Legal

Privacy Policy

Last updated: July 2025

Important: Vela is currently in early access and is not a HIPAA-covered entity. Do not enter information you consider Protected Health Information (PHI) under HIPAA. We are building toward HIPAA compliance and will update this policy accordingly.

1. Who we are

Vela Health, Inc. ("Vela," "we," "us," or "our") operates the Vela platform — an AI-powered health information tool for people living with autoimmune conditions. This Privacy Policy explains how we collect, use, store, and protect your information when you use our website and application.

2. Information we collect

We collect the following categories of information:

Account information: email address, name (if provided)
Health information you voluntarily enter: symptoms, conditions, medications, dietary history, lab values, flare patterns, and wellness check-ins
Usage data: pages visited, features used, time spent, device type, browser, and IP address
Communications: emails or messages you send to us

All health information you enter into Vela is provided voluntarily. You control what you share.

3. How we use your information

To provide, personalize, and improve the Vela platform
To generate health protocols and progress insights based on information you provide
To communicate with you about your account, updates, and early access
To analyze usage patterns and improve our AI models (using de-identified, aggregated data only)
To comply with legal obligations

We do not use your health information to train AI models without your explicit consent. We do not sell, rent, or share your personal information with third parties for marketing purposes.

4. Health data — special notice

We take health information seriously. Any health-related data you enter (symptoms, conditions, lab results, medications) is stored with additional safeguards:

Encrypted at rest and in transit using AES-256 and TLS 1.2+
Accessible only to you and to Vela systems providing your service
Never sold to insurers, employers, pharmaceutical companies, or data brokers
Never used to make decisions that affect your insurance, employment, or credit

During our early access period, some features may use browser-based local storage (your device only). Data stored locally never leaves your device unless you explicitly use a feature that syncs it.

5. Cookies and tracking

We use minimal, privacy-respecting analytics (no advertising trackers, no cross-site tracking). We may use session cookies to keep you logged in. You can disable cookies in your browser settings, though some features may not function as intended.

6. Third-party services

We may use the following third-party services:

AI providers (e.g., Groq): Queries are processed to generate protocol recommendations. We do not share identifiable personal information with AI providers.
PubMed / NCBI: We search publicly available medical literature on your behalf. No personal data is sent.
Email service provider: For sending waitlist and account emails.
Analytics: Aggregated, anonymized usage data only.

7. Data retention

We retain your account and health data for as long as your account is active. You may request deletion of your data at any time by emailing privacy@vela.health. We will process deletion requests within 30 days.

8. Your rights

Depending on your location, you may have the right to:

Access the personal data we hold about you
Correct inaccurate data
Request deletion of your data ("right to be forgotten")
Object to or restrict certain processing
Data portability (receive your data in a machine-readable format)
Withdraw consent at any time

To exercise any of these rights, email privacy@vela.health.

9. Children's privacy

Vela is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

10. Security

We implement industry-standard security measures including encryption, access controls, and regular security reviews. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security. We will notify you of any data breach that affects your personal information as required by applicable law.

11. Changes to this policy

We may update this Privacy Policy as Vela grows and as regulations evolve. We will notify you of material changes via email or a prominent notice in the application. Continued use of Vela after changes constitutes acceptance of the updated policy.

12. Contact

Questions or concerns about this Privacy Policy or your data?
Email us at privacy@vela.health