1. Who is responsible

Fettle Fitness Ltd (registered in England & Wales) is the data controller for your personal data. Contact: privacy@fettle.fit

2. What we collect

• Account data: name, email address, password (stored hashed), date of birth (to verify you're 18+).

• Health & body data: weight entries, height, activity level, goals, adherence and check-in responses, dietary preferences. This is special category data under UK GDPR.

• Usage data: how you use the app (screens, features), device type, crash logs — to keep the Service working and improve it.

• Grocery handoff: when you use the basket feature, your ingredient list is passed to a third-party grocery provider. We do not receive your wider grocery purchase history.

3. Why we process it (lawful bases)

• To run your plan — calculating targets, running the Adaptive Engine, building meal plans and baskets. Basis: performance of our contract with you; for health data, your explicit consent, which you can withdraw at any time in the app.

• To operate and improve the Service — diagnostics, aggregate analytics. Basis: legitimate interests, using the minimum data necessary.

• To communicate with you — service messages (contract); marketing only with your consent, unsubscribable in one click.

4. What we never do

• We never sell your personal data.

• We never use your data for third-party advertising. There are no ads in Fettle.

• We never share health data with insurers, employers, or data brokers.

5. Who we share data with

Only processors needed to run the Service, under contracts that bind them to protect your data: cloud hosting, app analytics/crash reporting, email delivery, and payment confirmation from the app stores (we never see your card details). Where any processor is outside the UK, transfers are protected by UK-approved safeguards (adequacy or standard contractual clauses).

6. How long we keep it

For as long as you have an account. Delete your account and your personal data is erased or irreversibly anonymised within 30 days, except the minimal records we must keep for legal, tax or fraud-prevention purposes.

7. Your rights

Under UK GDPR you can: access your data; export it in a portable format; correct it; delete it; restrict or object to processing; and withdraw consent for health-data processing at any time (the app can't run an adaptive plan without it, but you choose). Exercise any of these in-app or via privacy@fettle.fit. You can also complain to the Information Commissioner's Office (ico.org.uk) — though we'd appreciate the chance to fix it first.

8. Security

Data is encrypted in transit and at rest, access is restricted and audited, and we follow the principle of least privilege internally. No system is perfectly secure; if a breach affects your data we will notify you and the ICO as UK GDPR requires.

9. Children

Fettle is for adults 18+. We do not knowingly process children's data; accounts found to belong to under-18s are deleted.

10. Changes

Material changes to this policy will be notified in-app or by email before they take effect.