Provisum · Legal

Provisum Privacy Policy

Effective 16 October 2026

Provisum is made and published by Veyago Inc. This notice says what the app holds, where it is held, and what reaches us. It is written to be read rather than to satisfy a lawyer, and every line of it is meant to be literally true of the app as shipped.

Who is responsible

Veyago Inc. is responsible for the processing described in this notice (the "controller" under the EU General Data Protection Regulation, GDPR). Write to hello@veyago.cloud or to the address at the end of this page.

What Provisum stores

Provisum holds what you put into it for the person you look after (a parent, a partner, a child, a pet or yourself): documents and the photographs of them, dates and renewals, the contacts you rely on, the bills and costs you have taken over, notes and tasks, the emergency card, and, if you choose to read a passport or ID card chip, what the chip holds. It also holds the names you give things, and the tasks you and your family assign each other.

All of it is yours. None of it is sent to Veyago, apart from the one Apple Wallet request described below.

Where it is stored

On your iPhone or iPad, in the app's own storage.

If you turn on sync, or share a binder with family, the same data is stored in your own iCloud account, through Apple's CloudKit, in the private and shared databases that belong to you. Veyago operates no server that holds your binders, holds no copy of them, and has no way to read what is in your iCloud. Turn iCloud off and the app keeps working entirely on one device. The only Veyago service the app calls is the Apple Wallet signing service, described below.

A binder for every person

Provisum is made for adults who look after their family's papers. A binder can be for a parent, a child, yourself, a partner, a pet or someone else. What you add about another person is stored the same way as everything else: on your devices and in your own iCloud. Veyago does not see it.

When the emergency card leaves your iPhone

The emergency card, with its medications, refill dates and label photos, is stored on your iPhone, in storage that is not synced to iCloud and not saved in iPhone backups. It leaves your iPhone only in these ways:

• as a PDF that you send yourself;
• inside a backup file, if you choose to include it;
• to your family, if you share its binder and leave "Share the emergency card with family" on (below);
• as a read-only copy on your own Apple Watch, if you turn that on;
• as an Apple Wallet pass, if you add one.

Sharing the card with your family. When you share a binder through Apple's iCloud sharing, you can share its emergency card too, with the switch "Share the emergency card with family" in Family access. The switch is on for a new invitation, and the invitation says so; for a binder you shared before version 1.2, Provisum asks you once. A pet's binder shares its care notes the same way. A binder you don't share keeps its card on your iPhone, as above.

• What is shared: the card's text: blood type, allergies, conditions, medications (name, strength, prescriber, pharmacy and next refill date), preferred hospital, language and communication notes, whether there is an advance directive or a do-not-resuscitate form and where it is, and other notes. The binder's emergency contacts (name, role, organization, phone number) are shared with it. Prescription (Rx) numbers, medication label photos, the Apple Wallet pass and visit recordings are never shared with your family.
• With whom: everyone you invited to that binder, and no one else. People who can edit (co-managers) see and change the card; people who can only view see it. A change by anyone reaches everyone on their next sync, your own other devices included.
• How and where: through the binder's iCloud share (Apple's CloudKit), between your iCloud account and theirs. Everything the card says (its words, the refill dates, the wishes, the emergency contacts and who last changed it) is encrypted on the iPhone or iPad that sends it, before it goes to iCloud (CloudKit encrypted fields). Only what iCloud needs to keep the records in order is not: record identifiers, when the card and each medication entry were made and changed, the order of the medication list and how many entries it has. When you and everyone you share the binder with have Advanced Data Protection for iCloud turned on, the keys are available only to your devices and theirs. If you also share the binder's contacts (the Contacts switch in Family access), its contact list, emergency contacts and doctors included, goes to iCloud as ordinary iCloud data, without this encryption on the device. Like the rest of a shared binder, the card is stored in your iCloud and theirs and on each person's devices. It never passes through Veyago, and Veyago cannot read it. While family sharing syncs with iCloud, Provisum leaves it out of device backups, on your devices and on theirs (it comes back from iCloud after a restore). On a device of yours that is signed out of iCloud, your family store, with any copy of the card still in it, is in that device's backups, because it is then the only copy of your shared to-dos and costs.
• Turning it off: switch it off in Family access, or stop sharing the binder. The card is then removed from the share, and the people you invited lose it when their devices next sync. Your own card stays on your iPhone. What someone has already read or written down stays with them, like a paper you handed over.
• Legal basis: your explicit consent (Article 9(2)(a) GDPR), which you give by sharing the binder with the switch on or by saying yes when Provisum asks. You can withdraw it at any time by turning the switch off; that does not affect what was shared before.

The emergency card on your Apple Watch

"Show on Apple Watch" is off until you turn it on. When it is on, Provisum sends a read-only copy of your emergency cards from your iPhone to your own paired Apple Watch, through Apple's connection between the two devices (WatchConnectivity). The copy does not go to Veyago, and Provisum does not put it in iCloud.

