Privacy Policy

1. Introduction

This Privacy Policy explains how Walsham Group Limited ("we", "us", "our") collects, uses, stores, shares, and protects personal data when you use Physique Pilot (the "Service"), available at physiquepilot.com. We are committed to protecting your privacy and handling your data transparently and lawfully under the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

2. Who we are

We are the data controller responsible for your personal data.

• Legal name: Walsham Group Limited
• Company number: 17209232 (registered in England and Wales)
• Registered address: 192 Maldon Road, Colchester, Essex, CO3 3AZ, United Kingdom
• ICO registration number: ZC144368
• Contact email for data protection matters: coach@physiquepilot.com

You may contact us about any aspect of this Privacy Policy using the details above.

3. What data we collect

We collect the following categories of personal data from you when you use the Service:

Account data

• Email address
• Password (stored only in hashed form by our authentication provider; we never see or store your password in plain text)
• Email verification status
• Account creation and last login timestamps
• If you sign in with Apple or Google, the name and email address they share with us (Apple lets you hide your real email address)

Profile data

• Name
• Date of birth
• Sex (male or female). We need it to estimate your energy needs, so it is required
• Height
• Current and goal body weight
• Training experience and history
• Available equipment
• Self-reported strengths and weaknesses
• Coaching goals and preferences

Health and fitness data (special category data under Article 9 UK GDPR)

• Body weight measurements over time
• Body composition data (where provided)
• Nutrition logs, including foods consumed, portion sizes, macronutrient and micronutrient intake, dietary preferences and restrictions
• Training logs, including exercises performed, sets, reps, loads, and session notes
• Cardiovascular activity, including step counts and cardio sessions
• Habit-tracking entries (e.g. sleep, hydration, stress)
• Check-in data, including progress photos, body measurements, mood and energy ratings, and free-text notes
• Injuries and physical limitations you tell us about
• Alcohol and flexible or social meals you plan or log
• Photos of a training logbook or a food label, if you choose to scan them
• AI coaching conversation history

Wearable data (collected only where you connect a third-party service)

• Heart rate, heart rate variability, sleep, recovery, workouts, daily activity and other metrics provided by integrated wearable platforms. See Section 15

Technical data

• IP address
• Browser type and version
• Device and operating system information
• Server access logs and timestamps
• Approximate location derived from IP address
• AI records: which AI features you have agreed to and when, whether you asked not to be asked again, and a count of how much AI was used (never the content)
• An app installation identifier. The mobile app can update its own interface without a store release, and records the outcome of each update against a random identifier generated when the app is installed. It is not derived from you or your device, is not linked to your account, and is used only to tell whether an update worked.

Referral data

• Where you joined through a gym or other partner link, a record that your account came from that partner. Some partners, such as gyms, earn a share of what you pay us for a period after you join, so we use your payments to work out what they are owed. Partners are never told which of their members have signed up or subscribed. They receive totals only, and small numbers are shown as “fewer than 5” so no one can be picked out.

Payment data

We do not store payment card details. Where you subscribe on the web, payments are processed by Stripe, who collect and process card data directly under their own privacy policy. Where you subscribe inside the iOS or Android app, the purchase is made through Apple or Google and we never see your payment details at all; RevenueCat processes the resulting receipt on our behalf so we know what you are entitled to.

In every case we receive only a subscription status and a transaction reference.

Refer a friend

If you join through a friend’s invite link, we record that on your account, along with whose link it was. If you share your link, we record which accounts were created through it. We use this to give the longer trial and to see whether the offer is working. Our lawful basis is legitimate interests. The member who shared the link sees only a count of friends who have started a trial, shown as “fewer than 5” until there are 5 or more, never who they are. We keep the record until either account is deleted.

Communications data

• Records of correspondence between you and us, such as support emails
• Messages you send through the in-app support form, together with the page, device type and plan you were on, so we can help without asking

4. How we use your data

We use your personal data for the following purposes:

• To create and manage your account
• To provide the coaching, tracking, and analytics features of the Service
• To check each change our engine makes to your plan against how you responded over the next few weeks, and to use your own results to tailor later changes of the same kind. This uses only your own data, never anyone else’s, and every change stays within the same safety limits
• To generate personalised training, nutrition, recovery, and habit recommendations using artificial intelligence
• To enable wearable integrations you choose to connect
• To send transactional emails (account confirmations, password resets, important service updates)
• To email you your weekly check-in report as a PDF. Your progress photos are left out of the email unless you switch them on in Settings → Check-in
• To send marketing emails about new features, content, and offers, only where you have opted in and from which you may unsubscribe at any time
• To process subscription payments
• To detect, prevent, and respond to security incidents, fraud, and abuse
• To improve the Service, including by analysing aggregated and anonymised usage patterns
• To respond to your enquiries and provide customer support
• To comply with our legal, regulatory, and tax obligations

