Skip to content

LastVet iOS — App Store Readiness

Status: draft v1, 2026-08-18 Owner: Ryan Curry Scope: iOS app (last.vet-ios) distribution via TestFlight (external cohort) and public App Store release Authority: App Review Guidelines — last updated 2026-06-08 Positioning: general wellness + health information management. Not a medical device. Not a diagnostic tool. Not a treatment tool.

1. Executive summary

LastVet gives veterans control of their own health records. It reads from the VA Lighthouse Patient Health API, presents the record on a timeline the veteran can read, and lets the veteran share specific categories with specific providers via signed release with revoke + audit.

App Store positioning: LastVet is a private organizer for a veteran's own health records and a coordination tool between the veteran and their providers. It does not diagnose, treat, screen, or make medical recommendations. It falls squarely under Apple's general wellness + health information management framing.

Real Apple review risk: low if positioning holds and copy discipline is maintained. High if any UI, copy, or feature drifts toward diagnostic, symptom-checker, or triage territory.

Primary risk vectors: 1. Section 1.4.1 (Physical Harm — Medical apps): copy that implies diagnostic or clinical judgment 2. Section 5.1.1(ix) (Regulated fields): must be submitted by a legal entity, not an individual 3. Section 5.1.3 (Health and Health Research): data use limits, no ad-based data mining 4. Section 5.1.1(v) (Account Sign-In): account deletion in-app is required 5. Metadata section 2.3 accuracy: no diagnostic claims in App Store listing, description, screenshots

Real prerequisites Ryan needs verified before submission: - Legal entity submission (Last 1 Enterprises, not Ryan Curry personal) - Privacy policy accessible in-app AND linked in App Store Connect metadata - Account deletion available in-app - Privacy nutrition label filled honestly and matches actual data practices - Beta App Review submission required for external TestFlight cohort (>100 testers or "external" distribution) - ITSAppUsesNonExemptEncryption declared correctly (server-side crypto model → false)

2. Apple guidelines that directly apply

2.1 Section 1.4.1 — Physical Harm (Medical apps)

Verbatim rule: "Medical apps that could provide inaccurate data or information, or that could be used for diagnosing or treating patients may be reviewed with greater scrutiny."

Specific requirements: - "Apps must clearly disclose data and methodology to support accuracy claims relating to health measurements, and if the level of accuracy or methodology cannot be validated, we will reject your app." - "Apps should remind users to check with a doctor in addition to using the app and before making medical decisions." - "If your medical app has received regulatory clearance, please submit a link to that documentation with your app."

LastVet's position: - Not a medical measurement app. No blood pressure, glucose, oxygen, or vitals measurement. Not covered by the "sensor accuracy" rejection clause. - Not a diagnostic app. Displays what the VA already recorded. Does not interpret or generate new clinical claims about the user. - Not a treatment app. No recommendations, no dose calculations, no symptom-checker. - Not FDA-regulated. Wellness + information organization = out of scope for FDA SaMD (Software as a Medical Device).

Required in-app text (Apple mandatory):

"LastVet organizes your health information but does not provide medical advice. Always check with your doctor before making medical decisions."

Where this text should appear: - Onboarding flow before first VA login - Any screen showing health data (subtle footer or info tap) - Any "share" screen before generating a release - Privacy policy and Terms of Service - App Store description

Language to NEVER use in UI, copy, or metadata: - "diagnose" / "diagnosis" / "diagnostic" - "treat" / "treatment" - "screen" / "screening" / "screener" - "detect" (in a clinical sense — e.g., "detect symptoms") - "cure" - "symptom checker" / "symptom analyzer" - "AI clinician" / "AI doctor" / "virtual doctor" - "recommended treatment" / "suggested therapy" - "diagnosed with" (in system-generated text, even if the VA data uses this) - "may indicate" (about the user's condition) - "you should consider" (any medical action)

Acceptable language: - "Your VA record shows..." - "Your provider recorded..." - "This information came from the VA on [date]" - "Discuss this with your doctor" - "Ask your care team about..." - "Share these records with..."

Test: every user-facing string should be reviewable against this list. Automated grep on repo before every submission is worth building.

2.2 Section 1.4.2 — Drug dosage calculators

Rule: "Drug dosage calculators must come from the drug manufacturer, a hospital, university, health insurance company, pharmacy or other approved entity, or receive approval by the FDA or one of its international counterparts."

