Tonic Health DIGITAL

Request ID: d12b7dd4-cedc-4e69-a65d-206afd927df6 Audit date: 6 October 2026 Target: Tonic Health, UK vitamin/supplement brand at tonichealth.co Legal operator: Tonic Nutrition Ltd (12174856) Domain: Digital Forensics / Technology Supply Chain (Digital)

Identity and scope

Companies House identifies Tonic Nutrition Ltd, company number 12174856, as an active UK private company incorporated on 27 August 2019 [pre-2020]; its current registered activities include manufacture of basic pharmaceutical products and other human health activities.¹ Sunna van Kampen is the company’s active person with significant control, holding more than 50% but less than 75% of both shares and voting rights.² The current officer record lists Sunna van Kampen and Bradley James Waldron as active directors.³

Tonic’s current website presents a consumer vitamin and supplement business, with direct online sales, subscriptions and customer accounts; the site states that it is powered by Shopify.⁴ Tonic’s own story pages identify Sunna van Kampen as founder and date the brand’s launch to 2019 [pre-2020].^{5, 6} Independent industry profiles in 2024-2026 likewise describe Tonic as a UK supplement brand built around direct-to-consumer and social-media marketing, with wider retail distribution.^{7, 8, 9} Retailers and other third parties are treated only as distribution context here; their technology or conduct is not attributed to Tonic.

This audit excludes the unrelated healthcare-software business using the Tonic Health name, the separate charity with a similar name/domain, and TonicGreens spam PDFs; the target boundary is the UK legal entity and consumer vitamin brand identified in the official records and storefront.^{1, 4}

Enterprise Technology Stack & Vendor Relationships

Israeli-origin software and services

Yotpo - verified current relationship (2026). Tonic’s live “Tonic Rewards” page implements a points, purchase, review and referral rewards programme and loads widget assets from Yotpo’s infrastructure, establishing a direct Yotpo integration in Tonic’s customer-engagement stack.¹⁰ Yotpo describes its products as e-commerce Reviews and Loyalty software and lists a current Tel Aviv office.¹¹ The Israel Innovation Authority identifies Yotpo as founded in Israel in 2011 [pre-2020].¹² Current Yotpo careers material continues to show product and R&D roles in Tel Aviv, including software-engineering work on its commerce platform.¹³

Yotpo’s subprocessor disclosure, last updated 18 June 2026, states that its list covers Personal Data of merchant End Users, defined as the merchant’s shoppers, and applies to all Yotpo products. It lists Yotpo Ltd - Israel and Akamai Technologies Israel Ltd - Israel among entities authorized to process End User personal data.¹⁴ Because Tonic exposes a live Yotpo rewards service to its shoppers, the public evidence establishes an Israel-linked processing pathway for personal data handled within that Yotpo service. The public record does not establish that every Tonic customer data field is stored in Israel, nor does it establish Yotpo as Tonic’s primary commerce host.^{10, 14}

No public evidence identified for Tonic use of Check Point, Wiz, SentinelOne, CyberArk, Nice, Verint, Claroty, Palo Alto Networks or another specifically searched Israeli-origin enterprise-security platform.

Scale of dependency

Tonic’s core public storefront is Shopify-backed: its live site links customer-account functions to Shopify and identifies the site as “Powered by Shopify.”⁴ Its Terms of Service describe online accounts, subscriptions, payment-provider charging and use of multiple third-party vendors/providers.¹⁵ The site’s wholesale login points to an Unleashed Software-hosted Tonic Nutrition Ltd portal.¹⁶ Tonic’s live privacy policy also names Google Analytics and Segment as analytics providers.¹⁷

The public evidence therefore places Yotpo in a customer loyalty/rewards engagement layer, while Shopify is the visible core storefront platform and Unleashed supports wholesale access.^{4, 10, 16} no public evidence identified that Yotpo provides Tonic’s primary hosting, payment processing, ERP, endpoint security or network-security layer.

Procurement and integrator relationships

Verified public vendor relationships relevant to the digital stack are Shopify, Yotpo, Google Analytics, Segment and Unleashed Software.^{4, 17, 10, 16} no public evidence identified of a named systems integrator or digital-transformation consultancy deploying Israeli-origin technology for Tonic.

