Privacy Policy

1. Who we are

Symbiote Fitness Ltd (company number 16649354) is a company registered in England and Wales. Our registered office is 3rd Floor, 86-90 Paul Street, London, England, EC2A 4NE.

For account, platform security, billing, product operation, and direct communications, Symbiote Fitness Ltd is the controller of your personal data. When a coach uses Symbiote to provide services to clients, the coach is normally the controller of the client's coaching data and Symbiote acts as the coach's processor, except where we process that data for our own legal, security, or billing purposes.

Privacy questions, rights requests, and general support requests can be sent to support@symbiotefitness.com. We have appointed a Data Protection Officer; mark your message for the DPO to contact them through this address. Our separate Consumer Health Data Privacy Policy is available at /consumer-health-privacy.

2. Information we collect

Depending on whether you are a coach, client, visitor, or administrator, we may collect:

• Account and identity data, including name, email address, hashed or provider-managed credentials, date of birth, age, optional phone number, business name, coach slug, and profile image.
• Coaching and health data, including height, weight, body measurements, goals, activity, workout records, nutrition and meal records, supplements, allergies, injuries, health conditions you choose to disclose, check-ins, progress photos, physique analysis, and other information entered in chat or uploaded documents.
• Coach content, including methodology, personality settings, knowledge-base documents, programs, client instructions, and AI configuration.
• Communications, including app chat, support messages, AI conversations, notification preferences, and delivery records.
• Billing and commercial data, including subscription status, invoices, transaction identifiers, Stripe customer and connected-account identifiers, and limited payment-method details such as card brand and last four digits. We do not store full card numbers.
• Coach referral data, including explicitly submitted invitation codes, referral relationships, reward status, founder review evidence and invoice-credit transaction references. Coaches see only their own invitation and anonymized referral outcomes, not another coach's private profile or payment evidence. There is no referral tracking cookie or browser fingerprinting.
• Technical and security data, including IP address, device and browser information, request identifiers, authentication events, logs, rate-limit records, and diagnostic information.
• Usage and product data, including feature usage, AI token or message consumption, storage use, and service performance.

3. How we collect information

We collect information directly from you, from your coach or client where they are authorised to provide it, automatically when you use the service, and from service providers such as AWS Cognito and Stripe. Coaches must have a lawful basis and provide appropriate privacy information before entering or uploading client information.

4. Why we use information and our lawful bases

We use personal data only where a lawful basis applies:

• To create accounts, provide the platform, deliver coaching features, process subscriptions, and respond to support requests: performance of a contract or steps requested before entering a contract.
• To secure the service, prevent fraud and abuse, maintain logs, improve reliability, measure capacity, and manage our business: our legitimate interests, balanced against your rights.
• To keep tax, accounting, company, consumer, and payment records, respond to lawful requests, and protect legal rights: compliance with legal obligations and legitimate interests.
• To send optional marketing or use non-essential tracking technologies: consent, where required. You can withdraw consent at any time.
• To process health and other special-category data for AI coaching and tracking: explicit consent under UK GDPR Article 9(2)(a), in addition to the applicable Article 6 basis.

We do not use health data, private coach knowledge, or client conversations to train public foundation models. We may use de-identified or aggregated information that does not identify an individual to operate, secure, and improve the service.

5. Health data and explicit consent

Fitness and coaching information can reveal health data and is treated as special-category personal data. We ask clients for explicit health-data consent during signup before health features and the AI coach become available.

You can withdraw health-data consent in account settings. Withdrawal does not affect processing that was lawful before withdrawal. When consent is withdrawn, health-dependent features are blocked and new AI health processing stops. You can later provide fresh consent. Account deletion and data-erasure requests are separate controls.

Do not submit another person's health information unless you are authorised to do so and have provided all required privacy information. Symbiote is not a medical service and does not make automated medical diagnoses.

6. AI processing and automated decisions

The service uses AI to generate coaching responses, analyse user-provided content, retrieve coach methodology and knowledge, and suggest or perform requested logging actions. AI output can be incomplete or wrong and should be reviewed before relying on it.

We do not use solely automated decisions that produce legal or similarly significant effects on you. Coaches remain responsible for their professional relationship, methodology, client instructions, and decisions. Safety flags or account restrictions may be generated automatically, but material account decisions can be reviewed by a person on request.

7. Who receives information

We disclose only what is reasonably necessary to:

• Your coach or authorised coaching business, for delivery of the service to you.
• Amazon Web Services, for hosting, databases, storage, authentication, email, monitoring, transcription, and Bedrock or AgentCore AI services.
• OpenAI, for the AI and voice interactions that use OpenAI models.
• Pinecone, for coach-scoped vector storage and retrieval of knowledge content.
• Cohere through AWS Bedrock, for search reranking where used.
• Stripe and Stripe Connect, for platform and coach-client payments, subscriptions, fraud prevention, and payouts.
• Open Food Facts, for barcode product lookup and product images. Our server sends the barcode number to its product database; it does not send your account credentials, private coaching content or uploaded photos. If a product image is shown, your browser requests it directly from images.openfoodfacts.org or static.openfoodfacts.org. That request exposes your IP address, browser and device headers, and the requested product-image path to that service. We use no-referrer on these image requests to suppress the referring page address; this does not hide your IP address or other request headers. Manual food entry remains available without a barcode lookup or product-image request.
• Professional advisers, insurers, auditors, regulators, courts, law enforcement, or a buyer of the business where legally permitted and necessary.

