This Consumer Health Data Privacy Policy explains how Vayas360 and its applicable subsidiaries and affiliates ("Vayas360," "we," "us," or "our") collect, use, and disclose "consumer health data" as that term or a similar term is defined under applicable U.S. state consumer health privacy laws. It supplements our general Privacy Policy.
This policy is intended primarily for health-related information that is not already governed by a separate healthcare privacy regime, such as protected health information subject to HIPAA. If information is governed by a Notice of Privacy Practices issued by Vayas360 or a participating healthcare provider, that notice controls the handling of that information to the extent required by law.
1. Consumer Health Data We May Collect
Depending on the Services you choose, consumer health data may include:
- Health conditions, diagnoses, symptoms, health concerns, health goals, family or health history, and information about treatment or care.
- Nutrition and dietary information, including food preferences, therapeutic nutrition pathways, meal selections, meal adherence, dietary restrictions, allergies, sensitivities, and supplement use.
- Medication information and information related to use of GLP-1 medications or other therapies, when voluntarily provided or received with appropriate authorization.
- Laboratory, diagnostic, and biomarker information, including A1C, lipid, metabolic, inflammatory, microbiome, metabolomic, genomic, genetic, body-composition, or other test results when such services are offered.
- Wearable, connected-device, and biometric information, which may include sleep, heart rate, heart-rate variability, activity, glucose, weight, body composition, or related trends when you connect a device or authorize a data source.
- Reproductive, maternal, hormonal, or pregnancy-related information when voluntarily provided in connection with a relevant service.
- Healthcare-provider, dietitian, care-plan, referral, eligibility, reimbursement, or program-participation information.
- Precise or approximate location information when necessary for a service, such as determining service availability, delivery, provider location, or applicable benefits, if collected.
- Inferences about health status, health interests, risk, dietary needs, or potential program fit that are derived from information described above.
- Other information that applicable law treats as consumer health data.
2. Sources of Consumer Health Data
We may collect consumer health data from:
- You, including through forms, assessments, connected accounts, surveys, communications, meal choices, and service use.
- A practitioner, registered dietitian nutritionist, healthcare provider, health plan, hospital, employer program, or care-management organization when legally permitted and appropriate permissions are in place.
- Laboratories, diagnostic companies, microbiome or omics providers, wearable platforms, connected devices, or other data sources that you choose to connect or authorize.
- Service providers that help us operate a requested health or nutrition service.
- Information generated through your use of Vayas360 Services, such as meal adherence, progress, or program-engagement information.
3. Why We Collect and Use Consumer Health Data
We may collect and use consumer health data, with consent where required, to:
- Provide the health, nutrition, diagnostic, coaching, monitoring, or related service you request.
- Personalize or assign nutrition pathways, meal programs, educational content, or service recommendations based on information you provide and the capabilities of the applicable service.
- Coordinate requested services among registered dietitian nutritionists, practitioners, laboratories, devices, health plans, hospitals, and fulfillment partners.
- Track adherence, service utilization, operational quality, and longitudinal outcomes.
- Improve safety, quality, products, protocols, and user experience.
- Conduct internal analytics, quality improvement, and research as permitted by law.
- Create aggregated or properly de-identified information for scientific research, outcomes analysis, product development, payer or healthcare analytics, or other lawful commercial purposes, provided the information is not reasonably linkable to an individual and applicable legal requirements are satisfied.
- Comply with law, prevent fraud or security incidents, and protect rights and safety.
4. Categories of Consumer Health Data We May Share
We may share the categories described above only as reasonably necessary for a disclosed purpose, as directed or authorized by you, or as otherwise permitted by law. Depending on the service, recipients may include:
- Registered dietitian nutritionists, physicians, other practitioners, or members of a care team involved in a service you request.
- Laboratories, diagnostics providers, microbiome or omics providers, wearable or connected-device platforms, and other health-technology providers.
