Privacy & Terms

Data Collection

VitalMetrics stores the following personal data: your email address, display name, and password (securely hashed with bcrypt). Application data includes extracted test results and marker values, the collection date and laboratory name of each test, the extracted text of the report, compound logs, VM Analysis history, and any health context you choose to add (conditions or medications that affect how your results should be read). That field is optional, encrypted, and never included in a shared link. All data is collected solely to provide the functionality of this application.

Uploaded Files Are Not Kept

When you upload a blood test PDF or image, the file is held in memory only for as long as it takes to read it. It is never written to disk, never placed in file storage, and never saved to the database. Once the marker values have been extracted, the file is discarded. The original filename is not retained either: it is replaced with a random-looking reference before anything is logged, because laboratory exports are often named after the patient.

We do keep the text extracted from the report, so that results can be re-checked against the source. Before that text is stored, an automated pass removes labelled patient details including name, date of birth, address, phone number, email, Medicare number and medical record number. This pass is automated and deliberately conservative so that it never deletes a marker value, which means it cannot be guaranteed to catch every possible layout. Treat it as a strong safeguard rather than an absolute one.

Encryption At Rest

Your most sensitive fields are encrypted in the database with AES-256-GCM, using a key held outside the database. This covers the extracted report text, your health context, the notes on your compound logs, your VM Analysis prompts and responses, chat messages, and generated protocols. Anyone with a copy of the raw database, and no key, cannot read them.

Data Storage

All data is stored in a PostgreSQL database. Each user's data, meaning blood tests, compound logs, VM Analyses, and favourites, is scoped to their account and is not accessible by other users. There is no cross-account data sharing.

Sharing Your Results

You can create a read-only link to share your marker results with a coach or clinician. This is off by default and nothing is shared until you switch it on. The link carries a long random token and can be given an expiry of 7, 30 or 90 days. Switching sharing off blocks it immediately, and generating a new link permanently breaks the previous one.

A shared link shows marker values, reference ranges and collection dates, and your display name so the recipient knows whose results they are looking at. It does not expose your compound logs, VM Analyses, personal notes, uploaded reports or email address. Shared pages are excluded from search engines.

Be aware that this is deliberately an exception to everything described above: anyone holding the link can open it without signing in. Treat it like a password, send it only to someone you trust, and revoke it when it is no longer needed. We show you how many times your link has been opened and when it was last viewed.

Administrator Access

VitalMetrics is operated by a small team, and an administrator can view account records in order to support and maintain the service. Being straightforward about the scope: an administrator can see your name and email, your marker values and flagged results, your compound logs including dosage, frequency and any notes you write on them, and the content of your VM Analyses.

Administrators cannot see your uploaded file, because it is never stored, and the administrator interface does not expose the extracted report text. Access is used for support, debugging and abuse prevention only. Your data is never sold, shared or used for any purpose beyond running the service. If you would rather an administrator could not read a particular note, do not put it in the notes field.

AI Processing

When you request a VM Analysis, your blood test data and marker values are sent to the OpenRouter API (a third-party service) for processing. This data is used solely to generate the analysis response. We do not send your personal account information (name, email) to AI providers, and the same automated patient-detail removal described above is applied before any report text leaves our servers.

Every AI request is restricted at the routing level to providers that operate under zero data retention and that have data collection disabled. Providers that do not meet both conditions are excluded from handling your request rather than simply asked not to retain it. This means your data is not stored by the AI provider after the request completes, and is not used to train any model.

Analytics & Cookies

VitalMetrics uses Google Analytics (GA4) for anonymous usage statistics and Contentsquare for heatmaps and session recordings to improve the user experience. These services may set cookies on your device. We do not use advertising trackers and no data is sold or shared with third parties for marketing or profiling purposes. A session authentication cookie is used to keep you signed in.

Data Deletion

You can delete your own account at any time from your profile settings, without asking anyone. Doing so permanently removes your account and all associated data, including blood tests, marker results, compound logs, VM Analyses, and favourites. An administrator can also delete an account on request. Deletion is permanent and cannot be undone.

Not Medical Advice

VitalMetrics is for informational and personal tracking purposes only. Nothing in this application constitutes medical advice, diagnosis, or treatment. Always consult a qualified healthcare professional before making health decisions. See our full Disclaimer for details.

AI Limitations

AI-generated analyses, recommendations, and protocols are not a substitute for professional medical consultation. AI models can produce inaccurate, incomplete, or misleading information. All AI outputs should be critically reviewed and validated by a qualified healthcare professional.

PED Context

This application provides PED-adjusted reference ranges and compound information strictly for harm-reduction and educational purposes. This does not constitute endorsement or encouragement of the use of any controlled or prohibited substance. Users assume all risk associated with the use of such substances.

Account Responsibility

You are responsible for maintaining the security of your account credentials. Do not share your login details or any invite codes with unauthorised individuals. You are responsible for all activity that occurs under your account.

Data Accuracy

PDF parsing and OCR extraction are performed on a best-effort basis and may produce errors. You should always verify that extracted results match your original lab report before relying on any data in this application. VitalMetrics is not liable for decisions made based on incorrectly parsed data.