Vitali Performance Therapy
1. Introduction and Scope
Vitali Performance Therapy is committed to protecting your privacy. This Privacy Policy describes how Vitali Performance Therapy, a California corporation (“Vitali,” “we,” “us,” or “our”), collects, uses, discloses, and protects information about you when you visit our website at www.vitalinow.com (the “Site”), use our patient portal and related applications (the “Platform”), communicate with us, or purchase or receive our services (collectively, the “Services”). This Privacy Policy is incorporated into and forms part of our Terms of Service. By using the Services, you acknowledge the practices described in this Privacy Policy.
Medical services available through the Platform are provided by independently owned professional entities and their licensed clinicians (the “Medical Groups”). Health information that you provide in connection with medical care may constitute protected health information (“PHI”) governed by the Health Insurance Portability and Accountability Act (“HIPAA”). PHI is subject to the Notice of Privacy Practices (“NPP”) made available to you at intake, and to the extent this Privacy Policy conflicts with the NPP with respect to PHI, the NPP controls. This Privacy Policy governs information we collect through the Site and in our administrative, technological, and commercial operations, including information about visitors and prospective patients who have not yet established care.
2. Information We Collect
The information we collect depends on how you interact with the Services. The table below describes the categories of personal information we collect and may have collected in the preceding 12 months, the sources and purposes of collection, and how long we keep each category. Categories marked with an asterisk are sensitive personal information under applicable state privacy laws.
| Category | Specific Information Collected | Source and Purpose | Retention Period |
|---|---|---|---|
| Identifiers | Name, date of birth, sex, mailing and shipping address, email address, telephone number, account credentials*, and government-issued identification* where required to verify your identity for certain treatments | Provided by you when you create an account, book an appointment, or complete intake. Used to provide the Services, manage your account, verify your identity, and communicate with you. | Duration of your account plus any period required by law |
| Consumer records (Cal. Civ. Code Section 1798.80(e)) | Name, contact details, and payment information | Provided by you at purchase. Used to process payments and maintain transaction records. Full card numbers are held by our payment processors, not on our systems. | Generally 7 years to satisfy tax, accounting, and dispute obligations |
| Health information* | Intake forms and questionnaires, symptoms and health goals, medical and medication history, laboratory and biomarker results, vitals and body measurements, treatment plans and prescription information, and communications with your care team | Provided by you and received from the Medical Groups, laboratories, and pharmacies involved in your care. Used to facilitate your evaluation and treatment and to coordinate testing, prescriptions, and shipments. Where this information relates to your care it is PHI governed by the NPP. | Clinical record retention periods required by state law, generally at least 7 years from last treatment |
| Commercial information | Purchase and subscription history and related transaction records | Collected automatically when you make a purchase. Used to administer subscriptions, provide support, and analyze and improve the Services. | Generally 7 years to satisfy tax, accounting, and dispute obligations |
| Internet or other electronic network activity | IP address, browser type, operating system, device identifiers, pages viewed, links clicked, and dates and times of visits | Collected automatically through the technologies described in Section 5 when you use the Site or Platform. Used to operate, secure, and improve the Site. | Generally no longer than 24 months |
| Geolocation data | Approximate location derived from IP address | Collected automatically when you use the Site. Used to confirm service availability in your state and for security. We do not collect precise geolocation. | Generally no longer than 24 months |
| Audio and visual information | Audio and video from telehealth visits, recorded only with your consent, and photographs you choose to submit | Provided by you during your care. Used by your Provider for evaluation, treatment, and documentation. | Retained as part of your clinical record |
| Communications and inquiries | Messages you send us through forms on the Site, email, text, or support channels | Provided by you. Used to respond to your inquiries, schedule your visit, and provide support. | Duration of your account plus any period required by law |
| Inferences | Insights we derive from the categories above to understand your goals and preferences | Derived from the information described above. Used to personalize your experience and, where drawn by your care team, to inform your treatment plan. | Retained with the underlying records from which they are drawn |
3. Sources of Information
We collect information directly from you when you complete forms, create an account, book an appointment, or communicate with us. We collect information automatically through the technologies described in Section 5. We also receive information from third parties in connection with your care and our operations, including laboratories that perform your testing, pharmacies that fulfill your prescriptions, the Medical Groups and their clinicians, identity verification services, payment processors, and the technology providers that operate the Site.
