• We are a health & fitness social media platform and information you upload may be made publicly available.
• We collect specific information about you concerning your account & usage of the Service and that information is not made publicly available.
• Some of the information we collect (such as your height and recorded activities) relates to your health & fitness. We treat this as sensitive "special category" information and only process it with your consent.
• We use trends in your information along with your saved preferences to tailor your experience of our Service.
• We aggregate your data along with other users into statistical data that may be made publicly available.
• We do not sell your personal information to third parties.
• We do not share your personal information with third parties for their own purposes. We do use trusted service providers (such as our hosting provider) who process information on our behalf and under our instructions.
• When required by law, we will provide your information to third parties such as government departments or the police.
• We apply additional protections by default to users aged 13 to 17.
• We make every effort to protect the information we store about you, but do not guarantee 100% security.
• We use "Cookies" for core functionality of our Service and to enhance your experience.
• You have the right to delete your account at any time.
• We are based in the United Kingdom and despite the impact of Brexit, we choose to adhere to the UK GDPR and EU GDPR.

POLICY LAST UPDATED: 6TH SEPTEMBER 2026

We are a health & fitness social media platform delivered through a website, mobile device applications and other associated services (collectively, the "Service").

The collection of information from our users is integral to the operation of the Service. Privacy is important to us and our policy explains the information we collect, the legal basis on which we use it, how information may be shared, and your rights in connection with use of the Service.

We reserve the right to modify this policy at any time. Minor changes will be incorporated into the policy with significant changes being communicated to all users of the Service in a prominent manner.

If you have any questions regarding our policy you can contact us by logging in, or by emailing us at the address in the "Who we are and how to contact us" section below.

The Service is operated by Fitboost Limited, which is the "data controller" responsible for your personal information. Our details are:

• Company name: Fitboost Limited
• Registered in England & Wales, company number 12304384
• Registered office: 17 Harestock Road, Winchester, England, SO22 6NS
• Email: admin@fitboost.com

If you have any questions about this policy or about how we handle your personal information, please contact us using the email address above. You also have the right to complain to the Information Commissioner's Office (the "ICO"), the UK supervisory authority for data protection, at https://ico.org.uk/. We would, however, appreciate the chance to address your concerns before you approach the ICO, so please do consider contacting us first.

The information collected from you and stored by us is split into 3 main categories:

The following list are certain types of information which we have no use for. We will never ask for, collect or store this data:

• Any kind of banking, debit card, credit card or other payment details.
• Your home address.
• Your telephone number.
• Your sexuality.
• Your race.
• Your religion.
• Your political views.

Data protection law requires us to have a valid "lawful basis" for each way in which we use your personal information. The table below explains the lawful bases we rely on. Where we rely on consent, you can withdraw that consent at any time (see the "Your rights" section below).

Where we rely on "legitimate interests", we have considered whether those interests are outweighed by your rights and freedoms, and we do not use your information in ways you would not reasonably expect. You can contact us if you would like more information about this assessment.

Because we are a health & fitness platform, some of the information you provide - such as your height and the activities you record - may reveal information about your physical health. Under data protection law this is known as "special category" information and is given extra protection.

We only process this information with your explicit consent, which you provide when you choose to add it to the Service. You are never required to provide health & fitness information in order to hold an account, although some features of the Service will not be available to you without it.

Where you choose to make health & fitness information public on your profile or in your posts, we also rely on the fact that you have deliberately and manifestly made that information public. You can change this information, make it private, or delete it at any time through the standard functionality of the Service, and you can withdraw your consent at any time by removing the information or by contacting us. Withdrawing consent will not affect any processing that took place before you withdrew it.

The primary use of your information is to allow us to provide a health & fitness social media platform. Information that you provide, which is classed as being publicly available, will be searchable by the users of our Service (subject to the additional protections we apply to users aged 13 to 17, described below).

