GymSquire Privacy Policy

Version 2.2

Last updated: 14 September 2026

1. Who We Are

GymSquire (“GymSquire”, “we”, “our” or “us”) respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains:

• what personal information we collect;

• how and why we collect it;

• how we use, store and protect it;

• who we share it with;

• how long we retain it;

• your legal rights; and

• how you can contact us regarding your personal information.

This Privacy Policy applies whenever you access or use the GymSquire mobile application, website, AI Coach or any related services operated by GymSquire, collectively referred to as the “Services”.

GymSquire is operated as a partnership by:

Will Morse

and

Joshua Weatherall

Business correspondence address:

10 Enid Street Tonypandy CF40 2UR United Kingdom

Email:

team\@gymsquire.co.uk

GymSquire is the data controller responsible for the personal information processed through the Services.

2. Scope

This Privacy Policy applies to:

• the GymSquire mobile application;

• the GymSquire website;

• the GymSquire AI Coach;

• customer-support services;

• subscription-related services; and

• any associated online services operated by GymSquire.

This Privacy Policy does not apply to websites, applications or services operated independently by third parties that may be linked from GymSquire.

Those third parties maintain their own privacy policies, and we encourage you to read them before using their services.

3. Information We Collect

The information we collect depends on how you use GymSquire.

Some information is required to create an account, verify eligibility, provide requested features or administer a Subscription. Other information is optional and is collected only where you choose to provide it.

3.1 Information You Provide

When creating an account or using GymSquire, you may provide information including:

• your name or username;

• your email address;

• your password, which is handled using secure authentication and password-hashing methods;

• your date of birth or age;

• your sex;

• your height;

• your weight;

• your activity level;

• your fitness goals;

• your workout preferences;

• your workout history;

• your personal records;

• your custom workout plans;

• your AI chat messages;

• uploaded food photographs;

• uploaded objective-verification photographs;

• customer-support requests; and

• feedback or other information you choose to provide.

The application will indicate where information is required.

If you do not provide required information, we may be unable to create your account or provide the relevant feature.

3.2 Information Generated Through Your Use of the Services

When you use GymSquire, we may generate or store information including:

• completed workouts;

• workout statistics;

• XP earned;

• XP progression;

• objectives completed;

• achievements earned;

• exercise history;

• AI coaching history;

• nutrition recommendations;

• meal-analysis results;

• progress analytics;

• discount-reward eligibility and redemption status;

• Subscription status;

• Subscription platform;

• account status; and

• application and account settings.

This information is generated through your interaction with the Services.

3.3 Technical, Security and Usage Information

When you use the Services, GymSquire and its service providers may automatically process limited technical, security and usage information.

This may include:

• IP address;

• approximate country or region derived from an IP address;

• authentication events;

• sign-in and sign-out activity;

• password-reset events;

• email-verification events;

• dates and times of access;

• application version;

• operating-system information;

• browser, device or user-agent information;

• API-request information;

• network-request information;

• security logs;

• authentication logs;

• diagnostic information; and

• error information.

This information may be used to:

• authenticate users;

• maintain account security;

• detect fraudulent or unauthorised activity;

• prevent misuse;

• investigate technical problems;

• improve security;

• maintain service reliability; and

• protect GymSquire’s systems and users.

Technical information is not used by GymSquire to create advertising profiles.

3.4 Subscription and Purchase Information

GymSquire offers paid, auto-renewable Subscriptions through the iOS application using Apple In-App Purchase (IAP).

Apple processes the purchase, trial, renewal and payment transaction through the App Store using the payment method associated with the user’s Apple Account. Apple handles users’ payment methods and complete payment-card details under Apple’s own terms and privacy policy.

GymSquire does not receive or store your complete payment-card number, security code or other complete card credentials.