Surveillance, Biometrics & Retail Technology

Facial recognition & biometrics: no public evidence identified. The current target disclosures, company records and 2025-2026 industry profiles reviewed describe an online supplement business and customer-engagement stack, not a target-operated biometric or frictionless-checkout system.^{4, 17, 7, 8}

Predictive analytics & monitoring: no public evidence identified of Israeli-origin predictive policing, sentiment-monitoring, social-media surveillance or workforce-surveillance tools used by Tonic.

Third-party deployment: no public evidence identified that facial-recognition, biometric or surveillance technology reaches Tonic indirectly through a managed service or bundled suite. Technology used independently by retailers that stock Tonic products is outside the target-attribution boundary.⁹

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Data-centre operations in Israel: no public evidence identified that Tonic owns, leases or colocates data-centre infrastructure in Israel. The visible storefront is Shopify-backed.⁴

Data exposure / residency: Tonic’s privacy policy says it collects identity, contact, technical, profile, usage and marketing/communications data, names Google Analytics and Segment, and states that collected data may be transferred to and stored or processed outside the EEA; it does not name Israel as a Tonic-selected destination.¹⁷ Separately, Tonic’s verified Yotpo loyalty integration intersects with Yotpo’s all-products processing architecture, which lists Yotpo Ltd and Akamai Technologies Israel Ltd in Israel as authorized processors of merchant End User personal data.^{10, 14} This is the only verified Israel-linked data-processing pathway identified in the public Tonic technology stack.

Government cloud contracts / Project Nimbus: no public evidence identified of Tonic participation in Project Nimbus or another Israeli government cloud initiative.

Data-sovereignty and resilience services: no public evidence identified that Tonic provides digital-sovereignty, data-residency or infrastructure-resilience services to Israeli state or military bodies.

Defence, Intelligence & Security Sector Technology Relationships

Military & intelligence contracts: no public evidence identified of a Tonic contract, partnership or service agreement with the Israeli Ministry of Defence, Israel Defence Forces, Israeli intelligence agencies or other Israeli state-security bodies.

Dual-use technology provision: no public evidence identified that Tonic supplies a technology product used for Israeli military, intelligence or law-enforcement surveillance. Tonic’s public business is vitamins/supplements and associated e-commerce.^{4, 5}

Offensive cyber & weapons technology: no public evidence identified of Tonic developing, selling, licensing or maintaining offensive-cyber tools, zero-day capabilities or digital weapons.

Constructive notice: Because no Tonic technology provision to an Israeli state, military or settlement customer was identified, there is no target-attributable continuation of such provision to document after 19 July 2024 or after the November 2024 ICC warrants.

AI, Algorithmic & Autonomous Systems

AI/ML provision to state bodies: no public evidence identified of Tonic providing AI, machine-learning, computer-vision or autonomous decision-support systems to Israeli state, military or security bodies.

Training data & model development: no public evidence identified that Tonic trains models on civilian, intercepted or surveillance-derived data from Israel or the occupied Palestinian territories.

Autonomous systems & lethality: no public evidence identified of Tonic providing autonomous target generation, threat detection, tracking or other purpose-built military AI.

Yotpo currently markets AI-enabled commerce capabilities and recruits product/R&D staff in Tel Aviv, but Tonic’s observed Yotpo loyalty integration does not establish which optional Yotpo AI features Tonic uses. Those vendor capabilities are therefore not attributed to Tonic.^{11, 13}

Technology Ecosystem & R&D Footprint

Israeli R&D centres: no public evidence identified that Tonic operates an R&D centre, engineering office, innovation lab or accelerator in Israel. Yotpo’s Tel Aviv R&D presence establishes the location of a directly used vendor’s development operations, not a Tonic facility.¹³

Acquisitions & investments: no public evidence identified of Tonic acquiring an Israeli technology company or making a strategic investment in an Israeli technology startup or venture fund. Companies House identifies Sunna van Kampen as the controlling shareholder and does not identify a corporate parent in the current overview/PSC records.^{1, 2}

Patent & intellectual property: no public evidence identified of Tonic patent licensing or co-development with an Israeli-domiciled technology company, university or research institute.

