Last updated: 6th September 2026
This Privacy Policy explains how Primal Physique (“we”, “us”, “our”) collects, uses, stores, and protects your personal data when you use the Primal Physique app and related services.
We are a UK-based coaching business, and this policy is written to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Data controller: John Boon, trading as Primal Physique · Contact: john@primalphysique.fit
1.1 Account Information
Name, email address, phone number; password (stored securely, hashed — we never see or store your actual password); profile photo (optional); and plan/subscription tier.
1.2 Health and Physical Data — Special Category Data
Under UK GDPR, health-related information is classified as “special category data” and receives additional legal protection. We collect:
• Physical Activity Readiness Questionnaire (PAR-Q) responses, including any health conditions or risk factors you disclose. • Weight, body fat percentage, muscle percentage, and body measurements. • Progress photos (front, side, back) and any AI-generated physique analysis derived from them, including estimated body fat percentage. • Training readiness responses (sleep, soreness, energy, stress) submitted before workouts. • Wearable device data, where connected (for example, heart rate, steps, sleep data), once this feature is available.
We only collect this data with your explicit, informed consent, given separately from general account terms, as required for special category data under UK GDPR. You can withdraw this consent at any time (see Section 6).
1.3 Training and Nutrition Data
Workout logs (exercises, sets, reps, weight, RPE); food logs (via search, barcode scan, voice recording, or photo); voice recordings submitted for food logging (processed for transcription, not retained as audio after processing — see Section 3); and photos submitted for food logging (processed for identification, not retained after processing — see Section 3).
1.4 Communication Data
Messages sent via in-app Chat, including voice messages; posts, comments, and reactions in the Community area; and check-in form responses.
1.5 Technical Data
Device type, operating system, app version; usage data (which features you use, how often); and push notification tokens, if you enable notifications.
1.6 Payment Data
Payment processing is handled by Stripe. We do not store your full card details. We retain records of your subscription tier and payment status.
Providing coaching services you’ve signed up for — Performance of a contract. Health and physical data (PAR-Q, physique scans, measurements) — Explicit consent. Safety screening (PAR-Q risk flagging) — Vital interests / explicit consent. Improving the app and understanding usage — Legitimate interest. Marketing communications (if opted in) — Consent. Legal and regulatory compliance — Legal obligation.
We use the following third-party services to provide app functionality. Data is shared with these providers only as necessary to deliver the relevant feature:
Supabase — database and authentication; all account and app data hosted securely. Stripe — payment processing; payment details (we never see full card numbers). OpenAI (Whisper) — voice message transcription; audio recordings processed and not retained by us after transcription. Anthropic (Claude) — physique scan analysis, AI check-in assistance, and AI programme generation; progress photos, check-in data, and training preferences are processed to generate results and not used to train Anthropic’s models. Google/OpenAI vision models — photo food logging; food photos processed for identification and not retained after processing. Open Food Facts / USDA FoodData Central — nutrition data lookup; search queries only, with no personal data shared. Firebase (Google) — push notifications; device notification tokens. Apple Health / Google Fit — wearable data sync (where connected); health metrics you authorise sharing.
We do not sell your personal data to third parties.
Active account data is retained for as long as your account is active. Voice recordings and food photos used for AI-assisted logging are processed and discarded — we retain the resulting log entry (for example, “chicken breast, 200g”), not the original audio or image, once processing is complete. If your account is permanently deleted (at your request, or by your coach on your request), your personal data is deleted from our systems, with the exception of data we’re legally required to retain (for example, payment records, for tax purposes) and content visible to other users, which is anonymised rather than deleted (see Section 7). If your account is paused/deactivated, your data is retained unchanged in case you return.
5. Data Security
We take reasonable technical and organisational measures to protect your data, including encrypted storage and transmission; row-level security ensuring you can only access your own data (and your coach can only access data for their own clients); and restricted access to production systems. No system is completely secure, and we cannot guarantee absolute security, but we take this seriously given the sensitivity of health data we hold.
Under UK GDPR, you have the right to access the personal data we hold about you; rectify inaccurate data; erase your data (“right to be forgotten”); restrict or object to certain processing; receive your data in a portable format; and withdraw consent at any time where processing is based on consent (this will not affect the lawfulness of processing before withdrawal). To exercise any of these rights, contact john@primalphysique.fit. You can also request account deletion directly through the app’s Settings screen, or by asking your coach. You also have the right to lodge a complaint with the UK’s Information Commissioner’s Office (ICO) at ico.org.uk if you believe your data has been mishandled.
Your personal training, nutrition, weight, and photo data is permanently deleted. Your chat history is permanently deleted. Community posts you’ve made are anonymised (shown as “Deleted user”) rather than removed outright, since other users may have replied to or reacted to them — removing them entirely could break those conversations for other people. The content is preserved but no longer attributed to you.
Primal Physique is not intended for use by anyone under 18. We do not knowingly collect data from minors. If you believe a minor has provided us with personal data, contact us and we will delete it.
We may update this policy from time to time. If we make material changes, we’ll notify you via the app or email before the changes take effect.
If you have questions about this policy or how your data is handled, contact: john@primalphysique.fit · Primal Physique