Privacy Policy

Please read this Privacy Policy carefully before using our Services. It explains what personal data we collect, why we collect it, who we share it with, and the rights you have over it.

SENSITIVE DATA NOTICE: Vibrantly handles information about your body and habits — lab reports you upload, wearable metrics, meal photos, your voice when you use voice features, and your conversations with your AI companion. Section 4 describes exactly how that data is processed, including what is sent to third-party AI providers.

1. Introduction

Envisioning LLC-FZ (“Company”, “we”, “us”, or “our”) is a Free Zone limited liability company registered in the Emirate of Dubai, United Arab Emirates. We are committed to protecting your privacy and handling your personal data responsibly.

This Privacy Policy explains what personal data we collect, why we collect it, how we use it, who we share it with, and what rights you have in relation to your data when you use Vibrantly — our wellness and longevity app, website, and related services (“Services”).

Vibrantly handles sensitive information about your body and habits, including lab reports you upload, metrics from wearable devices, photos of your meals, and your conversations with your AI companion. We have tried to describe those flows plainly rather than generically.

This policy is designed to comply with applicable privacy and data protection laws, including:

The European Union General Data Protection Regulation (GDPR, Regulation (EU) 2016/679)
The United Kingdom General Data Protection Regulation (UK GDPR)
The California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA)
The UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL)

Please read this policy carefully before using our Services.

2. Data Controller

Envisioning LLC-FZ is the data controller responsible for your personal data under this Privacy Policy. This means we determine the purposes and means of processing your personal data.

If you have any questions about this Privacy Policy, our data practices, or wish to exercise your privacy rights, you can contact us at:

Envisioning LLC-FZ
Dubai, United Arab Emirates
Email: privacy@envisioning.group

We aim to respond to all privacy-related inquiries within 30 days of receipt, or within the shorter timeframe required by applicable law.

3. Information We Collect

We collect different categories of data depending on which features you use and the consents you provide. Some data is necessary to provide the service, some is collected on the basis of legitimate interest, and some requires your explicit consent before we collect it at all. Rows marked ‘Your consent’ apply only if you choose to enable that feature.

Data Category	What We Collect	Legal Basis
Account & profile	Email address, name, username, date of birth or age, gender, country or region, and the identifier issued by your sign-in provider. We also record the IP address and timestamp attached to each consent you give, as proof of that consent.	Contract — required to provide the service
Wellness profile	Height, weight, dietary preferences, food allergies, skin tone, goals, and any other details you choose to add about your habits or lifestyle.	Contract — required to personalise the service
AI companion settings	Companion name, personality archetype, avatar, voice preference, and the AI-generated personality document that shapes how your companion responds.	Contract — required to provide the service
Conversations	Your chat history with your AI companion, including anything you type or dictate and any images you attach.	Contract — required to provide the service
Voice	Audio captured when you use microphone dictation or a live voice call. Audio is sent off your device to be converted to text; the resulting transcript is stored as part of your conversation history.	Your consent — voice features
Lab and blood reports	The report files you upload (PDF, image, or CSV), the text extracted from them, the biomarker values we derive, and the record of the AI analysis performed on them.	Your consent — blood report analysis
Wearable and activity data	Heart rate, resting heart rate, heart rate variability, sleep, steps, and stress indicators, read from Apple Health or Health Connect through our wearable partner.	Your consent — health and activity data
Meals and nutrition	Photos of meals you log, the nutrition analysis produced from them, and your food log history.	Contract — required to provide the service
Memory	Facts and preferences our AI extracts from your conversations and logged data so your companion can remember context between sessions. See Section 5 on cross-product sharing.	Contract — required to provide the service
Device and notifications	Push notification token, device platform, and app version, so we can deliver reminders you have opted into.	Contract — required to provide the service
Product analytics	Usage events such as screens viewed and features used, tied to a pseudonymous identifier rather than your name or email. You can turn this off at any time in Settings → Privacy.	Legitimate interest — you may opt out
Diagnostics	Crash reports and error diagnostics from the mobile apps, used to fix defects.	Legitimate interest — service reliability
Payments & subscriptions	Your subscription plan and status. For purchases made in the app: the product you bought, store transaction identifiers, the price and currency, trial and renewal status, and the subscription's expiry date, as reported by Apple or Google through Adapty (see “In-app purchases” in Section 5). For subscriptions bought on our website: the identifiers our payment provider (Stripe) assigns to your customer record, subscriptions, and billing events. Card and payment details are collected by Apple, Google, or Stripe directly; we never receive your full card number.	Contract — required to provide paid features
AI usage records	Which AI feature you used, the model involved, and token counts and derived cost, for usage metering, cost attribution, and abuse prevention. These records are kept in de-identified form after account deletion (see Section 7).	Legitimate interest — metering and abuse prevention
Access and invite lists	An email address may be added to an invite or access group (for example by your organisation or our team) before you sign up, so the right plan or access applies when you do.	Legitimate interest — managing access and plans
Account deletion records	If you request account deletion, we keep a record of the request and its timestamps, with hashed (unreadable) confirmation tokens, as proof the deletion was requested and carried out. Your email address is removed from this record once the request completes or is cancelled.	Legitimate interest / legal obligation — proof of deletion

