Privacy Policy

Last updated: 17 October 2026

Who we are

Virka is a health companion for life, operated by Finsane Consulting EOOD (ФИНСЕЙН КОНСУЛТИНГ ЕООД), a company registered in Bulgaria, with its registered office at 14 Lyulyakova gradina str., Izgrev District, Floor 2, 1113 Sofia, Bulgaria. In this policy, "Virka," "we," "us," and "our" refer to Finsane Consulting EOOD.

You can reach us about privacy at vlad@virka.ai.

What data we collect

Virka collects the following data to provide its coaching service:

Account information: your name, email address, and profile photo from the Google or Apple account you use to sign in, used to identify your account.
Health and biometric data: depending on which sources you connect, this includes readiness, sleep, heart rate variability (HRV), heart rate, respiratory data, stress, activity, and recovery metrics. Virka can read this data from Apple Health (via Apple HealthKit) on iOS, from Health Connect on Android, and from Oura via the Oura API. Where you provide it, Virka also processes health context you enter yourself and structured health records such as bloodwork results.
Calendar data: your events for today and the next two days from Google Calendar or Microsoft Outlook Calendar, used to provide scheduling-aware coaching.
Journal entries: the entries you keep in Virka, used to personalise your briefing and coaching. You can type an entry or record it as voice. Voice recordings are sent to our server and on to a transcription provider to turn them into text. Only the text is kept, and the audio recording is deleted once transcription completes.
Photos: photos you take with the camera or choose from your photo library. This covers photos of meals and of supplement or medication labels, which are sent to our AI providers to identify what they contain, and photos or PDFs of medical records and bloodwork, which are read on your own device and never sent to Virka or our AI providers. If you turn on Backup, an encrypted copy that only you can open is kept in your own iCloud Drive or Google Drive.
Onboarding screen recordings: when product analytics is on, we make masked recordings of the onboarding screens shown after you turn it on, never the consent screen itself, to improve the product. Everything you type, all on-screen text and all images are hidden in the recording, which is kept for 30 days. Product analytics, these recordings included, stays off until you turn it on during onboarding (“Help improve Virka”) or in Settings, and it is separate from the AI setting: either can be on without the other.
Early access sign-up: if you join early access on virka.ai, your email address and, if you choose to answer, which wearables, apps, and labs or tests you use (for example a genetic or DNA test, meaning only that you have taken one, never its results) and where you heard about Virka. We store these with your email to shape Virka and to send you your access links, and we never sell them. If you later create an account with the same email, the answers are linked to it.
Profile data: your goals and health context, and details optionally collected during your first week (chronotype, coach voice or DISC style, saboteur patterns).

We only collect data from a source after you explicitly connect and authorise it.

How we use your data

Your data is used only to provide the Virka coaching service. Specifically:

To generate your personalised morning briefing
To power Virka chat with relevant context about your health and schedule
To reflect your journal entries back to you in coaching language
To run self-experiments you choose to start and measure them against your own baseline
To improve the relevance of your coaching over time

We do not sell your data. We do not use your data for advertising or marketing profiling. We do not use your health or biometric data for any purpose other than providing the service to you.

What the AI setting turns off

Turning off “Let the coach use AI” in Settings stops all of the following. Your journal, logs, and past data stay where they are.

Coach conversations, and the drafts Virka writes for you, like a reply declining a meeting or a read on a program you finished.
Your morning brief, in the app and by email.
Turning what you say into text, in the journal and anywhere else you speak to Virka.
Reading what you logged, whether you typed a meal or photographed one, and reading supplement and medication labels you photograph.
Making sense of documents you import, like a medical record or a care plan. These are read on your own phone first and only text with identifying details removed is sent on.
Preparing a summary when you share something with someone on your health team.

When you turn on “Let the coach use my intake”, the Virka coach may read the answers from an intake you have submitted and use them as context in your briefing and chat. This applies only while that switch and “Let the coach use AI” are both on; turning either off stops it.

