment, tax | Performance of our contract, legal obligation for tax reporting |
| Publish success stories you submitted and released to us | Success story submissions | Consent, given through the Permission and Release |
| Keep the service safe, prevent fraud and abuse, and enforce our Terms and Community Guidelines | Account, usage, community content | Our legitimate interest in a safe service, and legal obligation where applicable |
| Improve the service, fix problems, measure performance, and plan new features | Usage, aggregated and de-identified results | Our legitimate interest in improving what we offer |
| Improve the service and its AI features, using de-identified and aggregated information about how members use it, including AI coach conversations, surveys, and check-ins | Usage, wellness and survey responses, AI conversation content, de-identified and aggregated before we use it this way | Our legitimate interest in improving what we offer |
| Train or fine-tune an AI model on identifiable journal entries, identifiable survey or Vital Check answers, or identifiable AI conversations | Journal entries, wellness and survey responses, AI conversation content | Your separate, specific opt-in consent, which you can withdraw in Settings. We do not do this at all without it |
| Produce aggregated and de-identified statistics and insights, which we use inside our business, share with partners, publish to support the beauty industry, and use in our marketing | Wellness and survey responses, usage, role and generation, aggregated and de-identified before we use them this way | Our legitimate interest in research and in supporting our industry |
| Respond to support requests | Support and correspondence | Performance of our contract |
| Comply with law, respond to lawful requests, and establish or defend legal claims | Any category, as needed | Legal obligation, and our legitimate interest in defending claims |
We do not use your information to make decisions about you that produce legal or similarly significant effects without a human being involved.
De-identified and aggregated information
Some of what we do with member information happens only after we have taken your name off it and combined it with everybody else's. This section says plainly what that means and what we do with the result.
De-identified means we remove names, contact details, and other identifiers, and we do not attempt to re-identify anyone. Aggregated means combined across many members so that no individual can be identified.
- Improving the service and the AI features. We use de-identified and aggregated information about how members use the service, including AI coach conversations, surveys, and check-ins, to make the service and its AI features better.
- Statistics and insights we may publish. We turn survey and Vital Check responses, usage, wellbeing trends, and facts such as role and generation into statistics and insights, for example the share of members in a generation who report a given experience. We may use them inside our business, share them with partners, publish them to support the beauty industry in research, white papers, and press, and use them in our own marketing.
- The minimum group size applies to anything we publish. We do not publish a statistic for a group small enough that a person could be recognized. The same minimum group size we apply to organization dashboards in Section 8.2 applies here.
- Training an AI model is different, and needs your separate consent. We do not use identifiable journal entries, identifiable survey or Vital Check answers, or identifiable AI conversations to train or fine-tune any AI model unless you give us separate, specific opt-in consent, which you can withdraw at any time in Settings. Section 6 sets this out in full.
- Nothing from a school-program account belonging to someone under 18 is used to improve or train any AI model, with or without consent.
6. AI features
Two features in the member app use an artificial intelligence provider: Victor, our AI wellness coach, and our AI help desk assistant.
What is sent. When you send a message to Victor or to the help desk, we send your message and the recent conversation. We do not send your survey answers, your Vital Checks, or your journal. Where a feature needs context to be useful, for example your first name or your role, we send only what that feature needs.
Who processes it. Our AI providers, such as Anthropic and OpenAI, through their commercial APIs. They act as our service providers and process the content only to generate a reply for you. Under our agreements with them they do not use your conversations to train their models, and they delete it within 30 days.
Training. Our AI providers do not use your conversations to train their models. They process them through their commercial APIs, under agreements that do not permit it.
We do not use identifiable journal entries, identifiable survey or Vital Check answers, or identifiable AI conversations to train or fine-tune any AI model unless you give us separate, specific opt-in consent. That consent is its own choice, never bundled with anything else, and you can withdraw it at any time in Settings. Withdrawing it stops any future use. Nothing from a school-program account belonging to someone under 18 is used to improve or train any AI model, with or without consent.
Improving the AI features. We use de-identified and aggregated information about how members use the service, including AI coach conversations, surveys, and check-ins, to improve the service and its AI features. De-identified means we remove names, contact details, and other identifiers, and we do not attempt to re-identify anyone.
What Victor is not. Victor is a wellness coach inside a wellness education program. Victor is not a doctor, therapist, counselor, or licensed clinician, does not diagnose or treat any condition, and does not provide medical or mental health care. If you are in crisis, or at risk of harming yourself or someone else, get help now. In the United States, call or text 988 to reach the Suicide and Crisis Lifeline, or call 911 in an emergency. Outside the United States, call your local emergency number. Full safety information is on our Wellness Safety page. Do not rely on Victor for urgent help.
