Vylos Privacy Policy

Effective date: November 4, 2026

Vylos Solutions, Inc. ("Vylos", "we", "us") makes the Vylos app for iPhone. This policy explains what information the app uses, where it's kept, who else receives it, and what choices you have. It also covers our website, myvylos.com, and our testing program.

Vylos is for adults 18 and older in the United States.

The short version

Vylos reads your glucose readings from Apple Health. It never writes anything to Apple Health.
Your Vybe Score, History, Points, streak, achievements and day notes are worked out and kept on your phone. We don't receive them, unless you join our testing program and choose to share your daily results (section 8). iPhone backups may include some of this data (section 2).
Our servers hold only your account: your email address, display name, username, how you sign in, and basic account records, plus technical logs kept for a limited time (section 3). If you're a tester, they also hold what you chose to share.
We don't sell your information, show ads, or use your information for advertising. We never use Apple Health data for advertising, marketing or data mining, and we never share it with third parties.
If you help test Vylos, sharing how you use the app and sharing your daily results are two separate choices. Both are optional, and both are off unless you tick them on the application form.
You can delete your account in the app at any time.
Questions and requests: privacy@myvylos.com.

1. Glucose data from Apple Health

With your permission, Vylos reads blood glucose readings from Apple Health on your iPhone. It reads blood glucose only, along with Apple's record of which app or device wrote each reading. Vylos uses that record to tell CGM readings apart from other readings and to decide which days it can score. Vylos never writes to Apple Health.

Vylos doesn't connect to any CGM company. Your CGM app writes readings to Apple Health, and Vylos reads them from there.

Vylos uses these readings only to work out your daily Vybe Score, your History and your progress in the app, and it does this on your phone. We never use Apple Health data for advertising, marketing or data mining. We never sell it, and we never share it with third parties.

To stop Vylos reading your glucose, turn off its access to Blood Glucose in your iPhone's Health privacy settings. You'll find them in the Health app, or in Settings under Privacy & Security. Days Vylos has already scored stay on your phone until you delete the app or your account. Section 2 explains iPhone backups.

2. What stays on your phone

The app works out and stores these on your phone:

the daily figures Vylos works out from the glucose readings it reads from Apple Health (such as time in range, time below 70 mg/dL, variability and average glucose)
your Vybe Scores, tiers and History
your Vylos Points, level, streak and achievements
any day notes and tags you add, such as poor sleep, illness, alcohol or menstrual cycle

We don't receive any of this, unless you join the testing program and choose to share your daily results. Even then, we never receive your individual glucose readings or your day notes and tags (section 8).

The app has no advertising or tracking software, and no analytics software from other companies. Outside the testing program, it sends us no information about how you use it. Apart from Apple's own services, the app connects only to our servers: to sign you in and keep you signed in, and, for testers who chose to share, to send what they chose to share.

If you choose to export a summary, the app creates the file on your phone. Vylos doesn't receive it. Once you share it, the app or person you send it to controls it.

If you back up your iPhone to iCloud or a computer, the backup may include your Vybe Scores, tiers, History, Points, level, streak, achievements and daily figures, such as time in range and average glucose. The version testers have now (build 60) doesn't keep this data out of backups, although this policy used to say it did. We plan to fix this in the next test version. This data doesn't list your individual glucose readings or their times, but on a day with only one or two readings, the daily figures can reveal those values. Your day notes and tags are kept out of backups. These backups are in your own iCloud account or on your own computer. We can't see or delete them, and Apple's privacy policy covers iCloud backups. If you move to a new iPhone and don't restore a backup, Vylos rebuilds your History from the readings still in Apple Health, going back up to 90 days.

The app keeps your sign-in tokens in the iPhone's secure storage (the Keychain).