4. How We Use Information
We use the information we collect to provide and administer the Services, including creating and managing your account, scheduling visits, coordinating laboratory testing and prescription fulfillment, facilitating communications between you and your care team, and processing payments and subscriptions. We also use information to operate and improve the Site and Platform, provide customer support, personalize your experience, send administrative and transactional communications such as appointment reminders and shipping notifications, send marketing communications where permitted and subject to your right to opt out, detect and prevent fraud, abuse, and security incidents, comply with legal obligations, including clinical record retention requirements, and establish and defend legal claims. Where state privacy law requires consent for the collection or processing of sensitive information such as health data, we rely on the consent you provide at intake and through the Platform.
5. Cookies, Analytics, and Tracking Technologies
The Site uses cookies and similar technologies to operate core functionality, remember your preferences, and measure Site performance. We use only essential technologies necessary to operate the Site, and we do not use third-party advertising pixels or permit advertising platforms to collect information about your activity on the Site.
6. How We Disclose Information
We disclose information to the Medical Groups and their clinicians so they can evaluate and treat you, to pharmacies that fulfill your prescriptions, to laboratories that perform your testing, and to shipping carriers that deliver your treatments. We disclose information to service providers that perform functions on our behalf under contractual confidentiality obligations, including our electronic health record and telehealth platform, scheduling, online form, and communications vendors, payment processors, identity verification services, cloud hosting providers, and customer support tools. Where a service provider handles PHI, we require a business associate agreement as required by HIPAA. We may disclose information to comply with law, regulation, legal process, or a governmental request, to enforce our Terms of Service, to protect the rights, safety, or property of Vitali, our patients, or others, and in connection with a merger, acquisition, financing, or sale of assets, in which case we will require the recipient to honor commitments materially consistent with this Privacy Policy.
We do not sell your personal information, we have not sold personal information in the preceding 12 months, and we do not share your personal information for cross-context behavioral advertising. We never sell health information, and we do not use or disclose consumer health data for purposes prohibited by applicable law without your authorization.
7. Marketing Communications and Your Choices
If you subscribe to our marketing communications, you can opt out at any time. For marketing emails, follow the unsubscribe instructions included in each message. For marketing text messages, reply STOP to any message. You can also adjust your communication preferences in your account settings on the Platform or by contacting us at the information in Section 17. Please note that opting out of one channel does not automatically opt you out of another, so if you unsubscribe from marketing emails you may continue to receive marketing texts you separately opted into until you reply STOP. Even after you opt out of marketing, we will continue to send you transactional and care-related communications, such as appointment reminders, lab and shipment notifications, and billing notices. We do not share your personal information with third parties for their own direct marketing purposes.
8. Protected Health Information
To the extent your information is PHI, it is used and disclosed only as permitted by HIPAA and applicable state medical privacy laws, including the California Confidentiality of Medical Information Act, and as described in the NPP. This includes uses and disclosures for treatment, payment, and health care operations. Your medical records are maintained by the Medical Groups, and requests for access to or copies of your medical records may be made through the Platform or the contact information in Section 17.
9. Your Privacy Rights
Depending on your state of residence, you may have some or all of the following rights with respect to your personal information. The right to know and access the personal information we have collected about you, including the categories of information, sources, purposes, and the categories of third parties to which it has been disclosed. The right to obtain a portable copy of your personal information. The right to correct inaccurate personal information. The right to delete your personal information, subject to exceptions, including our obligation to retain clinical and transaction records for legally mandated periods. The right to opt out of the sale or sharing of personal information, of targeted advertising, and of certain profiling. The right to limit the use and disclosure of sensitive personal information to purposes permitted by law. The right not to receive discriminatory treatment for exercising your rights. Residents of certain states also have the right to appeal a decision we make on a rights request, and California residents have the specific rights described in Section 11.