Your control. You do not have to use the AI features. You can delete a single conversation from your chat history at any time, and deleting it removes it from our database rather than hiding it. You can also ask us to delete your whole history as described in Section 12.
Human review. No one routinely reads your AI conversations. A member of our team reads one only for safety, for support you asked for, to investigate a report of abuse or a security incident, or where the law requires it. Separately, we review conversations in aggregate and de identified form, with names, contact details and account identifiers stripped, to improve the program and the AI features.
7. Sharing your information
We share personal information in the situations described below, and nowhere else.
7.1 Service providers and processors
We use other companies to run parts of the service. They may only use the information to do the work we asked for, under a written contract. The categories are:
| Category | What they do |
|---|---|
| Hosting and infrastructure | Run the servers, storage, and databases behind the service |
| Payment processing | Take payments, store card details, issue receipts |
| Payments and tax for affiliates | Collect tax forms, verify taxpayer identity, send payouts, file information returns |
| Email and messaging delivery | Deliver account emails, reminders, and in-app notifications, which run on our own software, and the newsletter, which runs on Substack |
| Artificial intelligence | Generate replies for the AI coach and AI help desk |
| Analytics and product measurement | Tell us how the marketing website and the service are used so we can improve them |
| Advertising and marketing measurement | Measure our advertising and reach people likely to be interested, on our marketing website only |
| Customer support tooling | Manage tickets and conversations |
| Video and media hosting | Deliver on demand practices and recorded sessions |
| Error monitoring and security | Detect crashes, abuse, and security problems |
Ask us at support@jointhevitalityproject.com and we will send you the current list of the companies we use. The main ones are Stripe for payments and affiliate payouts, our United States cloud hosting provider, our AI providers, such as Anthropic and OpenAI, for the AI features, Substack and ManyChat for newsletters and marketing sign ups, YouTube for video, and the advertising and analytics platforms named in Section 10.
7.2 Your organization
If your membership comes through a salon, spa, school, franchise, or enterprise, we share limited information with that organization. Section 8 sets out exactly what is shared and what is never shared.
Data processing addendum. A salon, spa, school, franchise, or enterprise account may ask us for a data processing addendum by emailing support@jointhevitalityproject.com, and we will provide one.
7.3 Other members
What you post in the community feed, in group and team spaces, and on your public profile is visible to other members according to the audience you chose and the privacy settings you set. Direct messages are visible to the people in the conversation. Shared meeting notes are visible to everyone on that meeting by design. Please treat anything you post as something other people will read.
7.4 Affiliates and referral partners
If you sign up through an affiliate or referral code, we tell that affiliate that a sale was credited to their code. The affiliate sees the plan purchased, the date, and the commission owed. The affiliate never sees your survey answers, your journal entries, your Vital Check responses, or your AI conversations.
7.5 Legal and safety
We may disclose information when we reasonably believe it is necessary to comply with a law, regulation, subpoena, court order, or lawful request from a public authority, to enforce our Terms of Service and Community Guidelines, to detect or prevent fraud or abuse, or to protect the rights, property, or safety of any person.
7.6 Business transfers
If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction. We will require the receiving party to honor the commitments in this policy for information transferred, and we will tell you if the practices change materially.
7.7 With your direction
We share information when you ask us to, for example when you publish a success story or connect an outside application to your account.
8. What your organization can and cannot see
Many members use The Vitality Project because their salon, spa, school, or employer bought a membership. That organization pays for the program. It does not get to read your private answers. Individual survey answers, journal entries, Vital Check responses and AI conversations are never shown to a salon owner, champion, school or franchise administrator. An organization sees aggregated results only, and only where at least three people answered.
8.1 Never shown to an owner, champion, school administrator, or any other organization role
- Your individual answers to any wellness survey or Vital Check.
- Your individual wellness scores, bands, or dimension readings.
- Your journal entries, reflections, personal board notes, and letters to your future self.
- Your conversations with Victor or with the AI help desk.
- Your direct messages with other members.
- Your private log notes inside a challenge or tracker.
8.2 Shown to an organization, in aggregate only
Organization leaders see rolled up, anonymized results for their team. Our rules are:
- Results are reported as group patterns and levels, never as an individual's answer.