5. Lawful bases for processing

We rely on the following lawful bases under Article 6 UK GDPR:

• Performance of a contract: to provide the Service you have signed up for (account management, core features including the health and fitness data they run on, payment processing)
• Consent: for marketing communications, and for sending your data to our AI provider (see Section 7)
• Legitimate interests: for security, fraud prevention, service improvement, analytics, and recording who joined through a friend’s invite link. We have assessed that these interests are not overridden by your rights and freedoms.
• Legal obligation: for accounting, tax, and regulatory record-keeping

Health data is a special category of data, so it also needs a condition under Article 9 UK GDPR. For it we rely on your explicit consent (see Section 6).

You have the right to withdraw consent at any time where we rely on consent (see Section 10).

6. Special category data

Much of the data you provide to Physique Pilot, including body weight, body composition, nutrition, training history, recovery metrics, progress photos and wearable data, constitutes "data concerning health" under Article 9 UK GDPR. This is treated as a special category of personal data with heightened protections.

We process this data only on the basis of your explicit consent, which you give by ticking a separate box on its own screen when you set up your account, before we ask anything about your body. Members who joined before this screen existed are asked the same question the next time they open the app. We save none of this data until you have agreed. You may withdraw this consent at any time by deleting your account in Settings or by contacting us. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal.

AI features. Sending your health data to our AI provider is a separate step, and we ask for your explicit consent to it before an AI feature first runs (and, if you prefer, before every use). You can withdraw that consent at any time in Settings → Account → AI and your data. AI features then stop working until you agree again. Your account and everything already created stay as they are unless you delete your account.

Menstrual cycle tracking (optional). If you choose to enable cycle tracking, we collect your typical cycle length and the dates you tell us your period started. This is special category health data, collected only with your separate, explicit consent at the point you turn the feature on. We use it for a single purpose: interpreting your weekly results fairly, recognising that hormonal water retention can temporarily mask fat loss and that the associated drop is water rather than fat, and easing training intensity slightly in the premenstrual window. It is stored separately from your general profile, is never shared or used for any other purpose, and you can turn the feature off and permanently delete all cycle data at any time from Settings → Body & Goal. Cycle tracking is entirely optional and off unless you enable it.

7. Who we share your data with

We do not sell your personal data. We share your data only with the following categories of recipients, each of whom processes data on our behalf under appropriate contractual safeguards:

We may also disclose your data:

• Where required by law, court order, or regulatory request
• Where necessary to protect our rights, property, or safety, or the rights, property, or safety of our users or others
• In connection with a business transaction such as a merger, acquisition, or sale of assets, in which case we will notify you in advance

AI processing

Parts of the Service use artificial intelligence, provided by OpenAI, to write meal plans, training programs, weekly reports and coaching replies, and to read food text, nutrition labels and training logbook photos that you choose to submit. Your calorie and macro targets, training volume and weekly adjustments are set by our own rules-based engine. The AI writes the wording and fills in food and exercise choices around those numbers.

• What is sent: only what the feature needs. Depending on the feature, that can include your age, sex, height, weight, body fat, goal, weight, nutrition, training and recovery logs, allergies and injuries, notes you have written, messages you send to the coach, and any photo you choose to scan. Menstrual cycle information is included only if you have turned cycle tracking on.
• What is not sent: your name, email address, phone number, account ID, date of birth (we send your age), payment details, or your progress photos.
• Filtering: free text you type (such as notes or injuries) is filtered for email addresses, phone numbers, links, postcodes and your own name before it is sent. No filter is perfect, so please don't include other people's personal information in free text. A name written on a logbook photo would be seen by the AI.
• Your say: before an AI feature generates something for you, we ask you to acknowledge that your data will be shared with OpenAI. You can choose "Don't ask me again", or be asked every time, and you can withdraw consent at any time in Settings → Account → AI and your data. Without your acknowledgement, AI features do not run.
• Training and retention: under OpenAI's API terms, data sent through the API is not used to train OpenAI's models. We switch off OpenAI's optional storage of requests. OpenAI may keep API requests for up to 30 days for abuse monitoring and then deletes them, unless longer retention is required by law.
• Decisions about you: AI output is guidance for you to use or ignore. No one at Physique Pilot reviews it before you see it, and it does not make decisions that have legal or similarly significant effects on you. See also Section 10 of our Terms of Service.

