Does Apple have a VPN service that I can download on my iPhone?

No. VPNs have specific uses. Mainly, to set up an encrypted link between your computer and a remote office server. For general use, they offer no real protection.

Some VPN facts:

https://gist.github.com/joepie91/5a9909939e6ce7d09e29

A VPN can do absolutely nothing to hide any data going between you and the site you're viewing since only half of the communication is encrypted. Anything going to the site from the VPN and back to it is in the clear, or the site you're accessing would have no idea what to do with the encrypted data.

A VPN has only two uses:

1. You're using it to send and receive content from a truly tunneled VPN at your place of employment. Only the servers at the office get the unencrypted data from you as output from the VPN. Anything coming back to you is encrypted. Meaning, anyone trying to capture data between you and the office will only ever see encrypted data. A hacker would have to somehow breach the business' server on the clear input/output side to get anything, or on your end.

2. You're trying to hide yourself. Since a VPN encrypts what's coming back to you, it does a good job at hiding what IP address the data is going back to (and as the link mentions, even this doesn't do a good job of hiding you anymore). However, any and all VPN's log this data. If you do anything illegal and law enforcement tracks the clear data back to the VPN (and they can), they'll demand log data to see what IP address the data was output to. The site running the VPN will give you up. They aren't going to go to jail for what you do.

https://thebestvpn.com/how-free-vpns-sell-your-data/

This isn't exactly breaking news. It's been known for a very long time that free VPN's (in particular) log and sell your data. How else do you think they pay for their servers?

It's the same model as Google, and in particular, Chrome. You are the product. Chrome runs a background daemon from the moment you turn your computer on, whether Chrome itself is running or not. Its job is to constantly send anonymized data back to Google about your web and personal computer usage.

NordVPN is supposedly one of the better offerings, but it's still mostly useless. No matter what web site you're communicating with, only what you send to the VPN and it sends back to you is encrypted. Every bit of data out of the VPN to the site you're visiting, and from there back to the VPN is the same as using no VPN at all. It has to be, or the sites you're visiting would just get a load of encrypted data they can't do anything with.