4. Health Data, Wearables, and AI Analysis

This section describes the most sensitive processing Vibrantly performs. Please read it even if you skip the rest.

Vibrantly is not a medical service

Vibrantly provides wellness information and educational content only. Nothing in this platform constitutes medical advice, diagnosis, or treatment. Always consult a qualified healthcare professional before making decisions about your health.

We are not a healthcare provider, and Vibrantly does not operate as a HIPAA covered entity or business associate. Your data is protected under the general privacy laws listed in Section 1, not under HIPAA.

Vibrantly is powered by AI models operated by third parties. To respond to you and generate your insights, we send the content you share — your messages, photos, voice recordings, lab reports, and health data you sync — to OpenAI, Google, and Anthropic, which process it on our behalf and only to provide the service. Section 5 lists what each provider receives. All AI requests are routed through TrueMemory, Envisioning's AI gateway, which authenticates the request and applies rate limits; it does not add recipients beyond those listed in Section 5.

Because the service cannot operate without this processing, we ask for your explicit consent to it when you create your account (and again if this section changes materially), before any of your content is sent. You can see the consent you have given in Settings → Privacy. To withdraw it, delete your account (Section 7) — this stops all further processing.

Lab and blood reports

Uploading a lab report is optional and requires your explicit consent, which you can withdraw at any time in Settings → Privacy. When you upload a report:

The original file is stored in our cloud storage.
The report is sent to third-party AI providers to extract its text and analyse the results. More than one AI model may review the same report.
The report is sent substantially as you uploaded it. If your name, date of birth, or a laboratory reference number is printed on the report, that information is included. We do not currently strip identifiers from reports before analysis.
The extracted biomarker values and a record of the analysis are stored against your account so you can revisit the results.

Wearable and activity data

Connecting a wearable is optional and requires your explicit consent. We request read-only access — Vibrantly does not write data back to Apple Health or Health Connect. Data is read through our wearable aggregation partner, which receives an opaque account identifier rather than your name or email.

Daily wellness metrics derived from your wearable (such as sleep, heart rate variability, resting heart rate, and steps) may also be stored in your companion's memory layer and included as context in AI requests so conversations and insights can reference them.

Data read from Apple Health or Health Connect is used only to provide your wellness insights. It is never used for advertising, marketing, or data mining, is never sold, and is shared only with the sub-processors in Section 5 as needed to provide the service you have consented to.

If you disconnect a wearable, we stop receiving new data, but metrics already synced remain associated with your account until you ask us to delete them. You can also revoke access directly in your device's Health or Health Connect settings.

Meals

When you log a meal, the photo is stored in our cloud storage and sent to an AI provider for nutrition analysis. The same applies to restaurant menu photos you capture for menu analysis and to any image you attach in chat — each is transmitted to an AI provider to generate the response. To make that analysis relevant, the request may also include context from your wellness profile, recent biomarker values, and recent wearable metrics.

Voice

Audio captured for dictation or a live call is transmitted off your device and processed in real time by a third-party AI provider. Dictation audio is sent to OpenAI's speech-to-text models (Whisper) and converted to text. During a live voice call, your microphone audio streams continuously to Google's real-time voice AI model (Gemini Live) for the duration of the call, together with recent conversation context so the call can pick up where your chat left off. We do not retain the audio itself, but the resulting transcript is stored as part of your conversation history and may be used to update your companion's memory.

