Alex. Privacy Policy

Version 1.0 · Last updated: 1 October 2026

This policy explains how GWB Technologies Ltd collects and uses your personal data when you use the Alex app and website, whether as a member, as the client of a personal trainer, or as a personal trainer using Alex PT. It is written to meet our duties under the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

1. The short version

• →We use your data to coach you. We never sell it and never use your health data for advertising.
• →Health information (such as training, nutrition, sleep, weight, cycle, glucose and injury information) is special category data. We only process it with your explicit consent, which you give on separate screens in the app and can withdraw at any time.
• →Your coaching chats are processed by AI providers (Anthropic, and OpenAI for search and as a backup). They act on our instructions and may not train their models on your data.
• →We will only use your data to train an AI model of our own if you switch on Help improve Alex. It is off by default.
• →If you have a personal trainer, they only see what is described in section 9. They cannot see your screening answers, cycle data or private AI chats.
• →You can download or delete your data at any time, including on the web at www.getalex.app/delete-account.

2. Who we are and how to contact us

GWB Technologies Ltd (trading as "Alex."), company number 17278675, registered office 167–169 Great Portland Street, 5th Floor, London, W1W 5PF, is the controller of your personal data except where section 9 says otherwise. ICO registration number: ZC252989.

Privacy questions and requests: hello@getalex.app (subject "Privacy"), or Settings → Privacy in the app.

Data protection lead: our founder, George Bradbury, is responsible for data protection. We have assessed whether the law requires us to appoint a Data Protection Officer (DPO). Although we process health data, our processing is not currently on a scale that requires one. We will review this as Alex grows and will update this policy if we appoint a DPO.

Alex is currently available only to people aged 18 or over who live in the UK.

3. What we collect

Information you give us

• →Account details: name, email, password (stored hashed by our database provider), date of birth, phone number (if you choose SMS/WhatsApp messages), country.
• →Profile and goals: sex, height, weight, experience level, goals, available equipment, schedule and preferences.
• →Health screening (PAR-Q style): answers about heart conditions, chest pain, dizziness, blood pressure, pregnancy, injuries, medication (whether you take any, not the details), eating disorders and similar questions.
• →Logs: workouts, food and drink, weight and body measurements, sleep, mood and energy, soreness and injuries, and (if you choose) menstrual cycle information.
• →Photos and videos: food photos (sent to our AI provider to estimate nutrition and not stored permanently), progress photos (stored privately in your account), and exercise technique videos you share with a coach (private, not analysed by AI, and automatically deleted after 90 days).
• →Messages: your chats with the AI coach, and messages with your personal trainer (if you have one).
• →Support and complaints: what you tell us when you contact us.

Information from services you connect (only if you connect them)

• →Apple Health (HealthKit): workouts (with average and maximum heart rate), sleep, steps, weight, heart rate variability, resting heart rate, VO2 max, blood oxygen, breathing rate, and the energy you burn (active and resting), depending on what you allow. We only read from Apple Health. We never write to it.
• →Google Health Connect, if we offer it on Android: for example steps, workouts, heart rate and sleep, depending on what you allow.
• →Garmin: activities, heart rate, sleep, stress and similar data. If you ask us to, we also send workouts to Garmin.
• →Dexcom or FreeStyle Libre (LibreView/LibreLinkUp): glucose readings and trends. To retrieve them, we store the login details you give us for that account, encrypted, and use them only to fetch your readings (section 8).

Information from others

• →Your personal trainer: if you join a coach using their code, the programmes, notes and check-in feedback they give you.
• →Stripe: confirmation of your subscription status and payments. We never see your full card details.

Information collected automatically

• →Device and app information (device model, operating system, app version, language, time zone), IP address, log and security data, crash and error reports, and how you use features. See section 13 and our Cookie Policy.

We do not use HealthKit, Health Connect, Garmin or glucose data for advertising or marketing, we do not share it with advertisers or data brokers, and we do not store it in iCloud.

4. Your consent choices

We ask for these separately, with a clear on/off choice, and never pre-ticked:

Health data and AI processing of it are one consent, because the AI coach is how we use your health information to coach you. You can withdraw any consent at any time in Settings → Privacy or by emailing us. Withdrawing consent does not affect processing we carried out before you withdrew it. If you withdraw your health data consent, the features that depend on it will stop working, but we will not stop you cancelling or downloading your data.

