Privacy Policy

1. Who we are

VYVE Health CIC (“VYVE”, “we”, “us”, “our”) is a company registered in England and Wales under company number 16449796. We provide the VYVE wellbeing app for iOS and Android, the member portal at online.vyvehealth.co.uk, the VYVE Partners app and partner portal for the partners, coaches and ambassadors we work with, and this website, www.vyvehealth.co.uk (together, “VYVE” or “the Service”).

We are the data controller for the personal data described in this policy. We are registered with the Information Commissioner’s Office (ICO) under registration number 00013608608.

For anything about your data, contact us at team@vyvehealth.co.uk. Our registered office address is available on request and on the Companies House register.

2. The data we collect

When you sign up

• Your name, email address and password (passwords are handled by our authentication provider and are never visible to us)
• Your answers to the welcome questionnaire, such as your goals, preferred training style, experience level, availability and the coaching style you prefer
• Optional profile details you choose to give us, such as age, gender, height and weight, used to personalise your plan and nutrition targets
• How you joined, for example directly, through your employer, through a partner or ambassador link, or through a trial campaign code
• The consents you give, and when you gave them

When you use the app or member portal

• Workouts and programmes: the plans you follow, exercises, sets, reps and weights logged, and workouts you build
• Movement and cardio: sessions, steps, distance and duration you log or sync
• Nutrition: calorie and macro targets, food and hydration logs, and weight entries, where you use them
• Mind: daily mood check-ins, weekly and monthly wellbeing check-ins, breathwork and meditation sessions, and journal entries
• Habits, streaks, achievements, certificates and your wellbeing score
• Sessions and replays you join or watch, and communities and challenges you take part in
• Posts, comments and check-ins you share in community spaces
• Settings and preferences, including your leaderboard name setting and notification choices
• Messages you exchange with the in-app AI Coach

When you connect Apple Health or Android Health Connect

Only the data types you choose to allow. See section 4.

When you pay

If you subscribe directly with us, payment is handled by Stripe. We receive confirmation of your subscription, the plan, payment status and the last four digits and expiry date of your card. We never see or store your full card details. If you subscribe through the App Store or Google Play, Apple or Google handle the payment and tell us your subscription status.

When you contact us or fill in a form

• Your name, email address and message, and anything else you choose to include
• For employer enquiries: your organisation name, team size and industry
• For partner, ambassador, podcast guest or careers applications: the information you submit in that form

Collected automatically

• Device type, operating system, app version and browser
• IP address and approximate location (country or city level)
• How you use the website, app and portal, such as pages and screens viewed, features used and time spent
• Push notification tokens, if you allow notifications
• Crash and error information that helps us fix problems

3. Health and wellbeing data

Much of what you log in VYVE is health data, for example mood and wellbeing check-ins, journal entries, workouts, nutrition, weight, and data from Apple Health or Health Connect. The law treats health data as special category data and requires extra protection.

We only process your health data with your explicit consent, which we ask for in the app before you start using these features. We use it to:

• Build and adapt your personal plan, targets and recommendations
• Show your progress, streaks, achievements and wellbeing score
• Power your AI Coach (see section 5)
• Produce anonymised, aggregated statistics, for example for employer reports or to improve the Service, where no individual can be identified

We will never sell your health data, use it for advertising, or share it with your employer, a partner or anyone else in a way that identifies you. Your journal and check-in answers are private to you.

You can withdraw your consent at any time in the app settings or by emailing us. Withdrawing consent does not affect processing we carried out before you withdrew it, but some features, such as personalised plans and your wellbeing score, will stop working without it.

4. Apple Health and Android Health Connect

You can choose to connect VYVE to Apple Health (HealthKit) on iPhone or Health Connect on Android. This is optional and off until you turn it on. Your phone asks you which data types to share, and you can change or remove access at any time in your phone’s Health or Health Connect settings.

What we read

Only the data types you allow, which may include steps, distance, workouts and exercise sessions, active energy burned, heart rate during workouts, sleep, and weight. We only request the data types we need for the features you use.

How we use it

• To log your activity automatically, count it towards your habits, streaks, challenges, wellbeing score and Give Back milestones, and show your progress
• To personalise your plan and your AI Coach’s suggestions

What we never do

• We never sell data from Apple Health or Health Connect
• We never use it for advertising, marketing or to build advertising profiles
• We never share it with data brokers, employers or partners in a form that identifies you
• We never use it for credit, insurance or eligibility decisions

Our use of information received from Health Connect follows the Health Connect Permissions policy, including its limited use requirements, and our use of HealthKit data follows Apple’s App Store Review Guidelines. We only write data back to Apple Health or Health Connect if you ask us to, for example to save a workout you completed in VYVE.

