Legal
01
At Vela, safeguarding your privacy is our top priority. This Privacy Notice (“Notice”) describes the privacy practices of Vela Wellness, LLC and its affiliates (collectively, “Vela,” “us,” “we,” or “our”) in relation to your use of our websites (the “Sites”), web applications, waitlists, and other consumer wellness resources we operate. We refer to the Sites, applications, and related offerings collectively as the “Vela Platform.” The Vela Platform may include personalized educational information and services such as daily check-ins, pattern insights, Learn guides, lab or imaging upload helpers, optional health-device sync, waitlist communications, and AI-assisted educational tools (collectively, the “Services”).
This Notice does not apply to third-party sites or services that display a different privacy policy. If we expand the Vela Platform through acquisition of another company or property, that company’s offerings may operate under a separate privacy policy accessible via a link on those properties until integrated.
We provide the Vela Platform and Services as a consumer wellness and education resource intended to help people organize symptoms, lifestyle factors, and related information and receive educational insights. You can choose whether you want to use the Vela Platform and Services. If you do, you must agree to and comply with our Terms & Conditions, which serve as a contract between us and users of the Vela Platform and Services. By agreeing to the Terms, you confirm that you have read and understand the Terms and this Notice.
This Notice explains how we collect, disclose, transfer, secure, and use information about you in connection with your use of the Vela Platform and Services, and the rights and choices you have. If you do not want us to collect and use information about you as described here, you should not access the Vela Platform or the Services. By accessing the Vela Platform and Services, you acknowledge that we will store, use, and otherwise process your information in the United States and any other country from which the applicable Services are accessed or operated.
Vela Health may be used by people of any age. If you are under 13, a parent or legal guardian must accept consent before the account unlocks (see Children’s privacy). If you are between 13 and 17, use the Services only if you have capacity under applicable law and, where required, parental or guardian permission. If you reside in the European Economic Area (EEA), Switzerland, or United Kingdom, please also see the Supplemental European privacy rights section below.
02
The term “Personal Information” in this Notice refers to any information or data that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to a particular identifiable natural person or household, or any other information that constitutes “personal information,” “personal data,” or “personally identifiable information” under applicable data protection laws.
An identifiable natural person, or “Data Subject,” is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location information, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
Health and lifestyle information you voluntarily provide (for example, conditions, symptoms, medications, check-ins, labs, or photos) may also constitute sensitive personal information or, depending on context, protected health information under certain laws. You control what you enter. Do not upload information you are not authorized to share.
03
Information about your use of the Vela Platform and Services is collected as follows:
To use certain Services, you may be required to register an account and provide Personal Information such as your name, email address, password (stored as a one-way hash), optional profile photo, age or date of birth, sex/gender, height, weight, and similar demographics you choose to provide. You may update this information through account settings where available. Primary purpose: create and administer your account, authenticate you, and communicate about the Services (contract / legitimate interests; consent where required for sensitive data).
Certain features allow you to voluntarily share information about your skin, symptoms, and daily habits. This may include conditions (e.g., psoriasis, eczema, acne, rosacea), symptoms and severity; medications, topicals, supplements, allergies, and family history; diet, sleep, stress, movement, triggers, remedies, and free-text notes; daily check-ins and care-plan progress; lab reports, imaging notes, and extracted values you upload; progress or skin photos; and custom tracking or experiment notes. Primary purpose: provide personalized educational features you request (contract / consent for sensitive health data).
We automatically collect and store information about your use of the Vela Platform and Services, such as pages or screens viewed, feature usage, timestamps, search or navigation within Learn content, diagnostic logs, language/region settings, and engagement with educational features. We also collect device and technical information including IP address, approximate location inferred from IP, browser or device type, and similar data needed to operate and secure the Services. Primary purpose: operate, secure, measure, and improve the Services (legitimate interests; consent where required for non-essential cookies).
Email address, name, and content you provide when you contact support, join the waitlist, submit feedback, or otherwise communicate with us. Primary purpose: respond to inquiries, operate the waitlist, and improve support (contract / legitimate interests / consent for marketing where applicable).
Communication preferences, weekly digest settings, and other preferences or requests you provide. Primary purpose: honor your choices and create a relevant experience (consent / legitimate interests).
Purchases and subscriptions for paid plans (such as Vela Plus) are processed by Stripe or similar payment processors. We receive billing status and related metadata; we do not store full payment card numbers on our servers. Primary purpose: perform the contract for paid Services.
We may create aggregated, de-identified, or anonymous data to identify patterns, improve the Services, and produce statistics that cannot reasonably identify you. We take steps so that such data is not reasonably re-associable with you. We may retain and use anonymized data indefinitely as permitted by law.
