Formm Privacy Policy
Last updated: 1 November 2026
1. Who we are
Formm is a strength training app with an automated coach. The controller of your personal data is:
- Avlo Ltd, registered in England and Wales (company number 17095752), registered office 34 West Woodside, Bexley, DA5 3PQ, United Kingdom
- Contact for privacy questions and requests: formm@avlo.uk
- ICO registration number: ZC106780
If we appoint a data protection officer or a UK representative, their details will go here.
2. The short version
- You give us information about your training, your injuries (including any notes you choose to write about them), what you love or hate in training, and your food so the coach can personalise your plans and notes. You can also, if you choose, tell us that you take a GLP-1 medication (for example Wegovy or Mounjaro) or that you are in perimenopause or menopause, so the coaching can take it into account. That is optional, you can say you would rather not, and you can remove it at any time in Profile.
- If you choose to, you can also connect Health Connect on Android, or Apple Health on iPhone, so the coach can see your sleep, resting heart rate and workouts. This is optional, read only, and you can switch it off at any time.
- Some of this is health information. It is treated as "special category data" under UK GDPR, and we only use it with your explicit consent.
- We do not sell your data and we do not use it for advertising.
- Your information is processed by a small number of service providers (listed in section 8) so the app can work. Three of them, Anthropic, ElevenLabs and (through ElevenLabs, during live voice calls only) Google, may process health information as part of writing or speaking the coach's replies.
- You can see, correct, export or delete your data. You can delete your account from Profile > Delete my account, and you can disconnect Health Connect or Apple Health and delete the health summaries we hold from Profile at any time.
- Formm is coaching, not medical advice.
3. What we collect
You give us:
| Information | Why | Examples |
|---|---|---|
| Account details | To create and secure your account | Email address, password (stored hashed by our authentication provider), first name |
| Profile and goals | To build your plan | Goal, how often you can train, equipment |
| Optional health context (special category) | To shape training and food guidance if you choose to share it: for example more resistance training, protein toward the higher end and no aggressive calorie deficit if you take a GLP-1 medication, or progressive strength work, bone-friendly impact and easier days when you are tired if you are in perimenopause or menopause. It is never used to diagnose anything, and Formm gives no advice on medication, doses or hormone replacement therapy | Only what you tick: taking a GLP-1 medication, perimenopause or menopause, or "prefer not to say", and when you chose it. There is no free text. Optional: leave it blank, or remove it any time in Profile |
| Injury and health information (special category) | To train you around injuries and keep you safe | Body areas you flag, what you want done about each one (leave it out, work around it or some light work), how bad it is, what hurts, any note you choose to write about it, "better / the same / worse" check-ins |
| Training preferences | To leave out moves you never want and lean towards ones you like | What you type for "Anything you love or hate?", the lists we read from it, and moves you hide with "Never show me this again" |
| Training information | To plan sessions and track progress | Workouts you do, sets, weights, reps, volume, personal bests, session times |
| Food information (may reveal health information) | To help fuel your training | Meals you describe in words or by voice, a photo of a meal or a food barcode you scan (the photo is read and not kept; only the foods it finds are saved), the estimated calories and macros, optional targets, optional bodyweight |
| Body details (optional) | To estimate your calorie and protein targets, for the nutrition tile and when you ask your coach about food | Your sex (male, female or prefer not to say), height and weight, and whether you like to see them in kg and cm or stones, pounds, feet and inches. You choose whether to add any of it. They are used only to estimate nutrition targets, never for anything else, and you can change or remove them in Profile at any time. A weight you add is also kept in your body log, and the latest entry is your current weight |
| Goals, check-ins and body measurements (may reveal health information) | To build your plan around what you are working towards, check in on how it is going, and adjust your plan | What you tell us you are working towards (an event, a date, focus areas, in your own words), your check-in answers (how the sessions feel, energy, enjoyment, aches, changes in your life, a note), the changes your coach makes to your plan and why, and an optional bodyweight and waist that you choose to add |
| Crash and diagnostic reports | To find and fix crashes and freezes | If the app crashes or freezes, a report with the error and where in the app it happened, the app version, your phone model and the version of its operating system. Not included: your name, email address, account ID, meals, injuries, messages, health values, tokens, screenshots or anything you typed. See section 8 |
| Conversations | To coach you | Messages you send the coach and the coach's replies, plan changes you accept |
| Voice | To log meals by speaking, to hear notes aloud, and to talk with the coach live (only if you use these) | Short audio recordings that are turned into text; text that is turned into speech; the audio and words of a live voice conversation |
| Preferences | To remember your choices | Coach voice and language, light or dark theme (stored on your device) |
| Consent record | To show what you agreed to and when | Consent version and date and time, for the sign-up consent (which includes your yes or no to the AI providers) and, separately, for Health Connect or Apple Health; and your confirmation that you are 18 or over |
Only if you connect Health Connect or Apple Health (special category): we read the types of data below from Health Connect (Android) or Apple Health (iPhone) on your phone. We only read them, and we never write to Health Connect or Apple Health. Section 5 explains what we store and why.
| Health Connect data | What we use it for |
|---|---|
| Sleep | How much you slept, to judge how hard to push today |
| Resting heart rate | Compared with your own usual level, as a sign of recovery |
| Exercise sessions (workouts) | Other training you have done recently (a run or a ride, for example), so we do not stack hard days |
Created or collected automatically:
- Technical information needed to run the service, such as your IP address, device and app version and error logs, held by our hosting and database providers.
