VYVE Health CIC (“VYVE”, “we”, “us”, “our”) is a community interest company registered in England and Wales under company number 16449796. We provide the VYVE app for iOS and Android, the member portal at online.vyvehealth.co.uk, the employer portal, the VYVE Partners app and partner portal for the partners, coaches and ambassadors we work with, and this website, www.vyvehealth.co.uk (together, “VYVE” or “the Service”).
We are the data controller for the personal data described in this policy. We are registered with the Information Commissioner’s Office (ICO) under registration number 00013608608. Our data protection lead is Lewis Vines, Co-Founder and CEO. VYVE does not currently meet the thresholds that require a Data Protection Officer; data protection is the responsibility of our directors.
For anything about your data, contact us at team@vyvehealth.co.uk. Our registered office address is on the Companies House register.
Your location from your phone’s GPS while the recording is running, to measure distance, pace and climb and draw your route. Apart from that, VYVE only uses your location on the phone itself: to show you on the map before you start, and to find races near you when you ask. It doesn’t send or keep it. Wherever anyone else can see your route, whether that’s a challenge or community post, a share card or picture you send out, or your month summary, the first and last 200 metres are left off the map, so your home or workplace isn’t visible. On your own walk’s page you see the whole route, with those hidden ends faded. The distance and time you are credited with are always the full walk.
Only the data types you choose to allow. See section 4.
If you subscribe directly with us, payment is handled by Stripe. We receive confirmation of your subscription, the plan, payment status and the last four digits and expiry date of your card. We never see or store your full card details. If you subscribe through the App Store or Google Play, Apple or Google handle the payment and tell us your subscription status. No payment details are needed to start a free trial, and members whose access is sponsored by an employer are never asked for payment details.
Much of what you log in VYVE is health data, for example mood and wellbeing check-ins, journal entries, workouts, nutrition, weight, injuries, and data from Apple Health or Health Connect. The law treats health data as special category data and requires extra protection.
We only process your health data with your explicit consent, which we ask for separately in the app before you use these features and record with a version and date. We use it to:
We never sell your health data, use it for advertising, or share it with your employer, a partner or anyone else in a way that identifies you. Your journal and check-in answers are not shared with anyone, with one exception we want to be open about: our safeguarding team may read text that has been flagged as a possible risk to your safety (section 6).
You can withdraw your consent at any time in the app settings or by emailing us. Withdrawing consent does not affect processing we carried out before you withdrew it, but features that depend on health data, such as personalised plans and your wellbeing score, will stop working.
Connecting another service is optional and off until you turn it on. Your phone asks you which data types to share, and you can change or remove access at any time in your phone’s Health or Health Connect settings. Where your phone allows it, VYVE can read new data in the background, so a walk from your watch is counted before you next open the app.
Only the data types you allow, which may include steps, distance, workouts and exercise sessions and their routes, active energy burned, heart rate during workouts, sleep, weight, mindful minutes and your State of Mind entries. We only request the data types we need for the features you use.
If you allow it on your phone’s Health permission screen, VYVE saves what you do in the app to Apple Health or Health Connect, so your activity rings and your other fitness apps can see it. That covers walks, runs and hikes with their route, distance and estimated calories; gym sessions; breathwork and meditation as mindful minutes; the weight you log; and the mood you tap each day. You can stop this at any time with “Save workouts to Apple Health” in VYVE’s Settings, or in your phone’s Health settings. Once something is in Apple Health or Health Connect, it is kept there under Apple’s or Google’s terms, and other apps you have allowed can read it.
Where VYVE offers it, you can connect services such as Strava, or fitness watches through a connection partner. We receive only the activities you choose to sync and send only the activities you record in VYVE (route, time and distance). Those services are independent controllers under your own agreement with them. You can disconnect in Settings at any time.
Our use of information received from Health Connect follows the Health Connect Permissions policy, including its limited use requirements, and our use of HealthKit data follows Apple’s App Store Review Guidelines. If you disconnect a service, we stop reading new data. You can ask us to erase data we have already received from it at any time.
