Effective 12 May 2026
Privacy Policy
Template - please review with a qualified solicitor before commercial use. Replace items in [square brackets] with your own details.
1. Who we are
CMM Strength & Performance ("we", "us") is the data controller for personal data processed through this app. Contact: [your-email@example.com].
2. Data we collect
- Account data: name, email, password (hashed), sign-in timestamps.
- Training data: weekly check-ins, body measurements, body composition, workout sessions, exercise logs, personal records, additional activities.
- Health data (special category, GDPR Article 9): medical conditions, injuries, medications, dietary requirements, stress level, sleep quality, body photos.
- App-generated content: AI summaries of your check-ins, food diary, intake form and progress, generated using your data.
3. Lawful bases for processing
- Contract: account, training programmes and session logging are needed to provide the coaching service.
- Explicit consent (Article 9): processing of your health data - given at signup and on the intake form. You can withdraw at any time in Account Settings; if you withdraw, your account will be archived.
- Legitimate interests: service security, abuse prevention.
4. Who we share data with
We share your data only with the processors strictly needed to run the app:
- Lovable Cloud (Supabase): database, authentication, file storage. Hosted in the EU.
- Anthropic (Claude) and Google (Gemini): AI summarisation of check-ins, food diary photos and progress. Only data needed for the summary is sent.
We do not sell your data and do not use it for advertising.
5. How long we keep your data
We keep your data for as long as your account is active. If your account is archived (e.g. you stop training), we retain it for 12 months in case you return, after which it is flagged for permanent deletion. You can request earlier deletion at any time.
6. Your rights under UK/EU GDPR
- Access - get a copy of your data
- Rectification - correct inaccurate data
- Erasure - delete your account and data
- Portability - receive your data in a portable format
- Withdraw consent - for health-data processing, at any time
- Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk
You can delete your account directly in Account Settings, or contact us at [your-email@example.com] for any other request.
7. Security
Data is encrypted in transit (HTTPS) and at rest. Access is restricted to your trainer (admin) and to you. We use Row-Level Security so users can only read their own data.
8. Children
This service is for adults aged 18 and over. We do not knowingly collect data from children.
9. Changes
We may update this policy. If material changes are made we will ask you to re-consent on next sign-in.