This Privacy Policy ("Policy") applies to Vitalcy, and Vitalcy, Inc ("Company") and governs data collection and usage. For the purposes of this Privacy Policy, unless otherwise noted, all references to the Company include vitalcy.com. The Company's application is a social network application. By using the Company application, you consent to the data practices described in this statement.

This Policy is designed to comply with applicable data protection laws, including the General Data Protection Regulation ("GDPR") for users in the European Economic Area ("EEA") and United Kingdom ("UK"), and the California Consumer Privacy Act ("CCPA") for California residents.

Collection of your Personal Information

In order to better provide you with products and services offered, the Company may collect personally identifiable information, such as your:

• First and last name

• Mailing address

• Email address

• Phone number

• Employer

• Job title

We do not collect any personal information about you unless you voluntarily provide it to us. However, you may be required to provide certain personal information to us when you elect to use certain products or services. These may include: (a) registering for an account; (b) entering a sweepstakes or contest sponsored by us or one of our partners; (c) signing up for special offers from selected third parties; (d) sending us an email message. To wit, we will use your information for, but not limited to, communicating with you in relation to services and/or products you have requested from us. We also may gather additional personal or non-personal information in the future.

Legal Basis for Processing (GDPR)

For users in the EEA and UK, we process your personal data under the following legal bases as required by GDPR:

• Contract Performance: Processing necessary to perform our contract with you, including providing the services you requested, managing your account, and processing transactions.

• Legitimate Interests: Processing necessary for our legitimate business interests, such as improving our services, preventing fraud, ensuring network security, and communicating with you about your account.

• Consent: Where you have given explicit consent for specific processing activities, such as receiving marketing communications or participating in optional features.

• Legal Obligation: Processing necessary to comply with legal obligations, such as tax reporting, fraud prevention, and responding to lawful requests from authorities.

Use of your Personal Information

The Company collects and uses your personal information in the following ways:

• to operate and deliver the services you have requested

• to provide you with information, products, or services that you request from us

• to provide you with notices about your account

• to carry out the Company's obligations and enforce our rights arising from any contracts entered between you and us, including for billing and collection

• to notify you about changes to our Vitalcy or any products or services we offer or provide through it

• in any other way we may describe when you provide the information

• for any other purpose with your consent.

The Company may also use your personally identifiable information to inform you of other products or services available from the Company and its affiliates.

Sharing Information with Third Parties

The Company does not sell, rent, or lease its customer lists to third parties.

The Company may share data with trusted partners to help perform statistical analysis, send you email or postal mail, provide customer support, or arrange for deliveries. All such third parties are prohibited from using your personal information except to provide these services to the Company, and they are required to maintain the confidentiality of your information.

The Company may disclose your personal information, without notice, if required to do so by law or in the good faith belief that such action is necessary to: (a) conform to the edicts of the law or comply with legal process served on the Company or the site; (b) protect and defend the rights or property of the Company; and/or (c) act under exigent circumstances to protect the personal safety of users of the Company, or the public.

Your Data Protection Rights

Depending on your location, you may have the following rights regarding your personal data:

Rights for EEA and UK Residents (GDPR)

• Right of Access: You have the right to request copies of your personal data. We will provide this information within 30 days of your request.

• Right to Rectification: You have the right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete.

• Right to Erasure (Right to be Forgotten): You have the right to request that we erase your personal data, under certain conditions. Upon verified request, we will delete your data within 90 days, subject to legal retention requirements.

• Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data, under certain conditions.

• Right to Data Portability: You have the right to request that we transfer the data we have collected to another organization, or directly to you, in a structured, commonly used, and machine-readable format.

• Right to Object: You have the right to object to our processing of your personal data, under certain conditions, including processing for direct marketing purposes.

• Right to Withdraw Consent: Where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time.

• Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority. For UK residents, this is the Information Commissioner's Office (ICO). For EEA residents, this is your local data protection authority.

Rights for California Residents (CCPA)

California residents have specific rights under the California Consumer Privacy Act, including:

• The right to know what personal information is collected

• The right to know whether personal information is sold or disclosed

• The right to opt-out of the sale of personal information

• The right to access your personal information

• The right to equal service and price

Right to Deletion

Subject to certain exceptions set out below, on receipt of a verifiable request from you, we will:

• Delete your personal information from our records; and

• Direct any service providers to delete your personal information from their records.

