How Your Data Works

What Happens When You Upload a Report

When you upload a lab report PDF to MyVitalSync, here is exactly what happens — in order:

• Step 1 — Text extraction: We extract the raw text from your PDF on our servers. No human reads your report at any point in this process.
• Step 2 — Report classification: We classify the report type — blood work, urinalysis, or imaging — using pattern matching. No AI is used for this step.
• Step 3 — Marker normalization: For blood and urine reports, an AI model identifies each biomarker by name, maps it to a standard code (LOINC), and extracts its value, unit, and reference range.
• Step 4 — Storage: Only the extracted marker data is stored in your account — name, value, unit, reference range, collection date, and lab source. The original PDF is discarded immediately after extraction and is never stored on our servers.
• Step 5 — Scoring: Your health score and biological age estimate are computed from the stored marker values.

Your PDF is never stored. Once the text has been extracted and the markers identified, the file is gone.

What We Store

• Biomarker values, units, reference ranges, and flags extracted from your reports
• Collection date and lab source (e.g. Quest Diagnostics, LabCorp)
• Your health profile: name, date of birth, sex, height, weight, blood group
• Computed scores: health score, biological age estimate, domain scores
• AI-generated summaries: Health Coach narrative, Care Brief (family profiles only)
• Wearable data context: recovery, HRV, sleep from Whoop or Apple Health — held in memory during your session, not permanently stored

What We Do Not Store

• Your original PDF lab reports — discarded immediately after extraction
• Photos of your reports
• Your Social Security number, insurance information, or government IDs
• Your location
• Browsing history or behavioral tracking data

How AI Is Used

MyVitalSync uses AI in three specific places:

• Marker extraction: Claude Haiku (via AWS Bedrock) identifies and normalizes biomarker names and values from your lab report text.
• Health Coach summary: Claude Sonnet (via AWS Bedrock) generates your personalized Health Coach narrative and responds to your chat questions, using your stored marker data as context.
• Care Brief: Claude Haiku generates a structured health summary for family profiles, designed to be shared with a caregiver or doctor.

All AI processing happens through AWS Bedrock, which is covered by our HIPAA Business Associate Agreement with Amazon Web Services. Your data is never used to train AI models.

Who Can See Your Data

• You: Only you can access your health data, authenticated via your account credentials.
• Family profiles: If you create family profiles, you manage their data under your account. You control who has access.
• Care Brief sharing: If you share a Care Brief, a time-limited link is generated. Only someone with that link can view it, and it expires after 7 days.
• Samvion Labs: We can access your data only for support and debugging purposes, and only with your explicit permission.
• No one else: We do not sell, share, or broker your health data with any third party.

How to Delete Your Data

You can delete individual lab reports from the Reports screen at any time. To delete your entire account and all associated data permanently, go to Settings → Account → Delete Account. Deletion is irreversible and completes within 30 days.

Security

All data is encrypted at rest (AES-256) and in transit (TLS 1.2+). Your health data is stored in Amazon RDS, covered by our AWS HIPAA BAA. Authentication is handled by Supabase — no health data is stored in the authentication system.

Questions

If you have questions about how your data is handled, contact us at privacy@myvitalsync.app.