Privacy Policy
ShareVitals (“we,” “us,” or “our”) is built around a simple principle: your vitals log is yours. This Privacy Policy explains what information we collect, how we use it, and the choices and rights you have. It applies to the ShareVitals mobile app, the ShareVitals web viewer at app.sharevitals.co, and this website.
The short version
- We collect only what the app needs: your email, your name, the vitals you choose to enter, your app settings, and — if you allow notifications — a push token for your device.
- We don’t use analytics, advertising, or third-party tracking of any kind. The only cookie we set keeps you signed in to the web viewer.
- We never sell your personal information.
- You decide who sees your vitals. Everyone you share with sees them read-only, in the app or in a web browser, and you can revoke access at any time.
Information we collect
Almost everything we collect is information you provide directly. The app also sends two technical details it needs to work: your device’s time zone and, if you allow notifications, a push token. There is no hidden background collection. If you use the web viewer, it keeps you signed in with a single cookie, and like any website our servers see your IP address.
Account information
- Email address — used to uniquely identify your account.
- First name— required to enable sharing, so the people you share with can tell whose data they’re viewing.
- Last name — optional; if you provide it, it is used in the app to help identify your shared data.
Health information you enter
The vitals you log in the app: temperature, oxygen (O₂) saturation, blood pressure, heart rate, blood sugar, weight, steps, and walking, running, and biking distance — along with any optional notes and the date and time of each entry. You enter this information yourself.
App settings
Which vitals you track, your preferred units (for example °F or °C, mg/dL or mmol/L), your reminder and notification choices, and your time zone, which the app reads from your device.
Device push token
If you allow notifications, the app registers a push token — an identifier that lets us send notifications to your device. We remove it when you sign out or delete your account, or when the delivery service reports that it no longer works.
Web viewer sign-in
People you share with can view your log in a web browser at app.sharevitals.co. The web viewer sets one strictly necessary cookie that keeps you signed in. It lasts until you close your browser (12 hours at most) or, if you choose “Keep me signed in,” 30 days from your last visit. Signing out deletes it. We set no other cookies. If signing in on the web creates your account, we record your browser’s time zone with it, so dates show correctly.
IP address
Your IP address is used to protect sign-in and the service from abuse, for example by limiting how often sign-in codes can be requested. We don’t store it in our database; our hosting provider processes it to deliver the service.
Sharing information
When you invite someone to view your vitals, you provide their email address so we can send them your share request. The invitation includes a link to view your log in a web browser once they confirm their email address with a one-time code. If they sign in, we create an account for their email address and store the name and unit preferences they give us.
What we don’t collect
ShareVitals does not use analytics, advertising identifiers, tracking cookies, crash-tracking SDKs, or any other third-party tracking technology in the app or on this website. We don’t build advertising profiles, and we don’t track you across other apps or sites.
How we use your information
- Email address — to identify your account and to send transactional email. We email you only to deliver a one-time passcode (OTP) when you log in, or to notify you when another user requests to share vitals with your email address.
- First name — to power sharing: it appears in the email and push notifications we send to the people you share with, and in the app so they can identify your shared data.
- Last name — if provided, shown in the app to help identify your shared data.
- Vitals you enter — stored so you can view, edit, and chart them, and made available read-only to the people you have chosen to share with.
- App settings — to show the vitals you track in your chosen units and to send reminders at the right local time. People you share with see your vitals in their own units, not yours.
- Push token — to send the notifications you turn on: reminders to log your vitals, and alerts when someone who shares with you logs an entry. Notifications never include your readings.
We do not use your information for advertising, and we do not sell it.
How your information is shared
With people you choose.The only people who can see your vitals are those you explicitly invite. They receive read-only access — in the ShareVitals app or in a web browser, they can view and chart your log and print or download a copy, but can never add or change an entry. Copies they keep are outside ShareVitals’ control. You can revoke anyone’s access at any time, which immediately removes their ability to view your data in the app and on the web.