GymSquire may receive limited purchase and Subscription information from Apple, including:

• Subscription product or plan;

• purchase status;

• Subscription status;

• billing period;

• renewal status;

• expiration date;

• free-trial or promotional-offer status;

• transaction identifier;

• original transaction identifier;

• refund, revocation or cancellation status;

• purchase or renewal date;

• country, region or App Store storefront information;

• currency;

• limited pricing information; and

• information needed to validate or restore a purchase.

We use this information to:

• confirm that a Subscription has been purchased;

• provide or remove access to paid functionality;

• verify Subscription entitlement;

• administer renewals;

• restore eligible purchases;

• apply eligible promotional offers;

• administer XP discount rewards where supported by the applicable App Store subscription configuration;

• identify expired, cancelled, refunded or revoked Subscriptions;

• provide Subscription support;

• prevent fraud or misuse; and

• comply with accounting, tax and legal requirements.

Subscriptions automatically renew unless cancelled through the user’s Apple subscription settings. Where GymSquire offers a free trial, the Subscription will convert to a paid Subscription at the end of the trial unless it is cancelled in accordance with Apple’s subscription rules. Apple states that users who do not wish to be charged should cancel at least 24 hours before the free trial ends.

Apple controls App Store billing, payment collection, renewal processing and eligibility for App Store refunds. Refund requests for Apple In-App Purchases should normally be made through Apple’s Report a Problem service or Apple Support. Refund eligibility is determined by Apple in accordance with the Apple Media Services Terms and Conditions and applicable consumer law.

Users can manage or cancel App Store Subscriptions through their Apple Account subscription settings. Cancelling prevents future renewal but does not itself delete the user’s GymSquire account.

GymSquire provides a Restore Purchases function so that eligible App Store Subscription entitlements can be recovered where appropriate, for example after reinstalling the application or changing device.

Use of Apple In-App Purchase and App Store Subscriptions is also subject to Apple’s applicable App Store rules, Apple Media Services Terms and Conditions, privacy policy and subscription-management processes. Nothing in this Privacy Policy limits any mandatory rights a user may have under applicable consumer law.

4. AI-Powered Features

GymSquire provides AI-powered fitness features, including:

• personalised workout planning;

• exercise guidance;

• nutrition guidance;

• meal analysis;

• supplement information;

• objective verification;

• motivation;

• habit coaching;

• recovery guidance; and

• general educational fitness information.

These features use OpenAI together with GymSquire’s own systems and service providers.

When you use an AI-powered feature, the information processed may include:

• workout questions;

• nutrition questions;

• uploaded food photographs;

• uploaded objective-verification photographs;

• body measurements;

• workout history;

• fitness goals;

• nutrition preferences;

• activity information;

• relevant account context; and

• any other information you voluntarily include in your request.

This information is processed to provide the response, analysis, verification or recommendation requested by you.

Users should avoid including personal information that is unnecessary for the requested feature, particularly information relating to another identifiable individual.

4.1 AI Conversation Retention

GymSquire temporarily stores AI conversation history to provide continuity during active use.

GymSquire’s live copy of AI conversation content is ordinarily retained for no longer than twenty-four hours.

After approximately twenty-four hours:

• the conversation is removed from the visible AI chat history; and

• the corresponding conversation records are deleted from GymSquire’s live database.

Deleted records may remain temporarily within encrypted database backups until those backups are automatically overwritten or deleted in accordance with the applicable backup cycle.

Service providers involved in supplying AI functionality may process or retain information for different periods in accordance with:

• their contractual terms;

• applicable legal obligations;

• security requirements; and

• the product settings and service configuration used by GymSquire.

4.2 AI Accuracy

AI-generated information:

• may be incomplete;

• may contain inaccuracies;

• may misunderstand a request or image;

• may not reflect the latest scientific evidence;

• may not account for every relevant personal circumstance; and

• should not replace advice from an appropriately qualified professional.

AI-generated content is provided for general educational and fitness purposes.

GymSquire does not provide medical diagnosis or treatment through its AI-powered features.

