Last updated: June 9, 2026

This Consumer Health Data Privacy Policy explains how Vana Labs, Inc., dba "VANA" ("we," "us") collects, uses, shares, and protects "consumer health data" as defined under applicable U.S. state laws, and the privacy rights and choices you have with respect to such data, in connection with our AI-powered coach and related products or services (collectively, the "Services").

VANA delivers its Services through third-party messaging platforms, including iMessage, Facebook Messenger, WhatsApp, and Telegram. This policy applies to all consumer health data we collect and process through these channels and through authorized integrations with third-party health services.

This Consumer Health Data Privacy Policy supplements our Privacy Policy.

Some consumer health data is private to your account and used only to operate the Services. Other consumer health data is data you have explicitly chosen to publish on your public VANA profile through our biometric streaming feature, which has a different privacy posture explained in the "Health Data You Choose to Make Public" section below. Before running any user-created Protocol, please also read our https://vana.so/disclaimer.

Categories of Consumer Health Data We Collect

We collect the following categories of consumer health data:

• Wearable device and biometric data, including heart rate, heart rate variability (HRV), sleep duration and quality, daily activity, step counts, calorie expenditure, respiratory rate, blood oxygen saturation (SpO2), stress indicators, and body temperature, collected through authorized integrations with wearable health platforms such as Whoop, Oura, Garmin, and Apple Health.
• Lab results and biomarker data, such as blood panel results, metabolic markers, and other clinical or at-home diagnostic panel screenings that you share with us through the Services.
• Self-reported health information, including symptoms you describe, health goals, lifestyle habits, dietary preferences, food allergies or intolerances, and other personal health details you communicate to our coach through messaging conversations.
• Supplement information, including the names of supplements you take, dosages, and administration schedules that you disclose to us in the course of using the Services.
• Health information derived or inferred from non-health data, such as health insights, risk scores, personalized health trends, and individualized recommendations that we generate from the information you provide and the data we receive through authorized third-party integrations.

Health Data You Choose to Make Public

The Services include an optional feature that lets you stream biometric data from health and wearable providers (including, without limitation, Oura, Strava, Apple Health, and Garmin) to your public VANA profile, where the selected data is visible to anyone on the internet.

Affirmative, per-connection consent. Public streaming is off by default. When you click "Connect" for any provider, the Services display a consent prompt that explains, in plain language, that the data from that provider will appear on your public profile. Your decision to proceed past that prompt is your affirmative, informed consent to the public disclosure of that consumer health data, as required by applicable consumer health data laws, including, where applicable, the Washington My Health My Data Act, the California Confidentiality of Medical Information Act, and the Nevada Consumer Health Data Privacy Law. Each provider is consented to separately.

Per-metric controls. After connecting a provider, you can choose which specific metrics (for example, sleep duration, heart rate variability, body weight, step count, body temperature) appear on your public profile, and you can change those selections at any time.

Multiple ways to hide your data. You can hide public bio-streaming at any time via (a) a one-click Hide/Unhide toggle next to the biometric cards on your public profile, which immediately hides every bio card from public view; (b) disconnecting any individual provider in Settings → Connections; or (c) the "Show bio-streaming data publicly" master toggle in your profile settings, which disables public bio-streaming for your entire account.

Public means public. Once consumer health data is displayed on your public profile, it is no longer subject to the confidentiality protections of this policy with respect to the public. It can be viewed, screenshotted, copied, scraped, indexed by search engines, archived by services such as the Internet Archive, and redistributed by third parties. Stopping public display on the Services does not retract copies already obtained by third parties. You should only enable public streaming for data you are comfortable having exist on the internet permanently.

No sale. VANA does not sell your consumer health data — including data you have chosen to make public — to data brokers or for advertising purposes. We do not control whether third parties who view your public profile choose to copy, store, or redistribute that data.