Privacy Policy
Effective 2026-11-09 · version 2026-11-09
What Filia collects, what it does with it, who sees it, how long it is kept, and how to get it or delete it. The promises that matter most: we do not sell your data, we do not put advertising trackers on pages about your health, and we do not share health information with anyone who is not helping deliver your testing.
1.Gifts
We use the recipient’s name and email address supplied by the purchaser to deliver and manage the Gift. We process the purchaser’s information for payment, receipts, gift administration and refunds. The recipient provides their own identifying and health information through their own account. The purchaser receives payment and gift status, but not the recipient’s tests, appointments, requisitions, physician decisions, results or other health information.
2.Who we are and what this covers
This policy is issued by Vanguard Performance LLC (2901 Cleveland Ave., Suite 102, Santa Rosa, CA 95403), which operates Filia at https://myfilia.com and its app, and also operates Vanguard at https://vanguardperform.com. It covers everything we collect through Filia. It does not cover what Quest Diagnostics, the ordering physician’s medical group, or any other company collects when you deal with them directly; each has its own notice, and How HIPAA Applies to Filia explains how they fit together.
Filia is not a healthcare provider and is not a HIPAA covered entity. The health information we hold is protected by this policy, by the Federal Trade Commission Act and the FTC’s Health Breach Notification Rule, and by the health-privacy laws of your state. The Consumer Health Data Privacy Notice restates the parts of this policy that those state laws require in their own form.
3.What we collect
- Account details
- Your name, date of birth, email address, phone number and postal address, given when you create an account. The laboratory needs the name and date of birth exactly as they appear on your ID, and the physician needs your sex and age to review an order.
- Health history
- What you choose to tell us in the optional health-history questionnaire: goals and concerns, reproductive history where relevant, diagnoses, medications, allergies, family history, prior labs and procedures, lifestyle, and anything else you add. It is optional and you can leave any of it blank.
- Orders and results
- The tests you order, the requisition, the laboratory’s results with its reference ranges, and any note the ordering physician attaches. Results reach us from the ordering physician’s medical group and Quest Diagnostics under the HIPAA Authorization you sign at checkout, as How HIPAA Applies to Filia explains.
- Documents you upload
- Lab reports from other laboratories that you choose to import. For PDFs, we use Google Cloud’s HIPAA-eligible Vertex AI service to extract the reported values. The document may contain your identifying and health information. You review the extracted values before they are saved to your history.
- Cycle observations
- If you use cycle tracking: why you are tracking and the setup answers that go with it, such as whether you use hormonal birth control; the daily observations you record, such as bleeding, cervical mucus, ovulation-test results, basal body temperature, pain, mood, sleep, hot flashes, symptoms and notes; the cycle dates derived from them; and any cycle data you import. This is reproductive health information. HIPAA does not cover what you enter in a cycle tracker; this policy, the FTC’s rules and your state’s health-privacy laws do, and it gets the strongest protection we have; see what we will never do.
- Purchases
- What you buy, and the address anything physical ships to. Your card number goes directly to our payment processor and never touches our servers; we keep the last four digits, the card type and the transaction record.
- Consents and preferences
- Which documents you accepted and when, your marketing choices, your lab-location preference, your theme, and the referral code you were given or used.
- Messages
- Email and text messages between you and us, including support conversations.
- Technical data
- When you use the site, our servers record the request, your IP address, browser type and the pages loaded, in ordinary server logs used for security and to keep the site working. We do not use analytics services, advertising pixels, session-recording tools or fingerprinting, and we do not build a profile of you from your browsing.
4.What we use it for
- To run your account and deliver what you ordered: passing your order to Junction and the ordering physician, producing your requisition, showing you your results, and sending you the essential messages about your order, such as your requisition and when your final results are ready. Reminders about an order’s next step, and emails that a partial result is available, are your choice in Settings.
- To give the ordering physician what they need to review your order responsibly: your account details, the tests chosen, and the parts of your health history relevant to them.
- To show you educational context beside your results. This context is generated from your data for you; it is not shared and it is not medical advice.
- To show you, if you use cycle tracking, estimates built from your own observations. They are generated for you, are not shared, and are not medical advice.
- To take payment, prevent fraud, apply credit and discounts, and run the referral program.
- To answer you when you write to us, and to tell you about material changes to the service or these documents.
- To send marketing, only if you opted in, and only until you opt out.
- To keep the service secure, to investigate misuse, and to meet legal obligations.
- To understand how the service is used in aggregate, using counts and de-identified data that cannot be traced to you. We do not sell de-identified data and we do not use your data to train artificial-intelligence models.
6.What we will never do with health information
- Sell it, rent it, or trade it, to anyone, for anything.
- Share it with advertising platforms, or place their pixels, tags or software-development kits on any page of the site or app.
- Share it with your employer, an insurer, or a data broker.
- Use the fact that you looked at a test or a condition to target you with advertising anywhere.