When your companion speaks a reply aloud (read-aloud and voice responses), the reply text is sent to Google's speech-synthesis AI models to generate the audio you hear. Only the companion's reply text is sent for synthesis, not your own messages.

We do not sell your personal data. We share it only with the service providers (sub-processors) listed below, each of which is bound by contract to process it solely on our instructions, and with the in-app purchase services described after the table. Each sub-processor is engaged under a data processing agreement that requires protections for your data at least equivalent to those described in this policy. The AI providers we use (OpenAI, Google, and Anthropic) process your content through their business APIs, which contractually restrict use of your content to providing the service.

Provider	Purpose	Data involved
Google Cloud Platform	Application hosting, database, and file storage	All stored data, including uploaded reports and meal photos
Google Cloud Vertex AI (incl. Gemini models)	AI models used for chat, lab analysis, and meal/menu photo analysis; real-time voice calls (Gemini Live); speech synthesis for spoken replies	Prompts and content sent for analysis, including report text and photos; live-call microphone audio; companion reply text for speech synthesis
OpenAI	AI models used in lab report analysis, and speech-to-text (Whisper) for voice dictation	Report text and prompts, and the captured audio recording sent for transcription
Anthropic (Claude models)	AI models used in lab report analysis and in generating your plans	Report text and prompts sent for analysis
TrueMemory (an Envisioning service)	AI gateway that routes every AI request to the providers above, and long-term memory for your companion	Conversation content, photos and audio in transit to AI models, and extracted memory facts
Junction (Vital)	Wearable and health-device data aggregation	Wearable metrics and an opaque account identifier
Google Firebase	Authentication, push notifications, and crash reporting	Account identifiers, push tokens, crash diagnostics
PostHog	Product analytics	Usage events and a pseudonymous identifier, with personal fields filtered out
Segment	Analytics routing	Usage events and account profile fields
Stripe	Payment processing for subscriptions bought on our website	Email address, subscription details, and payment records. Card details are entered on Stripe-hosted pages and held by Stripe, not by us
Resend	Transactional email, such as account-deletion confirmations	Email address, name, and the content of the email sent to you

In-app purchases

When you buy a subscription in the Vibrantly app for iOS or Android, Apple (App Store) or Google (Google Play) handles the purchase and your payment details under its own terms and privacy policy. Our app uses Adapty, a subscription-management service, to receive purchase confirmations and subscription status from the stores. Adapty receives your Vibrantly account identifier and an internal user identifier, an app installation identifier, your IP address, on Android your device's advertising identifier where available, and the store transaction identifiers, product bought, subscription and trial status, price, and currency.

Vibrantly shares an AI memory layer with other Envisioning products, including BlinkLife. If you use more than one of our products with the same account, your companion persona and the facts extracted into memory may be available across them, so your experience stays consistent. Your Vibrantly conversation history itself is kept separate per product.

Other disclosures

We may disclose your data where required by law, to enforce our Terms, or to protect the rights, safety, or property of Envisioning, our users, or the public. If Envisioning is involved in a merger, acquisition, or asset sale, your data may be transferred; we will notify you before it becomes subject to a different privacy policy.

6. International Data Transfers

We operate from the United Arab Emirates and our infrastructure and sub-processors are primarily located in the United States. If you access Vibrantly from the European Economic Area, the United Kingdom, or another region with data transfer restrictions, your data will be transferred outside that region.

Where such transfers occur, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses and equivalent mechanisms, together with the contractual commitments of our sub-processors.

7. Data Retention

We retain your data only as long as necessary to provide the service and fulfil the purposes described in this policy.

While your account is active — your profile, health data, meals, conversations, and memory are retained so the service works as intended.
Content you delete yourself — you can delete individual conversations and individual memories at any time, and these are removed when you do.
After account deletion — when you delete your account (see Section 9), our automated purge permanently removes the personal data Vibrantly stores: your profile and account details, lab reports and the files you uploaded, biomarker results, meal photos and food logs, conversations and chat images stored by Vibrantly, wellness and wearable metrics, and device push tokens. Deleting your account does not cancel a subscription bought through the App Store or Google Play — cancel it in your Apple Account or Google Play subscription settings, or Apple or Google will keep charging you. A subscription bought on our website is cancelled when the purge runs.