Civil Society Scrutiny & Regulatory History

UN / NGO / academic scrutiny: no public evidence identified of a UN, NGO or academic investigation specifically addressing Tonic’s technology relationships with the Israeli state or occupied territories. Searches of the 2025 Special Rapporteur report A/HRC/59/23, the 2023 OHCHR settlement-database update, the current 26 September 2025 OHCHR update A/HRC/60/19, the BDS corporate-priority guide and the 2025 Don’t Buy into Occupation company list produced no “Tonic” match for this target.^{18, 19, 20, 21, 22}

Boycott & divestment campaigns: no public evidence identified of an organized boycott, divestment or sanctions campaign specifically targeting Tonic for technology provision to Israel or activity in occupied territory.^{21, 22}

Regulatory & legal actions: The UK Advertising Standards Authority issued a ruling on 16 July 2025 concerning Tonic Nutrition Ltd t/a Tonic Health. It upheld complaints about duplicated testimonials and unauthorised/general health claims and recorded Tonic’s statement that duplicated testimonials arose from a technical error and had been addressed.²³ This is a verified digital-advertising/regulatory event, but it is unrelated to Israeli technology, state customers, surveillance, military provision or occupied-territory operations.

Settlement nexus: no public evidence identified that Tonic provides digital products, services or platforms in or to Israeli settlements, directly or through a licensee/franchisee. Tonic is not named in either the 2023 or 2025 OHCHR database update, nor in the 2025 DBIO company list checked for this audit.^{19, 20, 22}

Controlling-principal equity expansion - examiner-directed questions

1. Equity in Yotpo or other Israeli digital / cyber / surveillance / AI / military-tech companies

Sunna van Kampen - researched absence. Live searches found no public document identifying Sunna van Kampen as a shareholder, beneficial owner, board member, fund LP/GP, or investor in Yotpo or another Israeli digital, cybersecurity, surveillance, AI or military-tech company. Companies House currently links this Sunna van Kampen identity to four UK appointments: Tonic Nutrition Ltd; dissolved Tonic Health Global Limited; dissolved Business Bean Limited; and LVK Global Ltd, from which he resigned as director on 28 February 2020.²⁴ LVK Global’s PSC record also shows his control ceased on 28 February 2020.²⁵ These records bound the identified UK corporate vehicles; they do not prove that no personal, foreign, nominee or undisclosed minority investment exists.

Bradley James Waldron - researched absence. Live searches likewise found no public document identifying Waldron as an equity holder, beneficial owner, board member, fund LP/GP, or investor in Yotpo or another Israeli digital, cybersecurity, surveillance, AI or military-tech company. Companies House identifies his current UK appointments at Regeneration: Intelligent Inspiration Ltd and Waldron Wealth Management Limited, alongside older dissolved/resigned roles.²⁶ Waldron Wealth Management’s primary PSC register identifies Waldron as an active controller with ownership of shares and voting rights of 75% or more and the right to appoint or remove directors; Regeneration’s filing history records Waldron as a person with significant control.^{27, 28} No public portfolio disclosure located for either company identified an Israeli technology holding.

TALHANDAQ lead - disconfirmed for controlling-principal attribution. Waldron’s appointment history surfaced TALHANDAQ Investment Management Limited, a dissolved company whose registered activity was fund management.²⁹ The officer record shows Kevin Brian Downey as director and Waldron only as secretary from 29 November 2007 until 19 June 2009.³⁰ No evidence located established Waldron ownership or control of TALHANDAQ, so the vehicle and any hypothetical portfolio cannot be attributed to him on the present record.

Yotpo cross-check - no named match, but not proof of no holding. Yotpo’s public financing announcements identify institutional and named investors including Bessemer Venture Partners, Tiger Global, Claltech Investment, Coin Ventures, Hanaco, Vertex Ventures, Vintage Investment Partners, Access Industries, Marker and Innovation Endeavors; neither van Kampen nor Waldron is named in the reviewed announcements.^{31, 32, 33} CTech reported that $110 million of Yotpo’s 2021 Series F was used to purchase secondary shares from previous investors, confirming that secondary ownership changes occurred without providing a complete public cap table.³⁴ Accordingly, the search result is no public evidence identified, not proof that either individual could never have held an undisclosed minority or secondary position.