04
In addition to information we collect directly from you, Vela may receive information about you from other sources, such as service providers, identity providers, payment processors, or publicly available records where appropriate for security or operations. We are committed to complying with applicable data protection laws in the regions where we operate (collectively, “Data Protection Laws”).
If you are located in a U.S. state with privacy legislation, please also see Choice and control and Supplemental California and other U.S. privacy rights. If you are located in the European Union, EEA, Switzerland, or UK, please also see Supplemental European privacy rights.
05
Information about you may be used for the following purposes:
Although the sections above describe primary purposes, in many situations we have more than one purpose. If we wish to use Personal Information for a purpose that is not compatible with the purpose for which it was collected, we will request your consent unless an exception applies under applicable law. We balance our use of Personal Information with your interests, rights, and freedoms in accordance with applicable laws.
We do not sell your Personal Information. We do not share user questions or conversations. We do not train AI models on protected health information (PHI). We do not use your data to determine insurance eligibility, employment, or credit decisions. We do not use Apple Health / HealthKit or Google Fit data for marketing or advertising.
06
Parts of Vela use artificial intelligence to help you understand patterns in the health information you enter. AI is used for educational purposes only — it does not provide medical diagnosis, prescribing, or treatment decisions.
When you use AI-powered features (such as symptom chat, lab interpretation, imaging helpers, medication-label reading, or care-plan suggestions), your request may be processed by third-party AI inference providers solely to generate a response back to you under our instructions. That processing is not a sale, advertising use, or disclosure of your conversations to other users. Providers process data as our service providers / subprocessors under their terms and our instructions. We take steps to limit unnecessary identifiers in prompts; health details you entered may still be included so the feature can work.
Vela’s educational guidance is informed and trained using published scientific and medical research articles — not your protected health information.
AI outputs can be incomplete or incorrect. Always verify important health decisions with a qualified clinician. You agree not to treat AI outputs as clinical diagnosis or a care plan ordered by a licensed provider.
07
Information about your use of the Vela Platform and Services may be shared as follows. We require service providers to use Personal Information only to fulfill their responsibilities to us and to protect it in accordance with applicable law and our contractual requirements.
We work with third-party service providers to help us provide and operate the Services, including hosting, data storage and security, email delivery, analytics, authentication, payment processing, and AI inference used solely to return educational responses to you. Categories may include website and application hosting; databases and private object storage; email providers; identity providers (Google, Apple); payment processors (e.g., Stripe); analytics providers; and third-party AI inference providers (see Artificial intelligence). We do not sell Personal Information to these providers.
We may provide aggregated or de-identified information about users of our Services to third parties as we deem appropriate (for example, high-level trends). Aggregated reporting does not include names, contact details, questions, conversations, or information that identifies you as an individual.
We may release Personal Information when we believe release (i) is required to comply with valid legal requirements such as a law, regulation, search warrant, subpoena, or court order; or (ii) is reasonable in response to a physical threat to you or others, to protect property, or to defend or assert legal rights of us or others.
We may share information with affiliates for purposes consistent with this Notice. In connection with a corporate change in control (for example, a sale, merger, financing, asset sale, or bankruptcy), we reserve the right to transfer Personal Information to the new party in control or the party acquiring assets. In such an event, Personal Information will continue to be treated in accordance with this Notice as may be modified as described below. Where required, we will provide notice via the Services or email before such a transfer.
We may disclose your Personal Information to a third party in a manner not addressed by this Notice subject to your consent at such time.
We do not disclose Personal Information to advertising networks for cross-site targeted advertising. We do not operate public forums that expose your health diary to other users. We do not share user questions or conversations for advertising or with other users.
08
We use cookies and similar technologies (e.g., local storage) on the Sites and within the Vela Platform for (i) essential functions (security, login/session management, fraud prevention), (ii) functional preferences, and (iii) analytics to understand and improve performance. We do not use advertising pixels for cross-site ad targeting.
You can manage cookies in your browser settings, including blocking or deleting cookies. Rejecting cookies may limit certain functionalities (including staying signed in) but will not prevent you from accessing public marketing pages.
We may use privacy-oriented analytics and, if enabled by configuration, Google Analytics or similar tools to understand how visitors use the Sites (for example, pages visited and approximate location from IP). These tools may use cookies. You can manage preferences through your browser and, for Google Analytics, through Google’s opt-out tools where available.
Some browsers incorporate a Do Not Track (“DNT”) feature. At this time, the Vela Platform and Services do not respond to DNT signals. Other third-party websites may keep track of your browsing activities when they provide content.
09
We have implemented appropriate technical, organizational, and administrative security measures to protect Personal Information under our control from unauthorized access, use, disclosure, and accidental loss. When you enter Personal Information, we encrypt transmission using HTTPS/TLS. We limit access to Personal Information to employees, agents, contractors, and other third parties who have a business need to know. They process Personal Information on our instructions and are subject to confidentiality duties.
