Privacy Policy

Last updated: July 21, 2026

CoachOS Ltd, registered in England and Wales under company number 17045572 with its registered office at 1, Oak Court 67-72 Bethel Road, Sevenoaks, United Kingdom, TN13 3UE ("CoachOS," "we," "us," or "our"), respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, mobile applications, and services (collectively, the "Service").

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the Service.

1. Information We Collect

We collect several types of information to provide and improve our Service:

1.1 Information You Provide

Account Information: Name, email address, password, profile photo, and contact details when you create an account.
Profile Information: Professional credentials, certifications, business name, and biography (for coaches).
Health and Fitness Data: Body measurements, weight, fitness goals, workout logs, nutrition data, progress photos, and health metrics you voluntarily provide.
Communication Data: Messages, feedback, and communications between coaches and clients within the platform.
Enquiry Information: Name, work email, business details, contact preferences, your message, and basic referral or campaign context when you contact CoachOS.
Payment Information: Billing address and payment method details (processed securely by our payment processor, Stripe).

1.2 Information Collected Automatically

Usage Data: Pages visited, features used, time spent on the Service, and interaction patterns.
Device Information: Device type, operating system, browser type, unique device identifiers, and mobile network information.
Log Data: IP address, access times, referring URLs, and pages viewed.
Location Data: General location based on IP address (we do not collect precise GPS location unless you explicitly enable it).
Mobile App Diagnostics: For mobile app users, we collect crash reports and diagnostic logs to improve app stability. This may include device model, app version, and anonymized usage patterns.

1.3 Information from Third Parties

Wearable Integrations: If you connect an available fitness source (for example Apple Health, Health Connect or, where enabled, WHOOP), we receive health and activity data according to your permissions.
OAuth Providers: When you sign in with Google, we receive your name, email, and profile picture.

2. How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve the Service
Facilitate communication between coaches and clients
Process transactions and send related information
Send administrative notifications, updates, and security alerts
Personalize your experience and provide AI-powered insights
Analyze usage patterns to improve our features and user experience
Detect, prevent, and address technical issues, fraud, or abuse
Comply with legal obligations
Respond to your requests and support inquiries
Understand how prospective customers find CoachOS and improve our enquiry experience

3. Legal Basis for Processing

Under UK GDPR, we process your personal data on the following legal bases:

Contract: Processing necessary to perform our contract with you (providing the Service)
Legitimate Interests: Processing necessary for our legitimate business interests (improving the Service, security, fraud prevention) where these are not overridden by your rights
Consent: Where you have given explicit consent for specific processing (e.g., marketing communications, wearable integrations)
Legal Obligation: Processing necessary to comply with legal requirements

For special category data (health and fitness information), we rely on your explicit consent. You may withdraw consent at any time, though this will not affect the lawfulness of processing before withdrawal.

4. Health Data (Special Category Data)

CoachOS processes health and fitness data to enable coaching services. This data is considered sensitive personal information and we apply additional safeguards:

Health data is never sold. Access is limited to your designated coach(es) where you authorise it and to contracted service providers acting on our behalf where necessary to provide an enabled feature
Health data is NOT used for advertising, marketing, or any purpose other than providing coaching services
You control what health data you share and can delete it at any time
We use encryption in transit and at rest to protect health data
Where an enabled AI feature needs health data, a contracted AI provider may process limited information solely to deliver that feature. It is not disclosed for the provider's independent use, advertising, or training of generalized models.

4.1 Apple HealthKit (iOS)

When you grant permission, CoachOS accesses the following data types from Apple Health:

Read: Step count, sleep analysis, workout sessions, active energy burned, and heart rate data.
Write: Workout sessions completed within the CoachOS app are written back to Apple Health to keep your fitness records synchronised.

CoachOS uses HealthKit data solely to display your fitness and recovery metrics within the app and to provide the coaching features you choose to use. HealthKit data is never sold, used for advertising or marketing, or disclosed without your authorisation. Where you authorise sharing with your assigned coach, or where a contracted service provider processes data on our behalf to operate an enabled feature, access is limited to what is necessary to provide that service. HealthKit data is not disclosed to data brokers or information resellers. You can revoke HealthKit access at any time via your device's Settings > Health > Data Access & Devices.

4.2 Google Health Connect (Android)

When you grant permission, CoachOS accesses the following data types from Health Connect:

Read: Steps, sleep sessions, exercise sessions, active calories burned, and heart rate records.
Write: Exercise sessions completed within the CoachOS app are written back to Health Connect.

