Health Data Processing Notice

1. What this notice covers

This notice explains three optional ways Sweat Exchange can process training data that may reveal information about your health. It is separate from the Health and Safety Disclaimer, which is about exercise risk rather than personal-data processing.

Each purpose is off by default. You choose separately whether to allow workout logging and sync, bodyweight tracking, and progress analytics. Turning on one never turns on another. Refusing a purpose does not affect your account, purchases, entitlements or access to plan content.

For each purpose you turn on, we rely on your consent under Article 6(1)(a) of the UK GDPR and, where the data reveals information about health, your explicit consent under Article 9(2)(a). We record the purpose, this notice and version, the exact wording shown with your choice, and the server time of acceptance or withdrawal so that your decision can be proved.

2. Workout logging and sync

If you explicitly consent to workout logging and sync, we process the plan, workout and exercise identifiers you train against; session start, finish and completion times; sets, repetitions, loads, rest periods and notes; and the identifiers needed to keep those records attached to your account.

We use this data only to save workout logs on your device, upload them to your account, synchronise them between your devices, restore them after reinstalling, and show workout history, basic completion status and plan progression. Optional progress analytics is a separate purpose and remains off unless you also explicitly consent to it.

If you withdraw this purpose, the app immediately stops creating new persisted workout logs, stops new and pending uploads, and stops reading protected workout records from the service. A log queued before withdrawal is never uploaded automatically later, even if you opt in again. You can still exercise access, portability and deletion rights through the privacy or account-erasure request flow or by contacting support. Your plan content and entitlements remain available.

3. Bodyweight tracking

If you explicitly consent to bodyweight tracking, we process the bodyweight value, unit, measurement date and optional note you enter. We use it only to save the entry on your device, upload it to your account, synchronise it between devices, and show your bodyweight history.

If you withdraw this purpose, the app immediately stops new local bodyweight persistence, blocks new and pending additions or edits, and stops reading protected bodyweight records from the service. Entries queued before withdrawal are never uploaded automatically later. Access and portability requests remain available, and you can still delete an existing entry in the app because withdrawal must not trap your data.

4. Progress analytics

If you explicitly consent to progress analytics, we calculate and display optional measures derived from consented workout data, such as training volume, streaks, estimated one-repetition maximums, estimated performance and personal records. Basic workout completion status and plan progression belong to workout logging and sync, not this analytics purpose. Calculations may happen on your device and on our service. We do not use these analytics for advertising, automated decisions about you, or creator profiling.

Progress analytics requires both this choice and a current workout logging and sync choice. If you withdraw either one, new local and server-side analytics processing stops, protected analytics reads stop, and existing analytics are hidden rather than displayed as zero. Access, portability and deletion requests remain available through the privacy request flow or support.

5. Withdrawal, queued data and a later choice

You can withdraw any purpose independently in the app. Withdrawal takes effect immediately on that device. If the device is offline, it blocks protected persistence, uploads and reads at once; the server status is updated when the connection resumes, before that device attempts any other protected processing.

Withdrawal applies to future processing based on consent and does not make earlier processing unlawful. It does not delete records automatically because you may first want to exercise access or portability rights. Those rights and deletion remain available through the privacy or account-erasure request flow or support, and bodyweight deletion remains available in the app.

Opting in again creates a new acceptance. It does not revive the old acceptance and never automatically replays records that were pending when you withdrew. Only data created after the new acceptance can enter the normal persistence and sync flow.

6. Minimum completion and refund evidence

We separately retain the minimum evidence needed to apply the Refund Policy and handle disputes: the completed-workout count, completion time, and the purchase or plan to which the completion relates. This evidence does not contain your sets, repetitions, loads, notes, bodyweight or derived analytics, and we do not use it to reconstruct a workout or measure progress.

This minimum evidence is not processed on the basis of your health-data consent, so withdrawing a purpose does not erase it. We use it to perform the purchase and refund contract, prevent refund abuse, resolve disputes, and establish, exercise or defend legal claims. Where it reveals health information, we rely on the legal-claims condition in Article 9(2)(f). We retain it with the related purchase, refund or dispute record for up to six years after the relevant transaction or account closure, unless a longer legal hold is required.

7. Storage, sharing and security

Protected records are stored locally by the mobile app and, while the relevant purpose is on, in our Supabase-hosted service in the European Union. Trusted mobile API routes are hosted by Vercel. We do not send detailed workout, bodyweight or progress records to Stripe, plan creators or advertisers, and we do not sell them.

Access is limited to your account and the service processes needed for the purpose you selected. We use access controls, authenticated requests and encrypted network connections to protect the data.

8. Retention, access, portability and deletion

Consent-controlled records are available to product features only while the matching consent remains current. After withdrawal they are isolated from normal product reads and calculations. They are processed only as needed to answer your access, portability or deletion request, meet a legal obligation, or preserve a legal hold.

You can use the privacy or account-erasure request flow or contact support to exercise those rights. An existing bodyweight entry can also be deleted in the app. When deletion applies, we erase or irreversibly anonymise the protected records. The separate minimum completion and refund evidence described above follows its own limited retention rule.

9. Changes and contact

If this notice, a purpose or the wording beside a choice changes, we do not carry the old consent forward. That purpose remains off until you see the new version and make a fresh choice.

Questions, withdrawal assistance, exports and deletion requests can be sent to the support address published on the platform. You can also complain to the Information Commissioner's Office at ico.org.uk.