If you disconnect the integration, we stop reading new data. You can ask us to delete data we have already received from it at any time.

5. AI coaching and automated features

VYVE includes an AI Coach and AI-generated suggestions, such as workout recommendations, check-in reflections and weekly insights. To create them we send relevant information, such as your goals, preferences, recent activity and check-in answers, to our AI provider, Anthropic. We send it without your name or email address.

• Anthropic processes this data only to generate responses for VYVE, under a data processing agreement, and does not use it to train its models
• AI suggestions are for general wellbeing only. They are not medical advice, diagnosis or treatment. Speak to a healthcare professional about any medical concern
• We do not make any decisions about you using automated means that have a legal or similarly significant effect

If you do not want your data used for AI features, contact us and we will switch them off for your account.

6. How we use your data

• To create and run your account, including your 30-day free trial and subscription
• To deliver the Service: plans, programmes, sessions, replays, habits, nutrition tools, check-ins, communities and challenges
• To personalise your experience and your AI Coach
• To run Give Back, counting eligible activities towards donated memberships
• To send service messages, such as account emails, reminders you have switched on, certificates and important updates
• To answer your questions and provide support
• To keep the Service safe, prevent misuse and fraud, and fix problems
• To understand how the Service is used so we can improve it
• To produce anonymised, aggregated reports for employers and partners
• To send marketing, only where you have agreed or where the law allows (see section 13)
• To meet our legal, tax and accounting obligations

7. Our legal bases

The law requires us to have a legal basis for each use of your data. We rely on:

• Contract: to provide the Service you signed up for, manage your account and take payment
• Explicit consent: for health and wellbeing data (UK GDPR Article 9(2)(a)), for Apple Health or Health Connect, for push notifications and for marketing where consent is needed
• Legitimate interests: to keep the Service secure, prevent fraud, understand usage, improve the Service, respond to enquiries and send limited marketing to existing customers, where these interests are not outweighed by your rights
• Legal obligation: to keep financial records and respond to lawful requests

8. Employers, partners and charity referrals

If you have VYVE through your employer

Your employer pays for your membership and gives us your name and work email so we can invite you. Your employer only ever receives anonymised, aggregated information, such as how many people have joined and overall engagement trends, presented so that no individual can be identified. Your employer never sees your individual activity, check-ins, journal, health data or wellbeing score.

If you join through a partner or ambassador

If you sign up using a partner’s or ambassador’s link or code, we tell them that you joined so they can be paid a referral fee. If you join a partner’s community in the app, the partner can see your display name and your participation in their community, challenges and sessions. Nothing else. Partners never see your email address, your journal, check-in answers, health integration data, activity outside their community or wellbeing score.

If you are referred through Give Back

If a charity partner refers you for a donated membership, they share your name and email address with us, with your agreement, so we can set up your account. We tell the charity whether you activated your membership, but nothing about how you use VYVE.

Community spaces and leaderboards

Anything you post in a community space can be seen by other members of that community. You control how your name appears on leaderboards in your settings.

If you work with VYVE as a partner, coach or ambassador

If you use the partner portal or the VYVE Partners app, we also collect:

• Your account and page: your name, email address and password (handled by our authentication provider and never visible to us), and the photos, bio, services and prices you add to your page
• Content you upload: videos, photos and posts. Approved videos are shown to members in the VYVE app and hosted as unlisted videos on YouTube
• Identity verification: a photo of your ID, which our team checks before you go live. It is never shown to members
• Payment details: the account name, sort code and account number we pay your earnings to, and your earnings and payout records
• Your partner agreement, the bookings members make with you, the messages you send our team, and push notification tokens for the VYVE Partners app

We use this to run your partner account, check who you are before you go live, show your page and content to members, pay you, and meet our tax and accounting obligations. Our legal bases are contract (your partner agreement), legitimate interests (checking identity and keeping members safe) and legal obligation (financial records).

We keep your partner data while your partnership is active and for 12 months after it ends. Financial records, including payout statements, are kept for 7 years. If your application is declined, we delete your ID document within 90 days; otherwise we delete it when your partner account closes. You can close your partner account in Settings in the VYVE Partners app, or by emailing team@vyvehealth.co.uk.

