Privacy Policy

Workout Titan Limited is duly registered and incorporated under the laws of England and Wales. Our company is listed with Companies House under registration number 15657325. Registered with the ICO under registration number ZB796869. We, Workout Titan Limited ("us", "we", or "our"), operate the website found at https://www.workouttitan.com, the Basecamp coaching platform found at https://www.basecamp.workouttitan.com, and the mobile application available for download on the Apple App Store, for iOS and iPadOS, and on the Google Play Store, for Android, collectively referred to as the "Service".

This page serves to inform you of the legal policies and guidelines related to the collection, use and disclosure of personal data when you use our Service. It outlines the types of data we collect, the purposes for which such data is used, and the rights and choices you have in relation to your personal data. We take great care to ensure that all collection, use, and disclosure of personal data is conducted in accordance with applicable laws and regulations. This Privacy Policy is provided for your information; it is a notice rather than a contract, and using the Service does not by itself constitute agreement to it or consent to our processing of your personal data. Where the law requires your consent for a particular use of your personal data, we ask for it separately, as explained in the Legal Basis section below.

We use your data to provide and improve the Service, on the lawful bases set out below. Unless otherwise defined in this Privacy Policy, the terms used in this Privacy Policy have the same meanings as in our Terms of Service, accessible from https://www.workouttitan.com/terms-of-service.

Service: Service is the https://www.workouttitan.com website, the Basecamp coaching platform at https://www.basecamp.workouttitan.com, and the Workout Titan mobile application for iOS, iPadOS and Android, operated by Workout Titan Limited
Coeus: Coeus is the AI assistant built into the Basecamp coaching platform, described under Basecamp and Coeus Service Providers below
Personal Data: Personal Data means data about a living individual who can be identified from those data (or from those and other information either in our possession or likely to come into our possession)
Usage Data: Usage Data is data collected automatically either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit)
Cookies: Cookies are small files stored on your device (computer or mobile device)
Data Controller: Data Controller means the natural or legal person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal information are, or are to be, processed. For the purpose of this Privacy Policy, we are the Data Controller of your Personal Data
Data Processors (or Service Providers): Data Processor (or Service Provider) means any natural or legal person who processes the data on behalf of the Data Controller. We may use the services of various Service Providers in order to process your data more effectively
Data Subject (or User): Data Subject is any living individual who is using our Service and is the subject of Personal Data

Workout Titan Limited gathers a variety of information for different purposes, aiming to enhance and deliver our Service to you.

While using our Service, we may ask you to provide us with, or you may record in the Service, certain information about you ("Personal Data"). This may include, but is not limited to:

First name and last name
Email address
Health and fitness information you record: your weight, body measurements, nutrition and hydration logs, and your training programme and its history
Videos you upload and their written descriptions: for coaches, the coaching videos recorded for clients, including the appearance and voice of anyone who features in them and the captions generated from what is spoken
Cookies and Usage Data

By opting in, we may utilise your Personal Data to reach out to you with newsletters, marketing materials, promotions, and other relevant information. You retain the right to opt out of receiving any or all of these communications by utilising the unsubscribe link or following the provided instructions in any email correspondence, or by contacting us directly. Please note, certain essential communications such as system alerts or those mandated by law may still be sent to you regardless of your communication preferences.

We may also collect information on how the Service is accessed and used ("Usage Data"). This Usage Data may include information such as your computer's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Service that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers, and other diagnostic data.

We use cookies and similar technologies on our website and in Basecamp. Only those that are strictly necessary are set regardless of your choice; everything else — remembering your preferences, aggregated analytics, and session recording and surveys — is set only if you consent to that category, and you can change or withdraw your choice at any time. Our Cookies Policy lists each cookie individually, what it is for and how long it lasts.

Where a cookie or similar technology is not strictly necessary, we ask for your consent before it is set, and we offer an equally straightforward way to decline. If we introduce a new purpose, we update our Cookies Policy first and ask for your consent again before anything new is set.