How we share data

We share data only with the service providers required to operate Virka, acting as our processors:

Microsoft Ireland Operations Ltd (Azure): our primary AI provider. To generate your briefing and chat responses, prepare drafts for a practitioner you share with, identify what is in photos of meals and of supplement or medication labels, and turn voice recordings into text, relevant data (which may include biometric summaries, calendar, journal, and profile) is sent to AI models hosted on Microsoft Azure in the Sweden Central region. Text and photos are processed on EU Data Zone deployments, which keep the data in the EU. Voice transcription runs on a deployment that stores data in the EU but may process it outside the EU. Microsoft processes this data only to return the output and does not use it to train models. Genetic data reaches an AI provider only with your separate consent, as described in Genetic data.
Anthropic: our fallback AI provider. Only when the primary provider is unavailable, the same request (relevant biometric summaries, calendar, journal, and profile, or a photo of a meal or a label) is sent to Anthropic's API instead. Anthropic processes this data to return the output, subject to Anthropic's API terms.
OpenAI: our fallback transcription provider. Only when the primary provider is unavailable, a voice journal recording is sent to OpenAI's transcription API to convert your speech to text. OpenAI returns the text and does not retain the audio for training. Only the transcribed text is stored by Virka.
Oura: we read your Oura data via the official Oura API with your authorisation.
Google: we access your Google account and Google Calendar via OAuth with your authorisation.
Microsoft: where you connect Outlook, we access your calendar via OAuth with your authorisation.
Vercel: Virka is hosted on Vercel infrastructure, including a Redis datastore. Larger voice recordings are staged briefly in Vercel Blob storage while they upload, and are deleted immediately after transcription.
Resend: used to send transactional emails such as sign-up and approval notifications.
Stripe: if you buy a subscription, Stripe processes the payment. Your card details go to Stripe, not to Virka.
PostHog: product analytics, including the masked onboarding screen recordings described above. It runs only while product analytics is on.
Google Analytics: measures visits to our website, with IP addresses anonymised. It loads only after you accept cookies.
HubSpot: measures visits to our website for our marketing. It loads only after you accept cookies.

We do not otherwise share, disclose, or transfer your data to third parties, except where required by law.

Limited Use of Google user data

Virka's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Virka does not use, transfer, or sell Google Workspace or Google Calendar user data, whether raw, aggregated, or derived, to develop, train, or improve any generalized or foundational AI/ML models.

Google Calendar data is used solely to generate the user's own personalized morning briefing and to create calendar events the user explicitly requests.

Google Drive access is used solely to save, list, restore and delete the user's own encrypted Virka backup files, in the Virka Backups folder Virka creates. Virka cannot read their contents and does not access any other file.

Health data from your phone and wearable

What Virka reads: sleep, recovery, heart rate variability (HRV), heart rate, activity (steps, energy and exercise), body measurements and mindful minutes, from the sources you connect: Apple Health, Health Connect, Samsung Health, Oura, WHOOP or Garmin. Each source asks your permission first, and you choose what to allow.
Read only: Virka never writes to your health app or your wearable.
Why: your coach reads how you slept and recovered, and how active you were, to plan your day.
Disconnecting: disconnect any source at any time in Profile, Connections. You can also revoke access in the source's own settings.
DNA reports: handled separately, and kept on your phone. See Genetic data.

Calendar data

What Virka reads: the events on the calendar you connect (the main calendar of the Google account you choose, or the default calendar of your Outlook account) for today and the next two days.
Why: your coach reads your meetings and the load of your day to find room for recovery, such as a walk, meditation or a lighter block.
What Virka writes: Virka adds an event to your calendar only when you approve it. It never edits or deletes your existing events.
Disconnecting: disconnect a calendar at any time in Profile, Calendars. You can also remove Virka's access in your Google or Microsoft account settings.

Voice you record in Virka

What is recorded: audio only while you use Speak, wherever it appears (for example in onboarding, the journal and the coach). Nothing is recorded otherwise.
Transcription: in the iPhone and Android apps, where your phone supports it, your speech is turned into text on the phone and the audio does not leave it. Otherwise, and on the web, the recording is sent to our server and on to our transcription provider, which returns the text; larger recordings are staged briefly in Vercel Blob storage while they upload.
What is stored: only the text. Audio sent for transcription is deleted once it completes, and our transcription provider does not use it for training and deletes it within 30 days.
Deleting it: delete a journal entry in the journal, edit your onboarding answers in Profile, You, or delete everything by deleting your account in Profile, Account.

