Terms of service

Effective 22 October 2026 · WristVitals Cloud (cloud.wristvitals.com) and the WristVitals app

1. About these terms

These terms are an agreement between you and Igor Kuz, an individual located in California, USA ("we", "us"), who runs WristVitals Cloud at cloud.wristvitals.com (the "service") and publishes the WristVitals Android app and website. By creating an account on the service, or by using the app with the service, you agree to them. The privacy policy is part of these terms.

If you run the WristVitals server yourself, or use one run by someone else, these terms do not apply to that server. The software licence (section 9) does.

The app on its own, without a server, is free software you run on your own phone; sections 5, 9, 11 and 12 apply to it, the rest is about the service.

2. Eligibility

You must be at least 16 years old (13 in the United States) and able to enter into this agreement. A parent or guardian may manage a child's watch through their own account; the account and the responsibility are the adult's.

3. Accounts and your recovery key

• You create an account with a username and a password. Keep the password private and choose a username that does not reveal more about you than you want; we store no email address or name.
• When you first set up the account, a master key is generated on your phone or in your browser and shown to you once as a recovery key. It is never sent to us. Everything you store on the service is encrypted with keys derived from it.
• We cannot reset or recover your recovery key, and we cannot decrypt your data without it. If you lose it, the data stored on the service is lost; your phone keeps its own copy and can upload again under a new key. Save the recovery key somewhere safe (a password manager, or printed and put away).
• We can help you regain access to the account (for example after a lost password) only in ways that do not involve your data, and only if you can prove you control it.
• You are responsible for what happens under your account and for the devices you link to it. Remove a lost phone from Devices in the dashboard.

4. Acceptable use

Use the service for its purpose: storing and sharing health and watch data of yourself and of people who have agreed to it (your family, people in your care). Do not:

• upload another person's data without their knowledge and agreement, or use the service to monitor someone who has not consented;
• use it as general file storage, or store anything unrelated to WristVitals;
• attack, probe, overload or interfere with the service, try to access other people's accounts or data, or circumvent rate limits, quotas or the protections on report and visit links;
• use the contact form or visit emails to send spam or anything unlawful;
• use the service for anything illegal where you are.

Security research on your own account is welcome; tell us what you find.

5. Not a medical device

WristVitals is not a medical device and is not intended to diagnose, treat, cure or prevent any disease or condition. Readings come from a consumer watch and are shown for your information. The app's observations, scores, readiness, illness signs, sleep coaching, ECG displays and alerts are automated calculations, not clinical assessments, and they can be wrong, late or missing: watches lose contact, batteries run out, networks fail.

• Do not use WristVitals in an emergency. If you or someone you care for has symptoms such as chest pain, difficulty breathing, fainting or a suspected stroke, call your local emergency number.
• Caregiver alerts are a convenience, not a monitoring service. Never rely on them as the only way to notice that someone needs help.
• Nothing in the app, the dashboard or this site is medical advice. Decisions about your health belong to you and the professionals who care for you.

6. Sharing, report links and doctor visit links

The service lets you share data with family members, create encrypted report links, and give a doctor live read-only access for one appointment. In all cases:

• You choose whom to share with, and you are responsible for that choice. Check who you are adding and tell them what they are getting.
• The encryption and the server's access controls stop people you did not share with. They cannot stop someone you did share with from copying, screenshotting, printing or remembering what they saw while they had access. Ending a share, a report link or a visit stops further access; it does not take back what was already seen.
• Doctor visit links: the doctor opens the link with a code you give in person. Before seeing anything, they give their name and accept these terms of confidentiality: "I am the clinician this patient invited. I will use this information only for their care, will not disclose or share it beyond what their care requires and the law allows, and will not try to keep access after this visit. I understand that my name and the time of opening are shown to the patient." Every page they see is watermarked with their name, email (if given) and the time. Their agreement is sealed to your key so that only you can read who accepted it. If someone who opened a link breaks that promise, the matter is between you and them; we have no way to see or control what happened in their browser.
• Visit links expire unopened after the time you set (7 days by default), stay open for the window you set (4 hours by default) after the first opening, burn after five wrong codes, and can be ended by you at any time. Report links expire after the time you set and can be revoked from the phone.
• Keep links and codes out of the same message. The link travels by email; the code is for saying out loud.

