Vivente Privacy Notice

Version 1.0. Effective as of October 2026

1. Introduction

Vivente helps you bring health information from different sources together in one place, organise it into a structured health record and, where you choose, download it or let an approved AI service read it.

This Privacy Notice explains how Vivente collects and uses personal data when you use our website, platform and related services (together, the Services).

Vivente is a personal health information and general wellness service. It does not diagnose medical conditions or replace advice from a healthcare professional.

Vivente is for adults aged 18 or over.

We know that health and genetic information is particularly sensitive, so we want to be clear about how we use and protect it. You decide what health information you add to Vivente. AI may help read and organise uploaded health documents, but you remain in control of what is added to your structured record. We do not use your health data to train the AI models used by Vivente, and we do not sell your health information.

You can delete information, withdraw consent where we rely on it, and exercise your data protection rights. If you choose to connect Vivente to an approved external AI service, information you authorise will be shared with that provider and will then be subject to that provider’s own privacy practices. Vivente does not currently offer profiles managed on behalf of another person.

This Notice explains what information we collect, why we use it, who we may share it with, how long we keep it and the rights available to you.

Vivente Health Limited (“Vivente”, “we”, “us” or “our”) is the controller of personal data processed through Vivente.

You can contact us using the details below:

Registered address: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom (1st Formations)
Company number: 17366501
Privacy contact: hello@vivente.ai
Website: www.vivente.ai

2. Personal data we collect

Account and profile information; When you create and use a Vivente account, we collect your email address and your country of residence and, if you choose to give it, your date of birth. We also hold your sign-in details (including whether you have turned on two-step verification), your account status, and how your account was created, including who invited you. To create an account you must give your email address and your country of residence; everything else is optional.

Health and wellbeing information; You may choose to add health information to Vivente by uploading documents or entering information manually. Depending on what you provide, this may include laboratory and test results, medical records, medications and treatment information, medical history, genetic information, self-reported health information, lifestyle and social-history information, family medical history and data exports from wearable devices that you upload. Vivente does not connect directly to wearable services.

Health and genetic information is generally classed as special category personal data under UK and EU data protection law and receives additional protection.

Documents you upload; If you upload a health document, we store the document and may use AI to identify and organise relevant information from it. We also keep information showing where an extracted value came from, such as the source document and page, so you can check it against the original record.

User research and feedback; If you choose to take part in user research, surveys or interviews, we may collect the feedback you provide and, where you agree, a recording or transcript of the session. Depending on what you choose to discuss, this may include information about your health or experience of using Vivente. We will tell you how the research will be used before you participate and will ask for appropriate consent where sensitive information is involved.

Information about other people; Vivente may sometimes hold information about somebody other than the account holder. This may happen where you record family medical history, or where information about someone else appears within a document you upload.

We ask users not to include identifying information about relatives in family history fields.

Technical and security information; We also process limited technical information needed to operate and protect the Services, such as authentication records, security events, account activity and information needed to investigate technical or security issues. We use a record of when you use Vivente: when you sign in or open the app, upload or approve a document, export your record or connect an AI client, and how your account was created, including who invited you. We use it to understand how Vivente is used, to contact you if you seem to be stuck, and to decide what to improve. We never use the content of your health data for this, we do not share this record with any analytics provider, and we rely on our legitimate interests to do it, which you can object to at any time.

Marketing and communications information; If you sign up to receive updates from Vivente, join a waiting list or subscribe to a newsletter, we may collect your name, email address, communication preferences and information about whether you have opened or interacted with our communications.

3. How we use your personal data

We use personal data to provide and operate Vivente.

Depending on the features you use, this may include:

• creating and administering your account;
• storing and organising your health record;
• processing uploaded health documents;
• extracting information from documents using AI;
• allowing you to review, correct and delete information;
• generating health summaries and exports;
• enabling you to connect your account to an approved external AI service and, where you choose to do so, sharing the categories of information you authorise with that provider;
• protecting accounts and maintaining the security of the Services;
• responding to questions, complaints and data protection requests;
• maintaining appropriate records of consent and authority;
• investigating errors and improving the reliability of the Services;
• complying with our legal and regulatory obligations;
• conducting voluntary user research and interviews to understand how people experience Vivente and to improve the Services.

We may also use anonymous and aggregated information to understand how Vivente is being used and improve the product. For example, we may identify that users frequently upload a type of health result for which Vivente does not yet have a suitable field.

Where information has been properly anonymised so that nobody can reasonably be identified from it, it is no longer personal data.

Marketing

We may use your contact details to send you news, product updates, launch information or other communications about Vivente where you have asked to receive them or where applicable law otherwise allows us to do so

4. Our lawful bases for using personal data

Data protection law requires us to have a valid reason for processing personal data. Depending on the circumstances, Vivente relies on the following lawful bases.

Your consent; We rely on your consent where you actively choose to allow particular processing. Health and genetic information receives additional legal protection. Where we rely on consent to process this information, we obtain explicit consent. For example, you may give explicit consent for Vivente to process health information you add to your record.
We may also rely on your consent where you choose to sign up for newsletters, product updates or other marketing communications.