You can also direct your browser to reject cookies or to notify you when one is being sent. Declining non-essential cookies does not limit your use of the website or of Basecamp, though the strictly necessary cookies described in our Cookies Policy are required for sign-in and security to work.

For further details regarding our use of cookies and other cookie-based tracking technologies, please consult our Cookies Policy.

Where we rely on your consent — for non-essential cookies and for Coeus — we ask for it separately from anything else and record what you agreed to and when. You can review or withdraw each of these at any time: cookie choices through the "Cookie settings" link in the footer of the website and of the Basecamp landing page, or under Manage account once you are signed in; and your Coeus consent under Manage account. Withdrawing applies from the point you withdraw. Some processing does not rely on consent and continues regardless — where that is so, the Legal Basis section explains what we rely on instead.

Workout Titan Limited uses the collected data for various purposes:

To provide and maintain our Service
To notify you about changes to our Service
To allow you to participate in interactive features of our Service when you choose to do so
To provide customer support
To provide coaching features, including AI-assisted suggestions through Coeus where you have consented to it
To make the Service accessible, including generating captions for coaching videos so that they can be followed without sound
To gather analysis or valuable information so that we can improve our Service
To monitor the usage of our Service
To detect, prevent and address technical issues
To provide you with news, special offers and general information about other goods, services and events which we offer that are similar to those that you have already purchased or enquired about unless you have opted not to receive such information

The lawful basis on which we collect and use the personal data described in this Privacy Policy depends on the data concerned and the context in which we collect it. Workout Titan Limited is established in the United Kingdom and is regulated by the Information Commissioner's Office; where you are located in the European Economic Area, the equivalent provisions of the EU GDPR apply.

Workout Titan Limited may process your Personal Data for the following reasons:

Contractual Necessity: We may process your Personal Data when it is necessary to fulfil a contract with you or to take steps at your request prior to entering into a contract.
Consent: In some instances, we may process your Personal Data on the basis of your consent. Where the data is a special category — see Health and Related Data below — we ask for explicit consent. You have the right to withdraw consent at any time.
Legitimate Interests: We may process your Personal Data for legitimate interests pursued by us or a third party. This processing will be conducted in a manner that does not infringe upon your fundamental rights and freedoms. You have the right to object to such processing.
Legal Compliance: We may process your Personal Data to comply with legal obligations to which we are subject. This may include obligations arising from applicable laws, regulations, court orders, or governmental requests.
Protection of Vital Interests: In exceptional circumstances where it is necessary to protect your vital interests or those of another individual, we may process your Personal Data.

Some of what Workout Titan records concerns your body and your health: your weight, your body measurements, and the nutrition and hydration you log. Under the UK GDPR this is a special category of personal data, and we treat it with the additional care that requires.

Coeus's use of this information is something we ask you to consent to explicitly. We ask before Coeus becomes available to you, separately from anything else, and you can decline without losing the rest of the Service.

We record what you agreed to and when. You can withdraw your consent at any time under Manage account, without giving a reason. Withdrawing stops Coeus using your information from the point you withdraw, and the rest of the Service carries on working. Withdrawing does not undo processing that has already taken place.

Where a coach records this information about a client, the client's own consent governs it. A coach cannot consent on a client's behalf.

Workout Titan Limited does not currently have a designated Data Protection Officer (DPO). We are committed to complying with all applicable data protection laws and regulations, including the UK GDPR. While we do not have a DPO at this time, we are dedicated to protecting your privacy rights and ensuring the security of your personal data. If you have any questions or concerns regarding our data processing practices or this Privacy Policy, please feel free to contact us using the information provided at the bottom of this documentation.

Workout Titan Limited retains personal data only for as long as necessary to fulfil the purposes outlined in this Privacy Policy unless a longer retention period is required or permitted by law.

We will retain and use your personal data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

Workout Titan Limited will also retain Usage Data for internal analysis purposes. Usage Data is generally retained for a shorter period, except when this data is used to strengthen the security or to improve the functionality of our Service, or we are legally obligated to retain this data for longer time periods.

