GDPR & Your Data Rights
Effective: 1 September 2026 · Version 2.0 · Vitantra LLC · vitantra.ai
This page explains the data-protection rights available to you under the EU General Data Protection Regulation and under United Kingdom data-protection law, and how to exercise them with Vitantra LLC.
Which Rules Apply to You
The EU GDPR applies in the European Economic Area (EEA). In the United Kingdom, the UK GDPR and the Data Protection Act 2018 apply. The two regimes are closely aligned, but they are not identical in every respect, so the rights below apply to you as your own regime provides for them. Vitantra LLC is the controller of the personal data described in our Privacy Policy.
Your Rights
Subject to the conditions and exceptions in the applicable law, you have the right to:
- Access (Article 15): obtain confirmation of whether we process your personal data and receive a copy of it, together with information about how it is used.
- Rectification (Article 16): have inaccurate personal data corrected and incomplete data completed.
- Erasure (Article 17): ask us to delete your personal data where one of the grounds in the law applies.
- Restriction (Article 18): ask us to limit how we use your personal data in the circumstances the law sets out.
- Data portability (Article 20): receive personal data you provided to us in a structured, commonly used, machine-readable format where the right applies.
- Objection (Article 21): object to processing based on our legitimate interests, and object at any time to processing for direct marketing.
- Automated decision-making (Article 22): not to be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. Vitantra’s AI-generated plans and companion responses are wellness suggestions and are not intended to be decisions of that kind.
Health and Wellness Data
Some of the information you may give Vitantra — such as wellness goals, body measurements, logged nutrition, or data from a health integration you connect — can be special-category data under Article 9 where the applicable law treats it that way. Where we process such data and a further condition is required, we rely on an appropriate Article 9 condition for that specific processing, such as your explicit consent to it. Creating a Vitantra account does not by itself amount to explicit consent to special-category processing.
Consent and Withdrawal
Where consent is the legal basis for a particular processing activity, you can withdraw it at any time — for example by disconnecting a health or wearable integration, changing the relevant setting, or contacting us. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. Consent is not the legal basis for everything we do: much of the Service is provided on the basis of our contract with you, our legitimate interests, or a legal obligation, as set out in the Privacy Policy.
Service Providers
We use service providers to host, support, and operate Vitantra, including cloud infrastructure, payment processing, AI model providers, and support tooling. Where a provider processes personal data on our behalf, we put in place the data-protection terms required by applicable law for that relationship. We do not claim that every provider operates under one identical agreement, and some providers act as independent controllers under their own terms.
International Transfers
Vitantra is operated from the United States, so personal data may be transferred to or accessed from outside the EEA or the United Kingdom. Where such a transfer requires a safeguard under applicable law, we rely on an appropriate transfer mechanism recognised for that transfer, such as an adequacy decision or standard contractual clauses. We do not claim that every transfer relies on the same mechanism.
Personal Data Breaches
Where a personal data breach is likely to result in a risk to the rights and freedoms of individuals, we will notify the competent supervisory authority as required by applicable law, without undue delay and, where feasible, within 72 hours of becoming aware of it. Where a breach is likely to result in a high risk to you, we will also inform you as the law requires.
How to Exercise Your Rights
To make a request, email support@vitantra.ai and tell us which right you want to exercise. Where the Vitantra app offers a self-service option, such as account deletion or a data export, you can use that option directly instead.
We respond without undue delay and generally within one month of receiving your request. Where a request is complex, or where you have made a number of requests, that period may be extended as applicable law permits, and we will tell you within the first month if that happens. We may ask you to verify your identity before we act on a request. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive, in which case the law allows us to charge a reasonable fee or to refuse the request.
Supervisory Authority
You have the right to lodge a complaint with a data-protection supervisory authority. In the United Kingdom this is the Information Commissioner’s Office (ICO) at ico.org.uk. In the EEA, you can complain to the supervisory authority in the country where you live, where you work, or where the issue arose. We would appreciate the chance to address your concern first.
Data Protection Contact
Vitantra has not appointed a statutory Data Protection Officer. Data-protection enquiries, including rights requests, should be sent to our Data Protection Contact at support@vitantra.ai.
Contact & Questions
For any questions about this document, please reach us at support@vitantra.ai or visit our Contact page.