You are solely responsible for maintaining the security and confidentiality of your account credentials. Unfortunately, no method of transmission or electronic storage is completely secure. Although we take reasonable efforts to protect Personal Information, we cannot guarantee absolute security. Any electronic transmission of Personal Information is at your own risk.
In accordance with applicable Data Protection Laws, if we become aware of a Personal Information breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the relevant supervisory authority and, where required, affected individuals without undue delay.
10
Vela retains Personal Information for as long as necessary to fulfill the purposes outlined in this Notice or as required by law. Typically, Personal Information is kept while your account remains active or until you request deletion. Exact periods vary based on the type of information and why it is collected. Factors we consider include volume and sensitivity, potential risks of unauthorized use or disclosure, and legal requirements.
We may anonymize Personal Information so it can no longer be associated with you, and may retain anonymized data indefinitely for research, statistical, or business purposes. Personal Information may also be kept for backup, archival, or audit purposes and to resolve disputes. After the retention period, Personal Information will be archived securely for a limited time (notably to comply with applicable statutes of limitations) or fully anonymized.
11
Account information. You may update registration information through account settings where available, or contact us at info@healthvela.com to request updates or deletion. If we delete your account, we may maintain certain de-identified information for internal business purposes including research, analytics, and reporting.
Cookies. Most browsers can reject cookies; rejecting our cookies may limit access to signed-in Services.
Email communications. You may unsubscribe from marketing emails via the link in those emails or by contacting us. Transactional and service-related emails may continue while your account is active.
Opt-out of materially different uses. You may contact us to opt out of disclosure or use of Personal Information for purposes materially different from those described in this Notice or subsequently authorized by you, subject to applicable law and operational constraints required to provide the Services.
12
Based on your location, you may have control over your Personal Information, including:
Email info@healthvela.com with the subject “Privacy Request.” State the request you would like to make. We will need to verify your identity before processing requests. We may verify through email or by requesting account details. We aim to respond within 30 days (or sooner if required by law). We delete any new Personal Information collected solely for verification as soon as practical after processing your request, except as required by law.
Deleting uploads: If you are signed in, you can delete individual lab, imaging, or health-record uploads from Records in the app, or by emailing us.
Deleting your account: You can permanently delete your Vela account and
associated health data from Account settings in the app (type DELETE to confirm)
or by emailing info@healthvela.com from your
registered address. Account deletion removes your profile, check-ins, chats, plans,
lab/imaging uploads, and authentication credentials from active systems.
Waitlist: To leave the marketing waitlist, email info@healthvela.com.
Where legally permitted, you may appoint an authorized agent. We will require verification that you granted permission and may require you to verify your own identity directly with us. If you have concerns, you may complain to your local data protection authority. We do not make automated decisions about you that create legal effects or similarly significantly affect you within the meaning of applicable law.
13
Use of and access to your Personal Information by us is restricted to authorized individuals who need to know that information to provide the Services, and who are expected to protect Personal Information. Our service providers and business partners are contractually bound to maintain the confidentiality of Personal Information and may not use it for unauthorized purposes.
14
Vela Wellness, LLC is based in the United States, and a majority of the Vela Platform’s technical infrastructure and data hosting is located in the United States. To provide the Services, we will likely transfer your Personal Information outside your country of residence, including to the United States, where it will be stored and processed in accordance with this Notice. We may also transfer information to service providers with operations in other countries. Privacy laws in those countries may differ from those in your country of residence, and information may be available to government authorities under lawful process.
When we transfer Personal Information outside your country of residence, we do so in accordance with applicable law and take appropriate steps to protect it (for example, Standard Contractual Clauses approved by the European Commission, where applicable). By using the Services, you acknowledge the international transfer, storage, and processing of your information as described in this Notice. For data subjects in the EU, EEA, Switzerland, and UK, see also Supplemental European privacy rights.
15
Children under 13. We allow under-13 accounts only with verifiable parental or guardian acceptance. At signup (or age confirmation), we collect the child’s date of birth and a parent/guardian email. We email the parent a secure link to review this Notice and our Terms and to accept or decline. Until a parent accepts, the child’s account stays locked and cannot use product features. If a parent declines, or if we learn an under-13 account lacks valid consent, we will delete or disable the account and related Personal Information promptly. Parents or guardians may email info@healthvela.com with subject “Under-13 Account” at any time.
Teen users may use the Services if they have capacity under applicable law and, where required, parental or guardian permission. Parents and guardians remain responsible for supervising a minor’s use of health and lifestyle features.