Personal Data collected for the purposes of fulfilling a contract between the Data Subject and the Data Controller will be retained until such time as the contract has been completed and any necessary post-contractual obligations fulfilled.

Personal Data collected for the purposes of the Data Controller's legitimate interests will be retained for as long as necessary to achieve those interests, unless the Data Subject objects to such processing, in which case the data will be deleted unless there are compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the Data Subject.

Records of cookie consent are retained for 24 months from the date of the decision. Where you accept, decline or change your cookie choice, Workout Titan Limited stores that decision together with a random consent reference, the version of the cookie categories in effect at the time, the time of the decision and the user-agent string of the browser used. This record is kept in order to demonstrate that consent was given or refused, as required by Article 7(1) of the UK GDPR. The lawful basis for retaining it is our legal obligation, together with our legitimate interest in being able to evidence the choices made, and it is therefore retained whether you accept or decline. The record is not linked to your identity unless you were signed in to Basecamp at the time, in which case it is associated with your account. Upon expiry of the 24-month period the record is deleted automatically.

Coeus conversations are stored on our servers rather than on your device, so that a conversation continues across sessions and so that we can review it for safety, for abuse prevention and to improve the service. They are kept until you delete them; you can delete a conversation at any time from within Coeus.

Upon expiry of the retention period, or when the user requests deletion of their data, Workout Titan Limited will securely delete or anonymise the data in a manner designed to prevent its reconstruction or access by unauthorised individuals.

Users can request the deletion of their data by contacting Workout Titan Limited using the contact information provided in this Privacy Policy.

Please note that some data may be retained if necessary to comply with legal obligations or to resolve disputes.

Coaching videos are held by Mux rather than in our own database. When a coaching video is deleted, we delete the record of it in Basecamp and instruct Mux to delete the video itself, which removes the recording, its thumbnail and any captions generated from it.

Your information, including Personal Data, may be transferred to and maintained on computers located outside your country or other governmental jurisdiction where the data protection laws may differ from those of your jurisdiction.

If you are located outside the United Kingdom and choose to provide information to us, please note that we transfer the data, including Personal Data, to the United Kingdom and process it there.

Workout Titan Limited will take all the steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy and no transfer of your Personal Data will take place to an organisation or a country unless there are adequate controls in place including the security of your data and other personal information.

Some of the service providers named in this policy are located outside the United Kingdom, in particular Vercel, Mux, Atlassian, Anthropic, RevenueCat and Expo in the United States, and Sanity in Norway. Where personal data is transferred outside the UK, we rely on recognised lawful transfer mechanisms: transfers to Norway and the wider European Economic Area are covered by UK adequacy regulations, and transfers to the United States are made under the UK Extension to the EU–U.S. Data Privacy Framework where the provider holds a current certification, or otherwise under the UK International Data Transfer Agreement or Addendum incorporating standard contractual clauses, in each case together with technical safeguards such as encryption of data in transit.

Under certain circumstances, Workout Titan Limited may be required to disclose your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

Workout Titan Limited may disclose your Personal Data in the good faith belief that such action is necessary to:

To comply with a legal obligation
To protect and defend the rights or property of Workout Titan Limited
To prevent or investigate possible wrongdoing in connection with the Service
To protect the personal safety of users of the Service or the public
To protect against legal liability

At Workout Titan Limited, we prioritise the security of your data. However, it is important to note that no method of transmission over the Internet or electronic storage is completely secure. Despite our efforts to employ commercially acceptable means to safeguard your Personal Data, we cannot provide a guarantee of its absolute security.

We implement various security measures to protect your data from unauthorised access, alteration, disclosure, or destruction. These measures include:

Encryption: We use encryption protocols to secure the transmission of data between your device and our servers.
Access Controls: We restrict access to your Personal Data to authorised personnel only, who are bound by confidentiality obligations.
Review: We review our security practices and assess them for vulnerabilities, and improve them as our Service develops.
Data Minimisation: We only collect and retain the minimum amount of Personal Data necessary to fulfil the purposes outlined in our Privacy Policy.

