Privacy Policy
Spirit of Health · Last updated September 15, 2026
This policy covers the Spirit of Health client portal (my.spiritofhealthkc.com and its related addresses), the Spirit of Health mobile app, our health assessment and intake forms, your report and protocol pages, and the texts, calls and emails we exchange with you. Our public website, spiritofhealthkc.com, has its own notice.
Who we are. Spirit of Health Ministries (“Spirit of Health”, “we”, “us”), 5901 Main Street, Grandview, Missouri 64030. Questions: clientsupport@spiritofhealthkc.com · 816-492-5648.
The short version
- We are a cash-pay natural-health practice. You share health information with us so your practitioner can help you. We use it for that and to run the practice. We do not sell your information, and we do not share your health information with advertisers.
- The portal and app contain no advertising trackers and no third-party analytics.
- Our AI health agents run on models from Anthropic. Your messages, and the parts of your chart an agent needs, are sent to Anthropic to generate a reply. Under our agreement Anthropic does not use your information to train its models. You will be asked to agree before your first AI conversation.
- Texts are sent only with your written consent. Reply STOP to end them, HELP for help.
- You can see, correct, download and ask us to delete your information. Closing your account closes your login; your clinical records are kept for the period the law requires.
1. Information we collect
You give it to us.
- Account and contact: name, email address, phone number, mailing and shipping addresses, date of birth (used to confirm identity on report and protocol links and to confirm you are an adult when ordering labs), time zone, and a profile photo if you add one.
- Health information: your answers to our health assessment (symptoms, history, diet, lifestyle, medications and supplements), family health history, lab results you upload or that a laboratory returns, photos or documents you attach, what you write to your practitioner and to our AI health agents, your check-ins and supplement tracking, and the protocols, plans and reports we create for you.
- Family information: if you complete an assessment for a child or another family member, their information and your relationship to them (see section 9).
- Payments: when you buy programs, supplements or lab tests, your card is entered on a form hosted by our payment processor. Your full card number never reaches our servers. We keep the card brand, last four digits and expiry so you can recognise it, your order history, and, for recurring “autoship” orders, the consent you gave and when you gave it.
- Community: posts, comments and photos you share in the member community, and messages you send to other members.
- Communications: emails, texts and calls with us, including recordings and transcripts of calls with our voice assistant (section 5).
- Consent records: what you agreed to (texting, calls, autoship, AI processing), the version of the text, when, and the internet address and browser it came from.
We collect it automatically.
- Sign-in and security: device type, browser, internet (IP) address, sign-in times, and passkey credentials if you set one up. Face ID or fingerprint is checked on your device by Apple or Google; we never receive it.
- Usage inside the portal: which features you use and when. This is stored by us and is not shared with any analytics company.
- Errors and performance: if something breaks, an error report goes to our monitoring service with your account ID and technical details, without your name, email, date of birth or IP address.
- Approximate location: the country and postal code inferred from your connection, used only to suggest a nearby lab draw site. If you enter a ZIP code, we keep it in a cookie on your device for 30 days.
- Notifications: a device token for push notifications, if you turn them on.
We receive it from others.
- Lab results from the laboratory you were tested with, delivered to your practitioner and stored in your portal.
- Appointment, payment and message records from our practice-management and client-communication systems, our supplement store, and our studio booking system.
2. Why we use it
- To provide what you asked for: assessments, reports of findings, protocols, lab ordering and results, appointments, supplements, the community and the AI health agents.
- To personalise the AI agents with your own chart, so their answers relate to you rather than to a generic person.
- To run the practice: payments, receipts, shipping, invoices, scheduling, reminders, support and record-keeping.
- To keep accounts safe: sign-in codes and links, passkeys, rate limits, access logs, and fraud and abuse prevention.
- To send service messages (appointment reminders, results-ready notices, receipts) and, with your consent, marketing messages.
- To improve the service using aggregate, de-identified usage information.
- To meet legal obligations and respond to lawful requests.
We do not use your health information for advertising, and we do not use it to decide whether to offer you a price, an insurance product or credit.
3. Cookies and similar technologies
The portal and app use cookies only to keep you signed in and to remember basic settings:
| Cookie | Purpose | Lasts |
|---|---|---|
| soh-portal-access, soh-portal-refresh | your sign-in session | 15 minutes / 1 year |
| soh-cv | your session on a report or protocol link | 30 days, at most 90 |
| soh-portal-view | a display preference | 1 year |
| soh-labs-zip, soh-labs-country | the lab draw-site search you ran | 30 days |
| sign-in helpers | security during sign-in | minutes |
The portal keeps a few settings in your browser's local storage (your lab cart, whether you dismissed the install prompt, your app-lock preference). The assessment form saves your progress under your email address so you can resume; in-progress answers are kept for 60 days and completed submissions for 30 days on that system before they live only in your portal record.
