VYVE Policies | VYVE Health

This is VYVE’s policy suite. It applies to every member, employer, partner and supplier, however they use VYVE. The six documents are written to be read together, and the key facts below are used consistently across every one of them. Every policy is reviewed every 12 months, after any serious incident, and before any new employer or partner launch. Questions: team@vyvehealth.co.uk.

Documents in this suite

Privacy PolicyMembers, employers, partners. What we collect, why, and your rights Terms of ServiceMembers. The agreement between you and VYVE Safeguarding PolicyMembers, employers, partners. What happens if a member may be at risk AI Use PolicyMembers, employers, partners. Where VYVE uses AI and what it never does Information Security PolicyEmployers and procurement teams. How member data is protected Data Retention Schedule and Sub-processor RegisterEmployers and procurement teams. How long we keep data and who processes it

Key facts

Topic	Fact used in every policy
Legal entity	VYVE Health CIC, company number 16449796, a community interest company registered in England and Wales
Data protection registration	ICO registration 00013608608
Role	VYVE is the data controller for member data. Employers and partners are never controllers or processors of member data held in VYVE
Contact	team@vyvehealth.co.uk, subject “Data Privacy Request” for rights requests
Data protection lead	Lewis Vines, Co-Founder and CEO. VYVE does not meet the thresholds that require a Data Protection Officer
Safeguarding	Lead: Dean Brown, Co-Founder and CTO. Deputy and clinical adviser: Phil Hurwood, counsellor
Hosting	Supabase, EU (Frankfurt, Germany)
Encryption	TLS in transit across all services; encrypted at rest in the database
Access model	Row-level security: each member can access only their own data
Age	Members must be 18 or over
Health data basis	Explicit consent, UK GDPR Article 9(2)(a), asked for separately and recorded with a version and date
Safeguarding basis	Data Protection Act 2018, Schedule 1, paragraph 18; vital interests, Article 9(2)(c), only where life is at immediate risk
AI provider	Anthropic (Claude), under a data processing agreement. No training on VYVE data. No email addresses or account identifiers sent; a first name may be
AI and risk	AI never decides whether someone is at risk. Detection uses fixed rules; every flag goes to a person
Employer reporting	Aggregated and anonymised only. Any figure based on fewer than 8 people is hidden; the average wellbeing score needs 20
What employers can see about individuals	Seat-based contracts only: who has accepted an invitation, for billing. Never activity, health data or wellbeing. Self sign-up programmes: nothing at individual level about app use. Within an employer challenge, the colleagues organising it see who has joined it, their team and whether they were active that week
Safeguarding response	Member shown 24/7 crisis services immediately. Personal contact within 4 hours (critical) or 24 hours (concern), within cover hours of 08:00 to 21:00, seven days a week
Employer notification	Never about an individual, except a serious and immediate risk to life where the employer’s help is needed and emergency services cannot be reached another way
Free trials	No payment details needed. Access ends unless the member chooses to subscribe
Employer-sponsored access ending	Access ends automatically, with notice in advance. No payment details collected and no automatic conversion to paid. One email explaining the option to continue individually. Account and data erased 90 days after access ends unless the member chooses to continue
Rights requests	Answered within one month
Personal data breach	ICO notified within 72 hours where required; affected members without undue delay; affected employer clients within 72 hours
Policy review	Every 12 months, after any serious incident, and before any new employer or partner launch

Version history

Version	Date	Change
9.0	19 October 2026	Policy suite consolidated. Safeguarding, AI Use, Information Security, and Data Retention and Sub-processor documents added; Privacy Policy and Terms of Service revised and aligned with the app as it is today, including GPS routes, Apple Health writes, the safeguarding check and employer challenges

Every policy is owned by Lewis Vines, Co-Founder and CEO, except the Information Security Policy and the Safeguarding Policy, which are owned by Dean Brown, Co-Founder and CTO.