You can withdraw consent at any time.

Our contract with you; We process some personal data because it is necessary to provide the Services you have asked us for or to take steps at your request before entering into a contract.
For example, we need certain account information to create and administer your Vivente account and provide the features you have chosen.

Our legitimate interests; We may process personal data where it is necessary for our legitimate interests, provided those interests do not override your rights and freedoms.
These interests may include protecting Vivente and our users from unauthorised access or misuse, maintaining the security and reliability of the Services, identifying and resolving technical problems, responding to customer queries, maintaining appropriate audit and accountability records, and improving how the Services operate where this can be done fairly and proportionately.

Legal obligations; Sometimes we need to process personal data to comply with applicable laws, regulatory requirements, court orders or legitimate requests from public authorities.

External AI connections. If you choose to connect your Vivente account to an approved external AI service, we rely on your consent to make that connection and share the information you have selected. Where the information includes health or genetic data, we also rely on your explicit consent. The connection is optional and will not be enabled unless you actively choose to use it.

5. How Vivente uses AI

Vivente uses AI to help read information contained in health documents and organise it into a structured health record.

When you upload a supported document, it is securely stored and processed by our AI system. The AI identifies information that may be relevant to your health record and shows you what it has extracted, together with the source it came from. Nothing is added to your structured record until you have had the opportunity to review and confirm it.
AI can make mistakes, so you should check extracted information against the original document before confirming it.

How the AI works
Vivente uses AI to extract and organise information, not to provide medical advice. It does not diagnose medical conditions, recommend treatment, decide whether a health result is good or bad, or replace a doctor or other healthcare professional. Vivente also does not use AI to make decisions about you that have legal or similarly significant effects.

The AI service we use and AI training
Vivente currently uses Claude through Amazon Web Services Bedrock to process uploaded documents. The document extraction processing takes place within EU regions. Vivente does not use your health documents, health record or other personal data to train the AI models used by the Services. AWS also states that Bedrock inputs and outputs are not used to train its models or shared with model providers for model training. If this changes in the future, we will assess the change separately and provide appropriate information before introducing it.

6. Third-party data processing

We use a small number of specialist service providers to help us operate Vivente.

Some of these providers process personal data on our behalf. Where they do, we require them to process information only for the agreed purposes and to provide appropriate data protection and security safeguards.

Our main service providers currently include:

Vercel may operate build infrastructure in the United States, but Vivente’s current configuration does not send personal data through that build process. We review the providers we use and may update this list where our Services change.

Connecting Vivente to an external AI service

This is different from the AI Vivente uses internally to read your uploaded documents.

Vivente allows you to connect your Vivente account to certain approved external AI services. At present, the supported services are Claude, provided by Anthropic Ireland, Limited, and ChatGPT, provided by OpenAI Ireland Limited for users in the EEA and Switzerland and by OpenAI OpCo, LLC (United States) for users elsewhere, including the UK.

This feature is optional and is not enabled automatically. No information is shared unless you choose to connect a service.

How this works in practice

If you choose to use this feature:

1. You select one of the external AI services supported by Vivente;
2. You authenticate or authorise the connection;
3. You choose which categories of information you want that service to be able to access; and
4. Once you confirm the connection, the external AI provider can retrieve the information you have authorised directly from Vivente.

Because the information you choose to share may include health or genetic information, we will ask for your consent, including your explicit consent to sharing this sensitive information, before the connection is enabled.

What happens once information reaches the external AI service?

These providers act as independent controllers for the information they receive through the connection. This means that they process that information under their own terms and privacy policies. If you connect using a work or organisation account, your organisation's agreement with the provider also applies.

Once information has been shared with the provider, Vivente does not control how that provider subsequently uses, stores or deletes its copy of the information. This may include different retention arrangements, privacy settings, security practices and processing locations. The provider may also process or transfer information outside the UK or European Economic Area under its own international data transfer arrangements.

You should therefore review the provider's privacy information and settings before connecting it to Vivente, particularly where you choose to make health or genetic information available.

You can disconnect an external AI service at any time through your Vivente account. Disconnecting the service will stop it from accessing further information from Vivente, but it will not automatically delete information the provider has already received. You may need to contact the provider or use its own account settings if you want to exercise rights in relation to information it already holds.

Downloads and information you choose to share

Vivente may allow you to download a health summary or other information from your account.

Once you choose to provide that information to a doctor, healthcare provider or another third party, their own privacy practices will apply to their use of the copy you provide.

7. Managed profiles

Vivente does not currently let an account holder manage health information for another person. If we introduce this, we will update this notice before it becomes available.

8. International processing and transfers

Vivente has designed its core health data infrastructure so that personal data used to provide the main Services is stored and processed within the EU.

Our current database, file storage, application runtime and AI document processing environment are based in EU regions.

Some suppliers may have corporate operations or subprocessors elsewhere. Where Vivente itself makes a restricted international transfer of personal data, we will use an appropriate lawful safeguard, such as an adequacy arrangement or approved contractual safeguards, where required.