Despite these precautions, it is important to be aware that no security measure can guarantee complete protection against all threats. We continuously strive to enhance our security measures and stay abreast of the latest developments in cybersecurity to mitigate risks and ensure the integrity of your data.

If you have any concerns about the security of your data or suspect any unauthorised access or misuse, please contact us immediately.

In the unfortunate event of a data breach compromising the security of personal data, Workout Titan Limited is committed to promptly notifying affected individuals and relevant authorities in accordance with applicable laws and regulations. Our response to a breach includes assessing the scope and impact of the breach, mitigating risks to affected individuals, and implementing measures to prevent future incidents. We prioritise transparency and accountability throughout the breach notification process to ensure the protection of user data and uphold trust in our services.

You have a number of rights over the personal data we hold about you, and Workout Titan Limited takes reasonable steps to allow you to access, correct, amend, delete or restrict the use of your Personal Data. These rights apply if you are in the United Kingdom, under the UK GDPR, and equivalently if you are in the European Economic Area, under the EU GDPR.

For inquiries regarding the Personal Data we retain about you or to request its removal from our systems, please contact us. Furthermore, you may initiate the deletion of your Workout Titan Limited account and all associated personal data through the account-related settings section.

In certain circumstances, you have the following data protection rights:

The right to access, update or delete the information we have on you: Whenever made possible, you can access, update or request deletion of your Personal Data directly within your account-related settings section. If you are unable to perform these actions yourself, please contact us using the information provided at the bottom of this documentation.
The right of rectification: You have the right to have your information rectified if that information is inaccurate or incomplete.
The right to object: You have the right to object to our processing of your Personal Data.
The right of restriction: You have the right to request that we restrict the processing of your personal information.
The right to data portability: You have the right to be provided with a copy of the information we have on you in a structured, machine-readable and commonly used format.
The right to withdraw consent: You also have the right to withdraw your consent at any time where Workout Titan Limited relied on your consent to process your personal information.

We do not make decisions about you solely by automated means that produce legal effects or similarly significantly affect you. Coeus produces suggestions and drafts; a person — you, or your coach — decides what to act on.

Please be advised that in order to ensure the security and integrity of your personal information, we may require you to provide identification and authentication prior to fulfilling any requests related to your personal data. This verification process is intended to safeguard your data and prevent unauthorised access.

If you have concerns or complaints regarding our data processing practices or the handling of your personal data, you can contact us using the information provided below.

We take all complaints seriously and will investigate and address them promptly in accordance with our internal procedures and legal obligations. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office, the UK supervisory authority for data protection, at https://ico.org.uk/make-a-complaint/. If you are in the European Economic Area, you may instead complain to the supervisory authority in your country.

To facilitate our Service, Workout Titan Limited may engage third-party companies and individuals ("Service Providers") to perform various tasks on our behalf, including providing the Service, conducting Service-related activities, and analysing Service usage.

These third-party providers may have access to personal data as required for the performance of their services. However, they are contractually obligated to utilise such data solely for the purposes specified by Workout Titan Limited and to implement appropriate security measures to safeguard the data. Additionally, we may share personal data with third parties for legal or regulatory compliance purposes, such as responding to lawful requests from public authorities or enforcing our legal rights.

For the website specifically, we use the following service providers. They receive only the technical data necessary to deliver their part of the website to you, such as your IP address, browser type and the pages requested. Of these, only Contentsquare sets cookies on our website, and only if you have allowed session recording and surveys:

Vercel Inc. (United States) hosts and serves the website, and provides the cookieless, aggregated analytics and performance measurement described in our Cookies Policy, which runs only with your consent.

Sanity AS (Norway) provides our content management system; the text and images on our pages are delivered from Sanity's global content delivery network.

Mux Inc. (United States) streams the videos embedded in our pages. When a page containing a video loads, your browser requests the video from Mux, which receives your IP address as a necessary part of delivering the stream.