8. International transfers

Some of our service providers process data outside the UK, including in the United States and the European Economic Area. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, including:

• The UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses
• Reliance on adequacy decisions where applicable (e.g. the UK–US Data Bridge for transfers to certified US recipients)
• Contractual protections requiring providers to apply UK GDPR-equivalent standards

You may request further information about specific transfer mechanisms by contacting us.

9. How long we keep your data

We retain your personal data only for as long as necessary for the purposes set out in this Policy:

• Account and profile data: for the duration of your account. Deleting your account erases it immediately and permanently. There is no recovery period
• Health and fitness data: for the duration of your account, then erased immediately and permanently when you delete your account
• Progress photos: for the duration of your account, then erased immediately and permanently when you delete your account
• AI coaching conversation history: for the duration of your account, then erased immediately and permanently when you delete your account
• Server logs and security data: up to 12 months
• Data sent to our AI provider: we do not store the prompts we send. The results are kept as part of your account data. OpenAI may keep API requests for up to 30 days for abuse monitoring, then deletes them
• Payment and tax records: up to 7 years after the end of the relevant accounting period, as required by HMRC. Partner commission and payout records are kept for the same period and contain no member names
• Inactive accounts: if you have not signed in for 2 years and have no active subscription, we email you and delete your account 30 days later unless you sign in
• Trial record: to allow one free trial per email address, we keep a one-way scrambled (hashed) form of your email address after your trial starts, including after you delete your account. It cannot be read as your email address, and is used for nothing else
• Partner referral record: which partner you joined through, kept while your account exists and deleted with it
• Refer-a-friend record: which member’s invite link you joined through, or which accounts joined through yours, kept until either account is deleted
• Support messages: 2 years after our last reply, or sooner if you delete your account
• Partner enquiries (from gyms and organisations, not members): 2 years, or 6 years after a partnership ends
• Tester documents: if you send us a completed test document, 12 months, then deleted
• Marketing consent records: your current choice and when you made it, kept while your account exists and erased when you delete it
• Terms, safety, health-data and AI-processing consent records: when you agreed and to which version of the terms, and when you withdrew if you did. Kept while your account exists and erased when you delete it

Encrypted backups containing your data may persist for up to 30 days after deletion before they expire: our database provider keeps its own for about 7 days, and our separate encrypted backup, stored in the EU, keeps each night’s copy for 30 days. Backups are used only to recover from a failure, never to restore an account you have deleted.

10. Your rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access: to obtain a copy of the personal data we hold about you
• Right to rectification: to have inaccurate or incomplete data corrected
• Right to erasure ("right to be forgotten"): to request deletion of your data. You can delete your account and associated data directly from the Settings page of the app.
• Right to restrict processing: to ask us to limit how we use your data in certain circumstances
• Right to data portability: to receive your data in a structured, machine-readable format
• Right to object: to processing based on legitimate interests, and to direct marketing
• Right to withdraw consent: at any time, where processing is based on consent. You can withdraw your consent to AI processing yourself in Settings → Account → AI and your data
• Rights related to automated decision-making: you have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Our AI coaching is informational and does not produce such effects.

To exercise any of these rights, contact us at coach@physiquepilot.com. We will respond within one month, though this may be extended by a further two months for complex requests, in which case we will inform you of the reason. We do not charge a fee for exercising your rights, except where requests are manifestly unfounded or excessive.

11. Cookies and tracking

We use essential cookies and similar technologies to deliver the Service: for example, to keep you logged in and to remember your preferences. These do not require your consent under the Privacy and Electronic Communications Regulations. We use two optional advertising tools, the TikTok Pixel and the Meta Pixel, on our website only, and only if you accept them. They are described below.

We use a privacy-friendly product analytics tool (PostHog, EU region) to understand how the Service is used and to improve it. It is configured cookieless: it does not set tracking cookies and does not store identifiers on your device between sessions. It records which pages and features are used. Once you are signed in, those events are linked to your account ID (never your name, email or health data) so we can see where people get stuck, for example between sign-up and subscribing. It is not used for advertising.

The TikTok Pixel is an advertising measurement tool, so we can see whether our TikTok ads actually lead to sign-ups. It runs only on our public website (physiquepilot.com), never inside the app or on app.physiquepilot.com. It sets first-party cookies (_ttp and _tt_enable_cookie) and sends TikTok a record of the pages you view and the buttons you press on our website, together with your IP address and browser details. When you create an account or start a trial, our server sends TikTok a record of that event with a scrambled (hashed) form of your email address, your IP address and browser details, so the sign-up can be matched to an ad. None of this includes your health data. TikTok acts as an independent controller for this data and may use it to measure and target advertising.