5. What we use your data for, and our lawful bases

Where we rely on legitimate interests, we have balanced our interests against yours. You can ask us for details and you have the right to object (section 12).

6. The AI coach and AI providers

• →Anthropic (Claude) generates most coaching responses. When you use the coach we send your message and the relevant context it needs (for example your goals, recent logs and screening-based safety limits) to Anthropic.
• →OpenAI is used in two limited ways: (1) to turn your message into a numerical "embedding" so we can find relevant research in our knowledge base; and (2) as a backup (GPT-4o mini) that answers with the same context if Anthropic is unavailable.
• →We send only what is needed to answer you and we do not send your name or email address with the context.
• →Under our contracts, Anthropic and OpenAI process this data only to provide their service to us. They are not permitted to train their models on it. They may keep it for a short time (currently up to 30 days) to detect misuse, and longer only if content is flagged for breaking their usage policies (Anthropic may keep flagged content for up to 2 years), or if the law requires it.
• →Both providers are based in the USA. See section 11 for how your data is protected.
• →Automated decisions. Alex's AI personalises your plan and our safety rules may automatically limit certain programmes (for example restricting high-intensity training or calorie deficits based on your screening). These decisions do not have a legal effect on you, but because they use health data, you can ask for a human to review any such decision, express your view, and challenge it by contacting us. We will respond within one month.

7. Training our own AI models (optional)

If, and only if, you switch on Settings → Help improve Alex, we may use your coaching conversations, logs and related health data to train, fine-tune and evaluate AI models built and controlled by GWB Technologies Ltd, to make Alex's coaching safer and more accurate.

• →This is off by default, is based on your explicit consent (UK GDPR Art 9(2)(a)), and is never a condition of any plan.
• →Before any training, we remove direct identifiers such as your name, email and contact details, and we apply measures to minimise personal information in training data and to stop models reproducing it.
• →We will not share your training data with anyone else to train their models, and we will not sell it.
• →You can switch it off at any time. From then on, we will exclude your data from any future training or evaluation. Please be aware that it is not technically possible to remove the influence of your data from a model that has already been trained. This is why we ask for your consent separately and in advance.

Separately, we may create anonymised, aggregated statistics (for example "average weekly training volume across members") that cannot identify you, to improve the Service. Anonymised data is not personal data.

8. Connected services

• →Apple Health / Google Health Connect. When you first connect Apple Health, we show you what we read and why before Apple's own permission screen, and we ask for your health data consent if you have not already given it. You then choose which data types to share, and you can change this at any time in Settings > Health > Data Access & Devices > Alex on your iPhone. We read only the types you allow. Data from HealthKit is used only to provide and improve your coaching and is never used for advertising or sold.
• →Garmin. You connect through Garmin's own authorisation screen. Garmin is an independent controller of the data it holds. When we send workouts to Garmin at your request, Garmin's terms and privacy policy apply to that data.
• →Dexcom and LibreView (glucose monitors). To retrieve your readings, you give us your Dexcom Share or LibreLinkUp login. We store it encrypted, use it only to fetch your glucose data, never share it, and delete it immediately when you disconnect or delete your account. Dexcom and Abbott are independent controllers of the data they hold. Glucose information in Alex is for general wellness insight only and must not be used for diabetes management or treatment decisions.
• →Calendar (coaches only). A personal trainer can connect their Google or Microsoft calendar so client bookings appear there. Google and Microsoft are independent controllers of the coach's calendar data.

You can disconnect any service in Settings → Connected apps. Data already imported stays in your account until you delete it or your account.

9. Personal trainers and coaches

If you are a client. If you join a coach using their code:

• →Your coach can see: your name and profile, goals, training logs and programme progress, food and nutrition logs, weight trend, check-ins, progress photos you choose to share, technique videos you send, and messages between you.
• →Your coach cannot see: your health screening answers, cycle data, glucose data, or your private chats with the AI coach. Instead they may see a general flag, such as "modified programming advised", so they can coach safely.
• →Roles. We are the controller of your Alex account and app data. When you connect a coach, we share the information above with them at your request, and the coach becomes an independent controller of the information they receive and the records they keep about coaching you. The coach must give you their own privacy information. Where a coach keeps their own records in Alex PT (for example private coaching notes), we store them on the coach's behalf as their processor.
• →You can disconnect your coach at any time in Settings → My coach. They will then stop receiving new data. Records the coach already holds are their responsibility, and you can ask them for access or deletion.