- A result is released only when at least three people in that organization answered that question in that measurement wave. Below three, the organization sees no numbers at all, not even how many people answered.
- We do not return respondent counts in a form that lets a leader work backwards to who answered.
- Challenges and instruments that we have designated as health sensitive never enter any aggregate at all.
- There is nowhere in the product a leader can reach an individual's answers.
8.3 Shown to an organization about you as an individual
- Whether you completed a survey or check in, and when. Completion is a fact, not content.
- Participation facts such as whether you joined a challenge or attended a session.
- What you chose to publish on your member profile.
- Information you volunteered on your Blueprint and marked as visible to your leadership. Those fields are labeled inside the survey itself, so you can see which answers your owner or champion will read before you answer them.
8.4 A solo professional
If you are a solo professional with no team, you are the only respondent to your own surveys, so you see your own results in full. The three respondent threshold protects team members from being identified. It does not stop you seeing your own answers.
9. AI, automated decisions, and profiling
We use scoring to turn your survey answers into wellness dimension readings, levels, and suggested focus areas. These are informational. They do not by themselves determine your membership, your price, your employment, or your standing in a school. We do not sell scores or profiles, and we do not use them for advertising.
10. Selling, sharing, and advertising
We do not sell your personal information, and we have not sold personal information in the twelve months before the date of this policy.
Targeted advertising and your choices
We advertise our programs, and to measure that advertising we may use services such as Meta, Google, TikTok, and similar providers. None of them is running today. Where one of them is switched on, information about a browser's visit to our marketing website, and in some cases a hashed email address, is shared with the advertising platform so we can measure our advertising and reach people likely to be interested. Under United States state privacy laws that is "sharing" for cross context behavioral advertising and "targeted advertising." We tell you about it plainly here rather than hiding behind the fact that no money changes hands.
Five limits hold at all times:
- Marketing website only. No advertising or marketing tool of any kind runs in the member app, at checkout, or on any wellness, survey, Vital Check, mental health, journaling, or AI page.
- Never health data. Consumer health data is never shared with an advertising platform and never used for advertising, ever, by anyone, under any consent. Our Consumer Health Data Privacy Policy states that commitment in full.
- Never your content. No survey answer, Vital Check response, journal entry, wellness score, AI conversation, community post, or direct message is ever shared with an advertising platform.
- The current list is published. Section 4.4 of our Cookie Policy is the current list of every advertising and analytics tool we may use, with its purpose, its duration, and how to opt out. A tool appears there before it is switched on, and that page says what is running at any given time.
- Consent first. Nothing in the advertising category is running yet, so there is no banner to click. When we switch something on, a banner appears first and you choose then.
How to opt out.
- Use the Your Privacy Choices link in the footer of our website pages, which is also reachable at https://jointhevitalityproject.com/privacy-choices.
- Once the banner is in use, choose Reject All or turn off the advertising category. You can reopen those preferences at any time from Your Privacy Choices in the footer or from Settings in the app.
- Send a Global Privacy Control signal from your browser or extension. We honor it as an opt out of sharing for cross context behavioral advertising and of targeted advertising for that browser, with no further step from you. Where you are signed in, we record the preference against your account so it follows you.
- Email support@jointhevitalityproject.com and tell us you want out. We will act on it and confirm.
Your rights under state law. Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, New Jersey, Delaware, Iowa, Nebraska, New Hampshire, Minnesota, Maryland, Tennessee, Indiana, Kentucky, Rhode Island and every other state with a comprehensive privacy law, as those laws come into force, have the right to opt out of targeted advertising, of the sale of personal information, and of profiling that produces legal or similarly significant effects. We honor those opt outs for everyone, wherever you live, rather than sorting people by state. We do not discriminate against you for using the right, and we do not require an account to use it. You may use an authorized agent, and where we deny a request you may appeal as described in Section 12.
Sensitive information and advertising. We do not use sensitive personal information, including anything about your health, to advertise to you, and we do not build advertising audiences from it. There is no consent path that turns that on.
We never sell or share consumer health data. Section 8 of our Consumer Health Data Privacy Policy explains this commitment in full.
Affiliate and referral tracking. When you arrive through an affiliate link or enter a referral code, we record that code with your sign up so the right person is credited and paid. That is attribution for our own commission program. It is not advertising to you, and we do not pass your information to an advertising network for it. Our Cookie Policy explains how the code is carried.