2. Stake, dates, governance rights, vehicle and attribution threshold

Outcome: no qualifying holding identified. Because no Yotpo or other Israeli technology equity holding was verified for van Kampen, Waldron, or a vehicle shown to be controlled by either, there is no evidenced stake percentage, acquisition/disposal date, board seat, observer right, veto/governance right or attributable investment vehicle to document. The TALHANDAQ record does not establish Waldron control.^{29, 30} On the evidence found, the controlling-principal / influential-owner attribution required by the rubric is therefore not established for an Israeli technology investment. This remains a researched absence bounded by public sources, not a finding that private holdings are impossible.

Dated ownership and governance supplement

The replacement confirmation filing records 62 registered holdings totalling 290,695 shares: 190,695 A Ordinary and 100,000 B Ordinary. On that dated share count, Sunna van Kampen held 100,000 B shares, a historical share-count ratio of 34.4003%; Tom Singh and Anna Singh together held 25,727 A shares, 8.8502%; Lucy Mercey and Joseph Wray together held 26,002 A shares, 8.9448%; AwesomeAction Limited held 17,292 A shares, 5.9485%; Side By Side Partnership held 8,450 A shares, 2.9068%; and Rubix Venture Partners held 1,625 A shares, 0.5590%. These percentages are calculations against the 290,695-share total in that filing and are not current October 2026 voting, beneficial-ownership or control percentages.³⁵

The dates require separation. The Companies House filing index identifies the confirmation statement as at 26 August 2025 and the replacement filing index date as 6 May 2026; the replacement PDF records receipt on 24 April 2026 and original-document registration on 22 October 2025.^{35, 36} The current Companies House PSC record supplied by the root reports Sunna van Kampen in the greater-than-50%-and-less-than-75% bands for shares and voting rights, while the dated confirmation share register gives 100,000 of 290,695 registered shares, or 34.4003%. The supplied primary evidence does not reconcile those records, and no exact October 2026 ownership or voting percentage is inferred.^{35, 37}

The articles were adopted on 23 June 2025 and filed on 21 July 2025. They treat A and B as separate ordinary-share classes ranking pari passu subject to stated exceptions. Article 7.3 provides one vote per Equity Share on a poll and contains no B-share vote multiplier.^{38, 36} The same articles define BSI Shareholders as Lucy Mercey and Joseph Wray and give them jointly one BSI Director appointment right while the specified holding condition continues; this is a joint right to one appointment, not two individual appointment rights or an individual absolute veto.³⁸

Article 22.4 provides a director-appointment route for an Investor other than BSI holding, together with the permitted associated holdings specified by the articles, at least 5% of issued Equity Shares. The articles expressly provide aggregation treatment for Tom Singh with Anna Singh and for Ranjit Munro with Kuldip Singh Dhillon. On the dated 290,695-share register, Tom and Anna’s 25,727 shares exceed 5%, whereas Ranjit Munro and Kuldip Singh Dhillon’s combined 10,234 shares represent 3.5205%. Continuing holdings, status under the separate Shareholders’ Agreement, delivery of any appointment notice and actual exercise of any right are not established by these filings.^{35, 38}

The articles define Investors and Major Investors by reference to a separate Shareholders’ Agreement, so the articles alone do not establish the complete individual membership of those contractual categories. Their Investor Majority definition concerns more than 50% of shares held by Major Investors rather than more than 50% of the company.³⁸ Board quorum ordinarily includes the Founder Director and BSI Director to the extent appointed, but article 24 contains interested-director and adjourned-meeting exceptions, so the provision does not establish an absolute individual veto. Article 24.6 separately gives the eligible Founder Director a second or casting vote on tied board votes; this is a board right and does not create a B-share super-vote under article 7.3.³⁸

The written resolution circulated on 1 April 2026 authorised the directors to allot up to 6,524 additional A Ordinary shares and disapplied the relevant pre-emption provision for that authorised allotment. The filing was registered on 14 May 2026. The resolution is authority to allot, not evidence that all or any of those 6,524 shares were actually issued, paid for or added to the current capital denominator.³⁹