4.3 Automated Processing

GymSquire uses automated systems to generate or assist with:

• workout recommendations;

• meal recommendations;

• AI responses;

• food analysis;

• calorie and macronutrient estimates;

• objective verification;

• progress information; and

• personalised fitness recommendations.

GymSquire does not use these automated systems to make decisions that produce legal or similarly significant effects on users.

Objective-verification outcomes and XP rewards are used for engagement, progress and Subscription-reward purposes. They are not used for employment, insurance, credit, legal, medical or similarly significant decisions.

5. Images

GymSquire allows users to upload photographs for:

• meal analysis; and

• objective verification.

Uploaded images are processed using artificial intelligence to provide the requested functionality.

Uploaded images are not published publicly through GymSquire.

Access to uploaded images is limited to:

• authorised technical systems;

• authorised service providers where necessary to provide the requested feature; and

• authorised persons where access is strictly necessary for security, maintenance, troubleshooting or legal compliance.

GymSquire does not:

• sell uploaded photographs;

• use uploaded photographs for behavioural advertising;

• display uploaded photographs publicly; or

• intentionally use uploaded photographs to train artificial-intelligence models.

5.1 Image Retention

GymSquire’s copy of an uploaded food photograph or objective-verification photograph is deleted promptly after the requested processing has been completed.

Uploaded images are not intentionally retained as part of your permanent GymSquire account.

Temporary copies may remain briefly within technical systems while an upload, analysis or verification request is being completed.

Where an image is transmitted to a service provider, that provider may process or retain limited information in accordance with its contractual terms, legal obligations, security requirements and the service configuration used by GymSquire.

Users should avoid uploading images containing unnecessary personal information.

Users should not upload an identifiable image of another person without that person’s permission.

6. Health and Fitness Information

GymSquire provides personalised fitness, nutrition and AI-powered features. To provide those features, we process information relating to users’ physical characteristics, fitness activities and goals.

This may include:

• height;

• weight;

• age or date of birth;

• sex;

• activity level;

• fitness goals;

• workout history;

• exercise performance;

• personal records;

• nutrition preferences;

• meal information;

• recovery information;

• information voluntarily provided about injuries, health conditions or physical limitations; and

• health-related information included in AI conversations.

Some of this information may constitute special-category personal data, including data concerning health, under applicable data-protection law.

Where information constitutes special-category personal data, GymSquire will identify:

• an appropriate lawful basis under Article 6 of the UK GDPR; and

• an appropriate condition under Article 9 of the UK GDPR.

Where GymSquire relies on explicit consent, consent will be requested separately and clearly before the relevant processing begins.

You may withdraw that consent at any time through available account controls or by contacting:

team\@gymsquire.co.uk

Withdrawal does not affect processing that was lawfully carried out before consent was withdrawn.

Where consent is withdrawn or refused, GymSquire may be unable to provide personalised workouts, nutrition functionality, AI coaching or other features that depend on the relevant information.

GymSquire aims to collect and process only the health and fitness information reasonably necessary to provide features requested by the user.

UK data-protection law requires organisations processing special-category data to establish both an Article 6 lawful basis and a separate Article 9 condition.

7. How We Use Your Information

Depending on how you use GymSquire, we may use your personal information to:

• create and manage your account;

• verify your email address;

• authenticate your identity;

• verify your age;

• apply age-appropriate protections;

• personalise workouts;

• personalise nutrition recommendations;

• generate AI coaching responses;

• analyse uploaded food images;

• verify objectives;

• calculate XP;

• calculate achievements and progress;

• determine eligibility for XP discount rewards;

• verify and administer claimed discounts;

• recommend workouts;

• recommend meals;

• remember preferences;

• verify Subscription purchases;

• activate or remove paid access;

• restore purchases;

• administer Subscription status;

• respond to cancellation, refund or purchase enquiries;

• provide customer support;

• communicate with you about your account;

• communicate important information about the Services;

• investigate bugs and technical issues;

• maintain platform security;

• detect fraud, manipulation and misuse;

• prevent unauthorised access;

• comply with legal, accounting, tax and regulatory obligations; and

• establish, exercise or defend legal claims.

