WellVitals
Privacy Policy
Effective date: 3 November 2026
Who we are
WellVitals is a mobile app that turns blood test reports, yours and your family's, into results you can track over time. It is run by Revelator Apps, a sole proprietorship of Rohan Agarwal, J-301, Maxblis White House, Sector 75, Noida, Uttar Pradesh 201301, India ("we", "us").
This policy covers the WellVitals apps for iPhone and Android and the services behind them. It explains what we collect, why, who we share it with, how long we keep it, and the rights you have.
Who can use WellVitals
WellVitals is only for adults aged 18 and over, in every country where it is offered. During sign-up we ask for your date of birth. If it shows you are under 18, you cannot continue, and we keep nothing you entered.
WellVitals is not offered in the European Economic Area, the United Kingdom or Switzerland.
Your account starts with your own profile. You can also keep the health records of family members you look after, such as a parent, partner or child, each in a profile of their own (see Family members).
Family members
An account can hold up to 5 profiles: yours and up to 4 family members'. Each profile has its own name, date of birth, sex, reports and results, and a report you upload goes to the profile you are viewing.
Only add someone whose health records you have permission to manage:
- an adult must have agreed to you keeping their records in WellVitals;
- for a child under 18, you must be their parent or legal guardian.
Family members don't have an account of their own: their profiles are seen and managed only through yours. You give us their data, and we handle it as this policy describes for yours, only to show you their results.
If you are a family member and want to know what we hold about you, or want it corrected or deleted, email us (see Your rights and choices).
What we collect
We collect what you give us, what we work out from your reports, and a small amount of technical data from the app. What we collect for each family member's profile is the same as for yours: their profile details, reports and results.
| Data | What it includes | Where it comes from |
|---|---|---|
| Account | If you sign in with Google, Apple or email: your email address and your Google or Apple account ID. If you continue without an account: a random user ID only. Apple may give us a private relay email instead of your real one. In either case, the country your phone's time zone is set to when you sign up (such as India for Asia/Kolkata), never your GPS location or address. | You, and Google or Apple when you choose them |
| Profile | Your name, date of birth and sex (female or male, used to pick reference ranges), and the same for each family member you add. Whether you or they are pregnant or postmenopausal, and since when, if you tell us. The health categories you pin to each profile's Home. Each profile's saved names: other spellings of the person's name that you confirm when a report doesn't match it. | You |
| Lab reports | The PDF files you upload, for yourself or a family member, with their file name, size and page count, and photos or other images of a report you choose, such as a screenshot, or pages you scan with your phone's camera, which the app makes into one PDF on your phone. It leaves out the details your phone stores in a photo, such as where and when it was taken. Everything printed in them, such as the patient's name, age, test names, values, reference ranges, lab name and dates. | You |
| Results | The results we read from your reports, the changes you make when you review them, answers you give (such as weeks of pregnancy or cycle phase), results you enter yourself, and notes you add. | You, and our processing of your reports |
| Feedback | The rating you give a processed report. | You |
| Crash reports | When the app crashes or hits an error: the error type, technical details of where it happened, your device model, operating system and app version. Crash reports never include your results or report contents. | The app |
| App usage | The screens you open and the main buttons you tap, such as choosing a file or saving results. How your uploads go: the file's size and page count, whether it was read, and how many results were found, matched to a test or still need something from you. This is linked to your user ID, email address and country, and to the ID of the profile you are viewing (a random ID, never a name), with your device model, operating system and app version. Before you sign up, it is linked to a random ID made by the app, which is joined to your account when you sign up. It never includes your results, report contents, names or file names. It is deleted with your account. | The app, and our servers |
| Marker page views | Which test's history page is opened, counted anonymously: with no user ID, device details or time of day, so a view can't be linked to you. | The app |
| App events for our ads | That the app was installed and opened, and that an account was created. Once each: the first time you pick a report to upload (a PDF, images or a scan), the first time you save a report's results, and your second new upload. Each ad shown in the app, with what it earned us. These come with your device's advertising ID (see below), device model, operating system, app version and IP address, and are sent to Meta to measure our ads on Facebook and Instagram (see Our ads on Facebook and Instagram). If you have signed in with an email address, they also come with that address, scrambled (hashed) by Meta's SDK on your phone. They never include your name, profile details, results, or anything about a file: not its name, size or contents. Nor do they include which screens you open. | The app |
| Advertising ID | Your device's advertising ID, read by Google's ad service and by Meta's SDK: on Android, and on iPhone only if you allow tracking. | Your device |
| Server logs | The time of each request to our servers, internal IDs, the result of the request and your IP address. | Our servers |
We do not collect your precise location, contacts or data from other health apps. The app sees only the images you choose as a report, never the rest of your photo library.
