This policy explains what Vitarawells does with your personal data, why, and what you can do about it. It is written to meet the General Data Protection Regulation (Regulation (EU) 2016/679) and Portuguese Law 58/2019.
The data controller is:
Raquel Filipa Rodrigues Canuto, sole trader (empresária em nome individual)
R. de Espinho 59, 3810-193 Aveiro, Portugal
Portuguese tax number (NIF): 298318970
Telephone: +351 915 219 886 (national landline rate, Monday to Friday, 09:00 to 18:00 Lisbon time)
Email: support@vitarawells.com
For anything about your data, write to privacy@vitarawells.com. We are not required to appoint a data protection officer, so that address reaches the controller directly.
We do not run advertising trackers, and we do not buy personal data from third parties.
| Purpose | Legal basis |
|---|---|
| Creating your account, sending your access link, running the platform | Performance of a contract (Art. 6(1)(b)) |
| Building your plan, your score and your reports from health data you log | Your explicit consent (Art. 9(2)(a)), given when you complete the intake |
| Taking payment, preventing fraud, keeping invoices | Contract and legal obligation (Art. 6(1)(b) and (c)) |
| Answering support requests and complaints | Contract and legitimate interests (Art. 6(1)(b) and (f)) |
| Keeping the service secure and available | Legitimate interests (Art. 6(1)(f)) |
| Product emails or messages you have asked for | Consent (Art. 6(1)(a)) |
You can withdraw consent at any time. Withdrawing consent for health data means we can no longer build plans or reports, so the paid part of the service stops working; it does not affect processing carried out before the withdrawal.
Your plan, your score and your coaching answers are generated automatically from what you log. This is not profiling that produces legal effects or similarly significantly affects you, and no decision about you is taken solely by automated means. You can always ask a human: support@vitarawells.com.
We use a small number of processors, each under a data processing agreement. We do not sell personal data, ever, and we do not share health data with advertisers.
| Processor | What it does | Where |
|---|---|---|
| Stripe Payments Europe, Ltd. | Payments, subscriptions, invoices | Ireland, with transfers to the United States |
| Vercel Inc. | Website and platform hosting | European Union region, company in the United States |
| Meta Platforms Ireland Ltd. or Twilio Inc., depending on the channel in use | Delivery of the WhatsApp access message | Ireland or the United States |
| Anthropic PBC | Generating coaching answers, when the AI coach is enabled | United States |
We may also disclose data where the law requires it, or to establish or defend a legal claim.
Where a processor is outside the EEA, transfers are covered by the European Commission's Standard Contractual Clauses together with additional safeguards, or by an adequacy decision where one applies. You can ask us for a copy of the safeguards used.
You have the right to access your data, to have it corrected, to have it erased, to restrict or object to processing, to receive it in a portable format, and to withdraw consent. Write to privacy@vitarawells.com and we answer within one month. We may ask you to confirm your identity first. Exercising these rights is free.
If you think we have handled your data badly, please tell us so we can fix it. You also have the right to complain to the Portuguese supervisory authority, Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, cnpd.pt, or to the authority in the country where you live.
Traffic is encrypted in transit with TLS. Passwords are stored as salted scrypt hashes and are never readable by us. Access to production data is limited to the controller. We keep the number of people and systems touching health data as small as possible. If a breach ever puts your rights at risk, we notify the CNPD within 72 hours and tell you without undue delay.
Vitarawells is for adults. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, write to privacy@vitarawells.com and we will delete it.
See the cookie policy for what we store in your browser and how to change your choice.
If this policy changes materially we tell you before the change takes effect. The date at the top of the page shows the current version.