GymSquire does not sell personal information.

GymSquire does not use personal information for behavioural advertising.

GymSquire does not permit other organisations to create advertising profiles using information collected through GymSquire.

7.1 AI Personalisation

GymSquire may use relevant information provided by you to personalise AI-generated responses.

This may include:

• your fitness goals;

• previous workouts;

• body measurements;

• nutrition preferences;

• training plan;

• meal plan;

• workout history; and

• conversation content retained during the twenty-four-hour conversation period.

This information is processed to improve the relevance of the feature requested by you.

It is not used by GymSquire to create an advertising profile.

7.2 Improving GymSquire

We may use information to:

• investigate bugs;

• monitor performance;

• improve system stability;

• improve prompts and AI-feature configuration;

• improve objective-verification processes;

• improve workout and meal recommendations;

• prevent abuse;

• protect users; and

• improve application security and reliability.

Where reasonably possible, we use aggregated, de-identified or anonymised information rather than information that directly identifies an individual.

We do not intentionally use private AI conversations or uploaded images to train external artificial-intelligence models.

8. Lawful Bases for Processing

Where UK data-protection law applies, GymSquire processes personal information under one or more lawful bases.

The applicable basis depends on the purpose and circumstances of the processing.

8.1 Performance of a Contract

We may process personal information where necessary to:

• create and administer your account;

• provide requested fitness features;

• provide AI coaching;

• provide workouts and nutrition features;

• maintain workout and progress records;

• determine XP and reward eligibility;

• confirm Subscription entitlement;

• provide paid access;

• restore purchases;

• administer subscriptions; and

• provide customer support.

Without this processing, we may be unable to provide the Services requested by you.

8.2 Legitimate Interests

We may process information where necessary for our legitimate interests, including:

• securing the Services;

• preventing fraud and misuse;

• preventing manipulation of XP or rewards;

• diagnosing technical issues;

• maintaining service reliability;

• protecting user accounts;

• investigating complaints;

• improving functionality;

• managing our business; and

• establishing, exercising or defending legal claims.

Where we rely on legitimate interests, we consider whether those interests are overridden by users’ rights, interests or freedoms.

8.3 Legal Obligation

We may process information where necessary to comply with:

• tax obligations;

• accounting obligations;

• consumer-protection requirements;

• regulatory requirements;

• court orders;

• lawful requests from public authorities; and

• other applicable legal obligations.

8.4 Consent

We may rely on consent where we specifically ask for permission to carry out a particular processing activity.

This may include:

• explicit consent for processing certain health information;

• consent for optional marketing communications introduced in the future; and

• consent for optional analytics or non-essential cookies introduced in the future.

Where we rely on consent:

• the request will be presented clearly;

• consent will not be pre-selected;

• consent will be recorded where appropriate; and

• consent may be withdrawn at any time.

Withdrawing consent does not affect processing already carried out lawfully before withdrawal.

9. Third-Party Service Providers

GymSquire uses third-party providers to operate, secure and distribute the Services.

These providers receive only the information reasonably relevant to their function.

Some providers process information on GymSquire’s behalf. Others may act as independent data controllers for particular processing activities.

9.1 Apple

Apple distributes the iOS version of GymSquire through the App Store and provides the Apple In-App Purchase system used for GymSquire Subscriptions.

Apple may:

• process Apple In-App Purchases;

• manage users’ Apple payment methods;

• process free trials, Subscription purchases and renewals;

• administer Subscription cancellations;

• determine and process eligible App Store refunds;

• process App Store account and device information;

• provide Subscription and transaction information to GymSquire;

• provide information needed to validate and restore purchases;

• notify GymSquire about purchases, renewals, expirations, billing failures, refunds and revocations; and

• provide platform analytics and reporting.

Apple independently processes relevant information under its own privacy policy, Apple Media Services Terms and Conditions and applicable App Store terms.