3. Your Vylos account

You need a Vylos account to use the app. Our servers keep:

your email address. If you use Sign in with Apple and choose "Hide My Email", this is the relay address Apple gives us.
your display name and username
how you sign in: Sign in with Apple, or email and password. For Sign in with Apple, we also keep the account identifier Apple gives us.
basic account records: when the account was created, when it was last updated, and when it was last used
sign-in session tokens, which expire after 7 days, and single-use password-reset codes, which expire after 1 hour
a few profile settings from earlier versions of Vylos (profile and leaderboard visibility, and profile photo and bio fields). The current app doesn't use them or show them to anyone.
if you're a tester: the time you applied, your two sharing choices, and anything you chose to share (section 8)

If you sign up with email, we never store your password. We store a one-way hash of it (bcrypt), which can't be turned back into the password.

Vylos has no social features. Nobody else can see your account or your progress.

Unless you're a tester who chose to share daily results, your account doesn't hold your scores, Points, streak or achievements, and our servers hold no information worked out from your readings. Our servers never hold your individual glucose readings. Accounts created with early test versions of Vylos may also hold a few sample score and Points records from those versions. The current app doesn't create, use or show them, and we're deleting them.

When the app or website connects to our servers, our hosting provider and our servers may automatically record technical information, such as your IP address, device or browser type, and the time of the request. We use these logs only to run and secure Vylos and to count website visits (section 12), and they're kept for a limited time and then deleted automatically.

4. How we use your information

We use your account information to:

create your account, sign you in and keep you signed in
send you a password-reset email when you ask for one
run the testing program, if you apply (section 8)
keep the service working and secure, and prevent misuse
answer your privacy requests
meet legal obligations

We don't send marketing emails. Vylos sends a password-reset email when you ask for one. If you apply to test Vylos, the founder also emails you about your application and, if you join, about testing (section 8).

5. What we don't do

We don't sell your personal information, and we don't share it for advertising.
We don't show ads in the app, and we don't use your information to target ads anywhere.
We don't use or share Apple Health data for advertising, marketing or data mining, and we don't give it to third parties.
We don't track you across other companies' apps or websites.
Vylos Points have no cash value, and there's nothing to redeem them for. We don't share your information with sponsors or reward companies.

6. Who receives information

We share information only with service providers that run parts of Vylos for us, and only what each one needs:

Railway hosts our servers and database. For testers, this includes what they chose to share.
Resend sends password-reset emails. It receives only your email address.
Google (Google Workspace and Google Forms) hosts the testing-program application form, check-in and survey forms, the spreadsheets that hold their answers, and our email. It receives what you enter into those forms and the emails you exchange with us.
Netlify hosts our website and counts website visits for us (section 12).

These providers may use the information only to provide their service to us, and they must protect it at least as well as this policy does.

Apple. Sign in with Apple, Apple Health and TestFlight are Apple services, and Apple's privacy policy covers them. When you delete your account, we ask Apple to end Vylos's Sign in with Apple access.

We may also disclose information:

when the law requires it, such as a valid subpoena or court order
when we believe in good faith that it's needed to prevent imminent harm to someone's life or physical safety
if Vylos is part of a merger, acquisition or sale of its assets. The new owner must keep following this policy for the information it receives, and we'll tell you before your information becomes subject to a different policy.

7. Signing out, deleting the app, and deleting your account

Signing out. When you sign out, your History, Points, streak and achievements stay on this phone, tied to your account. If you sign back in with the same account, they're there. If someone else signs in on this phone, they can't see them.

Deleting the app. Deleting the app removes your History, Points, streak and achievements from this phone. We can't restore them for you, but if an iPhone backup includes them (section 2), restoring that backup may bring them back. It doesn't delete your account, and it doesn't change your readings in Apple Health. iOS can keep the app's sign-in tokens in the Keychain after the app is deleted. They stop working within 7 days. If you reinstall Vylos before then, you may still be signed in.

Deleting your account. In the app, go to Settings, then Delete Account, and confirm with your password or with Apple. This deletes your account from our servers straight away and removes Vylos's data from this phone. If you're a tester, it also deletes what you shared straight away. If you use Sign in with Apple, we also ask Apple to end Vylos's access to your Apple ID. Deleting your account can't be undone. Your readings in Apple Health aren't affected. If you've used Vylos on another phone, delete the app there to remove what's stored on it. An earlier iPhone backup may still include your data (section 2). We can't delete your backups, so delete them yourself if you want that copy gone.

