Privacy Policy
Version 2.2.0 · Last updated 26 October 2026
The short version
- We never sell your dataNo advertising, no data brokers, no third-party tracking.Section 5
- Health data needs your consentWe only use it with your explicit consent, and you can withdraw it.Section 4
- Your coach sees what coaching needsOnly while you work together. Their access ends when coaching does.Section 5
- Stored in the UKYour account data lives in London. Some providers are in the US, with legal safeguards.Section 9
- Download or delete any timeBoth are built into the app. Deleted accounts are erased after 30 days, except invoice records the law makes us keep.Section 13
- Applications don't hang aroundIf you apply but don't create an account, we delete it after 12 months.Section 2
This summary helps you find your way. The full policy below is what applies.
1. Who we are
DRS Coaching Ltd ("we", "us") runs DRS Coaching: the app, app.drs.coach and drs.coach. We are a company registered in England and Wales (company number 17195516), registered office Studio 9, 50–54 St Paul's Square, Birmingham, B3 1QS, United Kingdom. We are the data controller for the personal data in this policy.
This policy covers everyone whose data we handle: people who apply for coaching, people who use the app, and people who contact us. Questions about it, or about your data, go to support@drs.coach.
2. Applying for coaching and browsing drs.coach
When you apply for coaching using the form on drs.coach, we collect:
- your email address;
- your name and message, if you add them; and
- the date you applied.
We use this only to reply to you and talk about whether coaching is right for you. Our legal basis is taking steps you have asked for before entering a contract. Only our coaches and the people who run DRS can see it. We don't add you to a mailing list, and we never sell or share it for marketing.
Please keep your message to your goals and questions, and leave out medical details. If coaching goes ahead, your coach will ask for the health information they need through the app, where you give explicit consent for it.
We automatically delete an application 12 months after it was sent, unless you have created a DRS account with the same email address. You can ask us to delete it sooner at any time by emailing support@drs.coach.
You don't need an account to browse drs.coach, and we don't use advertising or analytics cookies on it. Our hosting provider processes basic technical data, such as your IP address, to deliver the site and keep it secure.
3. What we collect when you use the app
| Type | Examples |
|---|---|
| Account and profile | Name, email address, phone number (optional), date of birth (to confirm you are 18 or over and to personalise coaching), gender, location, profile photo. |
| Health and fitness (special category data) | Height, weight, body measurements and body fat; medical conditions, allergies and dietary needs; goals, training experience and activity level; sleep, stress and mood; workout and nutrition logs; progress photos; check-in answers; menstrual cycle data if you use cycle tracking; Apple Health data you choose to share. |
| Coaching and messages | Your coaching relationship, plans and programmes, messages with your coach, notes, and help requests you send us. |
| Billing | Your full name, billing address, and the amounts and dates of your payments. |
| Food photos | Photos of meals or nutrition labels you log, and any description you add. |
| Technical | Device type, operating system, browser and app version; IP address (used for security); sign-in session; error reports when something breaks; which features you use. |
We don't use your data for advertising, and we don't use third-party tracking or analytics tools in the app.
4. How we use your data and our legal reasons
| What we do | Legal basis (UK GDPR) |
|---|---|
| Run the app and its features, and let your coach coach you | Contract (Article 6(1)(b)) |
| Use your health and fitness data | Your explicit consent (Article 9(2)(a)), given separately when you sign up |
| Reply to coaching applications | Steps you asked for before a contract (Article 6(1)(b)) |
| Send service messages, such as password resets, security alerts and changes to our policies | Contract (Article 6(1)(b)) |
| Send reminders and notifications you have turned on | Contract (Article 6(1)(b)); you can turn them off in the app |
| Send you invoices and take your payments | Contract (Article 6(1)(b)) |
| Keep financial records, including invoices | Legal obligation (Article 6(1)(c)): UK company law and HMRC require us to keep accounting records |
| Keep DRS secure, fix problems and improve it | Legitimate interests (Article 6(1)(f)) |
| Keep records the law requires | Legal obligation (Article 6(1)(c)) |
You can withdraw your consent to health data at any time by emailing support@drs.coach or deleting your account. Withdrawing doesn't affect what we did before, but DRS can't work without health data, so we'll ask you to re-consent or close your account.
Some features suggest changes, such as adjusting your nutrition targets. These are suggestions for your coach to review. We don't make decisions about you with legal or similarly significant effects based only on automated processing.
5. Who can see your data
- Your coach, while you are working together. They can see your profile, health and fitness data, logs, progress photos, check-ins and your messages with them. Coaches can't see anyone who isn't their client, and access ends when the coaching relationship ends. Your coach uses DRS on our behalf and is not a separate data controller.
- Our team, only when needed to provide support, keep DRS secure or meet a legal obligation. Administrator activity is logged.
- Service providers who run parts of DRS for us under contract (see section 6). They can only use your data to provide their service to us.
- Authorities, where the law requires us to disclose data, for example under a valid court order.
- A buyer or successor, if DRS Coaching Ltd is ever sold or merged. They would have to keep your data protected in line with this policy, and we'd tell you first.
We never sell your personal data.