LastVet's position: does not calculate or recommend drug dosages. Displays medication list from VA record as-is. No calculators.

Required: ensure no future feature adds dose calculation. If a "medication reminder" feature is ever added, it must not calculate doses — only display what the VA already recorded.

Verbatim rule: "Apps that provide services in highly regulated fields (such as banking and financial services, healthcare, gambling, legal cannabis use, air travel and crypto exchanges) or that require sensitive user information should be submitted by a legal entity that provides the services, and not by an individual developer."

LastVet's position: healthcare data handling → must be submitted by Last 1 Enterprises (legal entity), not by Ryan Curry personally.

Required verification: - Apple Developer Program enrollment is under Last 1 Enterprises with D-U-N-S 14-388-1862 - App Store Connect team ownership under Last 1 Enterprises - Legal entity name matches state registration - Legal entity has valid business address, business phone

Risk: if enrollment is currently under Ryan Curry individual account, needs migration before submission. Real work if so.

Action item for Ryan to verify: log in to https://developer.apple.com/account, check "Enrollment" section, confirm entity type is "Organization" with Last 1 Enterprises as the legal entity name.

2.4 Section 5.1.1(i)–(v) — Data Collection, Privacy Policy, Account Deletion

Requirements: - Privacy policy linked in App Store Connect metadata AND accessible in-app - Must identify: what data is collected, how, and all uses - Must confirm any third parties (VA, providers via share links) get equal or greater protection - Must explain retention/deletion and how user can revoke consent

Account deletion (5.1.1(v)): - In-app account deletion is required. - Simply pointing to a website is not sufficient - Deletion must be initiated from within the app - Must clearly explain what is deleted and any data that will be retained (e.g., legal audit logs)

LastVet's position: - Privacy policy exists at https://my.last.vet/privacy — verify link works - In-app account deletion: verify this exists in current iOS build. If not, must be added before submission.

Action item for Ryan / Cursor to verify: - Does current last.vet-ios have "Delete my account" flow? - If yes: verify it actually deletes on the backend - If no: real work item to add before App Store submission

2.5 Section 5.1.2 — Data Use and Sharing

Verbatim rules for LastVet: - "Unless otherwise permitted by law, you may not use, transmit, or share someone's personal data without first obtaining their permission." - "You must clearly disclose where personal data will be shared with third parties, including with third-party AI, and obtain explicit permission before doing so." - "Apps should not attempt to surreptitiously build a user profile based on collected data..."

Sharing scenarios LastVet does today: 1. VA → LastVet: veteran authorizes via VA OAuth. Explicit permission per session. Clear. 2. LastVet → Provider (share links): veteran generates share link, chooses what to share, chooses recipient. Explicit permission per share. Clear. 3. LastVet → Meridian (AI eval): does veteran data ever reach Meridian? Must be zero for App Store safety. If Meridian ever consumes real veteran data, add explicit consent flow AND update this doc.

Required: confirm Meridian does NOT process real veteran PHI. Per Muster memory, Meridian stays outside both staging and prod until there is a consent-scoped read API. Verify this remains true.

2.6 Section 5.1.3 — Health and Health Research

Verbatim rules: - "(i) Apps may not use or disclose to third parties data gathered in the health, fitness, and medical research context—including from the Clinical Health Records API, HealthKit API, Motion and Fitness, MovementDisorder APIs, or health-related human subject research—for advertising, marketing, or other use-based data mining purposes other than improving health management, or for the purpose of health research, and then only with permission." - "(ii) Apps must not write false or inaccurate data into HealthKit or any other medical research or health management apps, and may not store personal health information in iCloud."

LastVet's position: - No advertising, no marketing use of health data, no data mining — clean - iCloud storage of PHI is prohibited. Verify: does the app back up any veteran data to iCloud (either explicitly or via default document storage)? - If HealthKit is not used, this section doesn't apply to LastVet's data flows - If HealthKit is added in future, apps writing to HealthKit must not write false data

Action item for Cursor to verify: - Grep iOS project for any iCloud usage (CloudKit, NSUbiquitousKeyValueStore, com.apple.developer.icloud-* entitlements) - If iCloud is used at all, verify it's not storing PHI - Verify Info.plist backup settings exclude any PHI-containing paths

Research subjects: - LastVet is not currently conducting research → sections 5.1.3(iii) and (iv) do not apply - If future Meridian research involves real veterans as human subjects, this triggers IRB requirements

2.7 Section 5.1.5 — Location Services

LastVet uses location for: find-nearby-care feature (VA facilities, Vet Centers).