- Meal production, fulfillment, shipping, and logistics providers, to the extent information is necessary to fulfill an order safely and accurately.
- Health plans, hospitals, employer health programs, care-management organizations, or reimbursement partners when the service is provided through or coordinated with them and disclosure is legally permitted.
- Technology, cloud, security, communications, and support vendors that process information on our behalf and are contractually restricted as appropriate.
- Research or analytics partners when the information is appropriately de-identified or aggregated, or when a separate legally valid consent or authorization permits the disclosure.
- Other recipients you specifically direct us to use or authorize us to disclose information to.
Specific Vayas360 affiliates that receive consumer health data will be identified in this policy if applicable.
5. Sale of Consumer Health Data
Vayas360 does not sell identifiable consumer health data.
Our business model may include research, analytics, and real-world-evidence activities using data that has been appropriately de-identified or aggregated so that it is not reasonably linkable to an individual, subject to applicable law, contracts, consent requirements, and governance controls. If Vayas360 ever proposes an activity that constitutes a "sale" of consumer health data under an applicable consumer health data law, we will obtain a separate valid authorization before that sale when required by law. Consent to collect or use consumer health data will not be treated as authorization to sell it.
6. Advertising and Tracking
We do not disclose identifiable consumer health data to advertising networks or social-media platforms for targeted advertising based on your health condition, diagnosis, treatment, test results, or health activity. We intend to prevent non-essential advertising technologies from operating within health assessments, patient or practitioner portals, clinical workflows, or other areas that contain sensitive health information unless the use has been specifically reviewed and is legally permitted.
7. Geofencing
Vayas360 does not use geofencing around healthcare facilities or other sensitive health locations to identify or track consumers seeking healthcare services, collect consumer health data, or send health-related advertising in a manner prohibited by applicable consumer health data law.
8. Your Consumer Health Data Rights
Depending on where you live and applicable law, you may have the right to:
- Confirm whether we collect, share, or sell your consumer health data.
- Access consumer health data we maintain about you.
- Obtain information about categories of sources and the affiliates or third parties with whom we have shared or sold consumer health data, where required.
- Withdraw consent for collection or sharing of consumer health data, subject to legal and operational limitations.
- Request deletion of consumer health data from our systems and, where required, request deletion by processors, contractors, or other recipients.
- Appeal our decision on a consumer health data request where applicable.
Submit a request to privacy@vayas360.com or through the privacy-request mechanism on the Services. We may verify your identity before acting on a request. We will respond within the time required by applicable law.
9. Consent and Authorization
Where applicable law requires consent before collecting or sharing consumer health data, we will request consent that is separate from general acceptance of website Terms of Use. The request will describe the categories of health data, purpose of collection or sharing, and relevant recipients or categories of recipients.
Where applicable law requires a separate authorization for a sale of consumer health data, that authorization will be separate from consent to collect or share the data and will contain the information required by applicable law.
10. Deletion and Retention
We retain consumer health data only for as long as reasonably necessary for the disclosed purposes or as otherwise required by law, contract, clinical-record obligations, reimbursement rules, research requirements, dispute preservation, or security needs. A deletion request may not require deletion of information that we are legally permitted or required to retain. Where applicable law requires us to send a deletion request to relevant processors, contractors, affiliates, or other recipients, we will do so.
11. Security
We apply safeguards designed for the sensitivity of consumer health data, including access controls, security monitoring, vendor-management requirements, and other administrative, technical, and physical measures appropriate to the service. When information is subject to HIPAA or another regulated healthcare relationship, the safeguards and contractual requirements applicable to that relationship also apply.
12. Changes to This Policy
We may update this Consumer Health Data Privacy Policy as our services, data practices, or legal obligations change. If a change materially affects the collection, use, sharing, or sale of consumer health data, we will provide any additional notice or consent required by law before the changed practice applies.
13. Contact and Privacy Requests
privacy@vayas360.com
Vayas360
500 North Central Expressway, Suite 500
Plano, Texas, United States