VYVE uses AI to personalise your experience: to suggest a coaching style, starter habits and a first plan when you join, to write a private reflection on your weekly check-in, to name and shape your goal and your running plan, to reflect on a journal entry if you switch that on, and to write the occasional message that invites you back when you have been away. To do this we send the information each feature needs, such as your goals, preferences, recent activity, check-in scores and what you write in a check-in, to our AI provider, Anthropic. We never send your email address or any account identifier. Your first name may be included so a reflection or message can address you. Journal entries are only sent if you switch on the optional journal reflection feature.
If you do not want your data used for AI features, email us and we will switch them off for your account. Our AI Use Policy has more detail.
VYVE is not an emergency service. If you need help now, call 999, NHS 111 (mental health option) or Samaritans on 116 123, or text SHOUT to 85258. Our urgent support page lists more.
People sometimes write about very hard things in a check-in, a journal entry, a mood note or a community check-in. To help keep members safe, free text you write in the welcome questionnaire, check-ins, journal entries, mood notes and community posts is automatically checked against a fixed list of words and phrases that suggest a risk of suicide, self-harm, abuse or severe distress. This is a plain word list, not artificial intelligence, and nothing about your experience in the app changes when it matches. If something is flagged:
We never tell your employer, a partner or anyone else that you have been flagged. We only share information without your agreement where there is an immediate risk to your life or someone else’s (UK GDPR Article 9(2)(c), vital interests), where the law requires it, or where a child or another adult is at risk of serious harm. Our Safeguarding Policy sets out who responds, how quickly, and what we record.
| Purpose | Legal basis |
|---|---|
| Create and run your account, including your free trial or sponsored access, deliver the Service, take payment where you subscribe directly | Contract |
| Process health and wellbeing data, including the AI features | Explicit consent (UK GDPR Article 9(2)(a)) |
| Safeguarding checks on free text | Explicit consent (Article 9(2)(a)); Data Protection Act 2018, Schedule 1, paragraph 18 (safeguarding of individuals at risk); vital interests (Article 9(2)(c)) in an emergency |
| Apple Health, Health Connect and other connected services, push notifications, marketing where consent is needed | Consent |
| Keep the Service secure, prevent misuse and fraud, understand usage, improve the Service, answer enquiries, send limited marketing to existing customers | Legitimate interests, where not outweighed by your rights |
| Anonymised, aggregated reports for employers and partners | Legitimate interests, using only data that cannot identify you |
| Financial records and lawful requests | Legal obligation |
Your employer pays for your access. Depending on how they have set it up, either they give us your name and work email so we can invite you, or you join yourself using a link or QR code they share, with the email address your employer has asked us to accept (for example your work email). You can change the email on your account at any time in Settings, for example when you leave.
The colleagues who organise the challenge can see who has joined it, the team or building each person picked, and whether each person has been active that week. They never see your activity detail, routes, check-ins or health data. Other colleagues in the same challenge see what you choose to post in it, your distance totals and your position on its leaderboard, under the name setting you choose. If the challenge includes fundraising, the giving happens on the charity’s own site and we only read the public team totals.
If you sign up using a partner’s or ambassador’s link or code, we tell them that you joined so they can be paid a referral fee. If you join a partner’s community in the app, the partner can see your display name and your participation in their community, challenges and sessions. Nothing else. Partners never see your email address, your journal, check-in answers, connected health data, activity outside their community or wellbeing score.
If a charity partner refers you for a donated membership, they share your name and email address with us, with your agreement, so we can set up your account. We tell the charity whether you activated your membership, but nothing about how you use VYVE.
Anything you post in a community space can be seen by other members of that community. You control how your name appears on leaderboards in your settings.
If you use the partner portal or the VYVE Partners app, we also collect:
We use this to run your partner account, check who you are before you go live, show your page and content to members, pay you, and meet our tax and accounting obligations. Our legal bases are contract (your partner agreement), legitimate interests (checking identity and keeping members safe) and legal obligation (financial records).
We keep your partner data while your partnership is active and for 12 months after it ends. Financial records, including payout statements, are kept for 7 years. If your application is declined, we erase your ID document within 90 days; otherwise we erase it when your partner account closes. You can close your partner account in Settings in the VYVE Partners app, or by emailing team@vyvehealth.co.uk.