Required: - Purpose string in Info.plist explains location use - Location requested only when directly relevant (when user opens "find care", not on app launch) - Notify user before collecting

Verify: current Info.plist NSLocationWhenInUseUsageDescription says something honest like "Find VA facilities and Vet Centers near you" and not something generic like "This app uses location."

2.8 Section 4.8 — Login Services

Rule: If the app uses third-party or social login (Facebook, Google, etc.) as the primary account, must also offer an alternative with privacy protections (name/email only, keep email private, no ad tracking).

LastVet's login: VA credentials via ID.me OAuth. This is a government identity system → exempt per section 4.8 exception ("Your app uses a government or industry-backed citizen identification system or electronic ID to authenticate users").

Required: ID.me integration must be honestly described in App Store Connect metadata. Do NOT market as "Sign in with Apple" alternative — it's the primary and only sign-in method.

2.9 Section 2.3 — Accurate Metadata

Critical: - App name (30 char limit) - Subtitle - Description - Screenshots (must show actual app, not marketing art) - Preview videos (if any) - Age rating (answer honestly) - Category selection - Keywords (no trademark stuffing, no unverifiable claims)

LastVet metadata rules: - Category: Health & Fitness (NOT Medical). Wellness framing. - Age rating: 12+ or 17+ likely. Contains references to mental health, crisis, medications. Must answer age-rating questionnaire honestly. - Description: must not include diagnostic or treatment language. Must include general wellness disclaimer. - Keywords: avoid "diagnose", "treat", "symptoms", "condition detection", "AI doctor", etc. - Screenshots: must show real app screens, no promotional overlays claiming clinical capability. Redact any PHI in screenshots (use fixture veteran data like Sheba703).

Recommended App Store description opening sentence (drop-in template):

"LastVet is a private organizer for your VA health records. See your record on a timeline you can read, and share exactly what you choose with providers who need it. LastVet does not diagnose, treat, or make medical decisions — always talk to your doctor before making medical decisions."

Test: every metadata field should be reviewable for language compliance before submission.

2.10 Section 5.6.4 — App Quality

Rule: Excessive customer reports (negative reviews, refund requests) can trigger removal.

LastVet's position: app is free for veterans. No refund path for veterans. Reviews are the risk vector.

Real thing to plan for: veterans in crisis interacting with the app in ways developers may not anticipate. Reviews that describe crisis situations (whether solved or unsolved) are both a support issue and a review-quality issue.

Recommended: - Prominent Veterans Crisis Line 988 → press 1 in app (currently on my.last.vet, verify in iOS) - Clear "get help" path for users in distress - Support email prominently accessible

3. TestFlight-specific requirements

3.1 TestFlight external testing

Rule (2.2): any app for public TestFlight distribution must comply with all App Review Guidelines. Internal testing (<100 testers) is exempt; external testing (up to 10,000 testers, publicly linkable) requires Beta App Review.

LastVet's position: 10 external veterans lined up for testing → external TestFlight → Beta App Review required.

Beta App Review timeline: typically 24-48 hours, but health/medical apps see enhanced scrutiny per multiple 2026 industry reports.

Required for Beta App Review submission: - App Store Connect metadata as complete as possible (though can be minimal for beta) - Working demo account or built-in demo mode (if health data requires login) - Beta test information: what testers should test, what feedback you need - Contact for App Review

Real risk: health app + external testers + reviewer sees anything that looks diagnostic → rejection → iteration → time delay. Prep to reduce iteration risk.

3.2 Compensation restrictions

Rule: "apps using TestFlight cannot be distributed to testers in exchange for compensation of any kind, including as a reward for crowd-sourced funding."

LastVet's position: veterans are unpaid testers — clean.

4. Health app metadata questionnaire

App Store Connect asks specific questions during submission. Real answers for LastVet:

Question Answer
Is this app a medical device? No
Does this app make claims requiring FDA clearance? No
Does this app collect health data via HealthKit? No (currently)
Does this app share health data with third parties? Yes, but only via user-initiated share links with explicit consent, per user, per share
Does this app use health data for advertising? No
Is this app submitted by the entity providing health services? Yes — Last 1 Enterprises is the developer AND operates the LastVet service
Does this app operate in a highly regulated field? Yes — healthcare
Is the submitting entity a legal organization? Yes — Last 1 Enterprises

5. Privacy nutrition label

App Store Connect requires developers to declare all data collection. Must match actual practice.

