VITALVital helps you understand your health without using your health information for advertising. This notice explains what stays on your device, what optional features send to our services, and the choices you have.
Who is responsible
LMS Labs Ltd, Scotland (company number SC888839), operates Vital and is the controller of personal information used to provide the service. Contact business@lmslabsltd.com for privacy questions, access requests or deletion help.
Your device and Apple Health
Vital stores your local profile, logs and history on your device. If you allow access to Apple Health, it reads the categories you approve to provide your readings and history. Depending on the features you use, these can include sleep, heart rate, resting heart rate, heart-rate variability, heart-rate recovery, blood oxygen, respiratory rate, fitness estimates, steps, distance, stairs, energy, exercise, standing, mindful minutes, sleeping wrist temperature, time in daylight, alcoholic drinks, body measurements, nutrition, water, caffeine and workouts. Wrist temperature, daylight, drinks and mindful minutes help your Readiness on your iPhone: last night’s wrist temperature against your own usual, and yesterday’s daylight, drinks and mindfulness as a small nudge. They are read on the device, are optional (Readiness works without them) and are never sent to our servers as raw samples. Profile information such as age, sex, height and weight helps personalise the experience. If you allow it, Vital also saves what you log in Vital to Apple Health, such as workouts, food and drink nutrients, water, caffeine, weight and mindful minutes.
You can decline Apple Health access, change individual permissions in Apple’s Health settings, and use manual logging where supported. Local app data uses iOS file protection; account tokens use the device’s Keychain. An optional app lock adds a screen-access control.
The V and Ask V, on your iPhone
The V’s lines are worked out on your iPhone from your readings. To choose what to say, Vital keeps a small record on your iPhone of how you use the app: counts, hours and dates only, such as how often you open a page and the hour you usually log. It holds no health values, food, notes or anything you type, and it never records the Cycle page. It is never synced, never sent to us and never used for analytics. It stays on your iPhone until you erase local data, delete your Vital account or remove the app.
On an iPhone with Apple Intelligence turned on, Ask V answers your questions with Apple’s on-device model. It can use today’s readings, including the food you’ve logged today and your latest weigh-in. Your question and the readings it uses stay on your iPhone. The day’s conversation, and a question you haven’t sent yet, are kept on your iPhone so they are not lost if iOS closes Vital. A conversation from an earlier day is not brought back, and signing out or erasing local data clears it. The conversation is never synced, and it is not sent to us or to anyone else.
Optional accounts and cloud sync
You can use Vital without registering. If you create an account, we process your email or the identifiers supplied by Apple or Google, account dates and your chosen profile details to authenticate you. A temporary anonymous account may be used to associate an App Store purchase before registration.
Cloud sync is a separate choice. When enabled, it sends supported profile details, preferences, workouts and sets, food and drink entries, body measurements, daily health summaries, and other supported logs to our Supabase backend in Stockholm, Sweden. These summaries can include health measurements, including heart rate, heart-rate variability and sleep information; they are not limited to scores. Progress photos you choose to sync are stored in private cloud storage. Sensitive features such as mood and cycle tracking have their own controls. Agreeing to this notice when you set up Vital does not turn on cloud sync, mood or cycle tracking, or online food lookup; each is a separate choice you make in the app. If you record them and enable the applicable sync, profile and cycle records can include pregnancy due dates, symptoms and intimate cycle information.
Turning sync off stops new general sync transfers. It does not itself erase information already stored in your account. A minimal record of your withdrawal may still be sent so the service can respect and record your choice. Use account deletion to request erasure.
Food search and external services
Food searches and barcode scans look in Vital’s own food catalogue on our servers, which includes product data from Open Food Facts. When you approve external food lookup, a search term or barcode may be sent through our service to food-data providers such as FatSecret, Open Food Facts or USDA FoodData Central. Do not put private health details in a food search. When a completed catalogue search returns no results, we retain the search text and app version to identify missing foods and improve catalogue coverage; these records are not linked to your account. This catalogue-maintenance processing is separate from optional onboarding usage sharing. If you still use an older version of Vital, its food search works as it did then. Versions before 3.2.13 may send a search term or barcode from your iPhone directly to Open Food Facts, and through our service to FatSecret. Versions before 3.2.0 may also send a search that found nothing elsewhere through our service to Anthropic, which estimates the food’s nutrition. Only the search text goes to Anthropic; the estimate is added to Vital’s food catalogue and recorded against the account that asked for it. The current app sends food searches only to Vital’s catalogue and, when you approve online food lookup, to USDA FoodData Central. The current app does not provide the retired AI chat, AI insight, AI photo-analysis or AI food-estimate features. Records from older versions may remain until deleted under the applicable retention controls.
