Privacy Policy

1. Controller and contact

The controller is Craig Perry Clifton, trading as NexusFit, at Unit 1 Galley Lane Farm, Galley Lane, Gt Brickhill, MK17 9AA, United Kingdom. Contact fitness@nexusfit.co.uk for privacy questions, requests and complaints. NexusFit decides why and how member information is used; payment and sign-in providers may also act as independent controllers for their own services.

This notice covers the NexusFit website, installable web app, member workspace, community and administrative operations. It does not describe a certified medical record system or claim that the platform has been certified GDPR compliant.

2. Information we handle

Account and contact information: name, display name, email, sign-in identifiers, confirmation and access status, address, country and mobile number. We currently request address and mobile during account completion; the necessity of these fields is being reviewed.

Health and wellness information: date of birth, gender, height, weight, target weight and other entered body measurements; goals, activity and training preferences; conditions, allergies, intolerances, medicines and blood-pressure entries; diet and ingredient preferences; dated meals, confirmed scans and portions, hydration, fasting, self-reported sleep and morning feelings; exercise sessions, routines, sets, notes and progress photographs. Health information and health inferences receive special-category protection. Dietary choices may also reveal religious beliefs. A photograph is not automatically biometric data, but may be sensitive and may reveal health information.

AI and content information: the questions and conversation history you submit, archived chats, selected profile and log context used for answers, generated plans and reviews, recipes, recipe images, food images and equipment photographs. Avoid putting another person’s personal information into a prompt or image.

Billing and business records: selected plan, tester grant and expiry, subscription/payment status, renewal dates, payment amounts, currency, invoice and payment-provider references. Payment-card collection takes place through Stripe; we do not ask you to put card numbers in NexusFit forms or chat.

Community and operational information: messages, first-name display, optional achievement posts, reports, blocks, rule acceptance, submitted creator applications or content, marketing and reminder choices, push endpoints, feedback, staff access/edit audit records, daily workspace visits and technical request information such as IP-related network data and browser/device details where processed by our providers.

3. Why information is used and the proposed lawful bases

Account provision and ordinary membership administration: contract necessity under Article 6(1)(b), limited to information actually needed to deliver the service. Optional identity/contact fields require a separately justified purpose; contract is not a justification for collecting unnecessary data.

Personalised health-based planning, health logs and AI analysis: Article 6(1)(b) for genuinely necessary service processing or Article 6(1)(a) for optional processing, together with separate explicit consent under Article 9(2)(a) for health or other special-category information. We must explain the particular purposes and recipients and give you a genuine choice. Accepting the Terms or simply filling in a health field is not our substitute for explicit consent. We do not rely on the healthcare-provider exemption merely because our staff can open a health review.

Security, fraud prevention, proportionate troubleshooting, account-access administration and moderation: legitimate interests under Article 6(1)(f), subject to a documented balancing assessment and particular attention to young members. Any special-category information needed for a legal claim requires an appropriate Article 9 condition; ordinary legitimate interests alone is not enough.

Accounting, tax, legally required records and responding to lawful regulatory requirements: legal obligation under Article 6(1)(c), with the applicable obligation identified in our records.

Optional marketing, optional badge sharing and any additional consent-based uses: consent under Article 6(1)(a), plus an Article 9 condition if health information is used or inferred. Electronic marketing also requires compliance with PECR; we will not treat an automatic opt-in flag as proof of consent. Any soft opt-in must meet all legal conditions and must not be assumed for every free account.

Necessary reminders for a requested service are distinct from promotion; we explain their content and controls. Non-essential device storage requires consent unless a specific PECR exception applies with all required safeguards.

4. AI processing and service providers

When you request an AI feature, selected information is sent to hosted AI services through Lovable AI. Current integrations use OpenAI models through that gateway. Food images, recipe images, relevant allergies and conditions, or saved fitness and health context may be sent depending on the feature. The assistant can use saved plan dates, confirmed intake, water, sleep, training and blood-pressure information to answer account-specific questions. Training review may include medicines; medicines are excluded from meal-planning prompts and that planner does not check drug interactions. Do not assume that typing health information into chat confines it to your device.

Lovable Cloud provides application hosting, account/data storage and supporting platform services. Stripe provides checkout, subscriptions, card management and invoice access. Google/Lovable sign-in and email-delivery services are used for their relevant account/communication functions. Browser push services receive routing information for opted-in notifications. Exchange-rate requests use currency codes; the application does not need to send your health profile for a currency conversion.

A verified recipient schedule must identify the actual contracted entities, processor/controller roles, locations, data categories, purposes, safeguards and retention. Before adopting this notice, we must confirm hosting regions, email delivery processors, AI provider terms, subprocessors and whether any provider uses input/output for model training or other purposes. We do not promise “never used for training”, “UK-only storage”, a fixed provider deletion window or a certification without supporting contractual evidence.