LastVet's honest privacy label:

Data linked to you: - Health & Fitness → Health data (VA records, from VA OAuth flow, used for app functionality) - Contact info → Email (for account, from ID.me OAuth) - Identifiers → User ID (VA identifier, for account)

Data used to track you: - None

Data not collected: - Contacts, browsing history, search history, financial info, location beyond active use, sensitive info beyond health data listed above

Data purposes: - App functionality - User consented sharing (share links)

No third-party analytics. LastVet does not send data to Google Analytics, Firebase Analytics, Mixpanel, Segment, or similar. If any SDK is added in future, privacy label MUST update accordingly.

Verify before submission: grep iOS project for common analytics SDKs (Firebase, Analytics, Mixpanel, Segment, Amplitude, Sentry non-crash-only, Datadog, etc.). Presence of any changes the privacy label.

6. Real risk register

High risk (rejection likely if not addressed)

Risk Mitigation
Any UI copy that implies diagnostic capability Grep-based CI check for banned vocabulary before every submission
Missing in-app account deletion Verify current build has it; add if missing
Missing "check with your doctor" language Ensure appears on all health-data-showing screens
Privacy policy link broken or missing Verify link is live; verify in-app access
Individual developer submitting healthcare app Verify Last 1 Enterprises is Apple Developer entity
Third-party analytics SDK detected Remove before submission OR declare accurately
PHI in iCloud (even accidentally) Grep for iCloud usage; verify no PHI paths
Diagnostic language in App Store description or keywords Metadata review checklist before submission

Medium risk (may trigger enhanced scrutiny, not necessarily rejection)

Risk Mitigation
Crisis/suicide/self-harm content without clinical disclaimers + 988 link Ensure 988 crisis line prominent; disclaimer on any crisis-related UI
Health app category selection (Medical vs Health & Fitness) Use Health & Fitness; wellness framing
Missing beta review info for TestFlight external Complete review notes describing test focus
Screenshots showing real PHI Use fixture data (staging veteran A/B/C) for all screenshots

Low risk (worth noting, unlikely to block)

Risk Mitigation
Age rating too low Answer questionnaire honestly (12+ or 17+ likely)
Missing background modes justification Only declare backgrounds actually used
Push notifications used for marketing Ensure only transactional

7. Copy compliance checklist

Before every submission, verify:

7.1 UI copy check

  • [ ] Grep iOS repo for banned vocabulary (see section 2.1)
  • [ ] All health-data-showing screens have "discuss with your doctor" text
  • [ ] No AI-generated content is presented as clinical advice
  • [ ] No feature is marketed as "smart" or "AI-powered" in a way that implies clinical intelligence
  • [ ] Onboarding includes wellness disclaimer

7.2 Metadata check

  • [ ] App name (30 char max, no clinical claims)
  • [ ] Subtitle (no clinical claims)
  • [ ] Description (opens with wellness framing, includes disclaimer)
  • [ ] Keywords (no diagnostic terms)
  • [ ] Category: Health & Fitness (NOT Medical)
  • [ ] Age rating honest
  • [ ] Screenshots use fixture data
  • [ ] Preview videos (if any) show no diagnostic claims

7.3 Privacy check

  • [ ] Privacy policy link works (in-app and in App Store Connect)
  • [ ] Privacy policy accurately describes VA data flow
  • [ ] Privacy nutrition label matches actual practice
  • [ ] No analytics SDKs in build
  • [ ] No PHI in iCloud
  • [ ] Account deletion available in-app
  • [ ] Data retention/deletion clearly described

7.4 Technical check

  • [ ] ITSAppUsesNonExemptEncryption set correctly (server-side crypto → false)
  • [ ] All permissions have honest purpose strings
  • [ ] Location only requested when relevant
  • [ ] No background modes not actually needed
  • [ ] Push notifications not required for functionality
  • [ ] Sign in with Apple exemption verified (government ID via ID.me)
  • [ ] Apple Developer Program enrollment is Organization, Last 1 Enterprises
  • [ ] D-U-N-S number matches (14-388-1862)
  • [ ] Business address and phone accurate
  • [ ] Support URL functional

8. Beta App Review submission package

Real content for Beta App Review notes:

"What's new for beta testers":

"LastVet enables veterans to see their VA health record and share specific parts with providers via signed release. This beta introduces envelope-encrypted imaging upload (X-rays, reports, other medical imaging documents). Testers should verify: 1) VA login works, 2) health record displays correctly, 3) share flow generates a working release link, 4) imaging upload and download work for their documents up to 512 MiB."

