Privacy Policy

1. Introduction

This Privacy Policy explains how Walsham Group Limited ("we", "us", "our") collects, uses, stores, shares, and protects personal data when you use Physique Pilot (the "Service"), available at physiquepilot.com. We are committed to protecting your privacy and handling your data transparently and lawfully under the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

By creating an account or using the Service, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.

2. Who we are

We are the data controller responsible for your personal data.

• Legal name: Walsham Group Limited
• Company number: 17209232 (registered in England and Wales)
• Registered address: 192 Maldon Road, Colchester, Essex, CO3 3AZ, United Kingdom
• ICO registration number: ZC144368
• Contact email for data protection matters: coach@physiquepilot.com

You may contact us about any aspect of this Privacy Policy using the details above.

3. What data we collect

We collect the following categories of personal data from you when you use the Service:

Account data

• Email address
• Password (stored only in hashed form by our authentication provider; we never see or store your password in plain text)
• Email verification status
• Account creation and last login timestamps

Profile data

• Name (if provided)
• Date of birth
• Sex assigned at birth and/or gender identity (where you choose to provide it)
• Height
• Current and goal body weight
• Training experience and history
• Available equipment
• Self-reported strengths and weaknesses
• Coaching goals and preferences

Health and fitness data (special category data under Article 9 UK GDPR)

• Body weight measurements over time
• Body composition data (where provided)
• Nutrition logs, including foods consumed, portion sizes, macronutrient and micronutrient intake, dietary preferences and restrictions
• Training logs, including exercises performed, sets, reps, loads, and session notes
• Cardiovascular activity, including step counts and cardio sessions
• Habit-tracking entries (e.g. sleep, hydration, stress)
• Check-in data, including progress photos, body measurements, mood and energy ratings, and free-text notes
• AI coaching conversation history

Wearable data (collected only where you connect a third-party service)

• Heart rate, heart rate variability, sleep, recovery, workouts, daily activity and other metrics provided by integrated wearable platforms — see Section 15

Technical data

• IP address
• Browser type and version
• Device and operating system information
• Server access logs and timestamps
• Approximate location derived from IP address

Payment data (when subscriptions launch)

We do not store payment card details. Payments are processed by Stripe, who collect and process card data directly under their own privacy policy. We receive only a subscription status, transaction reference, and the last four digits of the card.

Communications data

• Records of correspondence between you and us (e.g. support emails)

4. How we use your data

We use your personal data for the following purposes:

• To create and manage your account
• To provide the coaching, tracking, and analytics features of the Service
• To generate personalised training, nutrition, recovery, and habit recommendations using artificial intelligence
• To enable wearable integrations you choose to connect
• To send transactional emails (account confirmations, password resets, important service updates)
• To send marketing emails about new features, content, and offers, only where you have opted in and from which you may unsubscribe at any time
• To process subscription payments (when subscriptions launch)
• To detect, prevent, and respond to security incidents, fraud, and abuse
• To improve the Service, including by analysing aggregated and anonymised usage patterns
• To respond to your enquiries and provide customer support
• To comply with our legal, regulatory, and tax obligations

5. Lawful bases for processing

We rely on the following lawful bases under Article 6 UK GDPR:

• Performance of a contract — to provide the Service you have signed up for (account management, core features, payment processing)
• Consent — for marketing communications and for processing of special category (health) data (see Section 6)
• Legitimate interests — for security, fraud prevention, service improvement, and analytics. We have assessed that these interests are not overridden by your rights and freedoms.
• Legal obligation — for accounting, tax, and regulatory record-keeping

You have the right to withdraw consent at any time where we rely on consent (see Section 10).

6. Special category data

Much of the data you provide to Physique Pilot — including body weight, body composition, nutrition, training history, recovery metrics, progress photos, and wearable data — constitutes "data concerning health" under Article 9 UK GDPR. This is treated as a special category of personal data with heightened protections.

We process this data only on the basis of your explicit consent, given when you create your account and complete onboarding. You may withdraw this consent at any time by deleting your account in Settings or by contacting us. Withdrawal of consent will not affect the lawfulness of processing carried out before withdrawal.

Menstrual cycle tracking (optional). If you choose to enable cycle tracking, we collect your typical cycle length and the dates you tell us your period started. This is special category health data, collected only with your separate, explicit consent at the point you turn the feature on. We use it for a single purpose: interpreting your weekly results fairly — recognising that hormonal water retention can temporarily mask fat loss and that the associated drop is water, not fat — and easing training intensity slightly in the premenstrual window. It is stored separately from your general profile, is never shared or used for any other purpose, and you can turn the feature off and permanently delete all cycle data at any time from Settings → Body & Goal. Cycle tracking is entirely optional and off unless you enable it.

7. Who we share your data with

We do not sell your personal data. We share your data only with the following categories of recipients, each of whom processes data on our behalf under appropriate contractual safeguards:

We may also disclose your data:

• Where required by law, court order, or regulatory request
• Where necessary to protect our rights, property, or safety, or the rights, property, or safety of our users or others
• In connection with a business transaction such as a merger, acquisition, or sale of assets, in which case we will notify you in advance

OpenAI and AI training: We use OpenAI's API (currently models in the GPT-5 family) to generate AI coaching responses. Per OpenAI's API data usage policy, data sent to the API is not used to train OpenAI's models. Data is retained by OpenAI for up to 30 days for abuse monitoring and then deleted, unless longer retention is required by law.

