Privacy notice
How the BwM Fitness app uses and protects your information.
Draft of 25 September 2026
Who we are
BwM Fitness is the personal training business of Matt Lewis ("Matt", "we"). Matt is the data controller for the information in the app and on this website.
Contact us about your information at privacy@bwmfitness.uk.
What we collect
| Information | Examples | Where it comes from |
|---|---|---|
| Account details | Your name, the name the app uses, email address, date of birth and timezone. Your password is held by our sign-in service in a form that cannot be read back, and we never see it | Matt, when he adds you, and you |
| Training | Your plan, the sessions you record (exercises, weights, repetitions, times, distances, settings), how hard each set or session felt, exercises you swapped or skipped, your comments and your Next time choices | Matt and you |
| Nutrition | Your nutrition plan, and the food allergies, intolerances and preferences you or Matt record | Matt and you |
| Weekly check-ins | Your answers about your week, such as what went well, your energy, recovery and confidence on a scale of 1 to 5, and your weight if you give it. Earlier answers are kept when you correct them, with when Matt reviewed each check-in | You |
| Body measurements and assessments | Weight, height, waist, hips and other measurements, body fat readings, and results worked out from them, such as body mass index and energy estimates | You, and Matt when he assesses you |
| Messages | Your messages and questions to Matt, and his replies | You and Matt |
| Photos and videos | Photos and short videos you or Matt choose to send in your messages, such as a progress photo or a video of an exercise. Sending them is always optional. The app removes location details from them before they leave your phone | You and Matt |
| Notifications | If you turn notifications on, a code from Apple or Google that lets us send a notification to your phone, kept only while you are signed in on it. Which updates you want to be told about, and your quiet hours. A list of your recent updates, such as "New message from Matt", with when you read them | You and your phone |
| Matt's private notes | Notes Matt keeps to coach you well. You cannot see them in the app, and you can ask for a copy | Matt |
| Security records | When you sign in, the time, your device's internet address and the type of device, kept to protect your account | Our sign-in service |
Measurements, assessments, food allergies and intolerances, check-in answers about how you feel, progress photos, and some training details are health information. The law gives it extra protection, and so do we.
We do not use advertising, analytics or tracking tools, and we never sell your information.
Why we use it, and our lawful basis
- To coach you: to write and adjust your plan, see what you did, answer your questions and track your progress. Our lawful basis is the contract we have with you for coaching.
- Your health information: we use it only to coach you, and only with your explicit consent, which you give when you join and can withdraw at any time. Without it, Matt cannot coach you through the app. We are confirming this approach with a privacy adviser before any client's real information is used in the app. Until then, the app is only used for testing.
- To keep the service secure and working: security records and emails such as password resets. Our lawful basis is our legitimate interest in protecting your account and the service.
Who we share it with
Only Matt can see your information in the app. Other clients cannot. We use these service providers, who act on our instructions and must protect your information:
- Supabase, which hosts the app's database, file storage and sign-in service. Your information is stored in London.
- Resend, which sends the app's emails, such as invitations and password resets. It processes your name and email address.
- Google Workspace, which runs our email, when you email us.
- Cloudflare, which hosts this website. It processes your device's internet address when you visit, to deliver the pages and protect them from attacks.
- Expo, whose push service passes our notifications to Apple and Google, who deliver them to your phone. It receives your phone's notification code and the notification itself, which only ever says "You have a new update from Matt." and carries a reference to the update. Your messages, plans and health information are never in a notification.
Apple and Google provide the app stores you download the app from, under their own privacy policies.
Some of these providers are based in the United States, and their staff may access information from there, for example for support. When that happens, the transfer is protected by the UK's approved safeguards, such as the International Data Transfer Agreement or the UK Extension to the EU-US Data Privacy Framework.
How long we keep it
We keep your account and records while you are coached by Matt, so your history stays in one place. When your coaching ends, your account and records are deleted 30 days later, unless you start coaching again before then.
Updates in the app's list of recent updates are removed after 90 days. What they pointed to, such as a message, stays. Your phone's notification code is deleted when you sign out, when Matt switches your access off, or when Apple or Google say it no longer reaches your phone.
You can ask us to delete your account at any time. Read how deletion works. Your access stops at once and everything is deleted after 14 days. Copies in our backups are removed within 7 days after that.
How we protect it
- Everything travels over encrypted connections, and our hosting provider encrypts stored data.
- Each client can only ever reach their own records, and Matt's account needs a second check with an authenticator app.
- Photos and videos are stored privately. Only you and Matt can open them, through links that stop working after ten minutes. They are never public and never used for marketing.
- What the app keeps on your phone for offline use is encrypted.
Your rights
You can ask us to:
- give you a copy of your information
- correct anything that is wrong
- delete your information
- limit how we use it, or object to a use
- give your information to you or another service in a common format
- stop using your health information, by withdrawing your consent
Email privacy@bwmfitness.uk. We may need to check it is you, and we reply within one month.
You can also download a copy of your information yourself, in the app under Profile, Privacy, Download your information. You enter your password again first. The file is made on your phone and is not kept by us. Photos and videos are listed in it but not included, and Matt's private notes are not included. Ask us for those.
If you are unhappy with how we use your information, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint.
Age
The app is for adults aged 18 and over.
This website
This website sets no cookies and uses no tracking. If you pause its moving pictures, your browser remembers that choice on your device only, and it never reaches us. If you email us from the website, we use your email to reply to you.
Changes to this notice
If we change how we use your information, we will update this notice and tell you in the app before the change applies.