The Meta Pixel (from Meta Platforms Ireland, which runs Instagram and Facebook) is an advertising measurement tool, so we can see whether our Instagram and Facebook ads lead to sign-ups. It runs only on our public website (physiquepilot.com), never inside the app or on app.physiquepilot.com. It sets first-party cookies (_fbp and _fbc) and sends Meta a record of the pages you view on our website, together with your IP address and browser details. When you create an account or start a trial, our server sends Meta a record of that event with your IP address, browser details and those cookies, so the sign-up can be matched to an ad. We never send Meta your email address or your health data. Meta acts as an independent controller for this data and may use it to measure and target advertising.

These are entirely up to you. We ask before we load them, and neither the pixels nor the server-side reports happen unless you accept. They never run inside the mobile apps. Declining costs you nothing. Every part of the Service works the same either way. You can change your mind at any time using the button below, and we will re-ask you at least once a year in any case. Withdrawing takes effect immediately and deletes the cookies.

12. Marketing communications

Where you have opted in, we may send you marketing emails about new features, product updates, training and nutrition content, and special offers. You can unsubscribe at any time by clicking the "unsubscribe" link at the bottom of any marketing email, or by emailing us. Unsubscribing from marketing does not affect transactional emails (account, password, payment).

You can also join our mailing list from our homepage without creating an account. In that case the only personal data we hold is your email address, processed on the basis of your consent and held by our email provider (Resend) until you unsubscribe. It is not linked to any account, is not used for anything other than sending you those updates, and is never sold or shared. Every such email carries a one-click unsubscribe link, which removes your address from the list.

13. Security

We take the security of your data seriously and implement appropriate technical and organisational measures to protect it, including:

• Encryption of data in transit (TLS) and at rest (provider-managed)
• Hashed password storage
• Database access rules so each account can reach only its own data, with the powerful database key kept on our server
• Access to user data limited to a single administrator, with account actions behind a time-limited unlock
• Security reviews of our code, and error monitoring that carries no personal data beyond an account ID

No system is 100% secure. In the unlikely event of a personal data breach affecting your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware, and notify you without undue delay where the breach is likely to result in a high risk to you.

14. Children

Physique Pilot is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete the relevant data without undue delay.

15. Wearable integrations

Physique Pilot can connect to the following third-party wearable and health platforms. Each one is optional, off until you connect it, and read-only:

• Oura Ring (Oura Health Oy)
• Whoop (Whoop, Inc.)
• Apple HealthKit (Apple Inc.)
• Health Connect on Android (Google LLC)

When you connect one of these services, we receive, with your authorisation, data including body weight, steps, heart rate, resting heart rate, heart rate variability, sleep, recovery, workouts, daily activity, and similar metrics. This data is processed in accordance with this Privacy Policy and the privacy policy of the third-party provider. You may disconnect any integration at any time from the Settings page.

16. Changes to this Privacy Policy

We may update this Policy from time to time to reflect changes in our practices, the Service, or the law. The "Last Updated" date at the top will indicate when changes were made. Where changes are material, we will notify you by email and/or via the app before they take effect.

17. Complaints

If you are not satisfied with how we have handled your data, you may lodge a complaint with the UK Information Commissioner's Office:

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

We would, however, appreciate the opportunity to address your concerns first. Please contact us at coach@physiquepilot.com. We will acknowledge your complaint within 30 days and tell you what we are doing about it.

18. Partners and creators

This section is for the gyms, universities, societies and creators who work with us, and the people who contact us on their behalf. It is not about members.

• What we collect: your name, email address and phone number; the name of your organisation or channel; its address, company number and VAT number; the signed agreement; and, for creators, the social media accounts it covers
• Payments: we pay commission through Stripe Connect. Stripe collects and checks your identity and bank details under its own privacy policy. We receive only whether your account is ready to be paid, and the payments made
• Your content: for creators, the posts we may reuse under your agreement, shown with your name or handle
• Why, and on what basis: to make and run the agreement (performance of a contract), and to keep tax records, including the monthly statements that serve as self-billed invoices (legal obligation)
• How long: enquiries that don’t lead to a partnership, 2 years. Agreements, statements and payment records, up to 7 years after the end of the accounting period they relate to, as HMRC requires. Creator posts, until 12 months after the agreement ends, as the agreement says

You have the same rights over this data as anyone else (Section 10).

19. Contact us

For any questions, requests, or concerns regarding this Privacy Policy or your personal data:

Walsham Group Limited
192 Maldon Road
Colchester
Essex
CO3 3AZ
United Kingdom
Email: coach@physiquepilot.com