GymSquire does not receive users’ complete Apple payment-card details.

Users should use Apple’s subscription-management settings to cancel future renewals and Apple’s Report a Problem service or Apple Support for App Store refund requests. Apple’s rules and applicable consumer law determine refund eligibility.

9.3 OpenAI

OpenAI supplies artificial-intelligence functionality used within GymSquire.

Information submitted through AI-powered features may be processed by OpenAI to generate the response, analysis or verification requested by the user.

This may include:

• AI conversation content;

• uploaded food photographs;

• uploaded objective-verification photographs;

• fitness information;

• workout context;

• nutrition context; and

• other information relevant to the request.

GymSquire aims to minimise unnecessary personal information transmitted to OpenAI.

9.4 Supabase

Supabase may provide:

• user authentication;

• database hosting;

• data storage;

• file-storage infrastructure;

• authentication logging;

• database backups;

• security logging; and

• backend functionality.

Supabase may process information including:

• account identifiers;

• account information;

• authentication events;

• IP addresses;

• request metadata;

• security logs;

• stored application data; and

• Subscription-entitlement information.

9.5 Cloudflare

Cloudflare may assist with:

• network security;

• API security;

• website or service delivery;

• performance optimisation;

• malicious-traffic detection; and

• denial-of-service protection.

Cloudflare may process limited network and technical information necessary to provide those services.

9.6 OnSpace

GymSquire is developed and operated using technology provided through OnSpace.

Depending on the technical configuration of the deployed application, OnSpace may provide:

• application-development infrastructure;

• deployment services;

• hosting or runtime services;

• workflow functionality;

• API connectivity; and

• technical support.

Where OnSpace processes personal information belonging to GymSquire users, it may process only the information needed to provide the relevant technical service, subject to its applicable contractual terms and privacy documentation.

9.7 Google Workspace

GymSquire uses Google Workspace to receive and manage correspondence sent to:

team\@gymsquire.co.uk

Google may process:

• email addresses;

• sender and recipient information;

• email content;

• attachments; and

• related email metadata.

9.8 Framer

The GymSquire website is hosted using Framer.

Framer may provide:

• website hosting;

• content delivery;

• website security;

• protection against malicious traffic; and

• privacy-focused aggregated website analytics.

9.9 Other Providers

GymSquire may use additional providers where reasonably necessary to:

• deliver requested features;

• maintain security;

• manage infrastructure;

• comply with legal obligations; or

• provide customer support.

Where a new provider materially affects how users’ personal information is processed, this Privacy Policy will be updated where appropriate.

10. International Transfers

Some GymSquire service providers operate internationally.

Personal information may therefore be processed or stored outside the United Kingdom.

Where personal information is transferred to a country that is not covered by applicable UK adequacy regulations, GymSquire will take reasonable steps to ensure that an appropriate transfer mechanism is used where required.

Such mechanisms may include:

• UK adequacy regulations;

• the UK International Data Transfer Agreement;

• the UK Addendum to the European Commission’s Standard Contractual Clauses; or

• another legally recognised safeguard.

You may contact us for further information concerning safeguards relevant to your personal information.

10.1 Data Minimisation

When information is provided to a service provider, GymSquire aims to provide only the information reasonably necessary for that provider’s function.

For example:

• Apple processes payment and Subscription information but does not need users’ complete workout histories to process an In-App Purchase;

• OpenAI receives information relevant to the AI request but does not need complete payment-card details;

• customer-support providers receive information relevant to the user’s enquiry; and

• security providers process technical information needed to protect the Services.

11. Data Security

GymSquire implements reasonable technical and organisational measures designed to protect personal information against:

• unauthorised access;

• accidental loss;

• misuse;

• alteration;

• disclosure;

• destruction; and

• unlawful processing.