9. Who we share data with

We do not sell your personal data. We share it only with trusted service providers who process it on our behalf, under written contracts that require them to keep it secure and use it only for our instructions:

• Supabase: database, authentication and server functions. Member data is stored in the EU (Frankfurt, Germany)
• Anthropic: AI coaching and AI-generated content (see section 5)
• PostHog: product analytics for the app, portal and website, hosted in the EU. A small sample of portal sessions may be recorded to diagnose problems, with everything you type and all email addresses masked
• Brevo: sending account and service emails, based in the EU
• Stripe: payment processing for direct subscriptions
• Apple and Google: app distribution, in-app subscriptions where used, and push notifications. Notification content never includes your health information
• Capawesome: in-app updates, hosted in the EU. Only device and app identifiers are processed
• YouTube (Google): hosting session and replay videos shown in the app and portal. YouTube may set its own cookies when you play a video
• GitHub (Microsoft): hosting this website and the member portal. No member data is stored there

We may also share data with professional advisers such as lawyers and accountants, with the police, courts or regulators where the law requires it, and with a buyer or successor if VYVE is ever sold or restructured, in which case this policy will continue to protect your data.

10. International transfers

We store member data in the EU (Frankfurt, Germany). Some providers, such as Anthropic, Stripe and Google, may process data in the United States. Where data leaves the UK, we make sure it is protected by an approved safeguard, such as the UK Extension to the EU-US Data Privacy Framework, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Contact us for more detail on the safeguards we use.

11. How long we keep data

• Account and profile data: while your account is open and for 12 months after it closes, then deleted or anonymised
• Activity, workout, nutrition and engagement logs: up to 24 months, then anonymised
• Wellbeing check-ins and journal entries: up to 12 months, then deleted or anonymised.
• Data received from Apple Health or Health Connect: for as long as you keep the integration connected, then up to 12 months, unless you ask us to delete it sooner
• AI Coach conversations: up to 12 months
• Enquiries and form submissions: 12 months after our last contact with you
• Financial and transaction records: 7 years, as required by UK law

You can ask us to delete your data earlier (see section 12). Anonymised statistics that cannot identify you may be kept longer.

12. Your rights

You have the right to:

• Access: get a copy of the personal data we hold about you
• Rectification: have inaccurate or incomplete data corrected
• Erasure: have your data deleted, including deleting your account
• Restriction: ask us to limit how we use your data
• Portability: receive your data in a structured, machine-readable format
• Objection: object to processing based on legitimate interests, and to direct marketing at any time
• Withdraw consent: at any time, for processing based on consent
• Automated decisions: not be subject to decisions based solely on automated processing that significantly affect you

To use any of these rights, email team@vyvehealth.co.uk with the subject “Data Privacy Request”. We may need to confirm your identity. We will respond within one month, and let you know if we need longer for a complex request. It is free, unless a request is clearly unfounded or excessive.

13. Emails and notifications

We send service emails that you need to use VYVE, such as account confirmations and important changes. We only send marketing emails if you have agreed to them, or if you are a customer and we are telling you about similar VYVE services, and every marketing email has an unsubscribe link. Push notifications are only sent if you allow them, and you can turn them off in the app or your phone settings.

14. Cookies and analytics

• Strictly necessary: keep you signed in and make the site and portal work. These cannot be switched off
• Local and session storage: remember things like a trial campaign code or your progress through a form, and speed up the portal by caching your data on your device
• Analytics: PostHog helps us understand how the website, app and portal are used so we can improve them. On this website, analytics only runs if you choose “Accept analytics” in our cookie banner. In the portal and app it is linked to your account
• Embedded video: YouTube may set cookies when you play a session or replay video

We do not use advertising or tracking cookies. You can change your choice at any time using “Cookie settings” at the bottom of any page. You can also block or delete cookies in your browser settings, although parts of the site and portal may not work properly without essential cookies.

15. Age limit

VYVE is for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you think someone under 18 has created an account, contact us and we will delete it.

16. Security

We use appropriate technical and organisational measures to protect your data, including:

• Encryption in transit (HTTPS) across all VYVE services, and encryption at rest in our database
• Row-level security, so each member can only access their own data
• Secret keys kept server-side only, never in the app or website code
• Automated backups, access logging and audit trails
• Access to personal data limited to the people who need it for their role
• Employer and partner reporting that only returns aggregated, anonymised data
• Regular review of our systems and our providers

If a data breach is likely to put your rights at risk, we will tell the ICO within 72 hours and tell you without undue delay.

17. Changes to this policy

We may update this policy as VYVE develops or the law changes. We will change the “Last updated” date at the top, and if a change is significant we will tell you by email or in the app before it takes effect. Where a change needs your consent, we will ask for it.

18. Contact us and complaints