To scan a report, the app opens your phone's own document scanner: Apple's on iPhone, which asks you to allow the camera, and Google's, part of Google Play services, on Android. The scanner finds each page's edges and crops and straightens it on your phone, and the app gets only the pages you keep; nothing you scan leaves your phone until you confirm the upload, and then only as the PDF described above. Google's scanner sends Google technical data about how it runs, such as your device model, operating system, app version, how long it took and any errors, but never the camera's images or your pages.
The app also keeps a copy of your recent results and the reports you have opened on your phone, so it works offline. These copies are removed when you sign out.
How we use it
We use your data only to run WellVitals for you:
- Reading your reports. An AI model reads each report you upload. Our software then checks every value against the PDF's own text, matches each test to our list of markers, and marks results high or low against the lab's printed ranges.
- Picking the right ranges. The age, sex and pregnancy or menopause status of the person a report is about decide which of a lab's reference ranges applies. These details are not sent to the AI model.
- Checking whose report it is. We compare the patient name printed on a report with the first word of the name on the profile you upload to, and with that profile's saved names, and ask you when they don't match. A name you confirm then is saved, so later reports with it don't ask again.
- Showing your results. Trends, categories and Home are built from the results you have reviewed.
- Running your account. Signing you in, counting your uploads, and answering you when you contact us.
- Fixing problems. Crash reports and server logs help us find and fix errors.
- Improving the app. App usage shows us where people get stuck, such as which steps of adding a report are left unfinished, and how well we read reports. Marker page views show which tests people look at most.
- Paying for free uploads. Ads let us offer uploads at no charge (see Ads).
- Measuring our own ads. We advertise WellVitals on Facebook and Instagram, and Meta tells us how many installs, sign-ups and uploads those ads led to (see Our ads on Facebook and Instagram).
We process your data with your consent, which you give by creating an account and uploading your reports. We process a family member's data on the permission you tell us you have from them, or, for a child, on your consent as their parent or guardian (see Family members). You can withdraw consent at any time by deleting a family member's profile or your account (see Your rights and choices).
We never sell your data or your family members'. We never use reports or results for advertising, and we never send them to an ad service. We do not use your reports or results to train AI models, and OpenAI does not use data sent through its API to train its models.
Ads
WellVitals shows ads from Google AdMob.
Ads are shown to you, the adult using the app, whichever profile you are viewing. An ad request never contains anything from any profile's details, reports or results, so ads are never chosen using your health data or a family member's.
- On Android, Google may personalise ads using your device's advertising ID. You can reset it or turn off personalised ads in your phone's settings under Google > Ads ("Delete advertising ID").
- On iPhone, the app asks whether it may track you. If you tap Allow, Google may personalise ads using your iPhone's advertising identifier. If you tap Ask App Not to Track, ads are not personalised. You can change this any time in Settings > Privacy & Security > Tracking.
Google uses the data it receives under its own privacy policy: policies.google.com/technologies/ads.
Our ads on Facebook and Instagram
We advertise WellVitals on Facebook and Instagram. To know which of those ads lead to people using the app, the app includes Meta's SDK, which tells Meta when the app is installed and opened, when an account is created, the first time you pick a report to upload, the first time you save a report's results, and when you make your second new upload. It also tells Meta about each ad shown in the app, with what the ad earned us. Meta matches these events to its ads and shows us totals, such as how many installs or uploads an ad led to. It does not tell us who you are.
Meta receives only the events described in What we collect. It never receives your name, any profile's details, your reports or results, anything about a file or image you pick or upload (its name, size or contents), or which screens you open, so the events can't tell Meta anything about your health or your family's. They do come with your email address, if you have signed in with one, scrambled (hashed) on your phone before it is sent. When you sign out, the app stops sending it.
- On Android, the events include your device's advertising ID. You can reset it or delete it in your phone's settings under Google > Ads.
- On iPhone, the events include your advertising identifier only if you allow tracking. If you don't, Apple's own ad measurement counts the install without anything that identifies you.
Meta may also use these events to show you ads, on its own apps and elsewhere. You can stop that in your Facebook or Instagram settings, under Accounts Center > Your information and permissions > Your activity off Meta technologies. Meta uses the data it receives under its own privacy policy: facebook.com/privacy/policy.
