Privacy Policy
This policy explains what personal data SPN Health collects, why we collect it, who we share it with, how long we keep it, and the rights you have over it.
Last update: 4 October 20261. Who We Are
SPN Health Ltd (“SPN Health”, “we”, “us”, “our”) is the data controller for your personal data. We are registered in England and Wales with company number 16682238, and our registered address is Bartle House, Oxford Court, Manchester, United Kingdom, M2 3WQ.
This policy applies to our website at spn.health (the “Site”), our application at app.spn.health (the “App”), and all our services, including Stride (VO2 max testing), Scan (DEXA scanning), Archie (AI training plans and coaching) and Membership (together, the “Services”). Our Services are for adults in the United Kingdom. Please also read our Terms and Conditions.
For any question about this policy or your personal data, email [email protected].
2. Information We Collect
Items marked health data are special category data. We process them only with your explicit consent (see Section 3).
- Account and profile: your name, email address, date of birth, gender, height, weight and preferences, and, if you choose to give them, your resting heart rate, body fat percentage and cycling power, which are health data.
- Health screening (health data): your answers to our pre-test safety questions, the outcome, and any GP clearance form you send us.
- Test results (health data): your VO2 max test results and report, and your DEXA scan results, image and report. A DEXA report can include your ethnicity, which the scanner uses to choose reference ranges. We also keep results we calculate, such as your training zones and cardiovascular age.
- Archie (health data): your goals, training history, injuries and preferences, the plans Archie builds, the workouts you log, and your conversations with Archie. If you log a workout by voice, your browser turns your speech into text and we receive only the text, never a recording.
- Payments: what you bought, when and for how much. Your card details go directly to our payment provider, Stripe, and never reach us.
- Referrals: who referred you, if you signed up through a referral link. If you are a referral partner, your details and the commissions you earn.
- Technical and usage: your IP address, device and browser, how you use the Site and App (only if you agree to analytics), and records of sign-ins and of the consents you give.
- Communications and sign-ups: messages you send us, and the name and email address you give if you join our waitlist or sign up on the Site.
Most of this information comes from you. Our testing partners (see Section 6) also send us your details and test results, and your GP may send us a clearance form.
You are not required by law to give us your data, but we cannot provide the Services without some of it, such as your test data and health screening answers.
3. Health Data and Your Consent
When you create an account, we ask for your explicit consent to process your health and fitness data as described in this policy. That includes the health data in Section 2, the details on your DEXA report, and sharing data with our AI provider for Archie (see Section 5).
We never sell your data. We never use your health data for advertising, and we never share it with insurers or employers.
When a testing partner sends us your results, you have already agreed with them that they can share the results with us. If you do not yet have an account, we use your details only to set one up and invite you. We do not use your results for anything else until you give us your consent.
You can withdraw your consent at any time in Settings in the App. The Services cannot work without your health data, so withdrawing consent closes your account, and we delete your data as described in Section 9.
4. How We Use Your Information
We use your information:
- To provide the Services: running your account, screening you for tests, delivering your results, building your training plans, and sending you service emails. Basis: our contract with you. For health data, your explicit consent.
- To take payments and pay referral commissions. Basis: our contract with you, and our legal obligation to keep financial records.
- To send marketing emails, but only if you opt in. Basis: your consent.
- To understand how the Site and App are used, but only if you agree to analytics. Basis: your consent.
- To improve and secure the Services: for example, using aggregated statistics, comparing versions of features, preventing fraud and misuse, and fixing errors. Basis: our legitimate interest in running the Services securely and reliably.
- To meet legal obligations and handle legal claims. Basis: legal obligation, and our legitimate interest in establishing or defending legal claims.
5. Archie and AI
Archie is an AI coach. It analyses your data to build training plans and reply to your messages. This is profiling. Archie does not make decisions with legal or similarly significant effects. Its plans are guidance that you choose whether to follow.
Archie uses a third-party AI provider. Before any of your data is sent to it, we remove your name, email address and date of birth. The provider processes the data only on our behalf, does not use it to train its models, and may process it outside the UK (see Section 7).
7. International Transfers
Our main systems are in the UK. Some of our service providers (see Section 6), including our AI provider, process data outside the UK, mainly in the European Union and the United States.
Whenever we transfer your data outside the UK, it is protected by a legal safeguard. Either the UK recognises the destination as giving adequate protection (for example, the EU, or US companies certified under the UK–US data bridge), or we use standard data protection contract terms approved for UK transfers. To ask for a copy of the safeguard that applies, email [email protected].
8. How We Protect Your Information
Our servers and database are in Google Cloud’s London region. Data is encrypted in transit and at rest, and only the people who need access to deliver the Services have it.
9. How Long We Keep Your Information
We keep your information for as long as we need it to provide the Services, then delete it. In deciding how long that is, we consider how sensitive the data is, why we hold it, and our legal obligations. In particular:
- When you delete your account, we delete your data within 30 days, except the records below.
- Records for legal claims and tax: your consent records, health screening outcome and test dates, and your payment records. We keep these for 6 years, the limitation period for contract claims in England and Wales, and the period HMRC requires for financial records.
- Archie conversations are deleted 90 days after the last message.
10. Your Rights
You have the right to access, correct, delete, restrict and move your personal data, to object to how we use it, and to withdraw any consent you have given. You can delete your account yourself in Settings in the App. For anything else, email [email protected]. Making a request is free, and we will respond within one month.
You can object at any time to our use of your data based on legitimate interests (see Section 4), and we will stop unless we have compelling grounds to continue.
If you are unhappy with how we have handled your data, please tell us first. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.
12. Children
The Services are only for people aged 18 or over. We do not knowingly collect data from anyone under 18, and if we learn that we have, we will delete it.
13. Changes to This Policy
We will update the date at the top of this page whenever this policy changes. We will email you about significant changes before they take effect, and we will ask for your consent where a change needs it.