11. Cookies and similar technologies
We use cookies, browser local storage, session storage, and similar technologies to sign you in, remember your settings, keep the app working, understand how the service is used, and credit referrals. Our Cookie Policy explains each category, the choices you have, and how to clear stored data.
12. Your rights and how to use them
Depending on where you live, you may have some or all of the following rights. We honor the core of these rights for every member, wherever you live, rather than sorting people by state.
- Know and access. Ask what personal information we hold about you, where it came from, why we process it, and who we share it with.
- Correct. Ask us to fix information that is wrong or incomplete.
- Download. Get a copy of the information you gave us in a portable, machine readable format.
- Delete. Ask us to delete your personal information.
- Withdraw consent. Withdraw a consent you gave, including consent to collect health data, to appear on the member map, or to receive marketing. Withdrawing consent does not undo processing that already happened lawfully.
- Opt out. Opt out of targeted advertising, of the sale of personal information, and of profiling that produces legal or similarly significant effects. We do not sell personal information. We do not share anything with advertising platforms today. If we ever switch an ad tool on, it runs on the marketing website only, and Section 10 explains how to opt out.
- Limit sensitive information. Ask us to limit our use of sensitive personal information to what is necessary to provide the service.
- Non retaliation. Use any of these rights without being denied service, charged a different price, or given a lower quality of service.
- Appeal. Ask us to reconsider if we deny your request.
How to make a request
- Use the request page at https://jointhevitalityproject.com/privacy-choices.
- Email support@jointhevitalityproject.com.
- Use the controls in the app under Settings, where you can update your profile, change your privacy and notification settings, control what appears on your profile and on the member map, export your data, and delete your account.
What happens next
We acknowledge your request within 10 business days and complete it within 45 days. If we need more time we will tell you why and take one extension of up to 45 additional days, where the law allows it. We tell you if we extend. There is no charge for a reasonable request. If a request is manifestly unfounded or excessive, or repeated, we may charge a reasonable fee or decline it, and we will explain why.
Verifying who you are
To protect your information we need to be reasonably sure a request comes from you. We will usually verify you through the email address on your account, or by asking you to make the request while signed in. For a deletion request or a request for specific pieces of information we may ask for more. We will not ask you to create an account just to make a request, and we will not use verification information for anything except verifying you.
Authorized agents
You may use an authorized agent to make a request for you. We will ask the agent for written permission signed by you, and we may ask you to confirm directly that you gave that permission and to verify your own identity. An agent with a valid power of attorney does not need to do this.
What deletion means
When you ask us to delete your account and information, we delete or de-identify the personal information we hold about you. Some things are handled differently, and we will tell you which apply:
- Content you posted in shared spaces, such as community posts and shared meeting notes, may remain visible to the people who were in that space, with your name removed where we can. You can ask us to remove specific posts.
- Information we must keep for tax, accounting, or other legal reasons, such as invoices and affiliate payout records, is retained for the period the law requires.
- Information we need to establish or defend a legal claim, or to prevent fraud and abuse, is retained until that need ends.
- Aggregated and de-identified results that can no longer be linked back to you are not deleted, because they are no longer personal information.
- Anything left in a backup is out of use and gone within 90 days.
13. Retention
We keep personal information only as long as we need it for the purposes in this policy, or as long as the law requires. Here is how long we keep each kind of information.
| Category | How long we keep it |
|---|---|
| Account, identity, and contact information | For as long as your account is active, then deleted within 30 days of closure |
| Organization affiliation and roster records | For as long as the organization's membership is active, then deleted within 90 days |
| Wellness and survey responses | For as long as your account is active, so you can see your own progress over time, then deleted or de-identified within 30 days of closure. You can delete a single past response at any time from Settings |
| Journal entries and private reflections | For as long as your account is active. Deleted when you delete them or when you close your account |
| Community posts, chats, and direct messages | For as long as your account is active, subject to the shared content note in Section 12 |
| AI coach and AI help desk conversations | 12 months rolling, then deleted, and sooner if you delete them yourself |
| Usage, device, and log information | 13 months, then aggregated or deleted |
| Approximate location for the member map | Until you remove yourself from the map or close your account |
| Payment and billing records | As long as required by tax and accounting law, generally seven years |
| Affiliate commission, payout, and tax records | As long as required by tax law, generally seven years from the tax year concerned |
| Success story submissions | For as long as the story is published, and afterwards as a record of the release you gave |
| Support tickets and correspondence | 24 months |
| Marketing contact records and consent records | Until you unsubscribe, plus a suppression record so we do not contact you again |
We do not apply a single blanket retention period to everything we hold.