Our current subprocessors are listed in the Subprocessor List. Sentry error monitoring, WhatsApp and custom voice cloning are not enabled for initial launch; we will update the list and applicable notices before enabling those providers. AWS remains our operational logging and monitoring provider.

8. International transfers

Our primary AWS application and database region is us-east-1 in the United States. Our Pinecone knowledge index is also configured in that region. Bedrock models can use US geographic cross-region inference, so an AI request may be processed in another US AWS region. CloudFront delivers website content through a global edge network. Direct OpenAI API processing is separate from our AWS region and must not be understood as EU-only or single-region processing.

Some providers process information outside the United Kingdom. Where UK personal data is transferred internationally, we use an adequacy regulation, the UK International Data Transfer Agreement or UK Addendum to the EU standard contractual clauses, or another lawful safeguard, together with supplementary security measures where appropriate. You can request information about the relevant safeguards by contacting support@symbiotefitness.com.

9. Retention

We keep personal data only for as long as necessary for the stated purposes:

• Active account, coaching, health, chat, and uploaded content: while the account or coaching relationship remains active, unless it is deleted sooner. Withdrawing health-data consent stops new consent-based health processing and restricts health features, but does not itself erase historical records; erasure can be requested separately.
• Closed account data and erasure requests: we assess and respond within the deadline under applicable law, measured from the request rather than from completion of an internal cleanup. Identity checks, any permitted extension, delayed backup deletion and lawful retention exceptions are explained where applicable. Account-deletion controls may include a cancellation grace period; contact support if you want erasure without that optional delay or want to delete only particular information.
• Encrypted database backups and point-in-time recovery data: normally retained for up to 35 days. A protected recovery snapshot may be retained longer when required for disaster recovery, an incident, or legal obligations, with access restricted.
• Production security and application logs: normally retained for 90 days. Development logs are normally retained for 30 days. Relevant records may be retained longer to investigate an incident or establish legal claims.
• Billing, tax, and accounting records: normally 6 years after the relevant financial year or transaction.
• Referral reward and anti-abuse records: retained where necessary to administer the limited pilot, prevent duplicate rewards and retain the related financial audit. Account deletion removes profile links and free-text review notes where applicable; reserved credits must be reconciled before deletion. Limited identity hashes and reward transaction references may remain with restricted access for these purposes.
• Consent and legal records: for as long as needed to demonstrate compliance and resolve claims. New acceptance and health-permission changes record the applicable document version, content fingerprints and the affirmative action or withdrawal; this does not reconstruct consent evidence for earlier accounts.
• AI provider records: not using your data to train a public model does not mean that the provider retains no data. For example, OpenAI API abuse-monitoring logs may include inputs and outputs for up to 30 days by default, with limited exceptions under its terms. Endpoint-specific storage and any separately approved retention controls also apply. We do not represent the service as having zero provider retention.

Deletion may be delayed where data is required for fraud prevention, legal obligations, disputes, or the protection of rights. We restrict use during any required retention period.

10. Security

We use measures appropriate to the risk, including encryption in transit and at rest, managed authentication, access controls, tenant-scoped database and storage access, private storage, rate limits, web-application firewall rules, logging, backups, monitoring, and incident-response procedures. No internet service can guarantee absolute security. Keep credentials confidential and report suspected compromise to support@symbiotefitness.com.

11. Your rights

Subject to applicable law, you may ask us to access, correct, erase, restrict, or provide a portable copy of your personal data; object to processing based on legitimate interests or direct marketing; withdraw consent; and ask for human review of qualifying automated decisions.

Send requests to support@symbiotefitness.com. We may need to verify your identity. Where a coach controls your data, we may refer the request to that coach and assist them as processor. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk, although we would welcome the opportunity to address your concern first.

Where EU GDPR or another local privacy law applies, its rights and protections also apply, including the right to complain to the competent local supervisory authority where provided by law. Our UK contact does not restrict those rights. US consumer health-data choices and our appeal contact are described separately at /consumer-health-privacy. English governing-law wording does not remove mandatory privacy rights available to you.

12. Children

The service is for people aged 18 or over. We do not knowingly permit children to create accounts or submit health data. Contact us if you believe a child has provided data so we can investigate and delete it where appropriate.

13. Cookies and communications

Our Cookie and Tracking Policy explains browser storage. Transactional messages about authentication, billing, safety, service operation, and account changes are necessary service communications. Optional marketing and proactive email preferences can be changed using account settings or an unsubscribe link, where available.

14. Changes

We may update this policy when the service, providers, or law changes. We will publish the new date and give additional notice where a change materially affects your rights or requires fresh consent.