7. Storage quota

Each account may store up to 200 MB of encrypted data (blobs and report links together). Years of watch data fit comfortably; large ECG and GPS collections eventually may not. When the quota is reached, uploads are refused until you remove something or delete old report links; nothing already stored is deleted. We may raise the limit; we will not lower it for existing accounts without at least 90 days' notice.

8. Availability and changes to the service

• The service is provided as a best-effort, personal project, free of charge, without any service level agreement. It may be slow, unavailable or interrupted for maintenance, failures, attacks or reasons outside our control, without notice. Your phone keeps a full copy of your data and keeps working without the service.
• We may change, limit or discontinue features or the whole service. If we plan to shut the service down, we will give at least 90 days' notice on the dashboard and this site so that you can export your data. If we must shut down sooner for reasons we cannot control, we will keep the export working for as long as we are able.
• You can export everything stored for you at any time from the dashboard (Account → Download export), and delete your account at any time.
• We may update the software at any time; the running version is shown by the server and the source is published.

9. Open source licence

The WristVitals app, server, dashboard and documentation are free software licensed under the GNU Affero General Public License, version 3.0. You may use, study, modify and share them under that licence. The service runs the published source code; the running version is visible on the dashboard and corresponds to a tagged commit in the repository. The AGPL also means that anyone running a modified server for others must publish their modifications.

WristVitals is not affiliated with, endorsed by or supported by Withings. "Withings" and watch model names are trademarks of their owners and are used only to say which watches the software works with.

10. Termination

• By you: delete your account from the dashboard at any time. Everything stored for it is removed immediately (backups age out as described in the privacy policy).
• By us: we may suspend or delete an account that breaks section 4, that is used to attack the service or other people, or when the law requires it. Where it is reasonable and safe, we will tell you first and give you a chance to export. We may also delete accounts that have had no sign-in and no sync for 24 months, after announcing the clean-up on the dashboard's sign-in page for 60 days.
• Sections 5, 9, 11, 12, 13 and 14 survive termination.

11. Disclaimers

The service and the software are provided "as is" and "as available", without warranties of any kind, express or implied, including warranties of merchantability, fitness for a particular purpose, accuracy of readings, availability, or non-infringement, to the fullest extent the law allows. We do not warrant that the service will be uninterrupted, error-free or secure, that data will never be lost, or that readings, calculations and alerts will be correct or timely. Some jurisdictions do not allow some of these exclusions; in that case they apply to the extent permitted.

12. Limitation of liability

To the fullest extent permitted by law, we are not liable for any indirect, incidental, special, consequential or punitive damages, or for loss of data, loss of profits, or personal injury or death arising from reliance on readings, alerts or other output of the software or the service. Our total liability for all claims relating to the service or the software is limited to the amount you paid us for the service in the 12 months before the claim, which is nothing, or 50 US dollars, whichever is greater. Nothing in these terms limits liability that cannot be limited by law, including for fraud, gross negligence or wilful misconduct.

13. Indemnity

If someone brings a claim against us because you broke these terms, uploaded data you had no right to upload, or shared someone's data without their consent, you agree to cover the reasonable costs and damages that result, provided we tell you promptly about the claim and let you take part in the defence.

14. Governing law

These terms are governed by the laws of the State of California, USA, without regard to its conflict-of-laws rules, and disputes are heard by the state or federal courts located in California. If you are a consumer in the European Union, the United Kingdom or another place whose law gives you the protection of your local courts and mandatory consumer rules, nothing here takes those away. Before going to court, write to us; most things can be sorted out by email.

15. Changes to these terms

We may change these terms. The new version is published here with a new effective date. For changes that reduce your rights or add obligations, we will announce them on the dashboard's sign-in page at least 30 days before they take effect. Using the service after that date means you accept the new terms; if you do not, export your data and delete your account before then. The history of this page is in the source repository.

16. Contact

Igor Kuz · California, USA · info@wristvitals.com · contact form