The copy holds what the card shows, without photos or dates of birth; member numbers are shortened to their last four digits. The watch stores it in Provisum's protected storage on the watch, outside its backups. The watch face shows a symbol and "Emergency card"; when the watch holds only one card and App Lock is off, it can also show that binder's name. It never shows a medical detail. When you turn the setting off, Provisum deletes the copy from the watch.

The emergency card in Apple Wallet

Why a server is involved. Apple Wallet only accepts passes signed with a certificate, and that certificate must not be inside the app. So, to make the pass, Provisum sends the details for it once to Veyago's signing service.

What is sent. Only what you switch on under "What goes on the card": the name always; blood type, allergies, emergency contacts (name, relationship, phone number) and hospital unless you switch them off; date of birth, medications, conditions, advance directive or DNR, language and notes only if you switch them on. The request also carries the app's language and a random number for the pass, so that a new version replaces the old one. Blood type, allergies, medications, conditions, directive or DNR details, and notes about hearing, vision, mobility or memory are health data.

Who receives it, and where. Veyago Inc.'s signing service. It runs on the servers of our processor, Supabase, in a project whose database is in Ireland (AWS region eu-west-1); Supabase may handle the request in a data centre near you. The connection is encrypted (HTTPS). Veyago Inc. is based in the United States.

What is stored. The service builds and signs the pass, sends it back to your iPhone and stores none of the details: they are not saved and not written to any log. To stop misuse, it stores a salted hash of your IP address with the time of the request, to limit how many passes can be made in an hour. The hash is deleted after one day; copies in our host's database backups expire on the host's own backup schedule. To stop forged passes, the service also keeps, for each installation of the app that has made a pass, an App Attest key from Apple: a key identifier, its public key and a counter, with the day it was last used. It contains nothing from your binders or the card, and it is deleted after 400 days without use. It lets us check that a request comes from the genuine Provisum app on a real Apple device. Our hosting provider also records technical data about each request (such as the IP address, the time and whether it worked), never the content of the card, and deletes it on its own schedule.

Legal basis. For the details on the pass: consent (Article 6(1)(a) GDPR) and, for health details, explicit consent (Article 9(2)(a) GDPR). For your own card, you give that consent in the app before anything is sent; for someone else's card, it is the consent of that person or their legal representative, which you confirm in the app before anything is sent. For the hashed IP address and the App Attest key: our legitimate interest in protecting the service against misuse (Article 6(1)(f) GDPR).

Your choice. You don't have to make a pass. Without these details no pass can be made; the rest of Provisum works the same. You can withdraw your consent at any time by not making or updating the pass and by removing it from Apple Wallet. Because the service stores none of the details, nothing remains with Veyago to delete. Withdrawing does not affect what was done before.

In Apple Wallet. Once added, the pass is in Apple Wallet like any other pass. Apple Wallet stores passes on your devices through iCloud, under Apple's privacy policy. Anyone holding your iPhone can see a Wallet pass, so leave off what a stranger doesn't need. Removing the pass in Wallet deletes it there.

Passport and ID card chips

Only when you choose "Read the chip" and hold a passport or ID card to your iPhone, Provisum reads the document's chip with your iPhone's NFC reader (Apple's CoreNFC). The reading happens on your iPhone and uses no network: nothing from the chip is sent to Veyago or anyone else.

What is stored. The document number, date of birth, photo and signature from the chip are stored on your iPhone only, encrypted with a key that lives in your iPhone's Secure Enclave and never leaves it. They open only after Face ID, Touch ID or your passcode. They are excluded from device backups and are not synced to iCloud or shared with family. You can switch the photo off and remove everything read from the chip at any time. Only the name, country and expiry date go onto the binder's paper, and those sync and are shared like the rest of the binder, as set out above.

What Provisum does not do. It doesn't check the document with any government or authority, and it never calls a document verified or official: it keeps a copy for your records, not an ID. Two open-source libraries run on your iPhone to open the chip's secure channel (NFCPassportReader, under the MIT licence, and OpenSSL); they have no network access of their own in Provisum.

Visit recordings and transcripts

When you record a visit or dictate a note, the recording, its transcript and its summary are made and stored on your iPhone only. The transcript comes from Apple's speech recognition on your iPhone; if the speech files for your language are missing, your iPhone downloads them from Apple. The summary comes from Apple Intelligence on your iPhone, where it is available. Provisum doesn't sync recordings, transcripts or summaries to iCloud, share them with your family, include them in backups or send them to Veyago or anyone else. One leaves your iPhone only if you share it yourself ("Share the recording", "Share the transcript"), to wherever you choose. Text you choose to copy into the binder's log, and dates you confirm as deadlines, become part of the binder: they sync and are shared like everything else in it.