"Sign-in information":

"Testers use their real VA credentials via ID.me sign-in. No demo account is provided because the app requires real VA account authentication. Reviewers may use test ID.me sandbox account: [ID.me sandbox user 114 with pre-populated verification codes] for review purposes."

"Notes":

"LastVet is a general wellness and health information management app. It does not provide diagnostic, treatment, or medical advice. Health data is fetched from the VA Lighthouse Patient Health API with the veteran's explicit OAuth authorization. Sharing with providers requires per-share explicit consent. All health data is encrypted at rest server-side (AES-256-GCM envelope encryption) and in transit (TLS 1.3 with hybrid post-quantum key exchange). Privacy policy: https://my.last.vet/privacy. Terms: https://my.last.vet/terms."

9. Post-submission monitoring

9.1 If rejected

Common rejection reasons for health apps + specific mitigations:

Rejected under 1.4.1 (medical apps requiring greater scrutiny): - Response: reaffirm wellness positioning, provide detailed explanation of what app does NOT do (no measurements, no diagnostic claims, no treatment recommendations), offer to add additional disclaimers if reviewer specifies concerns

Rejected under 5.1.1 (privacy policy inadequate): - Response: update privacy policy with specific missing information, resubmit with clear change log

Rejected under 2.3 (metadata inaccurate): - Response: correct metadata, ensure no diagnostic claims in listing

Rejected for missing account deletion: - Response: add in-app account deletion flow, resubmit

Rejected for missing "check with doctor" language: - Response: add mandatory disclaimer text to identified screens, resubmit

9.2 If approved

Real ongoing responsibilities: - Monitor App Store reviews for crisis-related content (respond with 988 line info within 24h) - Monitor for reviews mentioning bugs or safety issues - Maintain privacy policy alignment with actual practice - Maintain wellness positioning through all updates - Any new feature that touches health data → re-review against this document before shipping

10. What Cursor should do with this document

This document is authoritative for LastVet iOS App Store readiness. Cursor's job is to:

  1. Grep the iOS repo for banned vocabulary and report all instances
  2. Verify the technical checklist items in section 7.4 and report status
  3. Confirm NSLocationWhenInUseUsageDescription and other purpose strings are honest and specific
  4. Grep for third-party analytics SDKs and report presence
  5. Check for iCloud usage and confirm no PHI paths
  6. Verify in-app account deletion exists and functions
  7. Verify wellness disclaimer appears on all health-data screens
  8. Report on any gaps with recommended fixes

Cursor should NOT: - Submit to App Store on Ryan's behalf - Modify legal entity information in App Store Connect - Write clinical or diagnostic language - Add third-party analytics SDKs

11. Ryan's action items summary

Before Beta App Review submission: 1. Verify Apple Developer enrollment is Last 1 Enterprises Organization (not individual) 2. Verify privacy policy link works from within app AND from App Store Connect metadata 3. Verify in-app account deletion exists (or add via Cursor) 4. Verify no iCloud PHI storage (Cursor can grep) 5. Verify no third-party analytics SDKs (Cursor can grep) 6. Run copy compliance grep (Cursor can build automation) 7. Prepare beta review submission package (section 8)

Before App Store production submission (post-TestFlight soak): 1. All beta review items above 2. Complete privacy nutrition label honestly 3. Prepare metadata (name, subtitle, description, keywords) with wellness framing 4. Prepare screenshots using fixture data 5. Verify age rating questionnaire answered honestly 6. Verify category is Health & Fitness (NOT Medical)

Ongoing: 1. Every new feature reviewed against this document before shipping 2. Monitor App Store reviews for crisis content, respond with 988 info 3. Update this document if guidelines change or if LastVet's feature set changes

12. Document maintenance

This document must be updated when: - Apple updates App Review Guidelines (check quarterly at minimum) - LastVet adds new features that touch health data - LastVet's positioning changes (should not, but if it does) - Rejections or approvals reveal new patterns - Beta App Review or App Store Connect requirements change

Owner: Ryan Curry Next review: post-first-successful-submission or 2027-01-01, whichever comes first

Appendix A: Cited guideline sections (with URLs)

Appendix B: Beta App Review resources

Appendix C: Privacy resources