6. Service providers we use
| Provider | What they do for us | Where |
|---|---|---|
| Supabase | Database, sign-in, file storage and server functions. Holds your account data. | London, UK |
| Vercel | Hosts drs.coach and the web app. Processes basic request data such as IP addresses. | Global network |
| Anthropic (Claude) | AI processing (see section 7). | United States |
| OpenAI | Drafting training programmes (see section 7). | United States |
| Resend | Sends emails from the app. | United States |
| Starling Bank | Our business bank account. Receives your payments and holds the invoices we send. | UK |
| Google Workspace | Our email, including support@drs.coach. | EU and United States |
| Apple, Google and your browser's push service | Delivers notifications you have turned on, including the notification text. | United States |
| Google Fonts | Serves the typefaces the app and sign-in pages use. Receives your IP address and browser or app user agent when the fonts load, not your account details. | United States |
| Open Food Facts | Food search and barcode lookups. Receives your search terms and scanned barcodes, not your account details. | France |
| TheMealDB | Recipe lookups. No personal data is sent. | United Kingdom |
7. AI
We use AI providers for:
- estimating nutrition from food photos you log (Anthropic);
- helping us and your coach review check-ins and prepare feedback (Anthropic), which can include your check-in answers and the Apple Health metrics you share, such as sleep, steps and resting heart rate;
- helping your coach draft training programmes from your goals, experience and preferences (OpenAI);
- wording reminders and notifications, which includes your first name (Anthropic); and
- sorting and summarising help requests you send us (Anthropic).
We send each provider only what the task needs, and never your email address or password. Under their business terms, these providers don't use your data to train their models. Your coach reviews AI-assisted feedback before it reaches you.
8. Apple Health
If you connect Apple Health, we receive the data types you choose to share, such as weight, steps, sleep, heart rate and active energy. We use it only to provide DRS features and coaching. Apple Health data is never used for advertising, never sold, and never shared for marketing.
Detailed minute-by-minute readings are deleted after 7 days, once they have been turned into daily and 15-minute summaries. You can stop sharing at any time, and you can remove access in your iPhone's Health settings.
9. Where your data is stored
Your account data is stored in the UK, in Supabase's London data centre. Some of our providers are based outside the UK, mainly in the United States (see section 6). When your data goes to them, it is protected by the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or by the UK-US Data Bridge where the provider is certified, plus a data processing agreement with each provider.
10. How long we keep it
| Data | How long |
|---|---|
| Your account, profile, health and fitness data, logs, photos and messages | While your account is open. Erased 30 days after you delete your account. |
| Coaching applications | Deleted automatically 12 months after they are sent, unless you have a DRS account. |
| Minute-by-minute Apple Health readings | Deleted after 7 days. Daily summaries are kept with your account. |
| Security and access logs | Limited periods set by our providers, then deleted automatically. |
| Backups | Overwritten automatically on a rolling basis. |
| Statistics that no longer identify you | May be kept indefinitely. |
| Invoices and payment records, including your name and billing address | We keep invoices and payment records, including your name and billing address, for 6 years after the end of the financial year they relate to, because the law requires us to keep accounting records. This applies even if you delete your account; the rest of your account data is deleted as normal. |
| Records the law requires us to keep | For the period the law sets. |
11. Keeping your data safe
- Data is encrypted in transit and at rest.
- Database rules control exactly who can see what, so coaches only reach their own clients.
- Administrator access is limited and logged.
- Passwords are never stored in readable form, and sign-in sessions expire.
No system is perfectly secure. If a data breach puts your rights at risk, we'll tell the Information Commissioner's Office within 72 hours where the law requires, and tell you without undue delay if the risk to you is high.
13. Your rights
Under UK GDPR you can:
- get a copy of your data (you can download it in the app);
- correct data that is wrong (most of it you can edit in the app);
- have your data deleted (you can delete your account in the app; see how to delete your account or some of your data);
- receive your data in a format you can take elsewhere;
- ask us to limit how we use your data, or object to how we use it;
- withdraw consent at any time; and
- complain to the Information Commissioner's Office (see section 16).
For anything you can't do in the app, email support@drs.coach. We reply within one month. If a request is complex we may take up to two more months, and we'll tell you. We may ask you to confirm your identity first, to protect your data from someone pretending to be you.
14. Adults only
DRS is for adults. You must be 18 or over to create an account, and we don't knowingly collect data from anyone younger. If we find out someone under 18 has an account, we delete it and their data. If you think a child is using DRS, email support@drs.coach.
15. Changes to this policy
The version number and date at the top of this page show which version is current. If we make an important change, such as collecting a new type of data, using it for a new purpose or adding a provider, we'll tell you in the app and ask for your consent again where it's needed. Small wording fixes are made without notice.
16. Complaints
If you're unhappy with how we've handled your data, please email support@drs.coach first so we can put it right. You can also complain to the Information Commissioner's Office: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF; phone 0303 123 1113; ico.org.uk.
17. Food data attribution
Product and nutrition information comes from Open Food Facts, a free, collaborative database of food products.
The database is available under the Open Database License (ODbL) v1.0, and its individual contents under the Database Contents License (DbCL) v1.0. Product images are licensed CC-BY-SA. We keep a filtered copy of the UK part of the database, and any database we derive from it and share is offered under the same ODbL terms.