- Use it to train an artificial-intelligence model, or sell de-identified versions of it.
Reproductive health information gets one more promise. If a government agency or a private party asks us for cycle-tracking data, pregnancy-related data, or the results of a reproductive-health test, we release nothing voluntarily; we act only on legal process that is valid where we are served, in California; we challenge, as California law allows, a request from outside California that relates to reproductive care that is lawful here; we tell you about the request unless a court forbids it; and where the law of your state prohibits the disclosure, we refuse it. We keep this data only as long as you keep it, and deleting it from your account deletes it from our systems on the schedule below.
7.Email, text messages and marketing
We send account and order emails through Resend when they apply to your use of the service, such as account-access messages and order updates.
Junction or the laboratory involved in your order may also send you text messages about your testing, such as order updates, collection instructions, appointment reminders, or kit-shipping updates. These service messages are separate from marketing messages.
Marketing email is a separate, optional choice that you can withdraw in Settings or through an unsubscribe link. We do not currently operate our own marketing text-message program. If we introduce one, we will ask for your separate consent. Consent to marketing is never a condition of buying anything.
To manage testing-related texts, follow the instructions in the sender’s messages or contact that sender.
See the SMS Terms. Mobile opt-in information and SMS consent will not be sold or shared with third parties or affiliates for their marketing purposes.
9.How long we keep it
| Information | Kept until |
|---|---|
| Account details, health history, results, uploads, and anything you record in the app | 30 days after you delete your account or ask us to delete them, unless a legal hold requires longer. Until then, as long as your account exists. |
| Payment and order records | 7 years after the order, as tax and accounting law requires. They contain what you bought and paid, not your results. |
| Consent and marketing-preference records | 5 years after your account is closed, so that we can show what you agreed to if it is ever questioned. |
| Support messages | 3 years after the conversation ends. |
| Server logs | 90 days. |
Deleting your account with us does not delete the records the ordering physician’s medical group and Quest Diagnostics keep under medical-records law; ask them directly for those.
10.How we protect it
Information is encrypted in transit and at rest, access to it is limited to the people and systems that need it and is logged, and our service providers are held to the same standards by contract. These are the safeguards that HIPAA’s Security Rule describes, applied whether or not the law requires them of us. No system is perfectly secure; if we discover a breach of your unsecured health information we will tell you, and the Federal Trade Commission, without unreasonable delay and within 60 days, as the FTC’s Health Breach Notification Rule requires, and we will meet any shorter deadline your state sets. Because you gave us an email address when you created your account, email is your primary contact and is how that notice reaches you.
11.Your rights
Wherever you live, you can do all of the following, and we do not treat you differently for doing it:
- See and download everything we hold about you, from your account or by asking us.
- Correct anything that is wrong, in Settings or by asking us.
- Delete your account and everything in it, from Settings or by asking us. We confirm the deletion in writing.
- Withdraw a consent you gave, including the consent to marketing and, by writing to Junction, the HIPAA Authorization.
- Ask for the list of the third parties we have shared your health information with.
- Appeal if we refuse a request, and complain to your state attorney general or the Federal Trade Commission if the appeal fails.
Write to info@myfilia.com or use Settings. We verify that a request comes from the account holder before acting on it, we answer within 45 days, and we tell you if we need up to 45 more. You may authorise someone else to make a request for you; we will ask them for proof.
California residents
We are below the size at which the California Consumer Privacy Act applies, and we give every customer the rights it describes anyway. In its terms: we do not sell or share personal information, so there is no “Do Not Sell or Share” choice to make; we use sensitive personal information, which includes health information, only to provide the service you asked for and for the security and legal purposes the Act permits, so there is nothing to limit; and we disclose nothing to third parties for their direct marketing.
California’s Confidentiality of Medical Information Act treats a business that offers software to maintain medical information, including a reproductive-health digital service, as a provider of health care for confidentiality purposes. We treat ourselves as one. We do not disclose your medical information without your written authorization except as that Act permits, such as to the physician and laboratory delivering the testing you ordered, and we keep it confidential in storage and in destruction.
Residents of Washington, Nevada and Connecticut
Your states’ consumer health data laws are addressed in the Consumer Health Data Privacy Notice, which is a separate document as those laws require.
12.Children
Filia is intended for adults 18 and older. The person being tested supplies their own information and consent. Gifts and existing provider arrangements follow the Terms of Service. If you believe we hold information about someone under 18, contact info@myfilia.com so we can review it under our privacy and record-retention policies.
13.Changes to this policy
When we change this policy we update the date at the top and, if the change affects how health information is used or shared, we email account holders at least 14 days before it takes effect and ask for your consent where the law requires it. A change never expands what we do with information we already hold without that consent.
14.How to reach us
- Privacy requests and questions
- info@myfilia.com
- Vanguard Performance LLC, 2901 Cleveland Ave., Suite 102, Santa Rosa, CA 95403