We do not use advertising cookies or third-party analytics in the portal or app, and we do not track you across other websites. We do not currently respond to browser “Do Not Track” signals, because there is no tracking to turn off.
4. Who we share information with
We share information only with people and companies that help us serve you, under contracts that limit what they may do with it. We never sell it, and we never give it to data brokers or advertising networks.
Your care team. Your practitioner and the Spirit of Health clinical and client-support staff who work on your case. Each time a staff member opens your chart in the portal, that access is logged.
Family members you authorise. If you link a spouse, partner, child or dependent to your account, or a parent completes an intake for a child, the people in that household relationship can see what the relationship allows (section 9). You can end that access at any time.
Service providers, by what they do for us.
| Purpose | Provider | What they receive |
|---|---|---|
| Hosting the portal, app backend and database | Vercel, Supabase (United States) | what the portal stores, encrypted in transit and at rest |
| AI health agents and assessment interpretation | Anthropic | your messages to an agent and the chart sections it needs; for adult assessments, your answers, to interpret them and draft chart notes (section 6) |
| Search inside the AI agents | Voyage AI, Tavily | the text of your question, rewritten so the agent can find relevant material |
| Practice management, scheduling, records | Practice Better | contact details, appointments, notes, lab requests and results |
| Client communications and invoicing (email, text, invoices, payments) | GoHighLevel | contact details, appointment and payment status, message content, health-concern notes from discovery calls |
| Card payments | Stripe, and the payment service inside GoHighLevel | your card (entered on their hosted form), name, email, billing and shipping address, amounts |
| Supplement store and fulfilment | BigCommerce | name, email, phone, shipping address, what you ordered |
| Lab testing | the laboratory named on your order (for example Vibrant, Evexia for LabCorp and Quest draws, Precision Analytical, Trace Elements, BiomeFx) | your name, date of birth, sex, contact details and the tests ordered, as their requisition requires |
| Transactional email | Resend | your email address and the message (sign-in links and codes, receipts, results-ready notices) |
| Marketing email | Mailchimp | your email address and first name, only if you opted in |
| Voice assistant and call handling | Vapi | your phone number, the call audio, transcript and summary (section 5) |
| Push notifications | Apple, Google | a device token and a generic notice (“Open the app to view”), never the content of a result or message |
| Document storage | Google Drive, Dropbox (older records) | your lab documents and clinical files, in folders only staff can open |
| Error monitoring | Sentry | error reports with your account ID and technical details, no name, email or date of birth |
| Bot protection on forms | Cloudflare | your IP address and browser signals |
Legal reasons. We will disclose information if the law requires it, to protect someone's safety, to enforce our terms, or to investigate fraud or abuse. Where the law allows, we will tell you first.
A change of ownership. If Spirit of Health is sold or merged, your information would go with the practice under this policy, and you would be told.
5. Texts, calls and voice recordings
We send texts only after you have given written consent, for example on our start form, when you claim a store offer, or in the intake. Consent is not a condition of buying anything. Message frequency varies; message and data rates may apply. Reply STOP to stop and HELP for help. Our Messaging Terms are at my.spiritofhealthkc.com/messaging-terms.
Some calls are made or answered by an automated voice assistant that uses artificial intelligence. Where you have consented, these calls may use an artificial or pre-recorded voice. Calls with the voice assistant are recorded and transcribed so your practitioner can follow up. The recording, transcript and a summary are stored in your record, and the transcript is processed by the AI providers in section 6 to produce that summary.
6. Artificial intelligence
The portal includes AI health agents, for example Dr. Vaughn's agent and agents for labs, meals, workouts, lifestyle and children's health. They are educational tools built on Spirit of Health's own teaching. They are not a substitute for your practitioner and cannot diagnose you. Your practitioner reviews your assessment and writes your protocol. For children's assessments, nothing reaches a family until a practitioner has reviewed and published it.
When you use an agent, your message and the parts of your chart the agent is allowed to see (your supplement list, assessment category scores, recommended labs and your published lab markers) are sent to the AI provider that powers that agent to generate the reply. The only provider we use for your information is Anthropic. For adult assessments, your answers are sent to Anthropic to interpret the assessment and to draft your practitioner's chart notes. Uploaded images and scanned documents are sent to Anthropic to read the text in them.
We use Anthropic's business service under an agreement that does not permit it to train its models on your information. We do not allow any model from any other provider to see your chart; the portal enforces this in code, not only in policy. You can see and delete what an agent has remembered about you at any time under Memory in your profile.
You will be asked to agree before your first AI conversation, and again if the providers change. If you would rather not use the AI agents, everything else in the portal works without them.
7. How we protect information
- Encryption in transit and at rest.