14. Security
We use administrative, technical, and physical safeguards designed to protect personal information.
We encrypt your information in transit and at rest. Only the few people who need it can reach it. Card and taxpayer details stay with specialist providers, never in our own database. Every provider is under written contract. If a breach affects you, we tell you, by email, as fast as the law requires and faster where we can.
Where your data lives. Data is hosted in the United States.
If something goes wrong. If a breach of security affects your information, we will notify you without unreasonable delay and within the time the applicable law requires, by email to the address on your account. We will tell you what happened, what information was involved, and what we are doing about it.
No method of transmitting or storing information is completely secure. We cannot guarantee that our safeguards will never be defeated. Please use a strong, unique password, keep it to yourself, and tell us straight away at support@jointhevitalityproject.com if you think someone else has access to your account.
15. United States state privacy rights
This section adds detail for residents of states with comprehensive privacy laws. The rights themselves and the way to use them are in Section 12.
15.1 California
California residents have the rights in Section 12, including the right to know, delete, correct, opt out of sale and sharing, limit the use of sensitive personal information, and not be discriminated against for exercising a right.
Categories of personal information collected. The categories listed in Section 3 correspond to the statutory categories below. In the twelve months before the date of this policy we collected every category marked as collected here.
| Statutory category | Collected | Sold | Shared for targeted advertising |
|---|---|---|---|
| Identifiers | Yes | No | No |
| Customer records information | Yes | No | No |
| Characteristics of protected classifications | Only where you volunteer them | No | No |
| Commercial information | Yes | No | No |
| Biometric information | No | No | No |
| Internet or other electronic network activity | Yes | No | Only a browser's visit to our marketing website, and only while an advertising tool is switched on. None is running today. Section 10 explains this |
| Geolocation data | Yes, at an approximate level only | No | No |
| Audio, electronic, visual, or similar information | Only where you upload it | No | No |
| Professional or employment related information | Yes | No | No |
| Education information | Yes, for school members | No | No |
| Inferences drawn from the above | Yes | No | No |
| Sensitive personal information, including health information | Yes | No | No, and there is no consent path that turns this on |
Nothing you write inside the app is ever sold or shared with an advertising platform, and health data is never shared for advertising under any circumstances.
- Sensitive personal information. We collect account log in credentials, and health information in the form of your wellness answers, journal entries, and AI conversations. We use it only to provide the service you asked for, to keep the service secure, and for the purposes in Section 5. We do not use or disclose it to infer characteristics about you. That means we already limit our use of it to purposes the law permits without a further request from you.
- Sale and sharing. We do not sell personal information, and we have not shared personal information for cross context behavioral advertising, including for anyone under 16. No advertising tool is running today. If one is switched on, the only information shared is a browser's visit to our marketing website, on the five limits set out in Section 10, and never health data or anything you write in the app.
- Sources and purposes. Sources are in Section 4, business and commercial purposes are in Section 5, and the categories of recipients are in Section 7.
- Shine the Light. California Civil Code section 1798.83 lets California residents ask once a year for information about personal information we disclosed to third parties for their own direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes. To make a Shine the Light request anyway, write to support@jointhevitalityproject.com with "Shine the Light" in the subject line.
- Minors in California. If you are under 18, live in California, and have an account with us, you may ask us to remove content you posted publicly. Write to support@jointhevitalityproject.com from the address on your account and tell us you are a California resident. We will remove the content from public display. Copies may remain in backups and in systems we cannot fully purge.
15.2 Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws
Residents of these states may access, correct, delete, and obtain a portable copy of their personal information, and may opt out of targeted advertising, the sale of personal information, and profiling in furtherance of decisions with legal or similarly significant effects. We do not carry out any of those three activities.
- Appeals. If we deny your request you may appeal by replying to our decision or writing to support@jointhevitalityproject.com with "Appeal" in the subject line. We will respond in writing within 45 days and explain our reasoning. If we deny the appeal we will give you a way to contact your state attorney general.
- Consent for sensitive data. Colorado, Connecticut, Virginia, Texas, Oregon, and Montana require your consent before we process sensitive data, which includes data about your physical or mental health. We ask for that consent before we collect wellness answers, journal entries, and other health related content, and you can withdraw it at any time.
- Universal opt out signals. We honor the Global Privacy Control and other recognized universal opt out mechanisms as an opt out of targeted advertising and sale for the browser that sends the signal.