You can also ask us to delete your account by emailing privacy@myvylos.com (section 14).

8. The testing program

We're testing Vylos on iPhone with a small group of adults, using Apple's TestFlight. This section applies only if you apply to test Vylos. If you don't apply, none of it applies to you, and the rest of this policy describes everything Vylos does with your information.

Your application

The application form asks for:

your email address
that you're 18 or older, use an iPhone, use a Dexcom G6, G7 or ONE+, and live in the US outside Washington, Nevada and Connecticut
whether your Dexcom already shares data with Apple Health, and for roughly how long
your confirmation that none of the items on a short safety checklist apply to you
your two sharing choices (below)
a short code showing which card or link you came from

The form is hosted by Google Forms, and the answers are kept in a Google spreadsheet in our Google account. Only Josef (Joe) Korbel, Vylos's founder, sees them. We use them only to decide who can join testing and to contact you about it. Only your email address, your two sharing choices and the time you applied go into Vylos's own systems, so they can be matched to your Vylos account. Your other answers never do.

If you live outside the US, or in Washington, Nevada or Connecticut, you can't submit the form. We don't ask which state you live in.

How long we keep it. If you aren't accepted, your answers are deleted within 30 days of applying. If the testing group is full, we may put you on a waitlist; your application is still deleted within 30 days of applying unless you reply asking us to keep you on the list. If you do, we keep it until we offer you a place, you ask us to remove it, or 90 days after testing ends, whichever comes first. If you join, your answers are deleted 90 days after testing ends.

Two sharing choices

On the application form you can choose to share two kinds of information from the app. Each one is your choice, both are unticked unless you tick them, and saying no doesn't affect your application or how the app works. There's no consent screen in the app.

How you use the app. Which screens you open, when and for how long you use the app, and how setup went. In detail: setup screens viewed or skipped, the Apple Health permission request and whether readings were found, finishing setup, your first scored day, app opens and how long you stay, screens viewed, score explanations opened, and Points collected. Each record carries a random code for your installation of the app, the time, the local date and hour, the app version and the scoring version. It never includes glucose readings, scores, results, Points amounts, streak lengths, your name or your email address.
Your daily results. For each finished day: your Vybe Score and its tier, how each part of the score was worked out, time in range, time below 70 and below 54, time above 180 and above 250, average glucose, variability, how long your sensor was worn, and whether the day was scored or paused and why. If Apple Health has earlier data, this includes up to 90 days before you installed Vylos. We never receive your individual glucose readings.

Nothing is sent until your Vylos account is matched to your application by email address. If they don't match (for example, if you used "Hide My Email" with Sign in with Apple), nothing is sent. Your day notes and tags are never sent.

How we handle what you share

It's stored with your Vylos account on our servers, which we match to your application by your email address. The reports we review use a random code instead of your name or email.
Only the Vylos team looks at it, to improve the app. We never sell or share it with anyone else, use it for advertising, or use it in marketing, publications or medical claims.
It is not medical monitoring. We look at it days later, not live, and we will not spot or respond to lows or highs. Keep using your CGM app and its alerts.
It's deleted 90 days after you last open the app, or straight away if you delete your account. Copies can stay in our backups for a limited time until those backups are deleted.
Vylos collects it only from accounts matched to an application where you ticked that choice.

Stopping or deleting

To stop sharing either kind of information, email privacy@myvylos.com. We stop collecting it, and the app stops sending it the next time it checks with our servers. Stopping doesn't delete what you've already shared. Ask, and we'll delete it within 30 days. You can also ask us to delete your application answers, check-in answers or survey answers at any time, and we'll delete them within 30 days.