- Passwordless sign-in by emailed link or code, passkeys, and an optional Face ID or fingerprint lock in the app. Sign-in attempts are rate-limited and logged.
- Health-record tables are unreachable from the public web layer. Access is scoped per person and enforced in the database, not only in the app.
- Staff access to client records is logged, and staff use separate, stronger sign-in.
- Notifications never carry results or message content to a lock screen.
- On Android, the app's data is excluded from device backups so a backup cannot copy your session or records to a cloud account.
- AI providers are restricted as described in section 6.
No system is perfectly secure. If a breach affects your information, we will notify you and the authorities as the law requires, without unreasonable delay.
8. How long we keep information
| Information | Kept for |
|---|---|
| Clinical records: assessments, reports, protocols, lab results, practitioner notes, call transcripts | for as long as Missouri law requires practitioners to keep client records; kept even if you close your login |
| Account and sign-in records | while your account is open; sessions expire after one year of inactivity; sign-in links and codes expire within 15 minutes |
| AI agent conversations | until you delete them; deleting a conversation removes it and its attachments immediately |
| Attachments you upload in chat | the file is removed 90 days after upload unless you pin it; the extracted text stays with the conversation |
| Payment records | as tax and accounting law require, typically 7 years |
| Consent records (texting, calls, autoship, AI) | as long as the consent is relied on, plus the period the law requires |
| Marketing preferences | until you opt out, then a record that you opted out |
| Assessment form progress on the form system | 60 days in progress; 30 days after submission |
| Security and access logs | retained for security review; not deleted on a schedule |
9. Children and families
Spirit of Health does not work with anyone under 18 without a parent or legal guardian involved. A parent or guardian completes the assessment for a child, and the guardian's name, contact details, relationship and attestation of authority are recorded. We do not knowingly collect information directly from a child under 13 online. If you believe a child has given us information directly, contact us and we will delete it.
A guardian sees a child's records through the guardian's own portal login. That access ends automatically on the child's 18th birthday; the young adult keeps their records and can grant access back if they wish. Household members you add can see only what the relationship you set allows, and you can remove them at any time. We will email you, without health details, when household access changes.
10. Your choices and rights
You can do most of this yourself in the portal under Profile. Otherwise email clientsupport@spiritofhealthkc.com from the address on your account, or write to us at the address above. We will confirm it is you before acting, respond within 45 days, and never charge for a first request.
- See and download your information. Reports and protocols can be downloaded from the portal; we will provide the rest on request in a portable format.
- Correct anything that is wrong.
- Delete. You can delete AI conversations and remembered facts yourself, immediately. You can ask us to close your account: we retire your login, revoke every session and device, delete your passkeys and notification tokens, and stop all non-essential processing. We keep your clinical records for the period in section 8, because your practitioner is required to and because you may need them later. Where a specific law gives you a right to have consumer health data deleted, we will honour it and tell you what, if anything, we must keep and why.
- Stop marketing. Use the unsubscribe link in any marketing email, reply STOP to texts, turn off push notifications in your device settings, and opt out of the community leaderboard in your profile.
- Withdraw AI consent. Turn the AI agents off in your profile. Your chart is then not sent to any AI provider.
- Appeal. If we decline a request, we will say why, and you can ask us to reconsider by replying to that decision.
- Complain to the Federal Trade Commission or your state attorney general.
Residents of Washington and Nevada. This policy is also our consumer health data privacy policy. We collect the categories of consumer health data listed in section 1, from the sources listed there, for the purposes in section 2, and share them only with the parties in section 4. We do not sell consumer health data. We do not use geofencing around health facilities. You have the rights listed above, including the right to withdraw consent, to have your consumer health data deleted, and to appeal.
Residents of other states with privacy laws may have similar rights. Contact us and we will honour any that apply to you.
We do not discriminate against you for exercising any right.
11. Where your information is stored
Our systems and providers are in the United States. If you use our services from outside the United States, your information is processed here.
12. The mobile app
The Spirit of Health app shows the same portal inside an app. In addition to the above, it may ask for camera access, only when you choose to take a photo for a chat, a post or your profile picture, and Face ID or Touch ID, to lock the app; that check happens on your device. It uses Apple's and Google's push services for notifications (section 4). We do not collect your precise location, your contacts, data from health apps, or an advertising identifier.
13. Links to other sites
Our services link to our supplement store, lab partners, video and course platforms, and community spaces. Their privacy practices are their own.
14. Changes to this policy
When we change this policy we will post the new version here with a new date. For changes that affect how we use your health information, we will tell you in the portal or by email before they take effect.
15. Contact
Spirit of Health Ministries, 5901 Main Street, Grandview, Missouri 64030 · clientsupport@spiritofhealthkc.com · 816-492-5648