Version 2.0 · Last updated 5 October 2026
This page mirrors the in-app health-data consent you accept when you create your account (Profile → Privacy & data). The Privacy Policy below is that same consent; the Terms of Use follow it.
VitalBook is a service of Mobillium Bilişim Teknolojileri Ltd. Şti. (“VitalBook”, “we”), Hüseyinağa Mah. İstiklal Cad. Grandpera Blok No:56-58 D:5, Beyoğlu / İstanbul, Türkiye — the data controller (veri sorumlusu) for the processing described here, under both the Turkish Personal Data Protection Law no. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR). Contact: info@vitalbook.ai.
We have not appointed a Data Protection Officer; data-protection questions are answered at the address above.
The lab reports you choose to add to VitalBook contain health data — a special category of personal data. Specifically: biomarker names, measured values, units, reference ranges, sample and report dates, and the issuing laboratory’s name. It also covers the basic details you enter yourself, and they are not all used for the same thing, so this says exactly which does what. Your date of birth and sex select the reference range a result is read against where your report printed none, and let an explanation be about someone your age rather than about nobody. Your height, weight and lifestyle selections are stored and shown back to you on your own Profile screen; they do not currently affect any value, status or explanation. Every one of these is optional, and the app works without them.
Your phone reads the report file and removes your name, ID numbers, address, phone number and doctor’s name before anything is sent. The file itself never leaves your phone. A line that cannot be reliably cleared of identity is dropped whole and never sent.
The cleaned text of your report — with your name, ID numbers, phone, email and doctor’s name already removed on your phone — is transmitted encrypted (TLS in transit, AES-256 at rest) to our servers in your region. There, with the help of an AI provider, it is read once to extract your values and write the plain-word explanations. That provider only ever receives the nameless text, never your identity. The result is filed to your pseudonymous record — linked to your account identifier, never to your name.
We process this data only to: (a) read and structure the reports you add; (b) explain results in plain words and show trends over time; (c) maintain your record and compute your VitalPoint summary; (d) send you one notification per report when results are ready; (e) generate a doctor summary page when you explicitly request and share it.
Your health data is never used for advertising or marketing, never sold or rented, never shared with data brokers or insurers, and never used to train machine-learning models. We do not build profiles for any purpose other than showing you your own record. The app diagnostics described in section 12 never contain a value, a marker name, a report, or anything read from one.
We use vetted service providers acting under our instructions and data-processing agreements: cloud hosting in your region, a push-notification service, and an AI provider that reads the cleaned report text to extract values and write the plain-word explanations. Because your name, ID numbers, phone, email and doctor’s name are removed on your phone first, this provider only ever receives nameless values — never your identity — and it may process them on servers outside your country under contractual safeguards (standard data-protection clauses). It does not use your data to train its models. No recipient receives your name together with your health data. Separately, Google (Firebase) receives the app diagnostics described in section 12 — crash reports and which screens were opened — which carry no health data and are not joined to your record by us. We disclose data only if a law we are subject to compels it, and we will tell you unless legally barred.
Your record is kept for as long as your account exists. If you delete a report, its values are removed from your record within 30 days, including from backups. If you close your account or use Delete everything, your record and account data are permanently erased within 30 days.
Under KVKK Art. 11 you may, at any time: learn whether we process your personal data; request information about it if we do; learn the purpose of the processing and whether it is used in keeping with that purpose; know the third parties to whom it is transferred, in Türkiye or abroad; request that incomplete or inaccurate data be corrected, and that the correction be notified to those third parties; request erasure or destruction, and that this too be notified; object to a decision made about you solely by automated processing; and claim compensation for damage caused by unlawful processing. Under the GDPR you additionally have the rights of access, rectification, erasure, restriction, objection and data portability.
How to use them. Most are in the app: everything we hold is on your Markers and Reports screens, Delete everything removes your record, and Close account removes all of it (Profile → Privacy & data). For a copy of your data, a correction we cannot make from a re-upload, or anything else on the list, write to info@vitalbook.ai and we will answer within 30 days, free of charge. We answer these ourselves rather than through an automatic export, so that a request is read by a person and the file we send is one we have checked.
You may also complain to a supervisory authority: in Türkiye the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu, kvkk.gov.tr), and in the EU or UK your own national data-protection authority. In Türkiye, KVKK Art. 14 asks that you write to us first.
You may withdraw this consent at any time, as easily as you gave it, in Profile → Privacy & data → Delete everything. Withdrawal stops all processing and permanently deletes your record. It does not affect the lawfulness of processing carried out before withdrawal. VitalBook cannot function without this processing, so withdrawing ends the service; nothing else you have with us is affected.
Legal basis. Your explicit consent — KVKK Art. 6(2) for data concerning health, and GDPR Art. 9(2)(a) together with Art. 6(1)(a). This consent is separate from the Terms of Use, is not bundled with any other agreement, and is recorded with its policy version and a timestamp so we can demonstrate it was given (KVKK Art. 12, GDPR Art. 7(1)).
Giving it is not a condition of anything else. You are not obliged to provide this data. If you do not, VitalBook cannot read a report for you, which is the whole of what the app does — so the consequence is that the service does not work, and nothing else.