8. International transfers

Some of our service providers process data outside the UK, including in the United States and the European Economic Area. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, including:

• The UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses
• Reliance on adequacy decisions where applicable (e.g. the UK–US Data Bridge for transfers to certified US recipients)
• Contractual protections requiring providers to apply UK GDPR-equivalent standards

You may request further information about specific transfer mechanisms by contacting us.

9. How long we keep your data

We retain your personal data only for as long as necessary for the purposes set out in this Policy:

• Account and profile data — for the duration of your account. Deleting your account erases it immediately and permanently — there is no recovery period
• Health and fitness data — for the duration of your account, then erased immediately and permanently when you delete your account
• Progress photos — for the duration of your account, then erased immediately and permanently when you delete your account
• AI coaching conversation history — for the duration of your account, then erased immediately and permanently when you delete your account
• Server logs and security data — up to 12 months
• Payment and tax records — up to 7 years after the end of the relevant accounting period, as required by HMRC
• Marketing consent records — until you withdraw consent, plus 2 years to evidence the prior consent
• Terms, safety, and AI-processing consent records — timestamps and version of the terms you accepted, retained for the duration of your account and up to 2 years after deletion to evidence the consent

Backups containing your data may persist for up to 90 days after primary deletion before being overwritten in the normal course of backup rotation.

10. Your rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access — to obtain a copy of the personal data we hold about you
• Right to rectification — to have inaccurate or incomplete data corrected
• Right to erasure ("right to be forgotten") — to request deletion of your data. You can delete your account and associated data directly from the Settings page of the app.
• Right to restrict processing — to ask us to limit how we use your data in certain circumstances
• Right to data portability — to receive your data in a structured, machine-readable format
• Right to object — to processing based on legitimate interests, and to direct marketing
• Right to withdraw consent — at any time, where processing is based on consent
• Rights related to automated decision-making — you have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Our AI coaching is informational and does not produce such effects.

To exercise any of these rights, contact us at coach@physiquepilot.com. We will respond within one month, though this may be extended by a further two months for complex requests, in which case we will inform you of the reason. We do not charge a fee for exercising your rights, except where requests are manifestly unfounded or excessive.

11. Cookies and tracking

We use only essential cookies and similar technologies necessary to deliver the Service — for example, to keep you logged in and to remember your preferences. These cookies do not require your consent under the UK Privacy and Electronic Communications Regulations.

We use a privacy-friendly product analytics tool (PostHog, EU region) to understand how the Service is used and to improve it. It is configured cookieless — it does not set tracking cookies and does not store identifiers on your device between sessions — so no consent is required for it. The data collected is aggregated, anonymous usage information (such as page views and feature interactions) and is not used for advertising.

We also use the TikTok Pixel, an advertising measurement tool, so we can see whether our TikTok ads actually lead to sign-ups. It sets first-party cookies (_ttp and _tt_enable_cookie) and sends TikTok a record of certain actions — viewing a page, starting registration, starting a checkout, starting a trial — together with your IP address and browser details. TikTok acts as an independent controller for this data and may use it to measure and target advertising.

This one is entirely up to you. We ask before we load it, and it is not placed on your device unless you accept. Declining costs you nothing — every part of the Service works the same either way. You can change your mind at any time using the button below, and we will re-ask you at least once a year in any case. Withdrawing takes effect immediately and deletes the cookie.

12. Marketing communications

Where you have opted in, we may send you marketing emails about new features, product updates, training and nutrition content, and special offers. You can unsubscribe at any time by clicking the "unsubscribe" link at the bottom of any marketing email, or by emailing us. Unsubscribing from marketing does not affect transactional emails (account, password, payment).

You can also join our mailing list from our homepage without creating an account. In that case the only personal data we hold is your email address, processed on the basis of your consent and held by our email provider (Resend) until you unsubscribe. It is not linked to any account, is not used for anything other than sending you those updates, and is never sold or shared. Every such email carries a one-click unsubscribe link, which removes your address from the list.

13. Security

We take the security of your data seriously and implement appropriate technical and organisational measures to protect it, including:

• Encryption of data in transit (TLS) and at rest (provider-managed)
• Hashed password storage
• Role-based access controls on our systems
• Regular security reviews and dependency updates
• Logging and monitoring for unauthorised access

No system is 100% secure. In the unlikely event of a personal data breach affecting your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware, and notify you without undue delay where the breach is likely to result in a high risk to you.

14. Children

Physique Pilot is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete the relevant data without undue delay.

15. Wearable integrations

Physique Pilot can connect to the following third-party wearable and health platforms. Each one is optional, off until you connect it, and read-only:

• Oura Ring (Oura Health Oy)
• Whoop (Whoop, Inc.)
• Apple HealthKit (Apple Inc.)

When you connect one of these services, we receive, with your authorisation, data including body weight, steps, heart rate, resting heart rate, heart rate variability, sleep, recovery, workouts, daily activity, and similar metrics. This data is processed in accordance with this Privacy Policy and the privacy policy of the third-party provider. You may disconnect any integration at any time from the Settings page.

16. Changes to this Privacy Policy

We may update this Policy from time to time to reflect changes in our practices, the Service, or the law. The "Last Updated" date at the top will indicate when changes were made. Where changes are material, we will notify you by email and/or via the app before they take effect.

17. Complaints

If you are not satisfied with how we have handled your data, you may lodge a complaint with the UK Information Commissioner's Office:

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

We would, however, appreciate the opportunity to address your concerns first — please contact us at coach@physiquepilot.com.

18. Contact us

For any questions, requests, or concerns regarding this Privacy Policy or your personal data:

Walsham Group Limited
192 Maldon Road
Colchester
Essex CO3 3AZ
United Kingdom
Email: coach@physiquepilot.com