Sthira Me — Privacy Policy

Effective: 17/05/2026  |  Version: 1.3

Summary

We are Sthira Me Limited, the UK company behind the Sthira Me app and the website at sthira.me. We collect as little about you as we can. Most of what the app knows about you — your name, your age, the body areas you want to be careful with, your health-condition self-tags, your session history, your streak — lives only on your phone and never reaches us. The few things that do reach our systems (your email if you join the waitlist; your subscription record if you go paid; a crash report if the app falls over) are kept for the reason we said we'd keep them, for the time we said we'd keep them, and shared only with the small set of suppliers we need to run the service.

You can ask us at any time what we hold, ask us to correct it, or ask us to delete it. Email our contact form and a real person will reply within 30 days. If we ever get something wrong, you can also speak to the Information Commissioner's Office (ICO), the UK regulator. The full Policy below sets out what we collect, why, who we share it with, how long we keep it, and what your rights are — in plain English.

1. Who we are

We are the data controller for the personal information described in this Policy. That means we decide what to collect, why we collect it, and what we do with it. Where we use a supplier to handle data on our behalf, we say so below and we have a written agreement with each one (a "data processing agreement" under Article 28 UK GDPR).

We have not appointed a Data Protection Officer because the law does not require us to at our current scale. The named contact for any privacy question is our contact form and the founder reads every email sent to that address.

2. What we collect, why, and what allows us to

This section is the one most people care about, so we have laid it out as a table — one row per type of information, with the lawful basis we rely on under UK GDPR Article 6 (and Article 9 where the information concerns your health). The internal record behind this table is our Record of Processing Activities (RoPA), which our regulator can request at any time.

2.1 Waitlist signup (sthira.me)

2.2 Inside the iOS app — the personal stuff stays on your phone

2.3 Apple HealthKit (optional)

2.4 Subscription and payment

2.5 Feedback and suggestions you send us

2.6 Behaviour analytics — opt-in, never on by default

2.7 Crash and error reporting

2.8 Email automations (Kit and UpViral)

2.9 What we do not collect

We do not collect, and we have designed the system so that we cannot collect:

• Your card details, your bank account, or your billing address (Apple handles all payment).
• Your real name, beyond an optional first name in your email profile and the display name you choose in the app.
• Your phone number.
• Your address.
• Your facial image or any biometric identifier.
• Your contacts list, your photo library, your microphone (the app does not request these permissions).
• Any third-party advertising identifier. There are no advertising SDKs in the app.

3. Special-category data — your health information

The health-condition self-tags you choose during onboarding count as special-category data under Article 9 UK GDPR, because they are information about your health.

We process this data on the basis of your explicit consent — Article 9(2)(a) — given when you tap through the onboarding step. We process it on your device only. It is never sent to our servers. It is not visible to us, to our suppliers, or to anyone else. The session builder uses it locally to pick exercises that suit you and to route around areas you have asked us to be careful with.

If a future feature would require us to process health-condition data outside the device, we will tell you what changes, ask for your separate consent, and complete a Data Protection Impact Assessment first. We will not change the deal after the fact.

4. In-app audio coaching

The voice you hear in Sthira Me coaching sessions belongs to the founder, Alpesh Patel. Voiceovers are pre-rendered against scripts we author — no user data (your name, check-in answers, health-condition tags, session history) is sent off-device to render audio. The audio you receive is finished media; nothing about you is transmitted to render it.

Future versions of the app may add named, credentialled teacher voices for new pillars. We will tell you what changes in this Privacy Policy before any such expansion ships.

5. Who we share information with

We do not sell your information to anyone. We do not share it with advertisers. We share what we have to share with the following suppliers, each of whom has signed a written data processing agreement with us under Article 28 UK GDPR.

We use Buffer to schedule social posts. Buffer does not process any data about app users — only marketing content created by us.

If we add a new supplier we will update this Policy and the underlying RoPA before the new supplier starts processing.

6. International transfers

Some of our suppliers are based outside the UK, mostly in the United States. When we send personal data outside the UK we rely on one or both of the following:

• Standard Contractual Clauses approved by the ICO. These are the contractual safeguards UK GDPR allows for transfers to countries without an adequacy decision.
• The UK extension to the EU–US Data Privacy Framework, which the UK Government recognises as providing adequate protection for transfers to certified US suppliers.