Purchases
Apple processes payments; we do not receive your card details. Vital and RevenueCat process product identifiers, transaction identifiers, purchase and expiry dates, trial and renewal state, country or storefront information and an app-specific customer identifier to recognise purchases, restore access and understand subscription performance. RevenueCat also receives technical information needed to provide its service, such as app and operating-system version, Apple’s identifier for vendor (a device identifier used within the app vendor’s apps), and connection information. We do not send RevenueCat your HealthKit readings, logs, photos, name or answers to health questions. If you turn on app usage (below), RevenueCat also receives your setup goal, app version, the reason you choose if you cancel through Vital, your random usage identifier and, if an Apple Search Ads campaign led to your install, which campaign. If you turn app usage off after Apple Search Ads collection has started, RevenueCat may still collect and send that attribution until you fully close and reopen Vital. RevenueCat also passes subscription events (such as a trial starting, a renewal, a cancellation, a billing problem or an expiry, with the product, price, store country and the app-specific customer identifier) to PostHog, so we can see how subscriptions perform over time. These events contain no health data, and nothing about how you use the app unless you turn on app usage.
When you buy in the app, Vital sends Apple’s signed transaction to our backend to confirm it and link it to your account, using your account identifier as Apple’s app account token. Apple also tells our backend about renewals, refunds and transfers of those purchases. If you delete your account, we remove the link to it but keep the transaction reference, so a purchase can be restored once and is not claimed by two accounts. Deleting Vital or your Vital account does not cancel an Apple subscription. Manage or cancel it in Apple’s subscription settings.
Invite a friend
When you invite someone from Vital, we create a random link code for your account and store it with your first name, taken from the name in your profile, so your invite page and its link preview can say who sent it. When someone taps the button on your invite page, we record that your link handed out an Apple offer code, which code and when. These handout records are deleted after 90 days. Your visitor’s IP address passes from our website to our backend so we can limit misuse. The address itself is not stored: our backend keeps only a keyed code made from it, which changes every day, to count taps, and deletes it within about a day.
Apple does not tell us which code was redeemed. When a new subscription starts with the friend offer, we match it to an invite: exactly, if your friend claimed the offer in the app while signed in, or otherwise by time, to the most recent unused handout. We then keep a record that links your account to Apple’s transaction reference for that subscription, so we can give you a free month once your friend’s first payment has been made and seven days have passed, and cancel it if that payment is refunded. You can receive up to three free months a year this way. You see only that someone joined and the state of your reward, never who it was. Vital never reads your contacts; invites are shared with the iOS share sheet. This record is deleted 12 months after the reward for that invite is settled, or sooner if you delete your account. Your invite link and the first name stored with it are kept while your account exists and are deleted with it. If your friend deletes their account, the link to their account is removed.
Optional app-usage information
If you choose to share app usage, we record which pages you open and which buttons you tap (for example opening Sleep, starting a log or viewing the Vital Club offer), which onboarding steps were reached, the type of thing you log (food, water, supplements, workout, weight or measurements) and how often, how long and how often you use the app, your answer to “What brings you to Vital?”, the reason you choose if you cancel through Vital, and your app and iOS version. This helps us see which parts of Vital help people and test small changes, such as the wording of the Vital Club offer.
Events use a random identifier, not your account, and never contain health readings, food or drink names, notes or anything you type, your name, email, photos or an advertising identifier. We never record that you use mood or cycle tracking, and we do not record your screen or your keystrokes. If you subscribe, the random identifier is linked to your subscription record so we can see, for example, whether people who log more stay longer.
