Privacy Policy

Overview

This policy explains how we collect, use, and protect personal data when you use the Right Direction mobile application (the "App"), available on the Apple App Store and Google Play.

The App is provided by Avantra Services Ltd, a company registered in England and Wales with company number 14871429. Our registered office is Suite 1-2 Brookfield Court, Selby Road, Leeds, United Kingdom, LS25 1NB.

This policy is written to support compliance with the UK GDPR, the Data Protection Act 2018, and the privacy requirements of Apple and Google.

1. Who we are and our role

Avantra Services Ltd is the data controller responsible for the personal data described in this policy. We develop and operate the App as a fitness, nutrition, wellbeing, and programme-tracking service for members.

If you have any questions about this policy or your data, contact us at hello@avantraservices.co.uk.

2. Data we collect

We collect and use the minimum personal data needed to provide the App, maintain account access, synchronise the records you choose to keep, protect member data, and support account export and deletion.

• Account and identity data, including your name, email address, authentication-provider identifiers, optional profile photograph, and account timestamps.
• Programme and fitness data, including the programme and plan you select, workout history, completion time, watched duration, exercise type, optional effort rating, optional private note, and progress summaries.
• Nutrition and hydration data, including food entries, serving quantities, estimated calories and nutrients, nutrition settings, product barcodes you ask us to look up, and water entries.
• Sleep data, including sleep start and end times you enter manually and, if you connect Apple Health or Health Connect and grant access, recent sleep-session information read from that platform.
• Optional cycle-tracking data, including period start and end dates and any cramps, low energy, or headache symptoms you choose to record.
• Preferences and service data, including reminder times, health-connection choices, saved content, offline-workout download status, app settings, synchronisation state, export and deletion requests, and security records needed to prevent misuse and safely retry operations.
• Technical data processed during normal service use, such as Firebase authentication security data, IP address, user agent, app and device information, and video-playback performance information. We do not include Firebase Analytics or Firebase Crashlytics in the App.

3. Tracking, advertising, and data we do not collect

• We do not collect payment card details.
• We do not sell personal data.
• We do not use third-party advertising.
• We do not use collected data for cross-app tracking or targeted advertising.
• We do not use IDFA-based advertising tracking.
• The barcode scanner decodes retail barcode numbers on your device. It does not take, store, or upload a photograph.
• Searching the in-app Help Centre does not send us the words you type, member identifiers, health data, or app logs. If you choose to email support, your email app controls the message you send.
• We do not knowingly collect personal data from children under 13.

4. Third-party services we use

We use the following providers only where needed to deliver the relevant App or website function. They may process technical information such as an IP address or device information when you connect to their service.

• Google Firebase: Firebase Authentication, Cloud Firestore, Cloud Storage, and Cloud Functions provide sign-in, synchronised app records, private profile-photo and export storage, server-side access checks, and account lifecycle functions. Firebase Authentication may process email address, authentication identifiers, IP address, and user-agent information for account security and abuse prevention.
• Apple and Google: Sign in with Apple and Google Sign-In are optional account sign-in methods. Apple operates Apple Health on iOS, and Google operates Health Connect on Android. Health access is optional, permission-based, and limited to the data types described in this policy.
• Mux: provides signed workout-video streaming and offline acquisition. Mux Video processes playback requests, and Mux Data receives pseudonymised playback, device, coarse-location, and quality-of-experience information. Mux says pseudonymised video-view data is retained for up to 100 days and is not used for advertising.
• Open Food Facts: when you scan or type a product barcode and request a lookup, the barcode and ordinary network-request information are sent to its public product API. Returned product and nutrition information is community-sourced and you review it before saving.
• Vercel: hosts our public legal-information website and may process ordinary web request, security, and hosting logs when you visit it.
• Apple App Store and Google Play: distribute the App and operate their own store accounts, review systems, and any future in-app purchase processing under their own privacy terms.

5. Why we use your data and our legal basis

Under the UK GDPR we rely on the following legal bases:

• Performance of a contract: to create and maintain your account, authenticate you, provide the App's core functionality, and make your programme, fitness, nutrition, hydration, sleep, and wellbeing records available to you.
• Legitimate interests: to keep the App and member data secure, prevent misuse, maintain reliability, understand video-playback failures, provide support, and improve the service in a way that is balanced against your rights.
• Consent: for optional features that you choose to enable, such as a profile photograph and health-platform access. You can withdraw a device permission in system settings and turn optional features off in the App.
• Explicit consent for special-category data: when you make a separate affirmative choice to enable optional health or cycle features. You can withdraw that consent by disconnecting the feature or contacting us. Withdrawal does not affect processing already carried out lawfully, and manual fitness and wellbeing features remain available where applicable.
• Legal obligation: where we are required by law to retain, disclose, or otherwise process data.

6. How we share data

We share personal data only where needed to provide the App, comply with law, or protect our rights and users.

• With the service providers listed in this policy where they process data for app operation.
• With Apple and Google as app platform, authentication, distribution, and optional health-platform providers.
• With Mux for protected video delivery and playback-quality monitoring, and with Open Food Facts only when you request a barcode lookup.
• With authorities, regulators, legal advisers, or professional advisers where required by law or necessary to protect legal rights.

7. International transfers

Some providers may process data outside the UK. Where this happens, we rely on appropriate safeguards, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, standard contractual clauses, or an adequacy decision.

8. Data retention

We keep account and synchronised App data while your account is active. You can remove individual nutrition, hydration, sleep, cycle, and workout records using the available App controls, and you can request account deletion from Account > Privacy & data.

A prepared data-export file is available for 24 hours. Account deletion removes first-party member records, private profile photographs, prepared exports, protected offline downloads, local account-scoped data, and the Firebase Authentication account. A payload-free, pseudonymous deletion-status record may be retained for up to 30 days so we can evidence and safely recover the deletion lifecycle.

Records already written to Apple Health or Health Connect remain under your control in that platform and are not deleted by deleting the App account. Some records may remain in protected backups until the applicable backup cycle expires, after which they are put beyond use or deleted unless retention is legally required.

9. Your rights

Under UK data protection law you have the right to access, correct, delete, restrict, or object to our processing of your data, the right to data portability, and the right to withdraw consent where processing is based on consent. You can delete your account from within the App, or contact hello@avantraservices.co.uk about access, correction, or deletion.

You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

10. Security

We use appropriate technical and organisational measures, including encryption in transit, access controls, and secure authentication flows, to protect your data. No method of transmission or storage is completely secure, but we work to protect your information and to notify you and the regulator of any breach where legally required.

11. Health, fitness, and nutrition data

Fitness, workout, nutrition, sleep, and cycle information can be sensitive and may reveal information about your health. Optional health and cycle features are not enabled automatically.

If you grant health-platform access, the App reads recent sleep sessions to show them in the sleep experience and writes only completed Right Direction workouts after you opt in. It does not request broad access to all health records. You can pause or revoke access using the App and your device settings.

Cycle tracking records only the dates and symptoms you choose to enter. It does not predict fertility, ovulation, or cycle phases and does not automatically change your workouts.

The App supports personal tracking and general fitness and nutrition information. It is not a medical device and is not a substitute for medical advice, diagnosis, or treatment.

12. Children

The App is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it where required.

13. Changes to this policy

We may update this policy from time to time. We will post the updated version with a revised last updated date and, where changes are significant, notify users within the App or by another appropriate method.

14. Contact

Avantra Services Ltd

Suite 1-2 Brookfield Court, Selby Road, Leeds, United Kingdom, LS25 1NB

Company number 14871429 (England and Wales)

Email: hello@avantraservices.co.uk