App Privacy Policy
Last updated: 20 October 2026 · Versão em português
This App Privacy Policy explains how Vesta Labs, Lda. ("VESTA", "we", "us") collects, uses, shares, stores, retains and deletes personal data through the VESTA Labs iPhone app (the "App"). The App is used to carry out a biomechanical assessment of the feet and lower limb so that VESTA can design and manufacture custom insoles. Our website and online store are covered by our general Privacy Policy.
1. Who is responsible for your data
The data controller is Vesta Labs, Lda., Clínica Myalgia, Rua Adelaide Cabete, Loja 7A, 1500-023 Lisboa, Portugal. For any privacy question or request, contact us at info@vesta-insoles.com.
2. Data we collect
Identification and contact data: first name, last name, email address and the language you choose.
3D foot scan data (TrueDepth camera): a 3D model of each foot, a height map of each sole and one reference photo of each sole. See Section 3 for full details.
Movement data: a low-resolution video of the single-leg squat test recorded with the front camera, two still frames from that video and the joint angles measured from it (knee, hip, pelvis and trunk).
Questionnaire data: footwear type, shoe size, the painful areas you mark on the body map, any notes you write and, if you choose, a photo of your shoe insole taken with the rear camera.
Order data: order and payment status and, where applicable, the VESTA partner (clinic or pharmacy) that carried out the assessment with you. Card details are processed by Shopify; we never receive your card number.
Technical data: device model, iOS version, App version and error and upload logs.
The App has no account or login, shows no advertising, does not track you across other apps or websites and does not sell data.
3. TrueDepth camera and face data
3.1 What the App collects with the TrueDepth camera. The App uses the TrueDepth camera only during the 3D foot scan. The iPhone is placed on the floor with the screen facing up and you hold your bare foot about 20–25 cm above the screen. During the scan the App reads the TrueDepth depth maps and colour images of the sole of your foot. Depth readings outside the foot's distance range (closer than 8 cm or beyond about 60 cm) are discarded. From these readings the App builds, on your iPhone, three items for each foot: (a) a 3D model of the foot (STL file), (b) a height map image of the sole (PNG) and (c) one reference photo of the sole (JPG). The raw depth frames are held only in the iPhone's memory while the scan runs; they are never saved or sent anywhere. Intermediate processing files stay only on the iPhone and are deleted together with the scan files (Section 3.5).
3.2 No face data. The App does not collect face data. It does not use ARKit face tracking, does not create face meshes, face geometry or facial maps, does not use Face ID data and does not perform facial recognition or identification. The TrueDepth camera is pointed at the sole of your foot, never at your face. The single-leg squat test uses the front camera only as an ordinary video camera: no TrueDepth depth data is read during the test. Body joint positions are calculated on your iPhone with Apple's Vision framework (body pose, not face). The squat video may show your face as part of your whole body; it is used only so that the VESTA clinical team can review your movement, and it is never used to analyse or identify your face.
3.3 Purposes. TrueDepth data is used only to measure your feet (length, width and arch profile), to design and manufacture your custom insoles, to prepare your Biomechanical Report and to remake or adjust your insoles later. It is not used for advertising, marketing, profiling, building a user identity, training artificial intelligence models or any other purpose.
3.4 Storage and sharing. The 3D models, height maps and sole photos are sent over an encrypted connection (HTTPS) only when you complete the assessment, and are stored in VESTA's Google Workspace account (Google Drive), with access restricted to the VESTA clinical team. Google acts only as our data processor under a data processing agreement. TrueDepth data is not sent to Cloudinary, to Shopify, to VESTA partners or to any other third party, and it is never sold or shared for advertising. Your Biomechanical Report contains only measurements and results: no photos, video or 3D images.
3.5 Retention and deletion. On your iPhone, the scan files are deleted automatically 7 days after they have been sent successfully (the App keeps only a short summary of the assessment: name, email and measurements); deleting the App removes everything stored by the App on the iPhone. On VESTA's systems, scan data is kept for 5 years after the assessment, so that we can remake or adjust your insoles and compare future assessments, and is then permanently deleted. You can ask us to delete your scan data at any time by writing to info@vesta-insoles.com; we delete it within 30 days, unless the law requires us to keep it.
4. Why we use your data
To carry out your biomechanical assessment, which is reviewed by the VESTA clinical team.
To design, manufacture and deliver your insoles.
To send you your Biomechanical Report and messages about your order, in the language you chose.
To process payment and, where applicable, to associate the assessment with the VESTA partner who carried it out.
To provide support, adjustments and after-sales service, and to fix App errors.
To comply with legal obligations (for example, invoicing and record-keeping).
5. Legal basis
Health data (including the foot scan, movement data and pain information) is processed only with your explicit consent, which the App asks for before the assessment starts (Art. 9(2)(a) GDPR). Other data is processed to perform the contract for your insoles (Art. 6(1)(b)), to comply with legal obligations (Art. 6(1)(c)) and, for App security, on the basis of our legitimate interests (Art. 6(1)(f)). You may withdraw your consent at any time; this does not affect processing carried out before withdrawal.
6. Who we share data with
Google (Google Workspace: file storage, tracking sheet and email) — stores the assessment files, including the TrueDepth data described in Section 3.
Cloudinary — hosts the single-leg squat video only.
Shopify — online store and payment for the insoles.
VESTA partners — if a partner clinic or pharmacy carried out the assessment with you, we record that partner in our files. Partners do not receive your scan files, photos or videos from the App.
Public authorities, where required by law.
These providers process data only on our instructions. We do not sell your personal data.
7. International transfers
Some providers may process data outside the European Economic Area, in particular in the United States. In those cases, transfers rely on the EU-US Data Privacy Framework or on standard contractual clauses approved by the European Commission.
8. How long we keep your data
We keep scans, videos, photos and reports for 5 years after the assessment, so we can remake or adjust your insoles and compare future assessments, and then delete them. Invoicing data is kept for the period required by law. On the iPhone, assessment files are deleted automatically 7 days after they have been sent.
9. Your rights
You can ask for access to, correction, deletion, restriction or portability of your data, object to its processing and withdraw your consent by writing to info@vesta-insoles.com. You may also lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (www.cnpd.pt).
10. Children
Assessments of children under 16 must be carried out with the permission and in the presence of a parent or legal guardian.
11. Security
Data is sent over encrypted connections (HTTPS) and access is restricted to authorised VESTA staff.
12. Changes to this policy
We may update this policy. The date of the last update is shown at the top of this page.
13. Contact
VESTA LABS, LDA
Clínica Myalgia, Rua Adelaide Cabete, Loja 7A, 1500-023 Lisboa, Portugal
Email: info@vesta-insoles.com