- Utah. The Utah Consumer Privacy Act gives Utah residents the right to know, to delete, to obtain a copy, and to opt out of targeted advertising and the sale of personal data. Utah does not require an appeal process, and we offer one anyway.
- Oregon. Oregon residents may also ask for a list of the specific third parties to which we have disclosed their personal data. Ask at support@jointhevitalityproject.com.
15.3 Consumer health data
If you live in Washington, Nevada, or Connecticut, additional rules apply to health data. Those rules are set out in our separate Consumer Health Data Privacy Policy, which is linked from our homepage. It covers what health data we collect, how we use it, who we share it with, how you withdraw consent, and how you ask us to delete it.
15.4 Not a HIPAA covered entity
We are not a health plan, a health care clearinghouse, or a health care provider that transmits health information electronically in connection with a covered transaction. We are not a HIPAA covered entity or a business associate, and the wellness information you give us is not protected health information under HIPAA. State consumer health data laws and this policy are what protect it.
16. Children and minors
The member app and the marketing site are intended for adults, with one exception: students enrolled at a partner beauty school, some of whom may be minors.
- General members. You must be at least 18 to create a general membership.
- School members. A student under 18 may use The Vitality Project only through a school program under a signed agreement between the school and The Vitality Project, LLC. That agreement governs the student's participation, the consent the school obtains for the student, and what the school can see. No one under 13 may use the services.
- Student privacy inside a school. A teacher or school administrator sees the same limited information an owner sees, described in Section 8. A student's individual wellness answers, journal entries, and AI conversations are not shown to a teacher or to a school.
- If we learn we hold a child's information without the right authorization, we will delete it promptly. If you believe we hold information about a child in error, write to support@jointhevitalityproject.com.
- We do not knowingly sell or share the personal information of anyone under 16, and we do not do so for anyone of any age.
17. International users
We serve members worldwide, and your data is stored and processed in the United States. Our service providers process information in the United States and, in some cases, in other countries. By using the service from outside the United States you understand that your information is transferred to the United States, where privacy laws differ from those in your own country.
How that transfer is lawful. If you are a member in the European Economic Area, the United Kingdom, or Switzerland, the transfer of your information to the United States relies on the European Commission's Standard Contractual Clauses, together with the United Kingdom Addendum where United Kingdom data is involved, which we have in place with the processors who handle your information. A copy of the relevant clauses is available on request from support@jointhevitalityproject.com.
If you are in a region with its own privacy law, including the European Economic Area, the United Kingdom, Switzerland, Canada, Australia, and other regions with comprehensive privacy laws, we honor the rights those laws give you: access, correction, deletion, portability, objection, restriction, and the withdrawal of consent. Use Your Privacy Choices, or write to support@jointhevitalityproject.com, and Section 12 describes how we handle the request and how long we take.
The legal bases we rely on for members in those regions are your consent, and the performance of our contract with you. Where we rely on consent you may withdraw it at any time, and withdrawing it does not affect what we did with your information before you withdrew it.
If you want to complain to a regulator. Members in the European Economic Area, the United Kingdom, and Switzerland may lodge a complaint with their local data protection authority, and members in Canada may complain to the Office of the Privacy Commissioner of Canada. We would rather you wrote to us first at support@jointhevitalityproject.com so we can put it right, and the route to your regulator stays open to you either way.
If we later appoint a representative in the European Union or the United Kingdom, we will name that representative and give their contact details here.
18. Do Not Track and Global Privacy Control
Browsers send a range of privacy signals. There is still no common standard for Do Not Track, so we do not respond to Do Not Track headers. We do honor the Global Privacy Control, which is a recognized opt out signal. When we receive it we treat it as an opt out of sale and of targeted advertising for that browser, and we record the preference against your account if you are signed in.
19. Changes to this policy
We may update this policy. When we do we will change the updated date at the top and publish the new version at the canonical URL. If the change is material we will give you notice before it takes effect, by email, by a notice in the app, or both, and where the law requires your consent we will ask for it rather than assume it. Previous versions are available on request.
20. Contact us
Questions, requests, and complaints are all welcome.
- Privacy: support@jointhevitalityproject.com
- Support: support@jointhevitalityproject.com
- Requests: https://jointhevitalityproject.com/privacy-choices
- Legal notices: support@jointhevitalityproject.com
- Mail: The Vitality Project, LLC, 525 E Amiata Way, Washington, Utah 84780
If you are not satisfied with our response you may contact your state attorney general.