We do not sell your personal data. We share it only with service providers who process it on our behalf, under written contracts that require them to keep it secure and use it only on our instructions. They are listed, with their purpose, location and transfer safeguard, in our Sub-processor Register. We give employer clients at least 30 days’ notice before adding a provider that handles member data. In summary:
We may also share data with professional advisers such as lawyers and accountants, with the police, courts or regulators where the law requires it, and with a buyer or successor if VYVE is ever sold or restructured, in which case this policy will continue to protect your data.
We store member data in the EU (Frankfurt, Germany). Some providers, including Anthropic, Stripe, Apple, Google, Esri and any service you choose to connect, may process data in the United States. Where data leaves the UK, we make sure it is protected by an approved safeguard: the UK Extension to the EU-US Data Privacy Framework, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. The safeguard for each provider is in the Sub-processor Register.
We keep data only as long as we need it. The full schedule is our Data Retention Schedule. In summary:
| Data | How long |
|---|---|
| Account you close yourself | Erased 7 days after your request (you can cancel within that time) |
| Account after a paid membership or free trial ends | 12 months, so you can return, then erased |
| Account after employer-sponsored access ends, if you do not continue | 90 days, then erased |
| Activity, workout, nutrition and engagement logs | Up to 24 months, then anonymised |
| Routes from walks, runs and hikes | With the activity they belong to, up to 24 months, then erased. You can remove a single walk and its route in the app at any time |
| Photos and posts in communities and challenges | Until you remove them or the community or challenge closes, and never longer than your account data |
| Wellbeing check-ins, journal entries and AI reflections | Up to 12 months, then erased |
| Data received from Apple Health, Health Connect or a connected service | While connected, then up to 12 months |
| Safeguarding records (date, source, category, contact made and outcome, never your words) | 6 years after the concern is closed |
| Enquiries and applications | 12 months after our last contact with you |
| Financial and transaction records | 7 years, as required by UK law |
You can ask us to erase your data earlier (see section 12). Anonymised statistics that cannot identify you may be kept longer.
You have the right to:
You can request a copy of your data and close your account yourself from Settings in the app, or by emailing team@vyvehealth.co.uk with the subject “Data Privacy Request”. An account closure has a seven-day cooling-off period during which you can cancel it; after that it cannot be undone, and we also remove you from our email, payment and analytics providers. We may need to confirm your identity. We respond within one month, and let you know if we need longer for a complex request. It is free, unless a request is clearly unfounded or excessive.
We send service emails that you need to use VYVE, such as account confirmations, reminders you have switched on, certificates and important changes. We only send marketing emails if you have agreed to them, or if you are a paying customer and we are telling you about similar VYVE services, and every marketing email has an unsubscribe link. Members with employer-sponsored access receive no marketing from VYVE unless they opt in. Push notifications are only sent if you allow them, never include health information, and can be turned off in the app or your phone settings.
We do not use advertising or tracking cookies. You can change your choice at any time using “Cookie settings” at the bottom of any page. You can also block or erase cookies in your browser settings, although parts of the site and portal may not work properly without essential cookies.
VYVE is for people aged 18 and over. We do not knowingly collect data from anyone under 18. If we learn an account belongs to someone under 18, we close it and erase the data. If you think someone under 18 has created an account, contact us.
We use appropriate technical and organisational measures to protect your data, including:
Our Information Security Policy has more detail. If a data breach is likely to put your rights at risk, we will tell the ICO within 72 hours and tell you without undue delay.
We may update this policy as VYVE develops or the law changes. We will change the version and date at the top, and if a change is significant we will tell you by email or in the app before it takes effect. Where a change needs your consent, we will ask for it. Version 9.0 replaces the policy dated 19 October 2026 and earlier versions.
VYVE Health CIC · Company number 16449796 · Registered in England and Wales
ICO Registration Number: 00013608608
Data protection lead: Lewis Vines, Co-Founder and CEO
Email: team@vyvehealth.co.uk (subject “Data Privacy Request”)
Website: www.vyvehealth.co.uk
Employers and partners can request our Data Processing Agreement and completed security questionnaire at the same address.
If you are unhappy with how we have handled your data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint · 0303 123 1113
This document is one of six that together describe how VYVE handles data and keeps members safe. They are written to be read together and use the same facts.