Emails, check-ins and surveys

Emails. If you apply, the founder emails you from Vylos's Google Workspace account: an automatic reply when you apply, then about your application and, if you join, about setup, weekly updates and the end of testing. Each email goes to one person only. We don't use tracking pixels or open tracking.
Weekly check-ins and the exit survey. Testers get a short weekly check-in and a survey at the end, both on Google Forms. They include a question about whether your Vybe Score led you to change a dose or food, or how you treated a low. Only Joe sees the answers, they help improve Vylos, and they're deleted 90 days after testing ends. We don't read them live, so never use them for anything urgent. If something about your diabetes worries you, contact your care team. In an emergency, call 911.
Emails and screenshots you send us. We keep them only to run testing and answer you, and delete them 90 days after testing ends, unless we need them longer to handle a privacy request. Screenshots or feedback you send through TestFlight also go to Apple.
"Keep me posted." When testing ends, you can reply "keep me posted" to hear when Vylos is on the App Store. If you do, we keep only your email address for that, and you can ask us to remove it at any time. We delete it once we've told you Vylos is available.

9. How long we keep information

Your account: until you delete it. When you do, we delete it from our live systems straight away. Copies can stay in our backups for a limited time until those backups are deleted. We keep backups secure and use them only to recover from a system failure. We keep information longer only if the law requires it.
Sign-in session tokens: they expire after 7 days. Password-reset codes: they expire after 1 hour.
Data on your phone: until you delete your account or the app. Copies in an iPhone backup (section 2) last until that backup is replaced or deleted.
Testing program: as set out in section 8.
Privacy requests: we keep your message and our reply for as long as we need to handle the request and show that we did.

10. Security

Connections between the app and our servers are encrypted (HTTPS). Passwords are stored only as bcrypt hashes. Sign-in tokens are kept in the iPhone's secure storage. We limit who can reach our systems. No system is perfectly secure, and we can't guarantee the security of information. If a breach affects your information, we'll tell you as the law requires.

11. Adults only

Vylos is only for people 18 and older. When you create an account, you confirm that you're 18 or older. We don't knowingly collect personal information from anyone under 18. If we learn that an account belongs to someone under 18, we'll delete it. If you think someone under 18 is using Vylos, email privacy@myvylos.com.

12. Our website

myvylos.com is hosted by Netlify. Like any website host, Netlify receives your IP address and browser details when you visit. We also use Netlify Analytics to count visits to the website. It works from Netlify's own records of those visits and shows us totals, such as how many visits each page gets and which websites sent visitors here. We don't see who visited, and we don't link visits to a Vylos account or to anything in the app. The website loads nothing from other companies, and has no cookies, ad tracking or analytics scripts. The testing application form is on Google Forms; when you open it, Google's privacy policy covers that visit.

We use Google Search Console, which gives us summary reports from Google about how myvylos.com appears in Google Search, such as which searches led to the site. It adds no code or cookies to our website.

Do Not Track. We don't track you across other websites or apps, on the website or in the app, so we treat every visitor the same whether or not their browser sends a Do Not Track signal.

13. Where information is processed

Vylos is based in the United States and is available only on the United States App Store. Our service providers are US companies, and your information may be stored or processed wherever they run their services.

14. Your rights and how to use them

Wherever you live in the United States, you can ask us to:

confirm whether we hold personal information about you, and give you a copy of it
correct it
delete it
tell you which service providers have received it (section 6 lists them)
withdraw any consent you've given us. You can also stop Vylos reading Apple Health yourself at any time (section 1).
stop either testing-program sharing choice (section 8)

How to ask. Email privacy@myvylos.com. Tell us the email address your account uses. To protect your account, we'll confirm the request with you, usually by writing to that address. Someone you authorize can make a request for you if they send us your signed permission.

When we'll reply. Within 45 days. If we need longer, we'll tell you why within those 45 days, and we'll reply within 45 more. There's no charge.

If we say no. We'll explain why. You can appeal by replying with "Appeal" in the subject line, and we'll answer within 45 days. If we still say no, you can contact your state attorney general.

We won't treat you differently for using any of these rights.

15. Changes to this policy

If we change this policy, we'll post the new version here and update the effective date. If a change is significant, we'll tell you by email or in the app before it takes effect. We won't use information we already hold for a materially different purpose without asking you first.

16. Contact us

Vylos Solutions, Inc.
Email: privacy@myvylos.com