What we retain after account deletion

A limited set of records is not removed by the account purge:

AI memory layer — companion memories, your companion persona, and AI conversation threads held in our shared memory service (TrueMemory) are not removed by the account purge today. You can delete individual conversations and individual memories in the app at any time, including before deleting your account, and you can email privacy@envisioning.group to request removal of this data. We are building full memory-layer deletion into the account purge.
De-identified usage records — AI usage records are unlinked from your account (the account reference is cleared) and retained only as anonymous usage and cost data.
Billing records — subscription and payment records held with our payment and subscription providers (Stripe and Adapty), and related billing event logs, are retained for accounting, tax, and fraud-prevention purposes.
Promotional code redemptions — if you redeemed a promotional code, the record of that redemption, including your email address, is not removed by the account purge today.
Deletion audit record — a minimal record that the deletion was requested and completed, with your email address and tokens cleared.
Backups and logs — residual copies may persist in backups and operational logs for a limited period after deletion before being overwritten.
Legal and financial records — retained for the period required by applicable law.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

Encryption of data in transit using TLS/HTTPS
Google Cloud Platform's built-in encryption at rest
Row-level access controls so your records are only readable by your account
Rate limiting on sensitive endpoints to prevent abuse
Least-privilege access controls for our application and our staff

No method of transmission over the Internet is completely secure, and we cannot guarantee absolute security. We will promptly notify affected individuals and relevant authorities in the event of a data breach, in accordance with applicable law.

9. Your Rights

Depending on where you live, you may have the following rights over your personal data:

Access — obtain a copy of the personal data we hold about you
Rectification — correct inaccurate or incomplete data
Erasure — request deletion of your personal data
Restriction — ask us to limit how we process your data
Portability — receive your data in a portable format
Objection — object to processing based on legitimate interest
Withdraw consent — withdraw any consent you have given, without affecting processing already carried out
Non-discrimination — we will not treat you differently for exercising these rights

What you can do directly in the app

Review and withdraw individual consents in Settings → Privacy
Turn product analytics on or off in Settings → Privacy
Delete individual conversations
Delete individual memories your companion has stored
Disconnect a wearable at any time
Delete your account in Settings → Privacy

Deleting your account

You can delete your account yourself, on the web or in the mobile app, from Settings → Privacy → Delete account. The flow works like this:

We send a confirmation email to the address on your account. The confirmation link is valid for 24 hours.
Once you confirm, deletion is scheduled after a 7-day grace period. You can cancel at any time during those 7 days — from Settings or via the cancellation link in the email.
After the grace period, our automated purge permanently deletes the data described in Section 7. Deletion is then irreversible: signing in again creates a new, empty account.

A limited set of records is retained after deletion — including data held in the AI memory layer until memory-layer deletion is complete — as described in Section 7. If you cannot sign in, or prefer not to use the in-app flow, email privacy@envisioning.group or support@vibrantly.com from the address registered to your account. See also our account deletion page for step-by-step instructions.

Requesting a copy of your data

To request an export of your data, email privacy@envisioning.group from the address registered to your account. We will verify the request and confirm once it has been completed.

If you believe we have not handled your data properly, you have the right to lodge a complaint with your local data protection authority.

10. Cookies and Tracking Technologies

We use cookies and similar technologies that are strictly necessary to keep you signed in and to keep the service secure. We also use analytics technologies to understand how the product is used, which you can disable in Settings → Privacy.

We do not use advertising cookies, and we do not sell or share your personal information for cross-context behavioural advertising.

11. Children's Privacy

Vibrantly is intended for adults. You must be 18 years of age or older to create an account, and we ask you to confirm this during sign-up.

We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact privacy@envisioning.group and we will delete it.

12. Do Not Track Signals

Some browsers offer a “Do Not Track” setting. There is no common industry standard for how to respond to these signals, so we do not currently respond to them. You can control analytics collection directly in Settings → Privacy, which we honour regardless of your browser setting.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. If the changes are significant, we will notify you in the app or by email before they take effect.

14. Contact Us

If you have questions about this Privacy Policy or how we handle your data, contact us at:

Envisioning LLC-FZ
Dubai, United Arab Emirates
Privacy: privacy@envisioning.group
Support: support@vibrantly.com