Privacy Policy

UK GDPR / EU GDPR

1) Who we are and how to contact us

Shifted.Fitness is provided by Shifted.Labs Ltd ("we", "our", "us"). We are the data controller for personal data processed in connection with our app and website.

Contact: hello@shifted.fitness

Postal: 64 Bell Street, London, NW1 6SP, United Kingdom

If you are in the UK, you have the right to lodge a complaint with the Information Commissioner's Office (ICO). If you are in the EEA, you may also complain to your local supervisory authority.

2) Scope

This policy covers personal data we process when you use the Shifted.Fitness mobile/web app, our website, support channels, and related services (collectively, the "Services").

3) The data we collect

We collect and process the following categories of data:

  • Account & Identity Data: name, email, password or auth tokens, country/region, app store IDs.
  • Profile & Preferences: training goals, experience level, equipment access, dietary preferences, sleep patterns, cycle phase, wellness inputs.
  • Health/Wellness Data (special category): Some profile data may reveal health information. We only process such data with your explicit consent.
  • User-Generated Content: short exercise videos/photos you upload for form feedback. We host these on Cloudinary and delete them within ~24 hours.
  • In-App Interactions: messages/questions you submit to our coaching features, feature usage events, and preferences.
  • Device & Technical Data: device model, OS, app version, IP address, language, crash logs, diagnostics.
  • Communications: support requests, feedback, survey responses.

We do not deliberately collect data from children (see Section 12).

4) How we use your data

  • Provide and personalise training and nutrition plans and app features.
  • Offer AI-assisted coaching to answer your questions and generate tailored guidance.
  • Process your uploads for quick analysis and feedback, then delete media within ~24 hours.
  • Maintain safety and security, including fraud and abuse prevention.
  • Operate, maintain, and improve the Services.
  • Communicate with you, such as service updates and security alerts.
  • Comply with legal obligations and enforce our Terms.

5) Our legal bases

  • Performance of a contract (to deliver the app, account, and core features).
  • Consent (for processing health/wellness data; certain optional analytics/marketing). You can withdraw consent at any time.
  • Legitimate interests (to keep the service secure, prevent abuse, measure performance).
  • Legal obligations (to comply with applicable laws).

6) Sharing your data

We do not sell your personal data. We share data only with service providers (processors) under written contracts, including: Adalo, Netlify Functions, Cloudinary, OpenAI, professional advisers, and authorities when required by law.

7) AI features and your data

When you use AI-powered features, we send relevant parts of your inputs to our AI provider. We instruct our AI provider not to use your data to train public models. AI may occasionally make mistakes — please treat outputs as general guidance only.

8) International transfers

Some providers are located outside the UK/EEA. We rely on approved transfer mechanisms (UK IDTA, EU Standard Contractual Clauses, adequacy decisions) and implement additional safeguards.

9) Data retention

  • Account & Profile Data: kept while you have an account and for a reasonable period afterwards.
  • Health/Wellness Data: retained only as long as needed or until you withdraw consent.
  • Videos/Photos: deleted within ~24 hours of upload.
  • Support/Comms & Technical Logs: retained for reasonable operational periods.

10) Security

We implement encryption in transit, access controls, least-privilege practices, and provider due diligence. No method of transmission or storage is 100% secure.

11) Your rights

Under UK/EU data protection law you may have the right to:

  • Access your data and receive a copy
  • Correct inaccurate data
  • Delete your data
  • Restrict or object to certain processing
  • Data portability
  • Withdraw consent

Contact hello@shifted.fitness to exercise your rights. We aim to respond within one month.

12) Children and minimum age

You must be at least 16 in the UK/EEA and at least 13 elsewhere. If you are under 18, you should only use the Services with a parent/guardian's involvement.

13) Cookies

If you use our website, we may use cookies for essential operations and, with your consent, for analytics/experience improvements.

14) Changes to this policy

We will update this policy from time to time. Material changes will be notified in-app or by email where appropriate.