We will use your saved preferences (such as favourite activities) and trends in the information you provide (such as predominant type of activity being logged) to tailor your experience of the Service. This will include weighting the "feed" to show posts, images, videos, etc that are more likely to be relevant and / or interesting to you.

We may collect your information in aggregate with information from other users to produce statistical data. This data will be used to show trends, statistics, correlations and other forms of analysis that are linked to matters of health & fitness. We will not include personal details about you that would allow the aggregate statistical data to be directly linked to your account, however there does remain a risk that a link could be drawn against your publicly available information. We may share this statistical data on our Service or with third parties on a purely aggregated basis.

The Service is free to use and we will never charge a subscription fee. We do not currently show advertising on the Service.

We may introduce advertising in the future. If we do, we will update this policy before doing so, and we commit that:

• We will not use your health & fitness information (or any other special category information) to target advertising to you.
• We will not target advertising to users aged 13 to 17 based on their personal information.
• Any advertising cookies or similar technologies will only be used with your separate consent, which you will be able to refuse or withdraw.

You must be at least 13 years old to create an account on the Service. We recognise that users aged 13 to 17 (referred to here as "younger users") need additional protection, and we have designed the Service to provide this by default. We take account of the ICO's Age Appropriate Design Code in how we treat younger users' information.

When an account belongs to a younger user, the following protections are applied automatically:

• The profile is set to private by default, and by extension the connections, badges and analytics pages are private by default.
• A profile photo is not shown on the reduced ("thin") profile that non-followers may see - a default Fitboost logo image is shown instead.
• First and last name are not shown on the thin profile, even if the younger user has chosen to make them visible.
• The thin profile is not indexed by search engines.
• Other users must send a request to follow, and the younger user decides whether to accept or decline it.
• Younger users do not appear in the "user" category of search results, and cannot be found by browsing. Another user would need to know the younger user's exact username to find their profile and request to follow.
• Activities, events and meals uploaded by a younger user are only visible to their followers, do not appear in the discovery feed for other users, and do not appear in search results.
• Only followers can comment on and boost activities, events and meals uploaded by a younger user.
• Where a younger user comments on or boosts another user's content, any non-follower will only see the younger user's username - not their real name or profile photo.
• Photos and videos uploaded by a younger user can only be viewed, commented on and boosted by their followers.
• Uploaded media is stored with unpredictable file names (combining a random element with the exact upload date and time) so that files cannot be found by guessing the web address.
• Younger users cannot join or create clubs.
• If a younger user attempts to change their age from 13-17 to 18 or over, this is flagged for review by our administrators.

An automated daily process identifies younger users who have reached the age of 18 and removes the younger-user protections from their account. For your control and awareness, your privacy settings are not automatically changed when this happens - you remain in control and can adjust your settings yourself at any time.

If you believe a child under 13 is using the Service, or you have any concern about a younger user's safety or information, please contact us immediately at admin@fitboost.com. If we become aware that we have collected information from a child under 13, we will delete the account and associated information.

We do not sell information that you have provided, or aggregated statistical data, to any third party.

We do not share your personal information with any third party for that third party's own purposes. Please note that third parties can, however, view any publicly available information on our Service (subject to the additional protections we apply to users aged 13 to 17).

We do use a small number of trusted service providers who process information on our behalf and only under our instructions (see the "Service providers and where your information is stored" section below). We also share information where we are required to do so by law (see the "Legal requirements" section below).

To run the Service we rely on a small number of trusted third party service providers who process information on our behalf. These providers act only under our instructions and are not permitted to use your information for their own purposes. They include:

• Our hosting provider, IONOS, which stores the information that makes up the Service on secure servers within the European Union.
• Providers of content delivery networks and website tools used to display our pages correctly and to manage cookie preferences. When your browser loads our pages, technical information such as your IP address may be visible to these providers.

Your information is stored within the United Kingdom and / or the European Union. If at any point we need to transfer your information outside the UK or the European Economic Area, we will ensure that appropriate safeguards recognised under data protection law are in place to protect it, and we will update this policy accordingly.

