Privacy Policy

Wearable telemetry

VivoCore reads a small set of vitals from the wearable you connect: heart rate, heart-rate variability, blood oxygen (SpO2), sleep duration and stage summaries, step count, and a device-derived stress or readiness signal where your device provides one. We only see what your wearable exposes — we never read raw PPG, accelerometer traces, or anything your device does not surface through its official API.

Account information

When you create an account we store the email address you provide plus the credentials used to authenticate you. Your email is the address we send daily summaries and alerts to, and the address your linked caregivers reach you at — so keeping it current is important.

Alerts metadata

When VivoCore surfaces an anomaly we keep a small audit record: the recipient caregiver email addresses you have opted to, the alert text, the time it fired, and your acknowledgement state. The raw vitals that triggered the alert are not repeated in the alert — only the deviation summary.

VivoCore keeps one purpose: comparing your recent vitals against your own adaptive baseline so you — and the caregivers you have explicitly opted in — can act on deviations sooner. We do not sell your data. We do not share it with advertisers, insurers, employers, or data brokers. We do not use it to train third-party models.

Anomaly detection

Your incoming readings are scored against the personal baseline computed from your own recent history. Detected deviations are surfaced in the app first; they only reach a linked caregiver if you have opted that channel in.

Daily summary

A scheduled job generates a once-a-day email digest summarising your latest vitals, any flagged events, and notable trends. The summary is sent to your account email through our transactional email provider; it is not marketing.

Caregiver fan-out

When you link a caregiver, that person receives alerts only for the anomaly classes you have explicitly opted them into. They never see your unflagged readings, your historical raw vitals, or anything outside the alert envelope.

Raw vitals samples are retained for the rolling window your daily summary covers — long enough to score against your baseline, short enough that old readings fall out automatically. Daily summary email history stays in your account until you delete it. Alert events (who was paged, when, with what text) are kept for audit purposes.

When you delete your account, all of the above is permanently removed. There is no soft-delete, no archived backup, and no retention of “just enough” to reconstruct you later. The deletion is logged in our audit trail with no underlying record.

VivoCore does not operate its own data centres. A small number of named vendors process data on our behalf, and only the data they need to do their job. Each one is bound by a data-processing agreement equivalent to this policy.

Wearable data ingress

Apple HealthKit, Oura, Fitbit, and Garmin each act as ingress providers for the subset of users who connect through their platform. They deliver your readings to us; they do not see how we score them or who we notify.

Transactional email

Daily summaries and caregiver alerts are sent through the Polsia email proxy (`@/lib/email/send`). Email recipients see mail that originates from our verified sending domain and is signed against that domain.

Database hosting

Raw vitals, baselines, summaries, and audit records are stored in a hosted Postgres database operated by Neon. Neon is the only processor with access to your raw vital records, and its access is enforced through our standard least-privilege database role.

If you are in the European Economic Area, the United Kingdom, or California, you have a small set of rights over the personal data we hold about you, and we honour them regardless of where you live.

Right of access

You can request an export of the personal data associated with your account — your account record, your linked caregivers, your summary history, and any audit entries tied to your user id. We deliver the export within 30 days.

Right of deletion

Deleting your account immediately and permanently removes your records. There is no soft-delete and no retention grace period.

How to exercise

Email us to start either request. We respond to verified requests within 30 days, and we will not charge you for a reasonable number of requests over the course of a year.

The fastest way to reach the team behind VivoCore is by email. We monitor the inbox during European and US business hours and aim to respond to every privacy and data request within 30 days.