Photos you take in Virka

When you photograph a meal, Virka sends that photo to our AI providers so an AI model can identify what is in it. The same applies to photos of supplement or medication labels. The photo is used only to read what it contains. It is never used for advertising and never sold.

Photos and PDFs of medical records and bloodwork work differently. Those are read on your own phone, using your phone's built-in text recognition, and the image is never sent to Virka or our AI providers. Only text with identifying details removed is sent for structuring. If you turn on Backup, an encrypted copy that only you can open is also kept in your own iCloud Drive or Google Drive.

Backup of the records on your phone

Lab results, medical records and DNA reports, with the documents you added them from, are stored only on your phone. Backup is off until you turn it on in Settings. When it is on, Virka keeps an encrypted copy of them in your own cloud, so a new phone can have them back.

Only you can open it: the copy is encrypted on your phone (AES-256) with a key that belongs to your Virka account. The key is kept in your iCloud Keychain on iPhone, or Google's Block Store on Android, both end-to-end encrypted by Apple or Google, and is shown to you once as a recovery code. Virka's servers never receive the key or the backup file, so Virka cannot read your backup.
Where it is kept: a file named virka-backup-date in a Virka folder in your iCloud Drive or a Virka Backups folder in your Google Drive, which you choose. Apple or Google stores it under their own terms. Virka keeps the three newest backups and deletes older ones.
Google Drive: Virka asks only for access to files it creates (the drive.file permission) and never sees anything else in your Drive. Our server keeps that access, encrypted, to start uploads and to list and remove your backups; for a restore it hands your phone a short-lived access to download the file.
Saving a file instead: you can also save a backup file yourself, for example to Files or a password manager. It is encrypted the same way.
Turning it off: switching backup off stops new backups. Disconnecting Google Drive removes Virka's access. Backups already in your cloud stay there until you delete them, also after you delete your Virka account.
If the key is lost: without your phone's key and without your recovery code, nobody can open a backup, including Virka.

Genetic data

Genetic data is special-category personal data under Article 9 of the GDPR. We process it only with your explicit consent, separately for each purpose below, and you can withdraw each consent at any time without affecting the others.