This choice is off by default and can be changed at any time in Settings > Health & privacy > App usage. Declining it does not block the app. Turning it off stops collection of usage events at once and deletes events still waiting on your phone. Apple Search Ads attribution may continue until you fully close and reopen Vital, as explained under Purchases. Usage events are processed by PostHog in its EU cloud (Frankfurt) with IP addresses discarded and kept for 12 months; onboarding step counts in our own backend are kept for up to 30 days. Counts represent users who chose to share usage, so they do not describe everyone using Vital. To have usage data we already received deleted, contact business@lmslabsltd.com.
Diagnostics, support and service security
Crash and performance reports are stored locally unless you choose to share them, or separately opt into Apple’s diagnostic-sharing settings. If you contact support, we use your message and contact details to respond. Hosting, authentication and security systems process connection metadata, timestamps and error records to deliver and protect the service. Please avoid sending unnecessary health information in support messages.
Authorised operators can access account and service records for support, security and administration. Sensitive content in the app’s administration tools requires an additional access step with a recorded reason. Backend administrative access remains privileged access, so we do not promise that information stored with us is inaccessible to the service operator.
Why we process information
We process account and purchase information, and your invite link if you use Invite a friend, as necessary to provide the service you request (UK GDPR Article 6(1)(b)). Matching a friend’s subscription to an invite and limiting misuse of invite links rely on legitimate interests (Article 6(1)(f)). Optional usage collection relies on consent (Article 6(1)(a)). Catalogue-quality improvements, security, fraud prevention and appropriate service diagnostics rely on legitimate interests (Article 6(1)(f)); legal recordkeeping may rely on a legal obligation (Article 6(1)(c)). Health information also requires a special-category condition: we rely on your explicit consent under Article 9(2)(a). Reading this notice does not by itself grant those optional permissions.
You may withdraw consent at any time. Withdrawal does not change the lawfulness of earlier processing. Vital’s automated readings support general wellbeing; we do not use them to make decisions about your employment, insurance, credit or eligibility for healthcare.
Service providers and international transfers
Our providers include Apple for platform services, purchases, offer codes and Ask V’s on-device model, Supabase for authentication, database and storage, RevenueCat for subscription infrastructure, PostHog (EU cloud, Frankfurt) for optional app-usage analytics, Cloudflare for website delivery, the invite page button and cookieless website visit statistics (Cloudflare Web Analytics, which does not use cookies or track you across sites), the food-data providers described above, and Anthropic for food estimates requested by versions before 3.2.0. They receive the information needed for their respective roles. We do not sell personal information or provide health data to advertisers.
Although the main Vital database is hosted in Sweden, some providers and support operations may process information in other countries. Where UK transfer restrictions apply, we use an applicable adequacy decision or appropriate contractual safeguards. Contact us for information about safeguards relevant to your request.
Retention and deletion
Local information remains until you remove it, reset local app data or remove the app, subject to the device’s own backup settings. Cloud account records remain while your account is active. Account deletion removes the active account and associated records; storage cleanup must complete before the app reports success. If deletion fails, retry or contact us so we can finish it.
Deleted information may remain in restricted backups until the provider’s backup cycle expires. Security and administrative audit records are kept only for as long as needed to investigate incidents, prevent abuse and meet applicable legal duties. Transaction records may be retained where needed for billing, fraud prevention or legal obligations. Any retained information is restricted to that purpose. Invite handout records are deleted after 90 days, and the record linking an invite to a friend’s subscription 12 months after its reward is settled. Older chat content is subject to the app’s 90-day retention controls. We do not use backup copies to reactivate a deleted account.
Your rights
Depending on the circumstances, you may request access, correction, erasure, restriction or a portable copy of your information, and object to processing based on legitimate interests. Use the app’s export and deletion controls or contact us. We normally respond within one month; the law allows extensions for some complex requests, which we will explain. You can complain to the UK Information Commissioner’s Office or your local supervisory authority.
Children and changes
Vital is not intended for children under 13. Users aged 13 to 15 need a parent or guardian’s permission. Please contact us if you believe a child has provided information without the required permission. We update this notice when the service changes and will explain material changes in the app or through another appropriate channel.