We review the transfer position when we onboard a new supplier and at least once a year thereafter. If a safeguard becomes unsound we will say so and look for an alternative.

7. How long we keep things

The retention periods sit alongside each row in §2 above, but to summarise:

We honour an erasure request within 30 days regardless of these retention periods, except where we are required by law to keep something (mainly HMRC tax records and any data subject to a regulatory hold).

8. Your rights

UK GDPR gives you a set of rights over the information we hold about you. We will respond to any of the following within 30 days of receiving the request, free of charge in almost all cases:

Withdrawing your consent does not affect anything we did with your information before you withdrew. It just stops us from doing anything new with it.

9. Cookies and similar technologies

We say more about cookies in our Cookies Notice at sthira.me/cookies. The short version: we use a small number of cookies to make the site work; we ask for your consent before we set anything for marketing or analytics; and you can change your mind through the cookie banner at any time.

10. Children and the under-13 flow

The Sthira Me app is designed for ages 4 to 75. We take the under-13 audience seriously.

For users under 13, the onboarding flow includes a parental gate before any practice begins. We process the under-13 user's information on the same on-device basis as any other user — nothing leaves the phone — and we ask the parent to confirm before the app proceeds.

We do not market the app to children. The waitlist, the social channels, the email list and the website are all intended for adult sign-up; we do not knowingly accept a waitlist signup from a person we believe to be under 13.

If you believe we hold information about a child under 13 that should not be there, email our contact form and we will remove it immediately.

11. Security

We use proportionate technical and organisational measures to protect what we hold:

• TLS 1.3 for everything that moves over the network.
• Encryption at rest on Cloudflare D1 (AES-256, Cloudflare-managed) and on iOS (FileProtectionType.complete, Apple-managed).
• Cloudflare WAF + Turnstile + Rate Limiting to protect all sthira.me forms (waitlist signup, contact, suggestion, feedback) from automated abuse, plus a server-side honeypot field and input validation in our signup Worker. (Previously the waitlist form was hosted by Kit and used Google invisible reCAPTCHA v3; the form is now self-hosted on Cloudflare and reCAPTCHA no longer applies. Privacy Policy updated M-524 2026-05-28.)
• API keys held in server environment variables; never in the client app, never in the public repository.
• Sentry PII-stripped at the SDK level so crash reports do not carry your data.
• No payment data ever touches our infrastructure — Apple handles everything.

No system is invulnerable. If anything happens that we believe puts your rights and freedoms at meaningful risk, we will tell you.

12. If something goes wrong — breach notification

If we discover a personal data breach, the law requires us to notify the Information Commissioner's Office within 72 hours of becoming aware of it (Article 33), and to notify affected individuals without undue delay if the breach is likely to result in a high risk to their rights and freedoms (Article 34).

Our internal process for that — who detects, who assesses, who notifies, where it gets logged — sits in our breach register and our RoPA. The user-facing point is simple: if anything happens that affects you, you will hear from us, and you will hear from us promptly.

13. Changes to this Policy

We will update this Policy when something changes — a new supplier, a new feature, a change in how we process something. When we do:

• The version number at the top of this Policy will increment (1.0 → 1.1, etc.).
• The effective date will move forward.
• For material changes — anything that affects what we collect or how we use it — we will email everyone on our list and surface an in-app notice.

We do not consider this a one-way obligation. If a Policy change does not work for you, your right to withdraw consent and ask for erasure is unchanged.

14. How to contact us

For anything privacy-related, email our contact form. The founder reads everything sent there.

By post:

Sthira Me Limited, Moda Business Centre, Stirling Way, Borehamwood, Hertfordshire WD6 2BW, United Kingdom

15. How to complain

If you are not happy with how we have handled a privacy question, you can complain to the UK regulator, the Information Commissioner's Office (ICO):

Information Commissioner's Office Wycliffe House Water Lane Wilmslow, Cheshire SK9 5AF United Kingdom 0303 123 1113 https://ico.org.uk/make-a-complaint/

We would prefer that you came to us first, because we would like the chance to put it right — but you are entitled to go directly to the ICO at any time.

Sthira Me Limited · Privacy Policy version 1.3.