Health Connect data is used exclusively to display your fitness and recovery metrics within the app and to provide the coaching features you choose to use. Health Connect data is never sold, used for advertising or marketing, or disclosed without your authorisation. Where you authorise sharing with your assigned coach, or where a contracted service provider processes data on our behalf to operate an enabled feature, access is limited to what is necessary to provide that service. You can revoke Health Connect access at any time via your device's Settings > Health Connect > App permissions.

Important: CoachOS is not a medical service. The health insights and recommendations provided are for informational purposes only and should not replace professional medical advice.

5. Google Calendar and Google Workspace API Data

If you choose to connect Google Calendar, CoachOS requests access only to the free/busy availability and booking-event permissions needed for the booking features described below. Connecting Google Calendar is optional, and you can disconnect it at any time.

5.1 Data We Access

Free/busy availability: Start and end times showing when your primary calendar is busy. CoachOS does not request event titles, descriptions, attendees, or the content of unrelated calendar events for conflict checking.
CoachOS booking events: Event title, description, start and end times, attendee email address, event identifier, and Google Meet conference information for bookings created through CoachOS.
Authorization data: Encrypted OAuth access and refresh tokens, granted scopes, the primary calendar identifier, connection status, and sync timestamps or errors.

5.2 How We Use Google Calendar Data

We use free/busy time ranges to prevent visitors from booking unavailable times. We create, update, and delete CoachOS booking events on your primary calendar, send invitations to the attendee you specify, and generate a Google Meet link when you select Google Meet as the booking location. We do not use Google Calendar data for advertising, marketing, credit or lending decisions, or data-broker purposes.

5.3 Storage, Sharing, Retention, and Deletion

Free/busy time ranges may be cached briefly for availability checks and are not stored as permanent calendar-event records.
OAuth tokens are encrypted at rest and retained only while your Google Calendar connection remains active.
Google event identifiers and Meet links are stored with the related CoachOS booking so the booking can be rescheduled, cancelled, and communicated to the coach and attendee.
Booking details, invitations, and Meet links are shared only with Google, the booking attendee, and service providers acting on our behalf where necessary to operate the user-facing booking feature.
Disconnecting Google Calendar revokes Google access and deletes the stored OAuth connection. Associated booking records follow the account-retention periods described in Section 7 below. Deleted account data is removed within 30 days, subject to legal retention obligations.

5.4 Limited Use and AI/ML Isolation

Google Workspace API data is isolated from CoachOS AI functionality. We do not send, disclose, or otherwise make raw, aggregated, anonymized, or derived Google Workspace API data available to any AI or machine-learning service, including Google Cloud Vertex AI and the Gemini Developer API. This exclusion covers free/busy time ranges, OAuth tokens and scopes, Google calendar and event identifiers, Google Meet links, and any other data received or derived from Google Workspace APIs. Such data is not included in AI prompts, context, tool results, embeddings, evaluations, or model training.

An enabled AI feature may use booking records created directly within CoachOS, such as the CoachOS event type, start and end time, booking status, and CoachOS location type. These AI-facing records expressly exclude every Google-derived field described above. Google Calendar data is not sold, used to serve advertisements, or used to develop, improve, or train generalized AI or machine-learning models. The use of information received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

6. Information Sharing and Disclosure

We may share your information in the following circumstances:

6.1 With Your Consent

We share information between coaches and clients as necessary to provide coaching services. Clients' health data, progress, and communications are accessible to their assigned coaches.

6.2 Service Providers

We use carefully selected service providers to operate the Service. They receive personal data only where necessary for their role and are subject to appropriate contractual, confidentiality, and security obligations. Depending on the service, a provider may process data on our behalf or act as an independent controller under its own privacy terms. The categories of providers we use include:

Payments and billing: Subscription billing, connected payments, fraud prevention, and related financial records
Cloud infrastructure: Application and website hosting, databases, storage, backups, content delivery, caching, traffic management, and platform security
Communications: Transactional email, push notifications, and real-time in-app messaging
Bookings and scheduling: Publishing availability, arranging calls, preventing automated abuse, and connecting bookings with enabled calendar or meeting services
Product operations: Monitoring, diagnostics, error reporting, customer support, and abuse prevention
AI functionality: Google Cloud Vertex AI, provided on a usage-based Google Cloud plan, processes only the limited CoachOS data needed to provide enabled insights, recommendations, and coach-approved assistance. The Gemini Developer API Free Tier processes coach-uploaded website images only to generate optional accessibility alt text. For CoachOS as a UK business, Google applies its Paid Services data-use terms to this unpaid Gemini API quota. No Google Workspace API data is provided to either service.
Mobile services: App distribution, delivery, updates, and device notification infrastructure

We share only the personal data reasonably necessary for each provider's role. You can contact us at hello@coachos.io if you would like more information about providers relevant to your data.

