PRIVACY POLICY
Last updated: 28 September 2026
This Privacy Policy explains how Primal Physique ("we", "us", "our") collects, uses, stores, and protects your personal data when you use the Primal Physique app and related services.
We are a UK-based coaching business, and this policy is written to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Data controller: John Boon, trading as Primal Physique
Contact: john@primalphysique.fit
1. What Data We Collect
1.1 Account Information
- Name, email address, phone number
- Password (stored securely, hashed — we never see or store your actual password)
- Profile photo (optional)
- Plan/subscription tier
1.2 Health and Physical Data — Special Category Data
Under UK GDPR, health-related information is classified as "special category data" and receives additional legal protection. We collect:
- Physical Activity Readiness Questionnaire (PAR-Q) responses, including any health conditions or risk factors you disclose
- Weight, body fat percentage, muscle percentage, and body measurements
- Progress photos (front, side, back) and any AI-generated physique analysis derived from them, including estimated body fat percentage
- Training readiness responses (sleep, soreness, energy, stress) submitted before workouts
- Wearable device data, where connected (e.g. heart rate, steps, sleep data), once this feature is available
- GLP-1 medication dose and side-effect logs, where you choose to enable this feature
- Menstrual cycle tracking data (cycle length, period dates), where you choose to enable this feature
We only collect this data with your explicit, informed consent, given separately from general account terms, as required for special category data under UK GDPR. You can withdraw this consent at any time (see Section 6).
1.3 Training and Nutrition Data
- Workout logs (exercises, sets, reps, weight, RPE)
- Food logs (via search, barcode scan, voice recording, or photo)
- Voice recordings submitted for food logging (processed for transcription, not retained as audio after processing — see Section 3)
- Photos submitted for food logging (processed for identification, not retained after processing — see Section 3)
1.4 Communication Data
- Messages sent via in-app Chat, including voice messages
- Posts, comments, and reactions in the Community area
- Check-in form responses
1.5 Technical Data
- Device type, operating system, app version
- Usage data (which features you use, how often)
- Push notification tokens, if you enable notifications
1.6 Payment Data
Payment processing is handled by RevenueCat, via Apple's App Store and Google Play billing systems. We do not store your full card details. We retain records of your subscription tier and payment status.
2. Why We Collect This Data (Legal Basis)
| Purpose | Legal basis |
|---|---|
| Providing coaching services you've signed up for | Performance of a contract |
| Health and physical data (PAR-Q, physique scans, measurements) | Explicit consent |
| Safety screening (PAR-Q risk flagging) | Vital interests / explicit consent |
| Improving the app, understanding usage | Legitimate interest |
| Marketing communications (if opted in) | Consent |
| Legal and regulatory compliance | Legal obligation |
3. How We Use Third-Party Services
We use the following third-party services to provide app functionality. Data is shared with these providers only as necessary to deliver the relevant feature:
| Service | Purpose | What's shared |
|---|---|---|
| Supabase | Database and authentication | All account and app data (hosted securely) |
| RevenueCat | Subscription and payment processing (via Apple App Store / Google Play billing) | Purchase and subscription status — we never see full card numbers |
| OpenAI (Whisper) | Voice message transcription | Audio recordings, processed and not retained by us after transcription |
| Anthropic (Claude) | Physique scan analysis, AI check-in assistance, AI programme generation, and IRON IQ (our in-app AI coaching assistant) | Progress photos (for physique scans), check-in data, training and nutrition history, and — where you use these features — GLP-1 medication logs or menstrual cycle data, processed to generate results and not used to train Anthropic's models |
| Sentry | Crash reporting and app stability monitoring | Technical diagnostic data (device type, app version, error logs) — no message content or health data |
| Google/OpenAI vision models | Photo food logging | Food photos, processed for identification, not retained after processing |
| Open Food Facts / USDA FoodData Central | Nutrition data lookup | Search queries only, no personal data shared |
| Firebase (Google) | Push notifications | Device notification tokens |
| Apple Health / Google Fit | Wearable data sync (where connected) | Health metrics you authorise sharing |
We do not sell your personal data to third parties.
4. Data Retention
- Active account data is retained for as long as your account is active.
- Voice recordings and food photos used for AI-assisted logging are processed and discarded — we retain the resulting log entry (e.g. "chicken breast, 200g"), not the original audio or image, once processing is complete.
- If your account is permanently deleted (at your request, or by your coach on your request), your personal data is deleted from our systems, with the exception of data we're legally required to retain (e.g. payment records, for tax purposes) and content visible to other users, which is anonymised rather than deleted (see Section 7).
- If your account is paused/deactivated, your data is retained unchanged in case you return.
5. Data Security
We take reasonable technical and organisational measures to protect your data, including:
- Encrypted storage and transmission
- Row-level security ensuring you can only access your own data (and your coach can only access data for their own clients)
- Restricted access to production systems
No system is completely secure, and we cannot guarantee absolute security, but we take this seriously given the sensitivity of health data we hold.
6. Your Rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate data
- Erase your data ("right to be forgotten")
- Restrict or object to certain processing
- Data portability — receive your data in a portable format
- Withdraw consent at any time, where processing is based on consent (this won't affect the lawfulness of processing before withdrawal)
To exercise any of these rights, contact john@primalphysique.fit. You can also request account deletion directly through the app's Settings screen, or by asking your coach.
You also have the right to lodge a complaint with the UK's Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been mishandled.
7. What Happens When Your Account Is Deleted
- Your personal training, nutrition, weight, and photo data is permanently deleted.
- Your chat history is permanently deleted.
- Community posts you've made are anonymised (shown as "Deleted user") rather than removed outright, since other users may have replied to or reacted to them — removing them entirely could break those conversations for other people. The content is preserved but no longer attributed to you.
8. Children's Privacy
Primal Physique is not intended for use by anyone under 18. We do not knowingly collect data from minors. If you believe a minor has provided us with personal data, contact us and we will delete it.
9. Changes to This Policy
We may update this policy from time to time. If we make material changes, we'll notify you via the app or email before the changes take effect.
10. Contact Us
If you have questions about this policy or how your data is handled, contact:
john@primalphysique.fit
Primal Physique