Privacy Policy

Last Updated: 21 October 2026

1. About Us

Valda Fitness is a trading name of Valda Fitness Ltd, a company registered in England and Wales (Company No: 17080349). Registered Office: 71-75 Shelton St, London WC2H 9JQ. We are registered with the Information Commissioner's Office (ICO Registration No: ZC104863). We are the "Data Controller" of your personal information.

2. Data We Collect

• Identity & Contact: Name, email address, and account credentials, collected via Clerk.
• Health & Fitness Data: Workout logs, exercise performance, and body metrics. This is Special Category Data under UK GDPR Article 9; we process this only with your explicit consent.
• Heart Rate during workouts (Wear OS & Apple Watch): If you use the VALDA watch app and grant the heart-rate permission (on Wear OS this is the Health Connect Heart rate read permission), the watch app reads your heart rate from the watch sensor while a workout you have started is running, plus a short cool-down after it ends. We use it to show your live heart rate during sets, to calculate how hard each session worked your heart (the cardio part of your session score), and to measure how quickly your heart rate recovers. You can revoke the permission at any time in your watch's settings; workout logging keeps working without it.
• Health data from Apple Health and Health Connect (optional): If you connect Apple Health (iPhone) or Health Connect (Android), VALDA reads only the data types you approve on your phone's permission screen:
  • Heart rate, resting heart rate and heart-rate variability, including beat-to-beat intervals where your device records them
  • Sleep: when you fell asleep, when you woke, and total sleep
  • Wrist or skin temperature, and basal body temperature
  • Periods, flow and ovulation test results (ValdaFREYA only)
  • Steps and workouts recorded by other apps, to estimate your everyday training load
  We use this data only to show your morning readiness, your daily training load and, if you use ValdaFREYA, your cycle phase, each compared against your own normal. VALDA can also save the workouts you log, your body weight and, if you turn it on, the period flow you log, to Apple Health or Health Connect. We never read back data that VALDA wrote itself.
• Connected wearable accounts (optional): If you connect a WHOOP, Oura or Polar account, or turn on overnight capture in the VALDA app on a Samsung Galaxy Watch, we receive only the data types shown when you connect (for example overnight heart-rate variability, resting heart rate, sleep and temperature) and use them only for the purposes above. When you disconnect, we revoke our access and delete the data we received from that service within 30 days. Data from these services is never used to train or evaluate any model and is never pooled with other members' data.
• How we protect health data: Heart rate, sleep, temperature and the other data above is Special Category Data (UK GDPR Article 9). We process it only with your explicit consent, which you can withdraw at any time in the app or in your phone's Health settings. It is encrypted in transit and at rest; the most sensitive cycle fields (flow, observations, notes, contraception, pregnancy details) and temperature readings are additionally encrypted field by field. It is never sold, never used for advertising, never used to train AI models, and never shown to other people, including groups you belong to.
• Reproductive Health Data: If you choose to use our cycle-tracking or pregnancy features, we collect the following Special Category Data (UK GDPR Article 9), processed only with your explicit consent:
  • Menstrual cycle dates and flow levels (none, spotting, light, medium, heavy)
  • Self-reported observations: energy, mood, discomfort, sleep quality, and bloating
  • Pregnancy status, estimated due date, and contraceptive method
  This data is used solely to provide you with informational context about your training patterns. It is never used to diagnose, treat, or manage any medical condition.
• Technical Data: IP address and usage logs via Vercel and Neon.
• How You Found Us: If you reach valda.fit through one of our links (for example from our Instagram, TikTok or LinkedIn, or a partner club), the link's short code travels in the page address and is saved with your account when you sign up, along with the date you signed up. If you were invited by a club or organisation, we record that instead. Before you sign up, a visit through one of our links is counted anonymously: we keep the link, the time, the referring website and the type of device, but no IP address, no cookie and nothing that identifies you. We use this only to learn which of our posts and partners bring people to VALDA. It is deleted with your account.
• Subscription Data: Managed by Paddle and RevenueCat. We do not store credit card details on our servers.

3. How We Use Reproductive Health Data

Your reproductive health data is processed for the following specific, limited purposes:

• Cycle phase display: Showing your estimated cycle phase based on the dates you log. Phase labels are calculated from your self-reported data and are approximate.
• Observation logging: Storing and displaying your self-reported observations so you can track patterns over time.
• AI coaching context: Your cycle phase, recent observations, and flow data may be included as context when generating AI coaching insights. This data is pseudonymised (your name and email are not included) and is used only to provide observational commentary (e.g., "your data shows"), never to provide medical advice or directives.
• Performance correlation: Comparing your self-reported cycle data against your workout performance to display historical trends. These correlations are observational only.
• Pregnancy information: If you enable pregnancy mode, we use your due date to display general trimester information and published research citations about exercise considerations. This is general reference material, not personalised medical advice.

We do not use your reproductive health data to: make medical assessments, provide clinical recommendations, predict fertility or ovulation for family planning purposes, share data with insurers, employers, or any third party beyond our listed data processors, or train AI models.

4. Third-Party Integrations & Transfers

We use the following partners to provide our service. Our database is hosted in the UK (London). Some partners, such as Clerk and Vercel, also process data in the US, under standard contractual clauses.

• Clerk: Identity management and authentication.
• Paddle / RevenueCat: Payment processing and subscription logic.
• Neon / Vercel: Database hosting and application infrastructure.
• Anthropic: We use AI models to provide personalised fitness coaching insights. Your health and reproductive data is pseudonymised before being sent to Anthropic — your identity is not included. This data is not used to train Anthropic's global models. Reproductive health data (cycle phase, observations, flow level) may be included as AI context solely to generate observational coaching commentary.

5. Your Rights

Under UK GDPR and the Data Protection Act 2018, you have the right to access, rectify, or erase your data. You may also withdraw consent for health data processing at any time via App Settings → Privacy. To exercise any right, contact us at privacy@valda.fit.

Reproductive health data: You may delete individual cycle logs, observations, or flow entries at any time within the app. You may disable pregnancy mode or cycle tracking at any time. Disabling these features does not automatically delete previously logged data — to request full erasure of reproductive health data, contact us at the address above.

6. Data Retention

We retain your personal data for as long as your account is active. Upon account deletion, your data — including all reproductive health data — is removed within 30 days, except where we are required to retain it for legal or accounting purposes.

Health data from connected sources: Raw beat-to-beat heart data is kept for 90 days. The nightly values we calculate from it (such as your overnight heart-rate variability and resting heart rate) are kept until you delete them or your account. Data received from a connected wearable account is deleted within 30 days of you disconnecting it.

7. Contact

For any privacy-related queries, contact our Data Controller at privacy@valda.fit.