6.3 Legal Requirements

We may disclose your information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of CoachOS, our users, or others.

6.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you of any such change and the choices you may have.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services. We will also retain and use your information to comply with legal obligations, resolve disputes, and enforce agreements.

Active account data: Retained while your account is active
Deleted account data: Removed within 30 days of account deletion
Payment records: Retained for 7 years for tax and legal compliance
Communication logs: Retained for 2 years after account deletion

8. Data Security

We implement industry-standard security measures to protect your data:

Industry-standard encryption of data in transit and at rest
Secure password hashing and protected session management
Regular security audits and vulnerability assessments
Access controls limiting employee access to personal data
Established cloud providers with independently assessed security controls

While we strive to protect your information, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

9. Your Rights and Choices

Depending on your location, you may have the following rights:

Access: Request a copy of the personal data we hold about you
Correction: Request correction of inaccurate or incomplete data
Deletion: Request deletion of your personal data (subject to legal retention requirements)
Portability: Request your data in a structured, machine-readable format
Objection: Object to processing of your data for certain purposes
Withdrawal: Withdraw consent where processing is based on consent

To exercise these rights, contact us at hello@coachos.io. We will respond within 30 days.

10. Cookies and Tracking

We use essential storage to operate forms, protect the website, and remember your privacy choice. We do not require you to accept analytics to use the CoachOS website.

10.1 Optional Google Analytics

If you choose "Accept analytics", we use Google Analytics 4 to understand how visitors find and use the public CoachOS website. This may collect page paths, interaction events, broad device and browser information, approximate location, referral source, and campaign parameters. Google Analytics uses first-party identifiers such as the _ga cookie to distinguish visits. It does not receive the name, email address, phone number, business name, or free-text message entered into our contact form.

Purpose: Measure useful pages, referral sources, product interest, and completed enquiries so we can improve the website.
Legal basis: Your consent. Analytics storage and measurement remain disabled until you opt in.
Provider: Google Ireland Limited and its affiliated processors. Appropriate safeguards apply where information is processed outside the United Kingdom.
Retention: Event-level analytics data is retained for up to 14 months, while aggregated reporting may remain available for longer.

When a consented visitor submits the contact form, our server sends a single conversion event to Google Analytics. That event contains a pseudonymous Analytics client identifier and limited categorical context, such as the enquiry type and client-base band. It does not contain contact details or message content.

10.2 Your Controls

You can accept or reject optional analytics when the privacy notice appears. You can change or withdraw your choice at any time through "Cookie settings" in the website footer. Withdrawing consent stops future Analytics events and removes CoachOS Analytics cookies available to this website. You can also clear cookies through your browser settings.

11. Children's Privacy

The Service is not intended for users under 16 years of age. We do not knowingly collect personal information from children under 16. If we learn we have collected such information, we will delete it promptly. If you believe we have information from a child under 16, please contact us.

12. International Data Transfers

Your information may be transferred to and processed in countries outside the United Kingdom. When we transfer data internationally, we ensure appropriate safeguards are in place in accordance with UK GDPR:

Transfers to countries with UK adequacy decisions (recognised as providing adequate protection)
International Data Transfer Agreements (IDTAs) or UK Addendum to EU Standard Contractual Clauses
Binding Corporate Rules where applicable

Some of our service providers are based in the United States. We ensure these transfers comply with UK data protection requirements through appropriate transfer mechanisms.

13. UK GDPR Rights

Under the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, you have the following rights:

Right to be informed: Know how your data is being used (this Privacy Policy)
Right of access: Request a copy of your personal data (Subject Access Request)
Right to rectification: Have inaccurate data corrected
Right to erasure: Request deletion of your data in certain circumstances
Right to restrict processing: Limit how we use your data
Right to data portability: Receive your data in a portable format
Right to object: Object to processing based on legitimate interests or direct marketing
Rights related to automated decision-making: Not be subject to solely automated decisions with legal effects

You may also lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data protection rights have been violated.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. For significant changes, we will provide additional notice via email or in-app notification. Your continued use of the Service after changes become effective constitutes acceptance of the revised policy.

15. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

Email: hello@coachos.io
Website: coachos.io