10. Exercising Your Rights
You may exercise your privacy rights by emailing us at info@vitalinow.com, calling us at (866) 584-8254, or using the privacy request link in the Site footer. We will verify your identity before acting on a request, which may require you to confirm information we have on file, and we will respond within the time required by applicable law. You may designate an authorized agent to submit a request on your behalf, in which case we may require proof of the agent’s authority and verification of your identity. If we deny a request, residents of states that provide an appeal right may appeal by replying to our decision, and we will inform you of the outcome and of your right to contact your state attorney general. The Site footer includes a link titled Limit the Use of My Sensitive Personal Information, and we treat opt-out preference signals recognized by law, including the Global Privacy Control, as a valid request to opt out for the browser or device transmitting the signal.
11. Notice to California Residents
This Section supplements this Privacy Policy and applies to California residents under the California Consumer Privacy Act as amended by the California Privacy Rights Act (the “CCPA”). The table in Section 2 describes the categories of personal information we have collected in the preceding 12 months, the sources of each category, the purposes of collection, and the retention period for each category. We disclose these categories for business purposes to the categories of recipients described in Section 6. Sensitive personal information we collect consists of health information, account credentials, and government identification numbers, and we use and disclose sensitive personal information only for the purposes permitted by Cal. Civ. Code Section 1798.121(a) and the implementing regulations. Information governed by HIPAA or the California Confidentiality of Medical Information Act is exempt from the CCPA and is protected as described in Section 8. We do not knowingly collect or sell the personal information of minors, and the Services are not offered to anyone under 18.
12. Consumer Health Data
Certain states, including Washington and Nevada, regulate consumer health data that is not covered by HIPAA, such as health-related information submitted by Site visitors who have not established care. For residents of those states, the categories of consumer health data we collect, our purposes, sources, and disclosures are as described in Sections 2 through 6, and we collect and share consumer health data only with your consent or as necessary to provide services you request. You have the right to access your consumer health data, including a list of the third parties to which it has been disclosed, to withdraw consent, and to have your consumer health data deleted, and you may exercise these rights and appeal any denial using the methods in Section 10. We do not sell consumer health data, and we do not use geofencing around health care facilities to track consumers, send notifications, or collect health data.
13. Data Retention
We retain personal information for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, to comply with our legal obligations, to resolve disputes, and to enforce our agreements. Clinical records are retained for the periods required by applicable state law, which in many states is at least seven years from the last date of treatment, and longer where required. When personal information is no longer needed, we delete or de-identify it in accordance with our retention schedule and applicable law.
14. Security
We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption of information in transit and at rest, access controls, network security measures, and workforce training. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affecting your information occurs, we will notify you and the appropriate regulators as required by applicable law. Please help protect your account by using a strong password and keeping your credentials confidential.
15. Processing and Storage in the United States
The Services are offered only in the United States, and your personal information is processed and stored in the United States, where privacy laws may differ from those of other jurisdictions. If you access the Site from outside the United States, you acknowledge that any information you provide will be transferred to and processed in the United States as described in this Privacy Policy.
16. Children
The Services are intended for adults and are available only to individuals who are at least 18 years of age. We do not knowingly collect personal information from anyone under 18, and if we learn that we have done so we will delete it. If you believe a minor has provided us with personal information, please contact us at the information in Section 17.
17. Contact Us
If you have questions about this Privacy Policy or our privacy practices, or wish to exercise your rights, you can reach us at info@vitalinow.com, by phone at (866) 584-8254, or by mail at Vitali Performance Therapy, 333 City Blvd., 17th Floor, Orange, CA 92868.
18. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. When we do, we will post the updated version on the Site and revise the Last Updated date above, and where a change materially affects how we handle previously collected personal information we will provide additional notice or obtain consent where required by law. Your continued use of the Services after an update takes effect constitutes your acknowledgment of the updated Privacy Policy.