Please note that we may not be able to comply with requests to delete your personal information if it is necessary to:

• Complete the transaction for which the personal information was collected, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, provide a good or service requested by you, or reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform a contract between you and us;

• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for that activity;

• Debug to identify and repair errors that impair existing intended functionality;

• Exercise free speech, ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law;

• Comply with the California Electronic Communications Privacy Act;

• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when our deletion of the information is likely to render impossible or seriously impair the achievement of such research, provided we have obtained your informed consent;

• Enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us;

• Comply with an existing legal obligation; or

• Otherwise use your personal information, internally, in a lawful manner that is compatible with the context in which you provided the information.

Children Under Thirteen

The Company does not knowingly collect personally identifiable information from children under the age of 13. If you are under the age of 13, you must ask your parent or guardian for permission to use this application.

Email Communications

From time to time, the Company may contact you via email for the purpose of providing announcements, promotional offers, alerts, confirmations, surveys, and/or other general communication. In order to improve our services, we may receive a notification when you open an email from the Company or click on a link therein.

If you would like to stop receiving marketing or promotional communications via email from the Company, you may opt out of such communications by clicking on the unsubscribe button.

Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. Our specific retention periods are:

• Active User Data: Retained for the duration of your account plus 90 days after account deletion to allow for account recovery and comply with audit requirements.

• Rejected/Archived User Data: Retained for 30 days to allow for potential reapplication.

• Unaccepted Invitations: Retained for 120 days to provide ample time to respond.

• Data Export Files: Available for download for 30 days, then automatically deleted.

• Transaction Records: Retained as required by applicable tax and financial regulations (typically 7 years).

After the applicable retention period expires, your personal data is automatically and permanently deleted from our systems.

International Data Transfers

Vitalcy is headquartered in the United States. If you are accessing our services from the European Economic Area (EEA), United Kingdom, or other regions with laws governing data collection and use, please note that your personal data will be transferred to and processed in the United States.

For transfers of personal data from the EEA or UK to the United States, we rely on the following safeguards:

• Standard Contractual Clauses (SCCs): We enter into EU-approved Standard Contractual Clauses with our client organizations as addendums to our Master Service Agreements. These clauses provide appropriate safeguards for the transfer of personal data outside the EEA/UK.

• UK International Data Transfer Agreement (IDTA): For UK-specific transfers, we utilize the UK IDTA Addendum to the SCCs as approved by the UK Information Commissioner's Office.

• Data Processing Agreements: We maintain data processing agreements with all third-party service providers that process personal data on our behalf.

By using our services, you acknowledge and consent to the transfer of your personal data to the United States, subject to the safeguards described above.

External Data Storage Sites

We may store your data on servers provided by third-party hosting vendors with whom we have contracted. Our primary infrastructure is hosted on Amazon Web Services (AWS) in the United States. All third-party vendors are contractually obligated to maintain appropriate security measures and comply with applicable data protection laws.

Changes to This Statement

The Company reserves the right to change this Policy from time to time. For example, when there are changes in our services, changes in our data protection practices, or changes in the law. When changes to this Policy are significant, we will inform you. You may receive a notice by sending an email to the primary email address specified in your account, by placing a prominent notice on our Vitalcy, Inc, and/or by updating any privacy information. Your continued use of the application and/or services available after such modifications will constitute your: (a) acknowledgment of the modified Policy; and (b) agreement to abide and be bound by that Policy.

Contact Information

The Company welcomes your questions or comments regarding this Policy. If you believe that the Company has not adhered to this Policy, please contact the Company at:

Vitalcy, Inc
Whitestone, New York 11357

Email Address:
support@vitalcy.com

Phone Number:
917.279.9595

Data Protection Officer

For questions about this Privacy Policy or our data protection practices, or to exercise your data protection rights, please contact our Data Protection team at:

Email: privacy@vitalcy.com

We will respond to all legitimate requests within 30 days. Occasionally, it may take longer if your request is particularly complex or you have made multiple requests.

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you. Any automated processing we perform (such as content recommendations) does not result in decisions that have legal or similarly significant effects on individuals.

Effective as of December 01, 2025

This Privacy Policy was last updated to include GDPR compliance provisions, data retention periods, and international transfer safeguards.