5. Staff access, internal recipe copies and sharing

Account managers and owners have account/billing access for their assigned functions. Health staff have separate access to health review records; owner status alone does not confer that clinical access. The founder role has full staff-level access, including health review. Administrative reads and edits are subject to permission checks and auditing. Operational access must be limited to a justified purpose; a broad technical permission is not permission to browse out of curiosity.

The platform copies eligible saved AI meal/recipe material into an internal staff recipe library, including source linkage and, where attached, a meal-photo reference. This is a separate retained copy, not just your personal recipe-book screen. It must be covered by the approved purpose, access restrictions, retention/deletion procedures and any required consent. Public or commercial reuse of personal images or health-linked information is not covered merely by saving a recipe.

Other members can see your community posts and first-name display. If you opt in to achievement sharing, the community sees your first name, achievement and date; not the underlying weight figures or private progress photos. Even a badge can reveal or imply health progress. You control whether to share it. Public social sharing should be limited to content you approve; posting publicly can allow others to copy it beyond our control.

We may disclose limited information when necessary to comply with law, protect rights or handle a dispute, subject to the applicable legal basis. We do not describe a private account as invisible to authorised staff, service providers or a lawful investigation.

6. Children, profiling and automated results

Membership is 16+. People aged 16 and 17 remain children for relevant UK data-protection and online-safety duties. We must apply age-appropriate information, high privacy defaults and proportionate safeguards, and restrict adult-only personalised calculation/review features. We do not intentionally offer accounts to under-16s; contact us if you believe one has been created.

NexusFit calculates targets and produces AI suggestions using your entered profile and logs. These are automated analyses and may amount to profiling; they are not independently observed health measurements. Payment status and staff/tester grants also influence feature access. Where a solely automated decision has legal or similarly significant effects, applicable UK GDPR safeguards include information, a way to make representations, human intervention and contesting the decision; additional restrictions apply when special-category data is involved. You may contact us to query a result or access decision. A human review of a complaint does not mean an AI recommendation is clinically validated.

7. Retention, devices and your rights

Information is retained only as justified by its purpose and our approved retention schedule. Cancelling a subscription or suspending access does not automatically erase your account, logs, photos, assistant archives or internal recipe copies. The Data Retention Policy explains the proposed handling and separate legal/operational exceptions. Any proposed deletion deadline must be supported by a working process before we promise it.

Your device may retain a session, preferences, offline Gym Log records, recovery data, photographs awaiting sync and cached app assets. Use a protected personal device, sign out after shared-device use and consider clearing site data after syncing. Local data may remain if you cannot sign out or if storage removal fails.

Depending on the circumstances, you have rights to access, rectification, erasure, restriction, data portability and objection, and to withdraw consent without affecting processing already lawfully carried out. Withdrawal may prevent a health-dependent feature from working, but must not require loss of unrelated features without justification. Exporting Gym Log or a plan PDF is not a complete response to an access request. You can request your information through fitness@nexusfit.co.uk or by post; an in-app tool is not required to exercise a legal right.

We respond without undue delay and normally within one month, subject to lawful identity checks, clarification rules and permitted extensions which we explain. We do not routinely charge for requests. We protect third-party information and apply exemptions only where lawful.

8. Transfers, safeguards and complaints

Providers may process information outside the UK. Before making a restricted transfer, we must identify a lawful transfer mechanism, such as applicable adequacy regulations or an approved UK IDTA/Addendum, and complete the required transfer assessment. Do not interpret a UK correspondence address as a promise that all data stays in the UK. Request details through our privacy contact.

The application uses account-scoped permissions, private storage paths, limited photo-link lifetimes and staff audit functions. These measures reduce certain risks but are not a guarantee against a breach. Provider encryption, backup coverage, security certifications and incident procedures require separate verification.

Raise a privacy complaint through fitness@nexusfit.co.uk or our correspondence address. We will acknowledge it within 30 days, investigate appropriately and communicate the outcome. You may complain to the Information Commissioner’s Office at ico.org.uk and do not have to exhaust our process first.

Approved policy changes will have a version and effective date. If the purpose of sensitive processing changes, we will provide the appropriate new information and obtain fresh consent where needed; editing this notice alone is not fresh consent.

Your explicit choices in NexusFit

Before collecting or processing your member health information, NexusFit asks for separate explicit consent describing measurements, conditions, allergies, medication selections, meals, activity, sleep, blood pressure, photos, AI processing and authorised health-staff review. We privately record the consent wording, version, decision and timestamp. Withdraw or restore consent under Account & billing → Privacy & consent. Withdrawal stops consent-dependent access, new tracking, AI and plan reminders. Historical records are not automatically erased; ask fitness@nexusfit.co.uk for erasure or other privacy rights. Processing already lawfully performed is not reversed. Previously issued photo links may remain valid until expiry; provider retention is subject to their verified terms. Offline device access requires a recent consent check and cannot learn of withdrawal on another device while disconnected. Marketing is optional, unchecked by default and recorded separately; legacy automatic opt-ins without affirmative evidence have been disabled.