Who we share it with
We share your data only with the service providers below, who process it for us under contract and only to run WellVitals.
| Provider | What it receives |
|---|---|
| Google Cloud | Your uploaded PDFs, the work of reading them, and our server logs |
| Supabase | Our database: your account, profiles, results and notes |
| Google Firebase Authentication | Your email address and Google or Apple account ID |
| Google Firebase Crashlytics | Crash reports |
| Google ML Kit (Android only) | If you scan a report: technical data about how the document scanner runs, such as your device model, operating system, app version and errors. Never the images or pages you scan. |
| OpenAI | The PDFs you upload, to read the results in them. Never anyone's profile details. OpenAI may keep them for up to 30 days to detect abuse, then deletes them. |
| PostHog | App usage, linked to your user ID, email address and country, and anonymous marker page views (see What we collect). Never your results or reports. PostHog doesn't keep your IP address. |
| Google AdMob | Ad requests, and your advertising ID on Android, or on iPhone if you allow tracking (see Ads) |
| Meta (Facebook and Instagram) | App events for our ads, with your advertising ID on Android, or on iPhone if you allow tracking, and your email address, hashed, if you have signed in with one (see Our ads on Facebook and Instagram). Never your name, results or reports. |
| Google Sign-In, Sign in with Apple | Used only if you choose them to sign in |
We may also disclose data when the law requires it, for example to a court or a government authority with legal power to ask, or to protect the rights and safety of our users.
If WellVitals is sold or merged, your data may pass to the new owner, who must keep to this policy or ask for your consent again.
When you share a report from the app, it goes to whoever you choose. We do not control what they do with it.
Where your data is stored
Reports, results and profiles are stored in India. Your sign-in details, crash reports, ad requests and the document scanner's technical data are handled on Google's servers worldwide, OpenAI reads your PDFs in the United States, PostHog stores app usage in the United States, and Meta handles app events for our ads on its servers in the United States and elsewhere.
How long we keep it
We keep your data while you have an account, and delete it when you ask us to.
| Data | How long we keep it |
|---|---|
| Account, profiles, reports, results and app usage | Until you delete your account |
| Everything, after you delete your account | Deleted within 30 days, every family member's profile included |
| Marker page views | Kept as anonymous counts, since they can't be linked to you |
| A report you delete | The PDF is deleted at once, and its results within 30 days |
| A family member's profile you delete | Its PDFs are deleted at once, and its profile details, reports and results within 30 days |
We may keep a record of an upload, without its contents, to count the free uploads you have used. We keep data longer only where the law requires it.
App events for our ads are kept by Meta under its own policy. They are not linked to your WellVitals account, so deleting your WellVitals account does not delete them. Signing out stops the app sending your email address, and resetting or deleting your advertising ID stops new events being linked to the old one.
Your rights and choices
Under India's data protection law, you have these rights over your personal data. You can use them for the family members' profiles in your account too.
| Right | How to use it |
|---|---|
| Know what we hold and who we share it with | Your reports and results are in the app. For a summary of everything we hold, email us. |
| Correct or update it | Edit results when you review a report, and pregnancy or menopause status and saved names in the profile's details. For a name, date of birth or sex, email us. |
| Delete it | Delete your account in Settings (see Delete your account), delete a family member's profile from its details in the app, or email us to delete a single report. |
| Withdraw consent | Delete your account, or a family member's profile for their data. This stops the processing, and does not affect processing that happened before. |
| Nominate someone | Email us to name a person who can use these rights for you if you die or cannot act. |
| Complain | Contact us. If you are not satisfied with our answer, you can complain to the Data Protection Board of India. |
If someone keeps your health records in WellVitals, or your child's, you have the same rights over that data even though the account isn't yours. Email us to ask what we hold, or to have it corrected or deleted. We may ask you to show that the records are about you, or that you are the child's parent or guardian.
We answer requests within 30 days, and grievances within 30 days. We may ask you to confirm your identity first, usually by writing from the email address you sign in with.
Security
We protect your data with:
- Encryption in transit (HTTPS for every connection) and at rest, for your files and our database.
- Sign-in checked on every request, and storage rules so each account can reach only its own files.
No system is perfectly secure. If a breach affects your data, we will tell you and the Data Protection Board of India as the law requires, and report it to CERT-In within 6 hours.
Children
WellVitals is for adults: only someone aged 18 or over can create an account and use the app. An adult can keep a child's health records in a family profile, as the child's parent or legal guardian (see Family members). The parent or guardian gives us the child's data, and we use it only to show them the child's results.
Ads are shown to the adult using the app and are never chosen using a child's data: nothing from a child's profile is sent to an ad service or to Meta.
If you believe a child is using WellVitals themselves, or that someone who isn't their parent or guardian has added a child's records, email us and we will delete them.
Not medical advice
WellVitals helps you keep track of your lab results. It does not diagnose or treat any condition. Talk to a doctor about your results.
Changes to this policy
We will post any change here with a new effective date. If a change affects how we use your health data, we will tell you in the app before it applies and, where the law requires, ask for your consent again.
Contact us
For questions about this policy or your data, use Contact us in the app's Settings, or email apps.revelator@gmail.com.
We will resolve your complaint within 30 days.