Atlassian Corporation (Statuspage, United States) provides the service-status indicator shown in our website footer, which your browser retrieves directly from Atlassian's status service.

Contentsquare — the trading name of Content Square Ltd, a company registered in England and Wales under number 09825744 with its registered office at 6 St Andrew Street, London EC4A 3AE — provides the session recording and on-site surveys described in our Cookies Policy. These load only if you separately allow session recording and surveys, which is a different permission from analytics, and only on our public landing pages — never once you are signed in to Basecamp. Content Square Ltd acts as our processor and may use what it collects only to provide the service to us. The data it collects for us is processed and stored in the European Economic Area, in Ireland. It is kept for 13 months; session recordings are deleted after one month; IP addresses are not stored in Contentsquare's databases and are removed from its short-term technical logs after three days. Where any personal data is transferred beyond the UK or the EEA, that transfer relies on an adequacy decision or on the Standard Contractual Clauses incorporated into our data processing agreement with Content Square Ltd.

Details of the cookies and similar technologies used on the website, and the consent choices available to you, are set out in our Cookies Policy.

Basecamp is our coaching platform, where training programmes, nutrition logs, hydration, weight and body measurements are recorded and where coaches and clients message each other. Coeus is the AI assistant built into it. These providers support that:

Supabase, Inc. (United States) provides accounts, sign-in and the database behind Basecamp. The records described above are stored in our Supabase project, which is hosted in London, in the United Kingdom.

Vercel Inc. (United States) hosts and serves Basecamp, in the same way that it hosts our website.

Mux Inc. (United States) stores and streams the coaching videos uploaded in Basecamp, as well as the videos embedded in our website pages. When a coach uploads a video it is sent to Mux, which prepares it for playback and holds it until it is deleted. A video records the appearance of anyone who features in it and, where it is narrated, their voice.

Captions on coaching videos. So that a client who is deaf or hard of hearing, or who simply cannot play sound, can still follow a demonstration, Mux generates captions automatically from a video's audio. The transcription is done by machine, without a person listening to the recording, and produces a written record of what is spoken, which is stored with the video at Mux and shown as subtitles during playback. Mux acts as our processor and may use what it receives only to provide the service to us. A video with no audio track is not transcribed. Coaches should bear in mind that whatever they say while recording is written down in that transcript, so please do not narrate anything about a client that you would not want stored alongside the video.

Anthropic PBC (United States) provides Claude, the AI model behind Coeus. When Coeus is used, what is typed into it and the Workout Titan records it reads in order to answer are sent to Anthropic, which processes them on our behalf under contract and may not use them for its own purposes. For a coach this can include a client's weight history, calorie and macronutrient targets, the coach's written notes about them, and the message thread between them. Coeus does not read body measurements, nutrition logs, hydration logs or end-of-day notes.

Turning Coeus off. Clients can switch off the use of their data by Coeus at any time, under Manage account. From that point their records are excluded from their coach's Coeus: they no longer appear in the client list it works from, and their programmes, logs, notes and messages are not read by it. Switching this off does not stop a client using Coeus themselves — it governs only what their coach's Coeus can see. Conversations a coach held with Coeus before that point may still contain information from earlier.

Who is responsible for your data. Workout Titan Limited is the data controller for everything described in this policy, including the records a coach creates about a client on the platform. Your coach is a user of our platform rather than a separate controller: they can see and edit the records of clients assigned to them, but the purposes and the means of the processing are ours. If a coach takes information outside Workout Titan and uses it for their own purposes, they are responsible for that, and we are not.

The Workout Titan mobile application for iOS, iPadOS and Android does not use cookies, and the cookie choices described in our Cookies Policy do not apply to it. It does rely on the following service providers, each of which receives only what its part of the app requires:

Supabase, Inc. (United States) provides the accounts, sign-in and database behind the app. Your account details, and the training, nutrition, hydration and body measurement records you create, are stored in our Supabase project, which is hosted in London, in the United Kingdom.

