Your privacy rights
VegaLoop’s published policies are the Privacy Policy, the Consumer Health Data Privacy Policy, and the Terms of Service. This page covers the parts you are most likely to act on. If anything here and the policies differ, the policies apply.
What you can do yourself
| Action | Where | What happens |
|---|---|---|
| Download everything | Settings, Account, Export my data | One JSON file with your profile, biometrics, workouts, meals, goals, dashboard history, billing, and connected-device records, generated on the spot. See Your account and data. |
| Delete your account | Settings, Account, Delete account | Your profile, sign-in record, and every section’s data, including uploaded photos and raw device files, are removed from the live systems. It cannot be undone. |
| Stop a device sharing data | Settings, Connect a Device, then Disconnect on the card | New data stops. Data already synced stays unless you delete it or ask for it to be removed. VegaLoop revokes its access with the provider where the provider supports that. |
| Revoke Google’s access | Google Account, Security, Third-party access | Deleting your VegaLoop account does not revoke the grant on Google’s side; remove it there. |
| Correct your details | Profile and Settings | Name, date of birth, gender, address, units, timezone, and targets can be changed at any time. |
What you can ask for by email
Where the law that applies to you gives you these rights, send your request to support@vegaloop.com from the email address on your account. Say which account the request is about and what you want done.
| Request | What it means |
|---|---|
| Access | A copy of the personal data VegaLoop holds about you, and the categories of data, sources, purposes, and third parties involved. |
| Correction | Fix personal data that is inaccurate or incomplete. |
| Deletion | Remove your personal data. The account deletion button does this for your whole account; email is for anything it does not reach. |
| Portability | Your data in a structured, machine-readable format. The export file provides this. |
| Objection and restriction | Object to processing, or ask VegaLoop to limit processing while a dispute about accuracy or lawfulness is resolved. |
| Withdraw consent | Where processing relies on your consent, withdraw it. For a connected device, disconnecting does this. |
| Appeal | Where the applicable law provides an appeal, VegaLoop tells you how when it declines or limits a request. |
California residents can ask what personal data is held about them up to twice in a rolling twelve months. Residents covered by Washington’s My Health My Data Act and similar laws can ask whether their consumer health data is collected, shared, or sold, access it, withdraw consent, and ask for its deletion.
VegaLoop responds to verified requests within the time the applicable law requires. When a request is declined or limited, the applicable law decides whether you are told why and how to appeal.
Verifying who is asking
VegaLoop may ask for information needed to confirm your identity, or your authority to act for someone else, before acting on a request. A request that cannot be verified, that is not specific enough, that is repetitive or excessive, or that would harm another person’s rights, privacy, or security can be declined where the law allows. Data that must be kept to meet a legal obligation, resolve a dispute, prevent fraud, or complete a transaction may be retained.
What VegaLoop does not do with your data
- VegaLoop does not sell personal data or health and wellness data to anyone.
- VegaLoop does not use health and wellness data for targeted or cross-context behavioural advertising.
- Health data is shared only with the service providers needed to run VegaLoop, with recipients you direct a sharing action to (such as a recipe link you share), where the law requires, in a business transaction subject to the same protections, or with your consent.
- Where the law requires it, a browser’s opt-out preference signal is honoured as a request to opt out of sale or sharing.
- Device data from Google Health is used only for the features you can see, never for advertising, credit, or lending decisions, and is not passed to any third party except VegaLoop’s cloud providers as needed to run the service.
Backups and deletion
| Copy | Kept for |
|---|---|
| Database recovery and daily backups | 35 days |
| Weekly backups | 180 days at most |
| Sign-in directory exports | 90 days |
Backups exist only to restore the service after an outage, fault, or attack. When you delete your account, or VegaLoop deletes data at your request, the data leaves the live systems promptly and stays in backups only until each one expires, at most 180 days. If a backup made before the deletion is ever restored, the deletion is applied again to the restored data.
Invoices and payment records stay with Stripe as the financial record. Usage data kept for security or legal reasons may be held longer, as the Privacy Policy describes.
Users under 18
VegaLoop is not intended for children under 13 and does not knowingly collect their data. If you learn that a child under 13 has an account, email support@vegaloop.com and VegaLoop will remove the child’s information.
People aged 13 to 17 may use VegaLoop only with the consent and supervision of a parent or legal guardian who agrees to the Terms of Service.
Health data and HIPAA
VegaLoop is a general wellness platform, not a healthcare provider or a HIPAA covered entity, and data you put in it is not protected by HIPAA unless VegaLoop says so in writing. The Terms ask you not to upload medical records, diagnoses, or laboratory results that VegaLoop does not need. See VegaLoop and your health.
Questions the policies do not answer
Changing the email address on an account, adding a password to a Google or Apple account, and requests about another person’s account have no self-service path and no published procedure. Contact support from the email on the account and describe what you need.