When required by law, we will provide your information to third parties such as:

• Government departments / agencies.
• The police / law enforcement agencies.
• Lawyers / solicitors.

We reserve the right to share your information if we determine that such disclosure is allowed by the law or reasonably necessary to comply with the law, including to respond to court orders, warrants, subpoenas, or other legal or regulatory process.

We may also retain, preserve or disclose your information if we determine that disclosure is reasonably necessary or appropriate to prevent any person from death or serious bodily injury, to address issues of national security or other issues of public importance.

We have designed the Service to safeguard your information and we make every effort to enforce this. Our methods include the use of encryption and other measures for transmitting data safely and then storing it on our servers.

We cannot guarantee 100% security and users of our Service accept the risk that information we hold could be stolen, destroyed or lost.

In the unlikely event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within the timeframe required by law and, where the breach is likely to result in a high risk to you, we will inform you without undue delay.

Please ensure that you are using "best practice" when using the Service to reduce the risk of your data being intercepted or misappropriated:

• Do not share your email address with other people.
• Do not share your account password with other people.
• Keep your device up to date with the most recent operating system and upgrades.
• If applicable, install anti-virus software on your device.
• Update your browser(s) to the latest version.
• Be careful when accessing the Service on unsecured wi-fi networks (i.e. networks that are not password protected).
• Do not access the Service if you think that your device has been compromised with a virus, malware or keylogger.
• Do not click on links sent in unsolicited emails which state that they come from our Service.
• Do not leave yourself logged in on shared devices.
• Use the "Log out all devices" functionality if you think your account is being accessed on a shared device.

A cookie is a data file that might be stored on your device when you access the Service.

• Session cookies are temporary and are not stored in your browser beyond the session in question (i.e. a session could be a single visit to / use of the service). These cookies handle security when you log into your account and handle short-term preferences to tailor your experience.
• Persistent cookies are stored for longer periods of time. For example, if you choose to stay logged into the Service a persistent cookie would remember that preference over many individual visits.

The cookies described above are strictly necessary to provide the Service and to remember your choices. We do not currently use cookies for advertising. If we introduce any non-essential cookies in the future (for example, advertising or analytics cookies), we will only set them with your consent, which you will be able to refuse or withdraw.

Our aim is to keep the number of cookies we use, and the information stored in them, to a minimum. However, some cookies are vital to allow you to use our Service (e.g. a session cookie needs to be able to identify that you've logged into your account to provide full functionality). Please note that if you decide to partially or fully block cookies from being used then it's unlikely that you will be able to use the Service.

Please log in and contact us if you wish to delete your account. This action is irreversible and will remove almost all information that we hold related to you. We reserve the right to retain certain information from deleted accounts to comply with the law, prevent fraud, resolve disputes, troubleshoot problems, assist with investigations and take other actions permitted by law. The information we retain will be handled in accordance with this policy and none of it will be publicly available and / or shared with any third parties. Any aggregated statistical data that we produce prior to your account being deleted (i.e. that therefore incorporates your information) will not be deleted as it is not specific to you.

If you wish to delete information on the Service that is publicly available (without deleting your full account), you can do this through the standard functionality of the Service. For example - any photo, video, comment, recorded activity, etc can be deleted by you directly.

If we become involved in a business combination or other similar transaction (i.e. where control of our company might change), we may share or transfer your information in connection with such transaction.

We are based in the United Kingdom. Despite the impact of Brexit, we have chosen to adhere with both the UK GDPR and the EU GDPR (https://gdpr-info.eu/) given that (a) it sets a high standard for data protection; and (b) we operate in the EU by way of the Service being available on the Internet. Therefore, the GDPR applies to the Service given that we process and hold personal information about you (whether you are based in the UK / EU yourself or not).

The table below, supplemented by the full privacy policy above, lists your rights regarding the GDPR and use of the Service. You will not usually have to pay a fee to exercise these rights, and we will respond within the timeframe required by law.