Healthcare Data Protection
As a healthcare-focused platform, we understand the critical importance of protecting sensitive health information. We implement strict security measures and comply with healthcare privacy regulations to safeguard your clients' data.
Data We Collect
Practice Information:Your professional details, contact information, and practice settings.
Client Data:Information you enter about your clients including consultation notes, progress data, and treatment plans (stored securely and accessible only to you).
Usage Analytics:How you use our platform to improve our services (anonymized data only).
Verification Documents:For business accounts, the documents you provide so we can verify your business before your page is published, such as a tax certificate or a work permit.
Your Public Page
We write the texts of your public page with AI, from the details you give us: your answers in the setup wizard and, if you point us to one, your page on another site, such as your profile on a doctor directory or your own website. From that page we take only facts, such as your education, certificates and areas of work, and never copy its texts. We put its photos on your page only with your permission: you see them before they go live and can remove them at any time. Your details go to our AI provider, OpenAI, only to write your page, and OpenAI processes them on our behalf under its data processing agreement with us. You can change any text on your page at any time. If you lock AI in your account's security settings, none of this is sent.
Finding Your Professional Profiles
When you sign up, we look for your professional profiles on the internet, so we can fill in your page for you: health directories in your country, Google Maps, your own website, and the Instagram and LinkedIn results that a search shows for your name. Your name, profession, city and country go to our search service, Serper (or SerpApi, if Serper is unavailable), and to Google Maps, only to run these searches. We open the pages we find ourselves or, when a page needs a browser to show, through Firecrawl, and OpenAI reads them on our behalf, as described above. We keep only the facts we find, such as your title, areas of work, address and phone number, together with the address of the page they came from, never the page's text. You see them in the setup wizard: what you confirm goes on your profile, and what you don't confirm is deleted. If you lock AI in your account's security settings, we don't search. You can ask us at any time what we hold about you and to delete it.
Emails From Us
Account emails: Messages about your account and your work in Vitena: sign-in and security, bookings, payments and invoices, plan changes and legal notices. You receive these for as long as you have an account.
Reminders and suggestions: Now and then we email you a reminder or a suggestion to help you get started and get more out of Vitena, for example to finish setting up your account or your page. They are only ever about Vitena.
Turning reminders off: Every reminder has a link at the bottom that turns reminders off with one click, free of charge. You can turn them back on from the same page, and account emails keep coming either way. We keep a record of the emails we send and whether they were delivered, so that no reminder goes to an address our emails cannot reach or that has turned reminders off.
Measuring reminders: When you click the link in a reminder, we record the click, and we note whether the step it suggested was taken afterwards, for example publishing your page. This shows us which reminders help, so we can stop sending the ones that don't. We don't track whether you open our emails.
Google Calendar Integration & Google User Data
When you choose to connect your Google Calendar, Vitena accesses limited Google user data solely to provide appointment scheduling. Our use of information received from Google APIs adheres to the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including its Limited Use requirements.
Data we access:With your explicit consent we request the Google Calendar events scope (calendar.events), the Google Meet space settings scope (meetings.space.settings), and your Google account email address. We do not access your contacts, files, emails, or any other Google data.
How we use it:We create, update and delete events on your connected calendar for your confirmed appointments (adding the client as a guest), generate and configure a Google Meet link for online appointments, and read existing event times to detect conflicts and prevent double-booking. Google user data is used only to provide these scheduling features and for no other purpose.
Data sharing:We do not sell your Google user data and do not share it with third parties. It is processed only on our own infrastructure (Amazon Web Services, EU region) to operate the calendar feature. We never use Google user data for advertising or to train AI or machine-learning models.
Storage & protection:We store only the minimum required: an OAuth refresh token encrypted at rest with AES-256, your connected Google account email, and the identifiers of the calendar events we create. Short-lived access tokens are never stored. We do not copy or retain the contents of your calendar.
Retention & deletion:The connection is kept until you disconnect it in Profile Settings → Work Schedule, delete your Vitena account, or revoke access at myaccount.google.com/permissions. Disconnecting or deleting your account immediately removes the stored refresh token. You can also request deletion at any time by emailing our support team.
Cookies and Tracking
Essential Cookies:Required for platform functionality, login sessions, and security.
Analytics Cookies:Help us understand platform usage to improve features for nutrition professionals (only with your consent).
You can manage cookie preferences through our cookie banner or browser settings.
Data Security & Encryption
All data is encrypted in transit with TLS. Uploaded files are stored with AES-256 server-side encryption and are served only through short-lived signed links. Our servers run on managed AWS infrastructure in the EU (Frankfurt), and the database sits on a private network that is not reachable from the internet.
We maintain detailed audit logs of all data access and implement strict access controls to ensure only authorized personnel can access systems.
Data Ownership & Portability
You retain full ownership of all client data entered into our platform. You can export your data at any time in standard formats. Upon account termination, your data will be securely deleted according to your retention preferences.
Third-Party Integrations
We only use trusted services, and only for what Vitena does for you. Integrations you add yourself, such as Google Calendar, connect only when you choose to. Services that work for us in the background, such as hosting, email, AI and search, receive only the data they need for that and process it on our behalf.
Your Rights
You have the right to access, update, or delete your account information. You may also request data portability or account termination at any time through your account settings or by contacting our support team.
Contact Our Privacy Team
For privacy-related questions or data protection concerns, contact us at:info@vitena.care
We respond to privacy inquiries as quickly as possible.