Measures may include:

• encrypted communications using HTTPS/TLS;

• secure password hashing and authentication;

• encrypted database connections;

• secure cloud infrastructure;

• database access controls;

• restricted administrative access;

• role-based access controls;

• authentication logging;

• API security;

• network protections;

• denial-of-service protection;

• software updates;

• security monitoring;

• access reviews;

• row-level database security; and

• encrypted backup procedures.

Access to personal information is restricted to authorised persons and service providers who require it for legitimate operational, technical, support, security or legal purposes.

Where available and appropriate, administrative accounts are protected with multi-factor authentication.

No internet transmission or storage system can be guaranteed to be completely secure. GymSquire therefore cannot guarantee absolute security.

Users are responsible for:

• keeping their passwords confidential;

• using strong and unique passwords;

• protecting their devices;

• logging out from shared devices; and

• notifying GymSquire promptly if they believe their account has been compromised.

11.1 Security Incidents

If GymSquire becomes aware of a personal-data breach, we will investigate it promptly.

Where required by law, we will:

• record the incident;

• notify the relevant supervisory authority;

• notify affected individuals;

• take reasonable steps to reduce potential harm; and

• review relevant controls to reduce the likelihood of recurrence.

12. Data Retention

GymSquire retains personal information only for as long as reasonably necessary for the purposes for which it was collected, including providing the Services and complying with legal, accounting, tax, security and regulatory obligations.

12.1 Account Information

Account information is ordinarily retained while your account remains active or inactive.

An inactive Subscription does not automatically cause deletion of the GymSquire account.

This allows users to:

• renew their Subscription;

• restore a purchase;

• regain access to saved progress; or

• exercise their privacy rights.

Account information is deleted or anonymised following account deletion, subject to applicable legal and backup-retention requirements.

12.2 Workout, Progress and Reward Information

Workout history, completed exercises, XP, achievements, objectives, personal records, reward eligibility and progress information are ordinarily retained while your account exists.

This information is deleted or anonymised following account deletion, subject to applicable legal and backup-retention requirements.

12.3 Subscription and Transaction Information

GymSquire may retain limited Subscription and transaction information after cancellation, expiration, refund or account deletion where necessary to:

• administer purchase restoration;

• identify previous trials or offers;

• prevent fraud or repeated abuse;

• resolve payment disputes;

• support users;

• comply with tax or accounting obligations;

• maintain business records; or

• establish, exercise or defend legal claims.

Apple retains its own purchase and transaction records according to its legal obligations, Apple Media Services Terms and Conditions and privacy practices.

12.4 AI Conversations

Visible AI conversation history and the corresponding conversation records stored in GymSquire’s live database are ordinarily deleted within twenty-four hours.

Deleted information may remain temporarily in encrypted backup copies until the applicable backup expires or is overwritten.

12.5 Uploaded Images

GymSquire’s copy of uploaded food photographs and objective-verification photographs is deleted promptly after processing has completed.

Uploaded images are not intentionally retained as permanent account records.

12.6 Customer-Support Correspondence

Customer-support correspondence is ordinarily retained for up to two years after the relevant enquiry has been closed.

It may be retained longer where necessary to:

• resolve an ongoing dispute;

• investigate fraud or misuse;

• comply with legal obligations; or

• establish, exercise or defend legal claims.

12.7 Technical and Security Logs

Technical, authentication and security logs are retained only for as long as reasonably necessary to:

• protect accounts;

• maintain system security;

• diagnose technical issues;

• investigate incidents;

• prevent fraud; and

• operate the Services.

Where the applicable Supabase plan provides seven-day log retention, relevant Supabase logs are ordinarily retained for up to seven days unless longer retention is reasonably required for a security investigation or legal obligation.

12.8 Backup Copies

Where database backups are enabled, deleted personal information may remain temporarily within encrypted backup copies.

Under GymSquire’s intended configuration, database backups are ordinarily retained for up to seven days before being automatically overwritten or deleted.

Backups are used only for:

• disaster recovery;

• business continuity;

• system restoration; and

• security purposes.