Where you choose to connect an approved external AI service, Vivente shares the information you authorise with the provider named in section 6. For users in the EEA and Switzerland, both providers are established in the EEA. For users in the UK, Claude is provided by an entity established in Ireland, and ChatGPT by OpenAI OpCo, LLC in the United States. That provider may subsequently process or transfer the information outside the UK or EEA under its own international data transfer arrangements. Please review the provider’s privacy information before enabling the connection.

9. How long we keep your personal data

We do not keep personal data for longer than we need it.

Deleted information can remain in our encrypted backups for a short time after deletion, normally no more than 10 days, before it is removed automatically. If we restore data from a backup, we re-apply account deletions made since.

Generally:

Your health record

We keep information in your Vivente health record while your account remains active, unless:

• you delete it earlier;
• you withdraw the relevant consent; or
• another legal or operational retention trigger applies.

Uploaded documents

You can delete uploaded documents and associated information through the Services.

When you withdraw consent for a category, Vivente deletes the documents in that category and the information derived from them.

Account deletion

When you confirm the deletion of your account, Vivente deletes your account, your health information and your uploaded files. Copies in backups are removed within the period stated above.

We keep a record that a deletion took place, holding its date and counts of what was removed and nothing that identifies you, for 6 years.

Other records

We keep technical and security logs only for as long as reasonably necessary to operate, protect and investigate the Services. Where you take part in user research, recordings are kept for a limited period while the research is reviewed, after which they are deleted or reduced to the information needed for the research. Research notes or transcripts may be retained for longer where necessary to understand and improve the Services.

Marketing information is generally kept while you remain subscribed or while we have an appropriate reason to retain it. If you unsubscribe, we may retain limited information on a suppression list so that we can continue to respect your preference not to receive marketing.

We may retain consent, authority, rights-request, complaint and other accountability records for longer where necessary to demonstrate compliance, resolve disputes or establish, exercise or defend legal claims.

10. Keeping your information secure

Vivente uses technical and organisational safeguards designed to protect personal data from unauthorised access, loss, alteration or disclosure.

These include controls around:

• account authentication;
• access permissions;
• secure storage;
• encryption in transit and at rest;
• separation of production systems;
• restricted administrative access;
• a log of actions on your account, which you can see; and
• incident management.

We review our safeguards as the Services develop and take additional measures where the sensitivity of the information requires them.

11. Your rights and choices

Depending on where you live and the circumstances, you may have the right to:

• access the personal data we hold about you;
• correct inaccurate or incomplete information;
• delete your personal data;
• restrict how we use it;
• object to certain processing;
• receive certain information in a portable format;
• withdraw your consent; and
• complain to a data protection regulator.

These rights are not always absolute and some depend on the lawful basis or circumstances of the processing.

Withdrawing consent

Where we process health or genetic information with your consent, you can withdraw that consent at any time. Withdrawing consent does not make processing that took place before withdrawal unlawful. Withdrawing consent for a category deletes the documents and information in that category, and the parts of Vivente that depend on it stay empty until you consent again.

Exercising your rights

You can export your full record and delete your account yourself in My Account. For other requests, contact:

hello@vivente.ai

We may need to verify your identity before responding. Where somebody is making a request on behalf of another person, we may also need to verify their authority to act.

12. Cookies and similar technologies

Vivente may use cookies and similar technologies needed to operate the website and Services and, where applicable, for other purposes explained in our Cookie Policy.

Please see our Cookie Policy (app.vivente.ai/cookies) for more information about the technologies we use and the choices available to you.

13. Marketing and communications

If you choose to sign up for Vivente news, a waiting list, newsletters or product updates, we may use your contact details to send you those communications.

Where we ask for your consent to receive marketing, you can withdraw that consent at any time by using the unsubscribe link in our emails or by contacting us at hello@vivente.ai.

In some circumstances, applicable law may also allow us to contact existing customers about Vivente products or services that are similar to those they have already purchased. Where we rely on this route, we will only do so where the relevant legal requirements are met and we will always give you a clear opportunity to opt out.

You have the right to object to the use of your personal data for direct marketing at any time. If you object, or unsubscribe from marketing, we will stop using your personal data for that purpose.

Choosing not to receive marketing will not affect service-related messages that we still need to send about your account, security, changes to the Services or other operational matters.

We will not sell your contact details to third parties for their own marketing. We also will not use your health or genetic information to target marketing to you unless this has been separately explained to you and there is an appropriate legal basis for doing so.

14. We do not sell your health data

Vivente does not sell your personal health information.

We also do not provide your health or genetic data to advertising platforms or data brokers for advertising purposes.

If we introduce materially different uses of personal data in the future, we will assess those uses before they are introduced and update our privacy information where required.

15. Complaints

If you have any concerns about how we use your personal data, please get in touch with us at hello@vivente.ai. We would always welcome the opportunity to understand what has happened and see if we can put things right.

You also have the right to raise a complaint with a data protection regulator.

If you are in the UK, you can complain to the Information Commissioner’s Office (ICO).

If you are in the EEA, you can complain to the data protection authority in the country where you live or work, or where you believe a data protection issue has occurred.