Parents or guardians may contact info@healthvela.com at any time about a minor’s account.
16
We reserve the right to modify or update this Notice at any time. Changes are effective upon posting of the modified Notice. If we make material changes, we will update the “Effective date” / “Last updated” date at the top of this page and use reasonable efforts to notify you via the Services or email before changes become effective. We encourage you to review this Notice periodically. By continuing to use the Vela Platform and Services after changes are made, you agree to the updated Notice to the extent permitted by law.
17
If you have questions about your account, the Vela Platform, this Notice, or how your Personal Information may be used, contact us:
Email: info@healthvela.com
Subject: Privacy Request
Vela Wellness, LLC (operating as Vela Health)
Attn: Privacy / Legal
Email: info@healthvela.com
For a current registered mailing address (Delaware LLC), email the address above with subject
“Mailing Address Request” and we will provide it promptly.
If you contact us for assistance, we may need to verify your identity before fulfilling your request.
18
Effective date: September 4, 2026
The California Consumer Privacy Act, as amended by the CPRA (“CCPA”), and similar U.S. state laws provide residents with specific rights regarding Personal Information. This section describes those rights and how to exercise them. It does not apply to de-identified or aggregated data or publicly available information that is not Personal Information under applicable law.
We do not sell Personal Information and we do not “share” Personal Information for cross-contextual behavioral advertising as those terms are commonly understood under the CCPA. We do not use or disclose sensitive personal information for purposes other than providing the Services, security, and other permitted business purposes.
To exercise rights, email info@healthvela.com with subject “Privacy Request.” We may deny requests if we cannot verify you or your agent’s authority, or if an exception applies. We endeavor to respond in a timely, portable format unless a request is excessive, repetitive, or manifestly unfounded.
| Category | Examples / notes |
|---|---|
| Identifiers | Name, email, account ID, IP address, online identifiers. Sources: you; Google/Apple Sign-In; service providers. Disclosed to service providers. Sold? No. |
| Protected classification characteristics | Age and sex/gender you choose to provide. Sources: you. Sold? No. |
| Commercial information | Subscription plan and billing status. Sources: you; Stripe. Sold? No. |
| Internet / electronic activity | App and site usage, device/browser data, diagnostic logs. Sold? No. |
| Geolocation data | Approximate location from IP or country/zip you provide. We do not collect precise GPS geolocation for advertising. Sold? No. |
| Audio, electronic, visual | Optional profile or progress photos; images of labs or medication labels you upload. Disclosed to AI inference and storage providers as needed to provide the feature. Sold? No. |
| Inferences | Insights drawn from check-ins and plans (e.g., pattern teasers, guide suggestions). Used to personalize educational features. Sold? No. |
| Sensitive personal information | Health and lifestyle data you input. Used to provide the Services. Disclosed to service providers / AI inference providers under contract solely to operate features you request. Sold? No. Not used to train AI models on PHI. |
| Communications data | Support emails, waitlist messages, in-product questions. We do not share user questions or conversations with other users or advertisers. Sold? No. |
Do Not Sell or Share My Personal Information. Because we do not sell or share Personal Information for cross-context behavioral advertising, this opt-out is not applicable in the ordinary course; you may still contact us at info@healthvela.com with any privacy request. Where required by law, we will process opt-out preference signals (such as Global Privacy Control) for the browser/device that sends the signal.
19
Effective date: September 4, 2026
If you are a resident of the European Economic Area, United Kingdom, or Switzerland, the following applies in addition to the rest of this Notice, subject to exemptions provided by law.
The data controller for the Vela Platform and Services is Vela Wellness, LLC. Contact: info@healthvela.com.
We process Personal Information only as necessary for performance of a contract with you or steps prior to entering a contract; on the basis of your consent; to comply with a legal obligation; or as otherwise permitted by applicable law, including legitimate interests in securing and improving the Services, preventing abuse, and internal operations (balanced against your rights).
Subject to GDPR, UK GDPR, and Swiss law, you may have rights of access, rectification, erasure, restriction, portability, objection (including to processing based on legitimate interests or for direct marketing), and withdrawal of consent. You may lodge a complaint with your local supervisory authority. Rights are not absolute; we may refuse requests where exceptions apply. We will not discriminate against you for exercising such rights.
In accordance with the GDPR, if we become aware of a Personal Information breach likely to result in a risk to individuals’ rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, and notify affected individuals where required.
Except as described in this Notice or provided under applicable privacy laws, there is no charge to exercise your legal rights. If requests are manifestly unfounded or excessive, we may charge a reasonable fee or refuse the request and notify you of the reason.
This Notice is intended to disclose our practices clearly; it is not legal advice. Have qualified counsel review it for your entity, product stage, and jurisdictions.