GymSquire does not ordinarily restore an individual user’s deleted account information from a backup unless restoration is required as part of recovering the wider service from a significant technical or security incident.

13. Your Rights

Depending on applicable law and the circumstances, you may have the right to:

• request access to your personal information;

• request correction of inaccurate or incomplete information;

• request deletion of your personal information;

• request restriction of processing;

• object to processing based on legitimate interests;

• receive certain personal information in a structured, commonly used and machine-readable format where data portability applies;

• withdraw consent where processing relies on consent; and

• lodge a complaint with the Information Commissioner’s Office or another competent supervisory authority.

These rights are not absolute, and legal exceptions may apply.

13.1 Exercising Your Rights

To exercise a privacy right, contact:

team\@gymsquire.co.uk

We may ask you to verify your identity before responding.

Identity verification may include confirmation through the email address associated with the GymSquire account or another proportionate verification method.

We will respond within the time required by applicable law.

13.2 Withdrawing Consent

Where GymSquire relies on consent, you may withdraw that consent at any time.

Withdrawal does not affect processing carried out lawfully before consent was withdrawn.

Some features may become unavailable where they depend on information that GymSquire is no longer permitted to process.

13.3 Subscription Rights

Privacy requests do not automatically cancel an Apple In-App Purchase Subscription.

Where you wish to stop future billing, you should separately cancel the Subscription through your Apple Account subscription-management settings.

Deleting your GymSquire account does not cancel a Subscription managed through Apple In-App Purchase. You should cancel the Subscription separately through Apple to prevent future renewal charges.

Where a refund is requested for an App Store purchase, Apple controls the refund process and determines eligibility under its applicable terms and consumer-law obligations.

14. Children’s Privacy

GymSquire is intended for users aged 13 years and above.

Users are required to provide their age or date of birth during registration so that GymSquire can:

• enforce the minimum age requirement;

• apply age-appropriate protections;

• provide appropriate explanations; and

• comply with applicable law.

GymSquire does not knowingly permit children under 13 to create an account.

If we become aware that a user under 13 has created an account, we will take reasonable steps to:

• suspend or close the account;

• remove access to the Services;

• delete associated information where appropriate; and

• comply with applicable legal requirements.

14.1 Protecting Younger Users

Because GymSquire may be accessed by users under 18, we aim to consider their best interests when designing and operating the Services.

Where appropriate, we seek to:

• use clear and age-appropriate privacy explanations;

• collect only information reasonably necessary for requested features;

• use privacy-protective settings;

• avoid unnecessary sharing;

• explain why sensitive information is requested;

• provide accessible deletion and privacy controls;

• avoid advertising profiling;

• avoid encouraging unnecessary disclosures;

• use appropriate safety controls for AI-generated content; and

• consider the potential effect of fitness, nutrition, calorie and weight-related recommendations on younger users.

Children’s personal information receives additional protection under UK data-protection law and the Children’s Code.

14.2 AI and Younger Users

The GymSquire AI Coach provides educational fitness and nutrition information.

It does not provide:

• medical diagnosis;

• emergency advice;

• professional healthcare;

• prescriptions; or

• personalised medical treatment.

Users under 18 should involve a parent, guardian or appropriately qualified professional before making significant changes to:

• exercise;

• calorie intake;

• diet;

• supplement use; or

• injury or recovery management.

Users should avoid sharing unnecessary personal information through AI conversations and image uploads.

14.3 Age Accuracy

Users must provide accurate age information.

Providing false age information may result in account suspension or termination.

15. Marketing and Service Communications

GymSquire does not currently send promotional marketing emails or newsletters.

GymSquire may send service-related communications where necessary to:

• verify your email address;

• manage your account;

• provide security notifications;

• communicate important service changes;

• respond to support enquiries;

• communicate about subscriptions;

• communicate about purchases, refunds or restored purchases; or

• provide legally required notices.

If GymSquire introduces promotional marketing communications in the future, we will provide any consent mechanisms and withdrawal options required by law.

