Privacy Policy

Vigil

Effective 12 July 2026 · Version 1.0

What Vigil accesses

From Apple Health, with your permission:

• Heart rate
• Heart rate variability
• Beat-to-beat intervals (heartbeat series)
• Resting heart rate

Vigil requests read access only, and only for these types. You can revoke it at any time in the Watch app on your iPhone, under Privacy & Security → Health → Vigil.

Vigil also starts an Apple workout session while you are monitoring. This is what lets the watch sample your heart rate often enough to be useful and keep working when your wrist is down. Vigil does not save a workout to Apple Health.

What Vigil stores

At the end of each session, Vigil saves one record to your watch: the scenario you chose, start and end times, average heart rate, average and lowest variability, your session baseline, the time and values at each alert, which reset action you chose, your mental-effort rating, and any note you typed.

Vigil does not store the underlying stream of heart-rate samples. Individual readings are used to compute your rolling baseline and are then discarded.

Where it is stored

In the app's private container on your Apple Watch, protected by the operating system and your device passcode. Identifying information — any alias, any note you typed — is held separately from physiological data and is excluded from device backup.

What Vigil does not do

• It does not transmit your data anywhere. This version contains no networking code at all.
• It does not use analytics, crash-reporting SDKs, advertising identifiers, or tracking of any kind.
• It does not share, sell, or disclose your data to anyone — because it does not have it.
• It does not require or offer an account.

Deleting your data

Delete the app from your Apple Watch. Everything Vigil stored goes with it. There is no copy anywhere else.

Research features

Vigil is designed to support institutional research in future versions. Those features are switched off in this release — the app cannot enrol you in a study and contains no code that could transmit data anywhere.

When they are enabled, the following will be true, and are already enforced in the architecture:

• Participation is anonymous. A participant is identified by a random code with no derivation from anything about you. No name, date of birth, email, or staff number is required or stored.
• Your identity never travels with your physiology. Anything that could identify you — an alias, an institution code, notes you typed — is stored separately, never leaves your device, and is excluded from backups.
• Notes are treated as identifying data. People type names into note fields. Yours are excluded from research exports unless a study has explicit ethics approval covering them.
• Your employer cannot see your data. Institution administrators can create studies and invite participants. They cannot read participant health data. This is enforced by the data model, not by a settings toggle.
• Withdrawal works. A withdrawn participant's data cannot be included in any subsequent dataset.
• We cannot re-identify you. Linking a random participant code to a person requires the institution's own master list, which they hold and we never receive.
• Nothing is collected retrospectively. Sessions you record for yourself can never be added to a study later. Consent must come before collection, not after.

If this changes

Any future cloud sync, research export, or team feature will be opt-in, will be described here before it is enabled, and will require your explicit consent. We will not quietly begin uploading data that a previous version kept local.

Children

Vigil is not directed at children under 13 and we do not knowingly collect their data.

Your rights

Because Vigil holds no data about you on any system we control, there is nothing for us to disclose, correct, export, or erase in response to a request under the GDPR, the Australian Privacy Act, the CCPA, or similar law. Your data is in your hands, literally.

Contact

support@vigil.com.au