Privacy Policy

Who we are

Virka is a personal performance intelligence platform operated by Finsane Consulting EOOD (ФИНСЕЙН КОНСУЛТИНГ ЕООД), a company registered in Bulgaria, with its registered office at 14 Lyulyakova gradina str., Izgrev District, Floor 2, 1113 Sofia, Bulgaria. In this policy, "Virka," "we," "us," and "our" refer to Finsane Consulting EOOD.

You can reach us about privacy at vlad@virka.ai.

What data we collect

Virka collects the following data to provide its coaching service:

• Account information: your name, email address, and profile photo from the Google or Apple account you use to sign in, used to identify your account.
• Health and biometric data: depending on which sources you connect, this includes readiness, sleep, heart rate variability (HRV), heart rate, respiratory data, stress, activity, and recovery metrics. Virka can read this data from Apple Health (via Apple HealthKit) on iOS, from Health Connect on Android, and from Oura via the Oura API. Where you provide it, Virka also processes health context you enter yourself and structured health records such as bloodwork results.
• Calendar data: your events for the current and next day from Google Calendar or Microsoft Outlook Calendar, used to provide scheduling-aware coaching.
• Journal entries: the entries you keep in Virka, used to personalise your briefing and coaching. You can type an entry or record it as voice. Voice recordings are sent to our server and on to a transcription provider to turn them into text. Only the text is kept, and the audio recording is deleted once transcription completes.
• Photos: photos you take with the camera or choose from your photo library. This covers photos of meals and of supplement or medication labels, which are sent to Anthropic to identify what they contain, and photos or PDFs of medical records and bloodwork, which are read on your own device so the image itself never leaves it.
• Profile data: your chronotype, DISC type, saboteur patterns, health context, and goals, collected during onboarding.

We only collect data from a source after you explicitly connect and authorise it.

How we use your data

Your data is used only to provide the Virka coaching service. Specifically:

• To generate your personalised morning briefing
• To power Virka chat with relevant context about your health and schedule
• To reflect your journal entries back to you in coaching language
• To run self-experiments you choose to start and measure them against your own baseline
• To improve the relevance of your coaching over time

We do not sell your data. We do not use your data for advertising or marketing profiling. We do not use your health or biometric data for any purpose other than providing the service to you.

How we share data

We share data only with the service providers required to operate Virka, acting as our processors:

• Anthropic: to generate your briefing and chat responses, relevant data (which may include biometric summaries, calendar, journal, and profile) is sent to Anthropic's Claude API for processing. Photos you take of meals and of supplement or medication labels are also sent to Anthropic so their contents can be identified. Anthropic processes this data to return coaching output, subject to Anthropic's API terms.
• OpenAI: voice journal recordings are sent to OpenAI's transcription API to convert your speech to text. OpenAI returns the text and does not retain the audio for training. Only the transcribed text is stored by Virka.
• Oura: we read your Oura data via the official Oura API with your authorisation.
• Google: we access your Google account and Google Calendar via OAuth with your authorisation.
• Microsoft: where you connect Outlook, we access your calendar via OAuth with your authorisation.
• Vercel: Virka is hosted on Vercel infrastructure, including a Redis datastore. Larger voice recordings are staged briefly in Vercel Blob storage while they upload, and are deleted immediately after transcription.
• Resend: used to send transactional emails such as sign-up and approval notifications.

We do not otherwise share, disclose, or transfer your data to third parties, except where required by law.

Photos you take in Virka

When you photograph a meal, Virka sends that photo to Anthropic so the model can identify what is in it. The same applies to photos of supplement or medication labels. The photo is used only to read what it contains. It is never used for advertising and never sold.

Photos and PDFs of medical records and bloodwork work differently. Those are read on your own phone, using your phone's built-in text recognition, and the image never leaves the device. Only text with identifying details removed is sent for structuring.

Health Connect (Android)

On Android, Virka can read health and fitness data through Android Health Connect, with your explicit permission. Virka uses Health Connect data solely to generate your personalised briefing and coaching inside the app.

Our use of data obtained through Health Connect is limited as follows:

• We use it only to provide features you have requested within Virka.
• We do not use Health Connect data for advertising or marketing.
• We do not sell Health Connect data, and we do not share it with third parties except the processors listed above that are strictly necessary to deliver the service to you.
• You can revoke Virka's access to Health Connect at any time in the Health Connect settings on your device.

Apple Health (iOS)

On iOS, Virka reads health data through Apple HealthKit with your explicit permission. HealthKit data is used only to generate your briefing and coaching. We do not use HealthKit data for advertising, we do not sell it, and we do not share it other than with the processors listed above that are needed to deliver the service. You can revoke access at any time in the Apple Health app.

Data storage and security

Your account, journal, profile, and coaching data are stored in an encrypted datastore. Access tokens for connected services are stored securely. Structured health records such as bloodwork, where supported, are encrypted and held on your device; the raw records are not transmitted to or stored on our servers. Voice recordings are transient: they are used only to produce the transcribed text and are not retained after transcription completes. We retain your journal and profile data until you delete your account or the specific data.

Your rights

Because Virka is operated by an EU company, you have rights under the General Data Protection Regulation (GDPR), including the right to:

• Access a copy of the data we hold about you
• Correct inaccurate data
• Request deletion of your account and associated data
• Withdraw consent for processing at any time
• Revoke access to any connected source (Apple Health, Health Connect, Oura, Google, Microsoft) through that platform or your device settings
• Lodge a complaint with your local data protection authority

To exercise any of these rights, email vlad@virka.ai.

Legal basis for processing

We process your data on the basis of your consent, which you give when you connect a data source and use the service. Health and biometric data is a special category of personal data under GDPR, and we process it only with your explicit consent, solely to provide the coaching features you have asked for. You may withdraw consent at any time.

Children

Virka is not intended for anyone under the age of 18. We do not knowingly collect data from minors. If you believe a minor has provided us data, contact us and we will delete it.

Changes to this policy

We may update this policy as Virka evolves. We will communicate significant changes by email or in the app. Continued use of Virka after changes take effect constitutes acceptance of the updated policy.

Contact

For any privacy question, contact Finsane Consulting EOOD at vlad@virka.ai.