If you are a coach. We are the controller of your coach account, profile, directory listing, verification documents (qualifications and insurance), subscription and platform fee records. Our Coach Terms explain how we act as your processor for your client records.

10. Who we share your data with

• →Service providers (processors) who help us run Alex, under contracts requiring them to protect your data and act only on our instructions. The current list is at www.getalex.app/subprocessors and includes Supabase (database and storage), Vercel (hosting), Anthropic and OpenAI (AI), Stripe (payments), Resend (email), Twilio (SMS and WhatsApp), Sentry (error monitoring) and Meta (Pixel, on marketing pages only, if you accept cookies).
• →Independent controllers who make their own decisions about data under their own privacy policies: Apple and Google (app stores and push notifications), Stripe (for its own fraud prevention and legal duties, and for coach payments), Garmin, Dexcom, Abbott, Google/Microsoft calendars (for coaches), your personal trainer (section 9), and HM Revenue & Customs (we must report certain information about coaches' platform income to HMRC).
• →Professional advisers (lawyers, accountants, insurers) under a duty of confidentiality.
• →Law enforcement, regulators or courts, where the law requires it or it is necessary to protect someone's life or safety.
• →A buyer or investor if our business is sold or restructured, under confidentiality terms. They must use your data in line with this policy.

We do not sell your personal data and do not share it for cross-context behavioural advertising.

11. International transfers

Our main database is hosted in a data centre in a region we choose within our database provider's network (see our sub-processor list for the current region). Some providers are based in, or access data from, the USA or other countries outside the UK. When your data leaves the UK, we protect it with one of the following:

We check that providers relying on the data bridge are listed on the Data Privacy Framework List with UK Extension coverage. You can ask us for a copy of the relevant safeguards.

12. How long we keep your data

13. Cookies and similar technologies

We use strictly necessary cookies and local storage to log you in and keep Alex secure. We only use the Meta Pixel on our public marketing website, and only if you click Accept. It never runs in the app, on logged-in pages or on health pages. The app does not track you across other companies' apps or websites. You can change your choice at any time with the Cookie settings link in our website footer. See our Cookie Policy (www.getalex.app/cookies).

14. Marketing

We will only send you marketing emails, SMS or WhatsApp messages if you have opted in (or, for emails about similar services, if you are a customer and did not opt out). Every message includes a way to unsubscribe, and you can also change this in Settings → Notifications. Service messages (such as renewal reminders, security alerts and changes to our terms) are not marketing and will still be sent.

15. Your rights

You have the right to:

• →access your data (you can download most of it in Settings → Privacy → Download my data);
• →correct inaccurate data;
• →delete your data. Delete your account in the app (Settings → Account → Delete account), on the web at www.getalex.app/delete-account, or by email;
• →restrict or object to processing, including processing based on legitimate interests, and always to direct marketing;
• →data portability: receive the data you gave us in a machine-readable format (JSON/CSV);
• →withdraw consent at any time (section 4); and
• →ask for human review of automated decisions (section 6).

We will respond within one month. In complex cases this can be extended by up to two further months, and we will tell you if so. We may need to confirm your identity first. Some rights have exceptions, for example we must keep payment records for tax purposes.

16. Complaints

If you are unhappy with how we have used your data, please complain to us first through www.getalex.app/complaints (choose "My personal data") or at hello@getalex.app. We will acknowledge your complaint within 30 days and respond without undue delay.

You also have the right to complain to the Information Commissioner's Office (ICO): www.ico.org.uk/make-a-complaint, 0303 123 1113.

17. Children

Alex is for adults aged 18 and over. We do not knowingly collect data from anyone under 18. We previously allowed accounts for people aged 16 and 17. Those accounts are being closed: we have told the account holders, we will delete their data as described in section 12, and we will refund any unused paid period. If you think someone under 18 is using Alex, please tell us at hello@getalex.app.

18. Security

We use encryption in transit (TLS) and at rest, row-level access controls in our database, encrypted storage of connected-service logins, restricted and logged staff access, and we remove health data from error reports before they leave your device. No system is perfectly secure. If a breach is likely to put you at high risk, we will tell you without undue delay, and we will report breaches to the ICO where required.

19. Changes to this policy

We will tell you by email or in the app at least 30 days before a material change takes effect, and we will ask for your consent again if we want to use your data in a significantly different way that needs consent. The date at the top shows when this policy was last updated.