The microphone is used only after you tap Record or Dictate, and a red bar shows while a recording runs. Provisum reminds you to ask everyone in the room before you record. You can delete a recording, its transcript and its summary separately; deleting the appointment or the binder deletes them too.

Sharing with family

When you invite a brother, a sister or your parent, they join that binder as a co-manager, who can make changes, or as a viewer, who can only look. They see what you share of that binder: its documents, dates, contacts, bills, notes and tasks, and who completed what and when. They do not see any other binder. They see its emergency card only while "Share the emergency card with family" is on for that binder, as described above. You can stop sharing at any time from inside the app, which removes their access.

That sharing travels through Apple's iCloud sharing, from your iCloud account to theirs. It does not pass through Veyago, and there is no Veyago server in the middle of it.

To invite someone you type their email address or phone number. Provisum asks Apple's iCloud which Apple Account it belongs to, adds that person to the share and gives you a link to send them yourself, by Messages or Mail. The address or number goes to Apple, not to Veyago.

Plans and purchases

Provisum is free to start. Monthly (with a free week), Yearly and Lifetime unlock the same features. Apple handles every purchase: payment, renewal, cancellation, refunds and Family Sharing go through your Apple Account, under Apple's terms and privacy policy. Provisum checks on your iPhone which plan you have. Veyago receives from Apple only sales reports without names or contact details, and never sees your payment details. You can cancel a subscription in your iPhone's Settings.

What Veyago collects

Nothing about your binders. There is no account to create, no sign-in, no email address and no profile. Provisum contains no analytics, no advertising identifier, no attribution or measurement kit, and no third-party tracking code. It does not track you across apps or websites. The Apple Wallet request above, which you start yourself, is the only time details from a binder reach a Veyago service. Crash reporting, where it is on at all, is Apple's own and carries no document, photograph, name or note from your binder.

Apple sends us what Apple sends every developer: aggregate App Store and StoreKit figures, such as how many people downloaded the app or subscribed, in which countries, with no names and nothing that identifies a person. We cannot tell from them who you are or what is in your binder. Payments are handled by Apple; we never see a card number.

What the website collects

This website loads no analytics, no tag manager, no third-party fonts and no chat widget, and it sets no cookies. There is nothing to consent to, which is why there is no consent banner.

What remains is the ordinary record any web server keeps. veyago.cloud is a static site served by Vercel, which writes the usual access log line for each request: the IP address it came from, the time, the page or file asked for, the response code and the browser's user-agent string. That is standard for the internet and is used to serve the page and to stop abuse. We do not add anything to it, we do not export or store those logs ourselves, and we do not use them to build a profile of anyone. They age out on the host's own short schedule.

Export and delete

You can export a binder at any time, as PDFs and the files you put in, so you always have a copy that does not need this app to open.

Deleting a binder deletes it from your device and from your iCloud, and removes it from anyone you shared it with. Deleting the app removes its data from that device; anything in iCloud is managed in Settings → [your name] → iCloud, where you can delete it outright. For what Apple processes on its own account, see Apple's Privacy Policy.

Your rights

Under the GDPR you have the right to access your personal data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format and to withdraw consent at any time. You can object at any time, on grounds relating to your situation, to the hashed IP address and the App Attest key we keep on the basis of legitimate interest (Article 21 GDPR).

Most of this you can do in the app: export a binder, change it or delete it. Veyago stores none of your binders and none of the Apple Wallet details, so there is usually nothing on our side to show or delete (an App Attest key names no one, and a hashed IP address is deleted after one day and cannot tell us whose it is). To exercise a right, write to hello@veyago.cloud. We answer within one month.

You can also complain to a data protection authority, in particular where you live: in Germany the authority of your federal state (Land); in the Netherlands the Autoriteit Persoonsgegevens; in Belgium the Gegevensbeschermingsautoriteit / Autorité de protection des données; in France the CNIL.

Children

Provisum is not directed at children. A binder can be for a child, but it is made and held by an adult, and what it holds stays on that adult's devices and in their iCloud. We do not knowingly collect anything from a child, and nothing from a binder reaches us apart from the Apple Wallet request above.

Advice this app does not give

Provisum organises paperwork and reminds you of dates. It gives no legal, medical or financial advice and drafts no wills or directives. Decisions about care, money and legal matters belong with the doctor, attorney or advisor of the person you look after.

Changes to this notice

If this ever changes, the revised notice is posted here with a new effective date. A change that would alter what the app collects would be announced in the app as well, because a policy nobody reads is not consent.

Who to write to

Email hello@veyago.cloud and a person answers. By post:

Veyago Inc.
54 State Street, Ste 804 #17055
Albany, NY 12207
United States

Provisum is a product of Veyago Inc. · Effective 16 October 2026