These ownership and governance records establish dated holdings and conditional governance rights only. They do not themselves establish a qualifying political/welfare, military-output, digital-technology or economic-capital/operations act by any shareholder, investor or related person, and they do not establish that any conditional appointment right was exercised. Absence of such evidence from these particular filings is not evidence that no such act or exercise exists elsewhere.^{35, 38, 39}

Article 10.1 requires written majority class consent for variation or abrogation of special class rights, with combined-class treatment when classes are treated alike and exceptions under articles 10.2, 10.3 and 17.6. Sunna’s sole registered B holding makes this a relevant dated formal-right protection, not a universal transaction veto. The articles define SBS as the SidebySide EIS Venture Fund acting through WCS Nominees Limited, represented by The SidebySide Partnership International Limited; that definition does not alone reconcile all registered-holder labels or establish an observer seat, individual veto or beneficial percentage.^{35, 38}

Newly documented governance actors - bounded Digital update

The root-supplied 26 August 2025 snapshot/articles make Lucy Mercey/Joseph Wray and the aggregated Tom Singh/Anna Singh holding relevant for conditional governance screening, while AWESOMEACTION LIMITED is a separate corporate holder. These dated rights do not establish exercised control, a current October 2026 percentage or a digital-domain act by themselves.^{40, 41}

Fresh primary records add a digital-business connection for Lucy Penelope Mercey: Companies House lists her as active PSC of MEGA ADVANCED LTD (13403283), with more than 25% but not more than 50% of shares and votes, and as active director of ESPORTS AWARDS LTD (10622634).^{42, 43} MEGA’s own site identifies company 13403283 and says it owns/operates the Esports Awards and Mobies and provides gaming/esports events, production, marketing and tournament services.⁴⁴ No opened source in this bounded screen established an Israeli digital/cyber/surveillance/AI stake or governance role through MEGA, Esports Awards or Lucy; the gaming role is therefore recorded without inventing the required Israeli nexus.^{42, 43, 44}

Rianta’s current site says it invests across the UK, Europe and US, including B2C/B2B consumer tech; its About page says it is investment adviser to Tom and his family and that the family has unnamed LP positions in UK and US venture funds.^{45, 46} Fresh searches for Tom Singh, Anna Singh and Rianta with Israel, Israeli startup, cyber, surveillance and AI terms produced no opened public document naming a qualifying Israeli technology holding or governance role.^{45, 46} Because the LP positions are unnamed, indirect/private exposure remains unresolved.⁴⁶

A Joseph Peter William Wray is an active director of BOOT ROOM HOSPITALITY LIMITED (15529393), but no opened source tied that full identity to Tonic’s Joseph Wray, so no digital activity is attributed through it.^{40, 47} Companies House records Peter Noel Tighe as active director of AWESOMEACTION LIMITED (11166287); fresh bounded searches produced no opened public document establishing an attributable Israeli digital/cyber/surveillance/AI holding or role for Peter/AwesomeAction.⁴⁸ AwesomeAction beneficial ownership remains unresolved in the fresh primary material.⁴⁸

Earlier named-investor screening - retained bounded findings

SidebySide lists Tonic as a portfolio company; the secondary gritt.io database lists partner Ben Ashworth as a Board Observer from June 2025. This is an observer-role lead, not primary confirmation of a statutory seat, vote or veto.^{49, 50} Bounded searches for SidebySide/Ben Ashworth with Israel, Tel Aviv, cyber, surveillance, AI and Israeli technology-company terms found no public evidence identified in opened sources of an Israeli digital, cybersecurity, surveillance, AI or military-technology holding. SidebySide’s disclosed portfolio is not proven complete.⁴⁹

Rianta says Tom Singh’s family has backed more than 100 businesses and holds unnamed LP positions in UK and US venture funds.⁵¹ Those unnamed LPs prevent exclusion of indirect Israeli technology exposure. Searches for Singh/Rianta, Wray/Brendon Street and Rubix against Israeli technology terms produced no opened document establishing a direct Israeli digital/cyber/AI holding. No qualifying digital act is established in that opened set; the dated holdings and rights are addressed in the primary supplement.^{51, 52}