With service providers.We use reputable third-party providers to securely host and store data and to deliver email and notifications on our behalf. They process data only to provide these services to us, are bound by confidentiality and data-protection obligations, and do not use your information for their own purposes. Notifications are delivered through Expo’s push service and Apple’s push notification service, which receive your push token and the notification text.
For legal reasons. We may disclose information if required to do so by law, or if we believe in good faith that it is necessary to comply with a legal obligation, protect the rights or safety of our users, or investigate fraud or abuse.
We never sell your personal information, and we do not share it for advertising or cross-context behavioral advertising.
How we protect your information
All data transmitted between your device and our servers is encrypted in transit using SSL/TLS. Data is stored with established third-party infrastructure providers that maintain industry-standard physical and technical safeguards. No method of transmission or storage is ever completely secure, but we work to protect your information using appropriate measures.
Data retention
We keep your information for as long as your account is active so the app works as you expect. When you delete your account — in the app, in the web viewer, or by asking us — we immediately delete your personal information, vitals, sharing connections, and push tokens from our active systems, except where we are required to retain certain information to comply with legal obligations, resolve disputes, or enforce our agreements. Backups are purged on a rolling basis.
One-time sign-in codes, and the email addresses they were requested for, are deleted within a day.
Your choices and rights
You are always in control of your data:
- Access and edit — you can view and edit your vitals and profile at any time in the app.
- Control sharing — you decide who can see your vitals, and you can revoke access at any time.
- Delete your account — in the app or the web viewer, go to Settings and choose Delete account. This permanently deletes your account, your vitals log, and your sharing connections right away. You can also email us at support@sharevitals.co and we will process your request.
Depending on where you live, you may have additional rights, described below. To exercise any of them, contact us at support@sharevitals.co. We will not discriminate against you for exercising your rights.
If you are in the European Economic Area, United Kingdom, or Switzerland (GDPR)
Controller. ShareVitals is the controller of your personal data.
Legal bases. We process your information to perform our contract with you — that is, to provide the ShareVitals service (Article 6(1)(b)). Because vitals are health data, which is a special category of personal data, we process them on the basis of your explicit consent (Article 9(2)(a)), which you give by choosing to enter and share them. We also rely on our legitimate interests in keeping the service secure and preventing abuse (Article 6(1)(f)), and on compliance with legal obligations where applicable (Article 6(1)(c)). You can withdraw your consent at any time by deleting the data or your account; this does not affect processing already carried out.
Your rights. You have the right to access, correct, delete, or receive a portable copy of your personal data; to restrict or object to certain processing; and to withdraw consent. You also have the right to lodge a complaint with your local data protection authority.
If you are a California resident (CCPA/CPRA)
In the past 12 months we have collected the following categories of personal information, in each case from you or your device: identifiers (such as your email address, name, device push token, and IP address) and health/medical information (the vitals you enter). We collect this information to provide the ShareVitals service, as described above.
We do not sell or share your personal information, and we have not done so in the past 12 months. “Share” here has the meaning given under California law (disclosure for cross-context behavioral advertising).
As a California resident, you have the right to know what personal information we collect and how we use it, to access or delete your personal information, to correct inaccurate information, and to not be discriminated against for exercising your rights. Because we use your information only to provide the service you signed up for, we do not use sensitive personal information for any purpose that would give rise to a right to limit its use. To exercise your rights, contact us at support@sharevitals.co.
Children’s privacy
ShareVitals is not directed to children under 13 (or the minimum age of digital consent in your country, such as 16 in parts of the EU), and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, please contact us and we will delete it.
International users
ShareVitals and our service providers may store and process your information in the United States and other countries whose data- protection laws may differ from those where you live. If you use ShareVitals from outside these countries, your information may be transferred across borders. Where required by law, we put appropriate safeguards in place for these transfers.
Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page, and for significant changes we will provide a more prominent notice. Your continued use of ShareVitals after an update means you accept the revised policy.
Contact us
If you have any questions about this Privacy Policy or how we handle your information, email us at support@sharevitals.co.