Privacy Policy

Overview

We collect only the information we need to operate BPH Protocol, support your account, improve the programme and communicate with you.

BPH Protocol is built around personal direction, fitness, nutrition, recovery, family presence and growth. That means some information you choose to give us may relate to your habits, goals, progress, schedule, preferences, support needs and wellbeing. We use this information to provide the service and to help make the programme more relevant to you.

We do not sell your personal information. We do not use your personal information to make automated decisions that have legal or similarly significant effects on you.

Who controls your data

Grit Gyms Ltd is the controller of personal information processed through BPH Protocol, unless another organisation is clearly identified as the controller for a particular service. You can contact us at hello@bphprotocol.com.

Some third parties, such as Apple, Google, payment providers or analytics providers, may act as independent controllers for parts of their own services. Their privacy notices explain how they handle your information.

Information we collect

This may include your name, email address, account details, payment status, app usage, programme preferences, check-in responses, training goals, support messages and device or analytics information.

Account and contact information may include your name, email address, account ID, authentication details, billing status, purchase history, subscription plan, support records and communication preferences.

Programme information may include your baseline answers, goals, training preferences, nutrition and recovery habits, check-in responses, progress scores, family or presence priorities, professional or personal growth actions, and notes or messages you choose to send to us.

Technical and usage information may include device type, operating system, browser, approximate location derived from technical data, app version, pages viewed, buttons clicked, feature usage, crash logs, diagnostic data, IP address, cookie identifiers and similar analytics information.

Payment information may be processed by app stores or payment providers. We do not need to store full card details where a payment provider handles the transaction.

If you provide information about health, injuries, wellbeing or lifestyle, you should only provide information you are comfortable sharing for the purpose of receiving BPH guidance. Where this information is treated as special category data under applicable law, we process it only where we have an appropriate lawful basis and condition, such as your explicit consent or another permitted basis.

How we use information

We use information to provide the service, personalise your protocol, process payments, send service messages, respond to support requests, monitor performance, prevent misuse and improve BPH Protocol.

We may use your information to create and maintain your account, deliver the 60-day protocol, personalise prompts and check-ins, provide messaging or video support, manage subscriptions, verify purchases, send operational notices, provide customer service, understand which parts of the service are useful, troubleshoot technical issues and keep the service secure.

We may also use aggregated or anonymised information to understand trends, improve the programme, develop new features, assess performance and communicate high-level insights. Aggregated or anonymised information does not identify you.

Where you opt in to marketing, we may send updates about BPH Protocol, related services, offers, content or events. You can unsubscribe from marketing at any time.

Legal bases

Where UK GDPR applies, we rely on contract, legitimate interests, consent where required, and legal obligations depending on the processing activity.

Contract is used where processing is needed to provide BPH Protocol, manage your account, deliver paid features, process purchases, provide support and communicate essential service information.

Legitimate interests may apply where we improve the service, secure our systems, prevent misuse, respond to enquiries, understand business performance, manage customer relationships and maintain records, provided those interests are not overridden by your rights and freedoms.

Consent may apply to optional marketing, non-essential cookies, certain analytics, or health and wellbeing information where explicit consent is required. You can withdraw consent at any time, although this will not affect processing already carried out before withdrawal.

Legal obligation may apply where we need to keep tax records, respond to lawful requests, comply with app store or payment rules, or meet legal and regulatory obligations.

Sharing

We may share information with trusted providers who help us run the service, including hosting, analytics, payment, customer support and app store platforms. We do not sell your personal information.

Providers may include website and app hosting, cloud infrastructure, database services, analytics tools, email delivery, customer support, scheduling, video call services, payment processors, app stores, security tools and professional advisers.

We require service providers to handle information securely and only for the purposes they provide services to us, unless they act as independent controllers under their own terms and privacy notices.

We may disclose information if required by law, court order, regulator, law enforcement request, legal claim, business transfer, merger, acquisition, restructuring, or to protect the rights, safety and security of users, the public, Grit Gyms Ltd or BPH Protocol.

International transfers

Some providers may process personal information outside the United Kingdom or your home country. Where required, we use appropriate safeguards such as adequacy decisions, standard contractual clauses, transfer risk assessments or other lawful transfer mechanisms.

App stores, analytics providers, infrastructure providers and communication platforms may also process information internationally under their own terms and privacy frameworks. You should review their notices where relevant.

Retention

We keep information for as long as needed for the purpose collected, including account, legal, tax, security and support reasons. We delete or anonymise information when it is no longer needed.

Account information is usually kept while your account is active. Programme, check-in and support information may be kept for a reasonable period so we can provide continuity, respond to questions and understand your progress. Billing and transaction records may be kept for tax, accounting and legal reasons.

Security logs, analytics records and backup copies may be retained for shorter or longer periods depending on operational, technical and legal requirements. When information is no longer needed, we delete, anonymise or securely archive it.

Your rights

You may have rights to access, correct, delete, restrict or object to processing of your personal information, and to withdraw consent where processing is based on consent.

Depending on where you live and the law that applies, you may also have the right to data portability, the right to object to direct marketing, and the right not to be subject to solely automated decisions with legal or similarly significant effects.

We may need to verify your identity before responding to a rights request. Some rights are subject to limits, exemptions or competing obligations, such as legal retention, security, fraud prevention, freedom of expression, confidential information or the rights of another person.

To exercise your rights, contact hello@bphprotocol.com.

Children

BPH Protocol is intended for adults. We do not knowingly collect personal information from children without appropriate consent or another lawful basis. If you believe a child has provided personal information to us, contact us so we can review and take appropriate action.

Security

We use practical technical and organisational measures to protect information, but no digital service can be guaranteed to be completely secure.

Measures may include access controls, account protections, secure service providers, encryption where appropriate, monitoring, backups, staff guidance and processes for reviewing suspected security issues.

You can help protect your account by using a strong password, keeping your device secure, updating your software and telling us promptly if you suspect unauthorised access.

Complaints

If you have a privacy concern, please contact us first so we can try to resolve it. If UK data protection law applies, you may also have the right to complain to the UK Information Commissioner’s Office or another relevant supervisory authority.

Changes

We may update this Privacy Policy as BPH Protocol, our app, website, support model, analytics setup or legal obligations change. The latest version will be published on this page with the updated date.

Contact

Privacy questions, requests and complaints can be sent to hello@bphprotocol.com.