Terms, Privacy & Policies

Last updated: 31 August 2026

This policy explains what personal data Evolvance collects, why, who it is shared with, and your rights. It describes how the platform actually works, in plain terms. We are committed to complying with the UK GDPR and the Data Protection Act 2018, and we design to the standards of the ICO's Age Appropriate Design Code because under-18s use Evolvance.

1. Who we are

The data controller is Evolvance Fitness Ltd, registered in England and Wales (company number 17242515), 66 Paul Street, London, EC2A 4NA, United Kingdom. Contact: team@evolvancefitness.com or the in-app Support section.

2. What we collect

•Account and profile: name, email address, username, date of birth (the backbone of our age gates), optional bio, town/city (free text — we never collect GPS location), profile photo, biological sex (optional), and for coaches: qualifications, specialty and professional details.

•Training and activity data: your training logs (exercises, weights, RPE, sessions).

•Health data (special category data): bodyweight and body measurements, sleep records, recovery and readiness check-ins (including heart-rate variability and resting heart rate where you log or sync them), weekly check-ins (which may include injury notes and free-text reflections), nutrition logs and food diaries, and progress photos.

•Cycle tracking (adults only): users 18+ may choose to use menstrual cycle tracking, recording period days, flow, symptoms, pain, energy, and optional private medication notes. This is the most protected data in the app: the feature is hidden from anyone we know to be under 18, anyone whose age is unknown must confirm their date of birth before logging anything, it is not visible to coaches through any screen in the app, and it is hidden from Evolvance administrators by default — accessible only through a separate override process that requires a recorded reason (such as a safeguarding concern or a support request you initiated) and is logged.

•Content you create: messages (text, photos, videos, voice notes), social posts and stories, comments, videos you submit for technique review, and files you attach to support tickets.

•Payment and earnings records: what you bought, when, for how much, Stripe reference IDs, and — for coaches — earnings and payout records. We also record that you asked at checkout for your subscription to start immediately, when you agreed, and the exact wording you were shown. We never store card numbers — cards are entered into fields controlled by Stripe. Where an adult buys a subscription for an under-18 athlete, we record which adult is paying for it on that athlete's subscription.

•Support and diagnostics: support tickets include your message, any attachments, and technical details captured at that moment (the screen you were on, device and browser type, screen size, recent screens visited as paths only, and recent app errors). We also keep crash reports in our own systems.

•Usage records: basic records of which screens are opened, used to understand which parts of the app are used.

•Device data: if you enable push notifications, we store the push address and keys for your device.

•What we do not collect: precise location (GPS training files you import are processed on your device; coordinates are discarded and only totals such as distance and duration are kept, along with the file's name), your contacts, advertising identifiers.

2A. Data we receive from others

If you connect Oura, WHOOP, Fitbit, or Strava, we receive data from that provider under the permissions you grant there: sleep and recovery data, and from Strava your activities (including activities marked private on Strava, because its permission covers all activities) — of which we keep sport, date, duration, distance, average heart rate and elevation. We record when you consented and to what scope, and you can disconnect at any time in settings, which stops us receiving new data from that provider.

If a young person names you as their parent or guardian. An under-18 athlete can give us your name and email address in order to invite you — to supervise a coach conversation, to accompany them into a club group chat, to decide a coach's request for access to their training data, or so that you can buy an Evolvance+ subscription for them, which they are not permitted to buy themselves. We then email you at that address. We do this on the basis of our legitimate interests in keeping under-18s safe on the platform and in providing a lawful route for an adult to pay, and you can simply ignore the email: an invitation on its own gives the young person nothing and changes nothing about your data. If you do go on to register as their guardian of record, or to buy a subscription for them, then you will see that athlete's email address, and they will see yours on the subscription record so they know who is paying for and controls it. You can ask us to delete your details at any time at team@evolvancefitness.com. Apart from this, we do not ask you for other people's details. (Between existing users, some features naturally record both parties — an invitation to co-build a training block, or a report about another user — as described elsewhere in this policy.)

3. Why we process it (legal bases)

•To provide the Service you signed up for — contract.

•Health and fitness data — your explicit consent, collected separately for five categories (wellbeing check-ins, sleep and biometrics, body composition, nutrition, progress photos) with the exact wording you agreed to recorded. Cycle tracking is consented to by adults choosing to switch the feature on and use it; switching it off and deleting your entries withdraws that consent. Training logs and check-ins you submit to a coach are processed to deliver the coaching you asked for.

