Privacy Policy

1. Who we are and how to contact us

VitalReach Wellness Hub is a Ghanaian-American wellness brand offering wellness products, education and consultation intake. “We,” “us” and “our” refer to VitalReach Wellness Hub.

For a privacy request, provide a way to reach you and, if relevant, your submission or order reference. Do not include symptoms, medical histories, passwords, card details or identity documents in the general contact form. We will explain how to provide any information needed to verify and handle your request.

2. Information we collect

• Messages: name, email, phone, message content, submission time and read status.
• Optional Ask Vira chat: messages you enter, generated replies and limited recent conversation context, as explained in Ask Vira and your choices.
• Shopping and orders: browser shopping-session identifier, bag contents, product variants and quantities, contact and delivery details, order notes, quotes, shipping and taxes, payment currency and references, payment status and fulfillment history.
• Consultation intake: name, age, sex response, pregnancy/postpartum response, optional contact information, selected checklists, health answers, dated readings and lab results, medicines and remedies, and notes you provide.
• Clinical records we create: screening flags and supporting answers, submission reference, consent time and version, review status, and clinical assessment and action notes.
• Administration and security: sign-in identity, account status and permissions, reviewer identities, access/review audit events and technical logs.
• Spam prevention: browser and device signals processed by Google reCAPTCHA, verification tokens, risk scores and verification outcomes, as explained in Spam and abuse prevention.

Health questions may concern kidney, cardiovascular, liver or diabetes history, medicine use and withdrawal, mental wellbeing, and self-harm. Uncertain answers can remain “Unknown” or “Prefer not to say.” Do not guess measurements.

3. Ask Vira and your choices

Vira is our optional AI site-help assistant, powered by OpenAI. Before starting, you are shown a disclosure and asked to choose whether to continue. You can browse, shop or contact our team without using Vira. Starting a chat does not enroll you in marketing or provide consent for clinical intake.

When you send a question, we send that text, a limited number of recent messages and replies, and public product and location information to OpenAI to generate a response. Vira has no access to stored contact messages, orders, payment details, administrator accounts or consultation records. Anything you type into chat can nevertheless be sent to OpenAI, so do not include medical histories, symptoms, test results, passwords, payment details, identity documents or other sensitive information about yourself or someone else.

We hold drafts and recent chat history in temporary server session memory, not in our contact, order or clinical databases. Our admin portal has no chat-transcript inbox. The launcher’s “Close chat” button only hides the panel. Use the header’s “End and clear chat” control to remove the conversation from the active session. Closing the browser may leave the session briefly available for reconnection; a restart or session disposal removes it. A verification timeout requires verification again and does not itself delete the conversation.

We ask OpenAI not to retain the replies as stored conversation records. This is not a promise of zero provider retention: under OpenAI’s default API practices, security and abuse-monitoring records may include messages and replies for up to 30 days, with longer retention for legal or safety reasons. Other limited processing, such as temporary caching, may apply. See OpenAI’s API data controls. Ending your chat does not erase records already retained by a provider.

Vira does not create a clinical record, submit an inquiry to staff, book a visit or take payment. Use the appropriate form or contact a person for those requests. If you accidentally share sensitive information, stop the chat and contact us without repeating that information in a general inquiry. We will explain the available next steps.

4. Spam and abuse prevention

Google reCAPTCHA v3 helps protect contact submissions and Vira from automated abuse. It runs in the background when you submit a contact message, start chat or send a chat message. Google may process network, browser, device and interaction signals and set a necessary security cookie to assess risk. Our server verifies the result before accepting the request; the verification request does not include your contact message, chat text or health questionnaire.

VitalReach determines the security purpose of this processing. Google processes reCAPTCHA customer data on our behalf under its applicable data-processing terms. See Google’s reCAPTCHA data-processing information. This assessment helps decide whether an online request can proceed; it is separate from clinical screening and does not determine a diagnosis or eligibility for care.

Security checks can reject legitimate requests, and blocking the required scripts or cookies can prevent online submission. If this happens, contact us by phone at +1 (410) 504-4449 or email info@vitalreachhub.com. Do not send sensitive health or payment details through ordinary email.

5. Consultation consent and choices

When online intake is available, we ask for affirmative consent before storing your submission for consultation and automated screening review. Opening a QR link, browsing, purchasing a product or accepting general website terms does not give consent to collect a health questionnaire.

The QR code opens a blank form and contains no patient record or health answers. A submission reference is not a public link to your record. You may decline online submission and ask staff about assessment options. Omitting optional information or declining answers may limit the review.

Ask staff to correct a submitted answer or discuss withdrawing consent for future consent-based use. Withdrawal does not undo prior lawful use or necessarily require deletion of records that must be retained.

6. Automated screening and human review

Our software applies predefined rules to reported symptoms, history, medicines and measurements to highlight concerns. It records the rule version and reasons for each flag. The current feature does not send questionnaire answers to a generative-AI provider to produce flags.

Flags are not diagnoses or disease probabilities. Incomplete or inaccurate answers can produce missing or incorrect flags. A lack of flags does not mean a person is healthy. A clinical reviewer interprets the information; green “no outstanding action” status records an explicit reviewer decision.

You can ask for an explanation, correction or human review. The tool does not automatically decide eligibility for insurance, employment, credit or treatment. It does not dispatch emergency services or guarantee an immediate response.