Transfers abroad. Your record is stored in your region. The AI provider that reads the cleaned report text may process it outside Türkiye and outside the EEA. Where that happens, the transfer rests on KVKK Art. 9 — a standard contract concluded with the recipient and notified to the Personal Data Protection Board within five business days, or the Board’s authorisation — and on GDPR Art. 46 standard contractual clauses. You may ask us for a copy of the safeguards in place.
No automated decisions about you. Nothing in VitalBook makes a decision that has legal effect or similarly significant consequences for you, automatically or otherwise. It organises, explains and shows your own results; a status such as Watch is an arithmetic comparison against a reference interval, shown to you with the interval and its source, and it decides nothing.
If we ever want to process your data for a new purpose, we will ask you again first.
To find crashes and to see which parts of the app are used, VitalBook sends Google (Firebase Crashlytics and Firebase Analytics) a crash report when the app stops unexpectedly, and the name of a screen when you open it — for example that a report was opened, not which report or what was in it. These reports carry a device identifier generated by Firebase and your app version and device model. They never carry your name, your email, a lab value, a marker name, or anything read from a report; the list of events the app is able to send is fixed in the app and contains no field for them. Firebase also serves a small configuration file that lets us change a setting without shipping an update — fetching it sends an identifier for this installation of the app, and nothing else about you.
These are your choice, and they are off until you make it. You are asked once, on the consent screen, and you can change the answer at any time in Profile → Privacy & data → Send app diagnostics. Until you say yes, nothing is collected — not a crash report, not a screen name. No part of the app depends on the answer: every feature, paid or free, works the same either way.
Legal basis: your consent, under KVKK Art. 5(1) and GDPR Art. 6(1)(a). Withdrawing it is a switch, takes effect immediately, and stops both collection and our own calls to the SDK. It does not affect the lawfulness of what was collected before. Everything in sections 1 to 11 — your results, what is read from your reports, what is stored — is separate processing on separate consent. Google acts as our processor under its data-processing terms and may process these diagnostics outside your country under standard data-protection clauses.
If personal data we hold is breached, we will notify the Personal Data Protection Board within 72 hours of becoming aware of it and, where the GDPR applies, the competent supervisory authority within the same period — and we will tell you directly where the breach is likely to put your rights and freedoms at risk (KVKK Art. 12(5), GDPR Art. 33–34).
VitalBook helps you keep your own lab results in one place, explained in plain words, tracked over time, and ready to share with your doctor as one page. It is for information and general wellness only. It is not medical advice, it does not diagnose, and it is not a medical device or a substitute for professional care. Always talk to your doctor about your results.
You are responsible for your account and for keeping your sign-in secure. Provide a real email so we can send you a reset code if you need one. You must be 18 or older to use VitalBook. One person, one account.
Add only reports that are yours. Do not attempt to break, overload, reverse-engineer or gain unauthorised access to the service, and do not use it to store other people’s data without their consent.
Every value is verified against the line of the report it came from before it is stored, and all arithmetic (status, unit conversion, trends, derived indices) is computed by code with test vectors — a model never produces a number you see. Even so, extraction from a scanned document can be imperfect; check anything that looks wrong against your original report, which stays on your phone.
We work to keep the service available and accurate, but provide it “as is”, without warranties, to the extent the law allows. We may update, suspend or discontinue features, and we may change these terms; for material changes we will tell you in the app or by email and update the date above.
To the extent permitted by law, VitalBook is not liable for decisions made on the basis of the information it presents. It organises and explains your results; it does not replace a clinician’s judgement.
You can close your account at any time from Profile → Privacy & data, which permanently erases your record as described in section 8. We may suspend an account that abuses the service.
What is free. Your first report is free, and everything in it stays readable for ever — including its values, your trends across it, your doctor summary and its share link, a copy of your data on request, and deleting everything. Nothing already filed is ever put behind a payment.
What a subscription is for. Adding further reports. Reading a report costs us real money each time, and the subscription is what pays for it.
How it is billed. Subscriptions are sold through Apple and charged to your Apple Account. The price, the period and the currency are shown on the plan screen before you confirm, in your own storefront’s terms. A subscription renews automatically at the end of each period unless you turn off auto-renew at least 24 hours before it ends, which you do in your device’s Settings rather than here — we cannot cancel it for you, and we never see your payment details.
Price changes. If we raise the price of a plan you are on, Apple will ask you to agree before the next renewal, and the subscription will not renew at the higher price unless you do.
Refunds and withdrawal. Refunds for App Store purchases are handled by Apple under its own terms; we can ask Apple on your behalf but cannot grant one ourselves. Where consumer law gives you a right of withdrawal from a digital service — including Art. 15 of the Turkish Distance Contracts Regulation and Art. 16(m) of the EU Consumer Rights Directive — note that this right does not apply once a digital service has been fully performed with your consent, and that a report we have read has been performed. Apple’s refund process remains available to you regardless.
If a subscription ends. Nothing is deleted and nothing is hidden. Every report already in your record stays exactly as readable as it was; you simply cannot add new ones until you subscribe again.
Questions about these terms or your data: info@vitalbook.ai.
These Terms are governed by the laws of the Republic of Türkiye. The Istanbul (Çağlayan) Courts and Execution Offices have jurisdiction over any dispute arising from them.