What you can add: PDF reports from DNA tests you have taken, from sequencing.com, GenoPalate and dnalife (DNA Diet, DNA Sport and DNA Health). Virka does not perform DNA tests and does not accept raw genetic data files, such as 23andMe, AncestryDNA or VCF files.
On your phone, by default: when you add a DNA report, it is read and stored on your phone, encrypted, and excluded from your phone's own backups and device-to-device transfer. Adding a report sends nothing to Virka's servers, so no consent is asked for this step. If you turn on Backup, an encrypted copy that only you can open is also kept in your own iCloud Drive or Google Drive. You can delete a report at any time, which removes it and all its results from your phone; new backups leave it out, and the older backups that hold it are replaced over the next three backups. Deleting your Virka account does not reach your phone or your backups: delete your reports in the app, or delete the app, and delete the Virka folder in your iCloud Drive or the Virka Backups folder in your Google Drive.
We do not interpret your DNA: Virka shows each result as your report words it. It does not diagnose, and it is not a substitute for a clinician or genetic counsellor.
Sharing with a practitioner (optional, explicit consent): if you choose to share genetic results with a practitioner you have connected, we send them the results your reports list. For clinical findings, that is the condition, gene, variant identifiers, your genotype, and the report's own result category and evidence level. For lifestyle and nutrition results, it is the trait, its result, the report's one-line statement of it and any daily amount. Findings of uncertain significance are sent only as a count. We never send the report file, its detailed explanations or the name printed on it. These results may include medically significant findings, and the practitioner sees them labelled as report results to discuss with a clinician or genetic counsellor, not a diagnosis. If the practitioner asks Virka to prepare a summary, the results are processed by our AI providers, listed in How we share data, as our processors. Withdrawing this consent, or stopping sharing with that practitioner, deletes the practitioner's copy held by Virka and any summary prepared from it.
Sharing with your care team: a share link can include your DNA results, as described in How sharing works.
Using lifestyle results in chat with your coach (optional, explicit consent): if you switch this on, we store on our server only lifestyle results from a fixed list (currently training, sleep, caffeine, alcohol, lactose and vitamin results): the trait name and its result, never your report's text or any gene. Clinical findings (disease risk, sleep disorders, carrier status, medicine response), allergies, gluten and coeliac results, and your blood type are filtered out on your phone and filtered again by our server, and are never stored for coaching. They are used only in chat with your coach, not in your daily briefing, and only while “Let the coach use AI” is also on. Our AI providers process them as our processors to write chat replies. Switching it off deletes them from our server. They are also deleted when you delete your account, and included if you export your data.
What we never do: we do not sell genetic data, use it for advertising, or share it with insurers or employers.
Retention: reports and results on your phone are kept until you delete them or the app. A practitioner's copy is kept until you withdraw genetics sharing, stop sharing with that practitioner, or delete your account; when you delete a report, the copy is updated, or cleared if no report is left, the next time the Virka app syncs. A care-team share link's copy is kept until the link expires (30 days unless you choose a different period, at most 90), even if you revoke the link sooner; a revoked link can no longer be opened. Coaching results are kept until you switch coaching use off or delete your account.
Transfers: where our AI provider processes data outside the EEA, we rely on appropriate safeguards under Chapter V GDPR.
Your rights: your GDPR rights, including access, correction, deletion, restriction, portability, objection and withdrawal of consent, apply to genetic data; see Your rights for how to exercise them. Withdrawal never affects processing already carried out.

Health Connect (Android)

On Android, Virka can read health and fitness data through Android Health Connect, with your explicit permission. Virka uses Health Connect data solely to generate your personalised briefing and coaching inside the app.

Our use of data obtained through Health Connect is limited as follows:

We use it only to provide features you have requested within Virka.
We do not use Health Connect data for advertising or marketing.
We do not sell Health Connect data, and we do not share it with third parties except the processors listed above that are strictly necessary to deliver the service to you.
You can revoke Virka's access to Health Connect at any time in the Health Connect settings on your device.

Apple Health (iOS)

On iOS, Virka reads health data through Apple HealthKit with your explicit permission. HealthKit data is used only to generate your briefing and coaching. We do not use HealthKit data for advertising, we do not sell it, and we do not share it other than with the processors listed above that are needed to deliver the service. You can revoke access at any time in the Apple Health app.

Data storage and security

Your account, journal, profile, and coaching data are stored in an encrypted datastore. Access tokens for connected services are stored securely. Structured health records such as bloodwork, where supported, are encrypted and held on your device; the raw records are not transmitted to or stored on our servers. Voice recordings are transient: they are used only to produce the transcribed text and are not retained after transcription completes. We retain your journal and profile data until you delete your account or the specific data.

Your rights

Because Virka is operated by an EU company, you have rights under the General Data Protection Regulation (GDPR), including the right to:

Access a copy of the data we hold about you
Correct inaccurate data
Request deletion of your account and associated data
Withdraw consent for processing at any time
Revoke access to any connected source (Apple Health, Health Connect, Oura, Google, Microsoft) through that platform or your device settings
Lodge a complaint with your local data protection authority

To exercise any of these rights, email vlad@virka.ai.

Legal basis for processing

We process your data on the basis of your consent, which you give when you connect a data source and use the service. Health and biometric data is a special category of personal data under GDPR, and we process it only with your explicit consent, solely to provide the coaching features you have asked for. You may withdraw consent at any time.

Children

Virka is not intended for anyone under the age of 18. We do not knowingly collect data from minors. If you believe a minor has provided us data, contact us and we will delete it.

Changes to this policy

We may update this policy as Virka evolves. We will communicate significant changes by email or in the app. Continued use of Virka after changes take effect constitutes acceptance of the updated policy.

Contact

For any privacy question, contact Finsane Consulting EOOD at vlad@virka.ai.