•Safety features for under-18s (age gates, guardian supervision, retention of anonymised safety reports) — the substantial public interest condition for safeguarding children and individuals at risk (Data Protection Act 2018, Schedule 1, Part 2, paragraph 18). We maintain an appropriate policy document for this processing, available on request.

•Payments and fraud prevention — contract and legal obligation. The record of what you agreed to at checkout about your subscription starting immediately is kept because consumer law requires us to be able to show it.

•Contacting an adult a young person has named as their parent or guardian — legitimate interests (see section 2A), balanced against that adult's interests, which is why an invitation asks rather than assumes and can simply be ignored.

•Fixing crashes and improving the Service — legitimate interests, engineered to minimise data (see the Sentry entry in section 5).

4. Who sees your data inside Evolvance

•Your coach — only what you grant. An approved coaching relationship by itself lets a coach programme for you; it does not open your private data. Coaches must request access per category (recovery, sleep, bodyweight, progress photos, measurements, nutrition, training logs, check-ins, injury notes), you can approve some and refuse others, history from before the coaching relationship needs a separate grant, and you can revoke at any time. Weekly check-ins you submit to your coach are shared with that coach by design. Cycle data is not accessible to coaches through any screen in the app. Coaches are never shown your date of birth — only your age, and only to operate the safety gates.

•Guardians: a supervising adult confirmed into an under-18's coach chat can read that conversation (this is disclosed inside the chat). Where an under-18 belongs to a sports club that runs its team chat on Evolvance, their confirmed guardian is also added to those club rooms and can read what is said there, including messages from other members. The same applies to any private group chat an under-18 takes part in: their guardian of record has to be a member of it before anyone can post, and can therefore read everything said in it, including messages from other members. Guardians cannot see the athlete's training data, logs, or other conversations unless separately granted as part of consent they give on the minor's behalf — and any such consent is granted only after the guardian verifies through an emailed link, never from a form filled in inside the app.

•Other users: your profile, posts, stories, and coach reviews are visible to the community. Leaderboards are strictly opt-in and off by default. If you invite another user to collaborate on a draft training block (or accept such an invitation), each of you sees the other's name and email address on the invitation, along with the block's name and any note the sender adds. Collaboration invitations are normally between adults: an under-18 (or a user whose age is unknown) can only collaborate with a coach they already have an approved coaching relationship with, and only once a guardian of record exists.

•Evolvance staff: administrators can access operational data to run the platform. Cycle-tracking data is hidden from administrators by default and reachable only through a recorded-reason override process (see section 2). As with any online service, a small number of people with database-level access at our platform provider could technically reach stored data; that access is restricted.

5. Who we share data with (processors and recipients)

•Base44 — our platform provider (hosting, database, authentication, file storage, and the gateway through which our AI features reach model providers). All platform data is processed on Base44 infrastructure.

•Stripe — payment processing. Receives your name, email, and payment details at checkout.

•AI model providers — the in-app AI features in section 6 are routed via Base44; the automated assistant that reviews support tickets runs outside the app and reaches its model provider (Anthropic) directly. Both involve large US-based model providers.

•Sentry — crash and error reporting on EU (Germany) servers, configured to minimise data: we do not send names, emails or message content, session replay is off, and identifiers are redacted before a report leaves your device, with only an internal account identifier attached. Sentry is a US company; see section 5A.

•Google (Gmail) — sends our support replies. All other transactional email — guardian invitations, order confirmations, new-message alerts (which include a short preview of the message), session assignments, and weekly progress emails containing summary training, nutrition and bodyweight figures — is sent through Base44's email service.

•Apple, Google, and Mozilla push services — deliver notifications. Where we use web push, notification content is encrypted from our servers to your device using the Web Push standard, so these services see only an encrypted payload and a device address.

•Oura, WHOOP, Fitbit, Strava — only if you connect them (section 2A).

•Open Food Facts — receives barcodes you scan and food names you search (requests carry your device's IP address, as all internet requests do).

•Embedded content — some screens embed third-party content: YouTube exercise demonstration videos, Vimeo videos, Google Fonts, and stock imagery from Unsplash. When that content loads, those providers receive your IP address and may set their own cookies (see the Cookie Policy). We do not receive or use any data from them.

We do not sell your data. We do not share it with advertisers. We use no advertising or tracking SDKs.

5A. Where your data goes (international transfers)

Evolvance is based in the UK. Some of the organisations above are based outside the UK, principally in the United States and the European Economic Area. Where data goes to a country covered by UK adequacy regulations (including the EEA), we rely on those regulations. For transfers to the United States we rely on the UK Extension to the EU–US Data Privacy Framework where the recipient is certified, or otherwise on the UK International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum. You can request details of the safeguards applying to any transfer at team@evolvancefitness.com.

