Privacy Notice

VitaSignal, LLC, PO Box 1375, Stockbridge, GA 30281, United States. Contact: info@vitasignal.ai(including privacy and deletion requests).

Clinical AI Buyer Readiness is a private, unpublished preview. A submitting company describes one clinical-AI product or use case and supplies non-PHI evidence and claims. The service organizes that material into a persistent Buyer Readiness Record. It does not independently verify supplied content and it issues no proceed/pause style outcome.

• Account and contact details, such as an email address and sign-in identity. Credentials are handled by the authentication provider, not stored as ordinary application workspace content.
• Workspace content the company enters: product name, version, intended use, target user and setting, claims, descriptions of evidence sources, and related assessment answers.
• Generated records, snapshots and change history derived from that content.
• Generated example data, which is fictional and labeled "Generated example" and "No PHI".

Purchases are processed by Paddle.com as merchant of record. Card and billing details are entered in Paddle's checkout and are not stored by this service. The service stores the Paddle transaction and customer identifiers, the item, amount, currency, status, and purchase and refund dates, to unlock the purchased record and handle refunds. Paddle's own privacy notice applies to the data it collects.

VitaSignal, LLC processes personal data on the following legal bases:

• Contract performance. Account and sign-in details, workspace content, and purchase records are processed to create and operate your account, provide the readiness-record service you request, and unlock purchased records.
• Legitimate interests. Audit records, security logging and retention-limit enforcement are processed to keep the service secure, prevent fraud and misuse, and demonstrate what happened to data, balanced against your rights.
• Consent. Optional AI drafting runs only when you explicitly request it. You can decline without affecting the rest of the service.
• Legal obligation. Purchase and refund records are kept where required for tax, accounting and consumer-law purposes.

The service is designed for non-PHI, non-patient-level material only. Do not enter:

• Protected health information (PHI) or patient-level data of any kind.
• Actual clinical content, patient records, images or case details.
• Confidential information the submitter is not authorized to share.

There is no technical mechanism that reliably detects or removes such content, so this boundary is enforced by use, not by filtering.

Within this preview, submitted content is used to build, display and version the submitting account's readiness records and its own operational view. Essential hosting and authentication services process data to operate the preview. The hosting provider's public privacy policy (lovable.dev/privacy) states that it does not use data held by apps built on its platform (such as accounts and database records) for model training. That statement does not by itself establish gateway logging or retention practices, or how builder content is used. Optional analytics and tracking are not enabled for this service.

When you explicitly request an AI draft, the server sends the selected assessment's use-case context, claim text and evidence-source descriptions to Lovable AI Gateway using an OpenAI model. This is a review of supplied text and metadata, not an inspection of source documents or underlying data. Use only non-PHI material you are authorized to send to these providers.

AI drafts are displayed separately and are not saved as evidence, decisions or part of the record export. The request uses a disabled response-storage setting; that setting alone does not establish provider retention, deletion, model-training restrictions or processing location, which are governed by the providers' own terms.

Content is stored in the service's managed cloud database. The submitting account can view its own records in the application; provider and administrative access is limited to what is needed to operate and support the service. On October 6, 2026, the project's Cloud settings displayed the database location as Europe (Ireland). That observation does not establish the locations used by authentication, AI processing, logs or backups, or a contractual residency guarantee.

VitaSignal, LLC applies technical and organisational measures appropriate to the size of this service, including:

• Encrypted connections (HTTPS) between your browser and the service.
• Authentication handled by a dedicated managed authentication provider; passwords are not stored as ordinary application content.
• Row-level access rules in the database so each account can read and change only its own workspace records.
• Administrative actions (deletions, closures, restores) restricted to checked administrator roles and recorded in audit entries.
• Access by VitaSignal and its providers limited to what is needed to operate and support the service.

No method of transmission or storage is completely secure; these measures reduce, but cannot eliminate, risk.

The owner of an assessment can request its deletion from inside the app. An administrator then carries out the deletion, which removes that assessment, its claims, evidence entries, change entries and saved snapshots. The related product and organization entries are kept. Each request leaves an audit entry recording who asked, why, and how many items were removed. Ordinary app actions cannot edit or delete audit entries; audit records are kept for 6 years and then deleted.

Deletion does not purge provider backups. The hosting provider's general documentation describes daily database backups kept for a limited period, but how long backups of this service are kept, and when removed data leaves them, has not been confirmed for this account. Until it is, the audit entry records backup retention as unknown, pending provider verification, and no backup expiry is marked as confirmed.

• Account closure: workspace records (organizations, products, assessments, claims, evidence entries, change history and saved snapshots) are removed from the workspace immediately and held in a recovery archive for 30 days, during which VitaSignal can restore them on request. After 30 days the scheduled retention process purges the archive. Sign-in account removal is a separate administrator action after purge.
• Contact messages are deleted automatically 12 months after receipt, or sooner on request.
• Deletion and closure audit records, which contain counts and dates but not record content, are kept for 6 years and then deleted.
• Provider backups are not purged by these processes. Removed data may remain in provider backups until they expire; backup retention for this account has not been confirmed. If a backup is ever restored, completed deletions will be re-applied before access is reopened.

The preview is unpublished. The submitting account can download the current record as a dated JSON file containing claim/source links, source versions, evidence states and limitations. This is not a promise of any broader export or buyer-facing sharing feature.

Saved snapshots cannot be deleted through ordinary app actions; removal happens only through the logged administrator deletion described above. Backup retention and expiry for this account remain unconfirmed pending provider confirmation.

If this notice changes, the revised version will be posted on this page with a new effective date. Material changes will be highlighted on this page before they take effect.