16. Cookies and Website Technologies

The GymSquire website is hosted using Framer.

GymSquire does not currently use:

• advertising cookies;

• behavioural-tracking cookies;

• Google Analytics;

• Meta Pixel; or

• third-party advertising technologies.

Framer may process limited information or use technologies necessary for:

• website delivery;

• website security;

• fraud prevention;

• protection against malicious traffic;

• maintaining website functionality; and

• producing aggregated website statistics.

Where strictly necessary security technologies are used, they may operate without optional marketing or advertising tracking.

If GymSquire introduces optional analytics, advertising cookies or other non-essential technologies in the future, we will update this Privacy Policy and provide any consent controls required by law.

17. Account Deletion

GymSquire allows users to permanently delete their GymSquire account through the application.

When an account is deleted:

• access to GymSquire ends;

• profile information is deleted from the live system;

• workout history is deleted from the live system;

• XP, achievements and objectives are deleted from the live system;

• saved preferences are deleted from the live system;

• remaining AI conversation records are deleted;

• remaining uploaded images are deleted where applicable; and

• the account cannot ordinarily be recovered.

Limited information may be retained where necessary to:

• comply with legal obligations;

• maintain accounting or tax records;

• prevent fraud;

• resolve disputes;

• enforce legal rights; or

• establish, exercise or defend legal claims.

Deleted information may remain temporarily in encrypted backup copies until those backups expire or are overwritten.

17.1 Account Deletion Does Not Cancel Apple In-App Purchase Billing

Deleting your GymSquire account does not cancel a Subscription processed through Apple In-App Purchase.

Before deleting your account, you should cancel your Subscription through your Apple Account subscription-management settings to prevent future renewal charges.

GymSquire may provide instructions or links to assist with cancellation, restoration or refund requests, but Apple controls App Store billing, Subscription management and App Store refund processing.

18. Changes to This Privacy Policy

GymSquire may update this Privacy Policy to reflect:

• changes to the Services;

• new features;

• changes to Subscription systems;

• changes to providers;

• legal or regulatory developments;

• changes in technology; or

• improvements to privacy and security practices.

The version number and last-updated date will be revised when the policy changes.

Where a change materially affects users’ rights or how personal information is processed, we will take reasonable steps to notify users through the application, email or another appropriate method.

The updated Privacy Policy will apply from the effective date shown in the revised version.

Where required by law, we will obtain fresh consent before beginning new processing that depends on consent.

19. Contact Us

If you have questions about this Privacy Policy, how GymSquire processes personal information or your privacy rights, contact:

GymSquire

Partnership operated by:

Will Morse Joshua Weatherall

Business correspondence address:

10 Enid Street Tonypandy CF40 2UR United Kingdom

Email:

team\@gymsquire.co.uk

We aim to respond to privacy enquiries promptly and within applicable legal time limits.

20. Complaints

If you believe GymSquire has handled your personal information improperly, you may contact us so that we can investigate your concern.

You also have the right to complain directly to the relevant supervisory authority.

For users in the United Kingdom, the supervisory authority is:

Information Commissioner’s Office

Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF United Kingdom

Telephone: 0303 123 1113

Contacting GymSquire first is not a requirement and does not affect your right to complain to the ICO.

Submitting a privacy complaint does not affect any other legal rights or remedies available to you.

21. Summary of Our Privacy Commitments

GymSquire aims to:

• collect only personal information reasonably necessary to provide and protect the Services;

• explain why personal information is collected;

• use appropriate security measures;

• avoid selling personal information;

• avoid behavioural advertising;

• process iOS Subscription payments through Apple In-App Purchase without receiving complete card details;

• delete uploaded food and objective-verification photographs promptly after processing;

• delete GymSquire’s live AI conversation records after approximately twenty-four hours;

• provide accessible privacy controls;

• permit users to delete their GymSquire accounts;

• respect applicable data-protection rights;

• consider the interests of younger users; and

• review and improve privacy and security practices over time.