1. Our Commitment to Your Privacy
Vector Ventures Holdings Pty Ltd (ACN 698 553 758) ("Vector", "we", "us", "our") is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, store, and protect information about you when you use the Vector application ("App").
We handle your information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles ("APPs"), and the Health Records Act 2001 (Vic). Health information is treated as sensitive information under both Acts and is handled with additional care.
"Services" in this Policy means the Vector mobile application, website, and all associated health analysis features, including biological age estimation, biomarker tracking, health scoring, personalised wellness insights, lab referral ordering, and any other features we make available from time to time.
2. What Information We Collect
2.1 Account Information
When you create an account, we collect:
- First name and last name
- Email address
- Date of birth
- Biological sex (used to apply sex-specific reference ranges)
2.2 Pathology and Biomarker Data
When you upload a pathology report, we process the text content of the report to extract biomarker readings (e.g. glucose, cholesterol, HbA1c). The source PDF is discarded after extraction; only the extracted numerical values, units, and collection dates are stored. This constitutes health information for the purposes of the Privacy Act.
2.3 Apple HealthKit Data
With your explicit permission through iOS, we access the following data from Apple HealthKit:
- Heart rate variability (HRV)
- Resting heart rate
- VO2 max estimates
- Sleep data (deep sleep, REM sleep, sleep efficiency, sleep timing, and sleep regularity)
- Activity and exercise data (light, moderate, and vigorous intensity minutes)
- Active energy expenditure
Raw wearable history and device-timezone history remain on your device. To provide longitudinal trends, AI-generated insights, and your daily briefing, Vector may transmit and retain derived numerical summaries linked to your account identifier — for example, a sleep-regularity score and its data-coverage or travel-adjustment indicators. We do not retain raw sleep epochs, location history, or timezone identifiers on our servers, and no name or contact detail is included in the health-data payload sent for AI processing. HealthKit data is never used for advertising or marketing, or shared for any purpose unrelated to providing the Services.
2.4 Lab Referral Data
If you use the lab referral feature, we transmit the details required to place a pathology order to our referral provider, Eirly: your first name, last name, email address, date of birth, biological sex, phone number, and postal address (including postcode). This is the minimum information the pathology provider requires to create an Australian referral.
2.4.1 Payment Data
Lab orders are paid for through the App. Payments are processed by our payment provider, Stripe, which collects your card details directly through its secure payment interface. Vector does not receive or store your full card number; we retain only a Stripe customer reference, the payment/transaction identifier, and the amount charged, in order to fulfil and, where necessary, refund your order.
2.5 Technical Data
We collect app version and operating system version to diagnose technical issues. We do not integrate third-party analytics or crash-reporting SDKs. No usage data is shared with advertising or analytics platforms.
2.6 Push Notification Data
If you enable notifications, we register a push notification token for your device — a device identifier issued by Apple's Push Notification service and Expo's push service — so that we can deliver notifications to your device. This token is linked to your account identifier and is used solely to send notifications. It is deleted when you sign out on that device or when the device becomes unreachable, and it is never sold or shared with third parties for advertising. You control notifications through the App (Account → Notifications) and your device settings.
3. How We Use Your Information
We use your information to:
- Create and manage your account
- Analyse your biomarker data and deliver health metrics, scores, and insights
- Generate personalised wellness insights and recommendations
- Pre-fill and submit lab referral orders on your behalf (with your authorisation)
- Send transactional communications related to your account
- Send push notifications, if you enable them, for transactional purposes — such as when a pathology report you uploaded from the website is ready to review
- Improve and develop the App (using de-identified or aggregated data)
- Comply with our legal obligations
Push notifications are currently limited to transactional messages about your account and your reports; we do not send promotional or marketing notifications. You can turn notifications off at any time in the App (Account → Notifications) or in your device settings. We do not use your personal information for direct marketing without your separate consent.
4. AI Processing
The App uses Gemini 2.5 Flash, served through the Gemini Enterprise Agent Platform — Google Cloud's enterprise AI platform — to generate contextual health insights. AI requests are routed through Google Cloud's australia-southeast1 region, keeping your health data within Australia in compliance with Privacy Act APP 8. The platform is configured with zero data-retention: your health data is processed to generate your results and is not used to train or improve Google's models.
When you request AI-generated insights, the following information is transmitted via our servers: biomarker values, units, and status classifications; your age and biological sex; pathology history; wearable health metrics; and derived sleep-timing and reliability summaries. Raw sleep epochs, location history, and timezone identifiers are not transmitted.
This data does not include your name, email address, or any account identifier. Your account identity is known to our servers but is never forwarded to Google.
AI-generated insights are cached on our servers. Where AI processing is unavailable, the App falls back to deterministic, rules-based insights that run entirely on-device.
5. How We Share Your Information
We do not sell your personal information to third parties. We share your information only in the following circumstances:
5.1 Service Providers
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, and data storage | United States |
| Google LLC (Gemini Enterprise Agent Platform) | AI-powered health insight generation via Gemini 2.5 Flash on Google Cloud enterprise infrastructure | Australia (australia-southeast1) |
| Eirly | Pathology referral processing (lab orders) | Australia |
| Stripe | Payment processing for lab orders | United States |
| Apple Inc. (HealthKit) | Health data framework (on-device only) | N/A |
5.2 Legal Requirements. We may disclose your information if required by law, court order, or a lawful request from a government authority.
5.3 Business Transfers. If Vector is involved in a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity, subject to the same privacy protections.
5.4 With Your Consent. We may share your information for other purposes with your express consent.
6. Health Information — Additional Protections
Health information is sensitive information under the Privacy Act 1988 (Cth) and the Health Records Act 2001 (Vic). We collect and use health information only with your consent, and only for the primary purpose for which it was collected.
7. HealthKit — Apple Requirements
In compliance with Apple's guidelines:
- HealthKit data is used only to provide and improve health and fitness features
- HealthKit data is not used for advertising or marketing
- HealthKit data is not sold or disclosed to third parties for advertising or data brokers
- HealthKit metrics are stored as numerical values only — never as raw files — and are never sold, shared with data brokers, or used for advertising
8. Data Security
We implement appropriate technical and organisational measures including encrypted data transmission (TLS/HTTPS), Supabase row-level security, password hashing, secure authentication, and restricted internal access on a need-to-know basis.
9. Data Retention
- Account, biomarker, wearable, and briefing data: deleted immediately and permanently when you close your account
- Subscription records: retained in de-identified form (transaction ID and product only — your name, email, and account ID are removed) for financial audit purposes
- AI insight cache: retained for up to 120 days
10. Your Rights
10.1 Access. Request access to the personal information we hold about you (APP 12). We will respond within 30 days.
10.2 Correction. Request correction of inaccurate, out-of-date, or incomplete information (APP 13). We will respond within 30 days.
10.3 Deletion. Request deletion of your account and associated data through the App settings or by contacting legal@vector.healthcare. We will process deletion requests within 30 days.
10.4 Complaints. If you believe we have breached the Privacy Act, contact us first. If unsatisfied, lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by calling 1300 363 992.
11. Children
The App is not directed at children under 18 years of age. We do not knowingly collect personal information from children under 18.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes through the App or by email. Continued use of the App after the effective date constitutes your acceptance of the changes.
13. Contact Us
Privacy Officer
Vector Ventures Holdings Pty Ltd · ACN 698 553 758
Email: legal@vector.healthcare
Last updated 22 July 2026.