Privacy Policy

Effective date: July 13, 2026 · Blue Oak Holdings Inc. · Governed by Iowa law

    The short version: Your health data is encrypted, stays on our servers, never gets sold, never trains external AI, and you can delete all of it anytime. The rest of this policy explains the details.
  

1. Who we are

VADR is a personal wellness protocol tracking application operated by Blue Oak Holdings Inc., an Iowa corporation. Legal counsel: Luke Zielinski, Brick Gentry PC. Contact: hello@vadr.app

2. What data we collect

We collect only what the app needs to work:

Identity data: First name, last name, email address, date of birth, biological sex. Encrypted at rest with a dedicated identity encryption key.
Health data: Protocol logs (peptides, supplements, medications, injections), body metrics (weight, measurements), nutrition logs, daily check-ins (mood, energy, sleep, stress), lab panel results, and activity logs. Encrypted at rest with a separate health encryption key. Identity and health data use different encryption keys and never join outside an active authenticated session.
Device data: Expo push token (for notifications), device platform (iOS/Android). No device fingerprinting, no advertising identifiers.
Usage data: App feature usage in aggregate, anonymized. Only collected if you opt in (default: off).

3. How we use your data

To provide the app's core features: protocol tracking, nutrition logging, lab import, insights, morning messages, weekly summaries, and provider PDF export.
To send notifications you have configured (injection reminders, water goals, weekly summaries).
To send transactional emails: account verification and password reset only.
To generate your personalized AI features. All AI processing runs on our own hardware. Your data never leaves our infrastructure to an external AI provider.

4. How AI works in VADR

VADR uses AI for morning messages, food photo analysis, lab marker extraction, and weekly summaries. All AI inference runs on hardware we control. Your health data is never sent to OpenAI, Google, Anthropic, or any external AI service. This is by design, not convenience — it is a core architectural commitment.

5. Data sharing

We do not sell your data. We do not share your data with third parties for marketing or advertising. We do not use your data to train external AI models.

We may share data only in these limited circumstances:

With service providers who process data on our behalf under strict confidentiality agreements (email delivery via Resend).
If required by law, court order, or to protect the safety of our users.
In the event of a business transfer, with notice to users and the same privacy protections applying.

6. Data retention

We retain your data for as long as your account is active. If you delete your account, all personal data is permanently deleted within 24 hours. Backups are purged within 30 days. Unverified accounts (email not confirmed within 48 hours of registration) are automatically purged.

7. Your rights

Access: Request a copy of your data at any time via the app or by emailing hello@vadr.app.
Deletion: Delete your account from the Care tab in the app. All data removed within 24 hours.
Correction: Update your profile information at any time in the app.
Portability: Data export is available from the Care tab.
Opt-out: Anonymous usage data contribution is off by default. You control this in Care → Privacy.

8. Security

All data is encrypted in transit (TLS) and at rest (AES encryption with separate keys for identity and health data). We use bcrypt for password hashing with a work factor of 12. Access tokens are short-lived RS256 JWTs. We do not store plaintext passwords or unencrypted health data.

9. Children

VADR is not directed to children under 13. We do not knowingly collect data from anyone under 13. If we learn we have collected data from a child under 13, we will delete it immediately.

10. Accessibility

We are committed to making VADR accessible to users with disabilities. Our app and website target WCAG 2.1 AA compliance. If you encounter an accessibility barrier, please contact us at hello@vadr.app and we will address it promptly.

11. Changes to this policy

We will notify users of material changes to this policy by email and in-app notice at least 14 days before they take effect. Continued use after that date constitutes acceptance.

12. Contact

Blue Oak Holdings Inc.
Email: hello@vadr.app
Legal: Luke Zielinski, Brick Gentry PC, Des Moines, Iowa
Governing law: State of Iowa, United States