6. AI features — exactly what they see

When you use Vance (the in-app assistant), your message is sent to a third-party AI model together with context including your name, email, current training block names, latest recovery score, and recent sessions (for coaches, also business figures like client counts and earnings; for Evolvance administrators, also operational summaries that can include other users' names, such as pending coach applications and recent support activity). AI inputs are therefore not anonymised — treat Vance like a member of staff, not a diary. Messages touching injuries, medication, eating concerns, or involving under-18s are routed to the most capable model with strict safety instructions. The nutrition label scanner sends the label photo to a vision model. The coaching block builder shares programme context including the client's email. Support tickets are also reviewed by an automated AI assistant that drafts replies and diagnoses technical problems; sensitive matters are escalated to a person. Each time your account uses one of these AI features we keep a usage record (which feature and when, attributed to your account email) for cost and abuse monitoring; this record contains no message content. Aside from these features, nothing sends your data to AI models. Technique video reviews are performed by human coaches, not AI.

7. How long we keep data, and deletion

Your data is retained while your account is active. You can delete individual records (logs, posts, photos) at any time, and you can delete your whole account yourself, immediately, from Profile → Delete Account — no email or waiting period required. One exception: a coach with active athletes must first hand them over or remove them (the tools are in Coach Hub) so no athlete is stranded mid-programme. Deletion permanently removes your profile, health and fitness logs, cycle data, nutrition diary, progress photos, posts, stories, push subscriptions, and consents from the app. Records that involve another person are kept for them but permanently stripped of your name and email (messages you sent them; readiness entries shared with a coach; a coach's income records; safety reports, retained anonymised so that deleting an account cannot erase a misconduct trail). Any active subscription is cancelled as part of deletion so you cannot keep being billed. Residual copies — for example in backups — may persist for a limited period before being removed. Payment and tax records are kept for as long as the law requires (currently up to six years); where we no longer need to identify you in them, we remove your personal details. If you simply stop using Evolvance without deleting your account, your data stays until you delete it — though we may delete long-inactive accounts, and we will email you before we do.

8. Your rights

You have the right to access your data, correct it, delete it (see above — you can do most of this yourself), restrict or object to processing, withdraw consent, and data portability. Withdrawing a health-data consent is recorded immediately and we stop relying on it; to stop collection you should also switch the relevant feature off in its own settings. Contact Support or team@evolvancefitness.com; we respond within one month, and will tell you if a complex request needs up to two further months. If you're unhappy with how we've handled your data, you can complain to us the same way — we acknowledge data-protection complaints within 30 days and respond without undue delay, as the Data (Use and Access) Act 2025 requires. You also have the right to complain to the Information Commissioner's Office (ico.org.uk), though we'd appreciate the chance to resolve concerns first.

8A. Do you have to give us this data?

Your name, email and date of birth are required to open an account — we cannot provide the Service or run our age-safety features without them. Everything else is optional: health, fitness, nutrition, cycle and wearable data are only collected if you choose to use those features, and the only consequence of not providing them is that those features won't work.

8B. Automated decisions and profiling

Automated checks apply our age gates — for example locking age-restricted features and refusing purchases where the account holder is under 18. These are simple rules based on the date of birth on your account; if yours is recorded wrongly, contact Support and a person will review it. Your training and recovery data personalises what the app shows you (readiness indicators, suggested content) — this profiling only affects what you see. Account suspensions are reviewed by a person.

9. Children's privacy

Minimum age 13, enforced by date of birth at signup, with refused under-13 attempts recorded to prevent retries. For 13–17s: purchases are blocked, cycle tracking is not available, calorie-deficit targets and thermal recovery protocols are locked, coach chats require an attested adult supervisor (Terms clause 7), leaderboards are off by default, and where age is unknown every gate fails closed — the platform assumes minor until proven adult. Coaches see a derived age only, never a date of birth.

10. Security

Access to data is controlled row-by-row per user role; privileged operations run only in server-side functions; everything travels over HTTPS; card data is never stored by us; web push content is encrypted from our servers to your device; guardian confirmation links are single-use, cryptographically random, and insufficient without a matching, adult, signed-in account; crash reports are configured to redact identifying data before they leave your device; and destroying an account requires a typed confirmation. No system is perfectly secure — if we discover a breach, we will notify the ICO where the law requires, and tell you directly if it is likely to put you at high risk.

11. Changes

We will notify you in-app of material changes to this policy. The "last updated" date above always reflects the current version.