RevenueCat, Inc. (United States) manages subscriptions and in-app purchases. When you subscribe, restore a purchase or open the app, RevenueCat receives an identifier for your installation, the details of the purchase and basic device information, so that we can tell which features your subscription entitles you to. It does not receive your card details — those remain with Apple or Google, as described under Payment Processing below — and it does not receive your training, nutrition or measurement data.

Expo, Inc. (United States) provides the framework the app is built on and delivers app updates. Its analytics component reports aggregate usage and performance information, such as the app version, device model and operating system, so that we can see which builds are in use and where the app is failing. It does not report the content of what you log.

Apple Inc. and Google LLC deliver push notifications to your device. To send you a notification we register your installation with Apple's or Google's notification service and store the identifier it returns. That identifier is specific to your installation of our app, and it is removed when you turn notifications off or uninstall.

On your device. The app keeps your sign-in tokens in the operating system's secure storage — the iOS Keychain or the Android Keystore — and holds your app preferences and a working copy of recently viewed content in ordinary app storage. All of it is removed when you uninstall the app.

Permissions the app asks for. The camera is used to scan the barcode on a food product so that it can be matched against our nutrition database. The photo library is used when you choose an image or video to attach. The microphone is used only by features that record audio, and only while you are using them. Each permission is requested the first time it is needed, you can decline, and you can change your answer later in your device settings — declining the camera simply means entering foods by hand instead.

All payments for subscriptions and in-app purchases are securely processed through the Apple App Store or Google Play Store, depending on the platform you use. Workout Titan Limited does not directly handle or store payment information such as credit card details. For more details on how these platforms manage your payment data, please review their respective privacy policies:

Apple Privacy Policy: https://www.apple.com/legal/privacy/
Google Privacy Policy: https://policies.google.com/privacy

Additionally, personal data may be shared with third parties when required for legal or regulatory compliance, such as responding to lawful requests from public authorities or protecting our legal rights.

Workout Titan Limited is established in the United Kingdom and complies with the UK General Data Protection Regulation, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR). Where the EU General Data Protection Regulation applies to our processing, we comply with that as well. We review this policy and our privacy practices as our services change.

Our Service may contain links to other sites that are not operated by us. If you click a third-party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services.

Our Service is not intended for, or directed at, individuals under the age of 16 ("Children"). We have a zero-tolerance policy towards the collection of personal information from Children without the explicit consent of a parent or legal guardian. If we become aware that a Child has provided us with personal information, we will take immediate steps to remove such information from our servers and databases. Coeus, the AI assistant, is available only to users aged 18 or over.

We strongly advise parents and guardians to monitor their children's online activity, and to contact us immediately if they become aware that a child has provided us with personal information.

We take the protection of Children's personal information very seriously and will not hesitate to take all necessary measures to safeguard their rights and privacy.

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy and modifying the "last updated" date on this page.

Where a change materially affects how we use your personal data, we will give you notice — by email or by a prominent notice on the Service — before it takes effect. Minor corrections and clarifications are published on this page with an updated revision date.

You are advised to review this Privacy Policy periodically. Changes take effect when they are posted on this page, except where we have told you above that we will give you notice first.

If you have any questions about this Privacy Policy, or wish to exercise any of the rights described above, please contact us at legal@workouttitan.com. We will respond within one month, as required by the UK GDPR, and will tell you if we need longer because your request is complex.

Definitions

Information Collection and Use

Types of Data Collected

Personal Data

Usage Data

Tracking and Cookies Data

Use of Data

Data Protection Officer (DPO)

Retention of Data

Retention Period

Deletion of Data

Transfer of Data

International Transfer Safeguards

Disclosure of Data

Disclosure for Law Enforcement

Legal Requirements

Security of Data

Data Breach Notification

Lodging Complaints

Website Service Providers

Basecamp and Coeus Service Providers

Mobile Application Service Providers

Payment Processing

Regulatory Compliance Statements

Links to Other Sites

Children's Privacy

Changes to This Privacy Policy

Contact Us

Change log