7. Why we use information

We use information to provide optional AI site assistance, respond to requests, maintain shopping bags, prepare and fulfill orders, calculate taxes, verify payments, prepare consultations, support clinical review, administer access, investigate problems, prevent abuse and meet applicable recordkeeping obligations.

Consent supports the optional health-intake collection described above. Other processing may be needed to take requested steps toward a purchase, perform an order, protect the service or comply with law. The basis and rights that apply depend on the information, purpose and jurisdiction.

We do not sell personal information. Consultation answers, screening flags and clinical notes are not used for advertising, marketing audiences or newsletter enrollment. Submitting a message, order or consultation form does not sign you up for marketing.

8. Access and sharing

Authorized operational administrators handle messages and orders. Consultation records in the portal require separate clinical-review permission. Superadmins manage permissions; ordinary administrator or superadmin status alone does not grant clinical-record access. Record reads and review updates are audited.

OpenAI processes the chat content described above, and Google processes reCAPTCHA security signals. Hosting, infrastructure and support providers may process stored information or backups as needed to operate and secure the service. Payment providers receive payment setup details; tax providers receive delivery and transaction details; fulfillment partners may receive information needed for an arranged delivery. Health questionnaire answers are not supplied to payment or delivery providers as part of these workflows.

Information may also be disclosed as required or permitted by law, to address a safety/security concern, or as part of a lawful business transfer with appropriate protections. Separate clinical referrals or additional health-record disclosures should be discussed with you and handled on an appropriate legal basis.

9. Payments and order records

When enabled, payments take place on hosted Stripe or Paystack pages. We send setup details such as email, order/reference identifier, amount and currency, and receive verification/status information. Our checkout form does not collect full card numbers or bank login credentials.

Order details, payment references, tax evidence and fulfillment records support service, reconciliation and recordkeeping. Providers handle their own records under their policies: Stripe privacy and Paystack privacy.

10. Google sign-in and administrator records

Google authenticates approved administrators. We use basic identity information such as email, name, account identifier and sign-in status to control access and attribute activity. We do not request Gmail, Drive, calendar, contact-list or Google password access.

We maintain account status, permissions and relevant administrative records. We do not sell Google sign-in data or use it for advertising. See Google's Privacy Policy for its handling of information.

11. Cookies, forms and connections

Essential cookies support the shopping bag, access to this browser's orders, administrator authentication and request security. The shopping cookie lasts up to 30 days. Clearing it or changing browsers can remove browser access to prior orders without deleting the stored order. Keep your order reference for support. Admin sessions expire and may renew during active use.

Unsubmitted form entries are processed in a temporary server session while you use interactive pages. A short disconnection may permit recovery, but expiry, restart, closing or reloading can lose unsaved entries. Health drafts are not saved in browser local storage. Consultation records are stored when you submit successfully.

The current website does not use advertising pixels or behavioral-advertising cookies. External fonts and an embedded Google map may send technical information such as IP address and browser details to their providers. Following social or other external links is subject to those services' policies.

12. Technical records and safeguards

Servers may record IP addresses, request paths, times, browser information and errors. Connection diagnostics record events without questionnaire answers. Submission limits use a temporary derived network-address identifier to reduce abuse. Chat and spam-verification diagnostics record bounded failure categories and may include risk scores. Those application diagnostics exclude conversation text, form contents, secret keys and verification tokens.

Safeguards include HTTPS, encryption of stored consultation answers and clinical notes, separate clinical permissions, restricted server access and audit records. Basic metadata, such as reference, time, urgency and status, is stored separately. Authorized technical personnel may require controlled infrastructure access. No system can promise absolute security.

Use a private device where possible, sign out of shared admin sessions and close a shared visitor session when finished. If a security incident requires notice, we will provide notice as required by applicable law.

13. Retention and backups

Retention depends on the record and purpose: messages for resolving enquiries; orders/payments for fulfillment, accounting and disputes; consultation records for review, follow-up and applicable clinical recordkeeping; and security/audit records for investigating access and misuse.

Temporary Vira sessions are handled separately as described above. Stored messages, orders and consultation records do not automatically disappear when a consultation is reviewed, a browser closes, consent is withdrawn or an administrator is removed. The current intake service has no automatic deletion deadline. Contact us for applicable retention information or to request deletion; we will consider the purpose and any legal need to retain the record.

Backup copies may remain after a live record is removed until the relevant backup is retired. If deletion is restricted or delayed, we will explain the reason and available options, subject to applicable law.

14. Your requests and rights

Depending on applicable law, you may request access, a copy, correction, deletion, restriction or objection to certain uses, withdrawal of consent, or an explanation and human review of automated processing. We may need proportionate information to verify identity and locate your record. Legal exceptions may apply.

Start through our privacy request form or center staff, or email info@vitalreachhub.com if the form is unavailable. Do not include your health history in that initial message. You can also raise concerns with the competent authority, including Ghana's Data Protection Commission where applicable.

15. Age limits and international processing

Online consultation intake is for adults aged 18 and above. Visitors under 18 should ask staff about assisted assessment; the site has no parental-consent workflow for online intake. The general website is not directed to children under 13. Contact us if a child has submitted information inappropriately.

VitalReach serves Ghana and the United States. Processing may occur where our operations and providers are located, and protections differ between jurisdictions. Cross-border processing remains subject to applicable requirements; using this website does not waive statutory privacy rights.

16. Changes to this policy

Revisions will carry a new date/version. We will provide further notice or request consent where required for a material change. Updating this policy does not by itself authorize a new use of previously collected health information. Questions can be sent using the contact details in section 1.