- We don't use analytics or advertising trackers.
We do not knowingly collect data from anyone under 18. To create an account you have to tick a box saying you are 18 or over, and we keep that confirmation, with the date, alongside your consent record. The app also asks for your age when you set up and does not let you continue if it is under 18.
4. Health data is special category data
Information about your injuries (including any notes you write about them), the optional health context you may choose to share (a GLP-1 medication, perimenopause or menopause), your health and, in some cases, your food can reveal information about your health. Sleep, resting heart rate and similar data from Health Connect does too. UK GDPR gives this extra protection. We only process it:
- with your explicit consent (Article 9(2)(a)), and
- for the purposes described in this policy: personalising your coaching, plans and notes.
We ask for consent in four places:
1. When you create your account, for the injury, training and food information you give us. - And, separately, when you choose to share health context (the optional "Anything we should factor in?" question, in setup or in Profile). The screen says it is health information, that it is kept with your profile and shared with our AI provider along with your other coaching details, and that you can remove it at any time. Nothing is saved unless you tick it yourself. This covers only what you tick; it is not asked for, and is not needed to use Formm. 2. Once more in the app, before anything is sent to an AI provider (on your first run, or the next time you open the app if you signed up earlier). That screen names the AI coach (Anthropic) and the voice coach (ElevenLabs, with Google's Gemini model during live calls), says what each is sent, and links to this policy. If you say no, the AI coach, voice calls, dictation and AI-built sessions stay off, and logging, history and swaps still work. We keep your answer with the version of the wording and the date and time. 3. Separately, inside the app, before the Android or iPhone permission screen appears, if you choose to connect Health Connect or Apple Health. That screen says which types of data we will read, what we do with them, and who processes them, in the same terms as this policy. Nothing is read from Health Connect or Apple Health until you agree there and then grant the permissions on the system screen.
You can withdraw consent at any time: disconnect Health Connect or Apple Health in Formm (which also deletes the health summaries we hold, see section 5), turn off the AI coach in Profile > AI coach > Withdraw my consent, delete other information in the app, or delete your account. You can also remove Formm's access in the Health Connect settings (Android) or in Settings > Health > Data Access & Devices > Formm (iPhone), which stops us reading anything further. Withdrawing consent does not affect processing done before you withdrew. If you withdraw, we may no longer be able to provide personalised coaching.
5. Health Connect and Apple Health
Apple Health (iPhone). Apple Health is where an iPhone keeps health and fitness data from your phone, your watch and other apps, under your control. Using it in Formm is optional, and Formm works without it. If you connect it, Formm reads three types of data, read only: sleep, workouts and resting heart rate. We never write anything to Apple Health. iPhone asks you, type by type, what Formm may read, and if you say no Formm simply gets nothing and carries on as before. Formm reads when you open the app or bring it back to the front, and when you tap Sync now; it does not read in the background. Like Health Connect data (below), the app works out daily summaries on your phone and sends us only those: one row a day with your sleep and resting heart rate, and the type, start and end of each workout. We keep them for 90 days, use them only to decide how hard to push you, share them with our processors on the same terms, and never use Apple Health data for advertising, marketing or data mining, or sell it. To delete it, use Profile > Apple Health > Disconnect and delete, or delete your account. Removing Formm's access in Settings > Health > Data Access & Devices > Formm stops us reading more but does not delete the summaries already stored. The rest of this section describes the same handling for Health Connect.
Health Connect (Android). Health Connect is an Android feature that lets apps share health and fitness data from your phone and wearables under your control. Using it in Formm is optional. Formm works without it.
What we read. Three types of data, read only: sleep, exercise sessions and resting heart rate. We do not ask for anything else from Health Connect (we do not read other heart rate data, your location or route), and we do not write anything back. Formm reads when you open the app or bring it back to the front, and when you tap Sync now. It does not read in the background.
What we store. Summaries, not raw readings. The app works out the summaries on your phone, and only the summaries are sent to us. We never store or receive raw samples. We store:
- One row per day: how long you slept (and the time you went to sleep and woke); and your resting heart rate.
- A short summary of each workout you did outside Formm: the type, start time, end time and how long it lasted. No heart rate is stored with a workout.
- The date and time you agreed to Health Connect.
These are stored in our database (Supabase) against your account. Only you can read your own rows, and only our server can write them.
Why we use it. To help the coach decide how hard to push you. For example, if you slept badly and your resting heart rate is up on your usual, the coach may offer an easier session. We compare each number with your own usual level, not with other people. This is coaching, not a diagnosis, and it never tells you to train through pain or poor recovery.
Who sees it. Our server turns your summaries into a few facts and a rough low, normal or high readiness level (worked out by our own code, not by the language model). Those facts, not your raw data, are included in the text sent to Anthropic, our language model provider, so that the coach's plans, daily notes and replies can take your recovery into account. If you use the live voice coach, the same facts are also sent to ElevenLabs, which runs the voice conversation, and, through ElevenLabs, to Google, whose Gemini language model writes the coach's spoken replies. All of them act on our instructions as processors, not for their own purposes. Section 8 gives details. We do not sell health data, we do not share it with advertisers, data brokers or resellers, and we do not use it for advertising, credit, insurance or employment decisions. Access to your health data in our database is limited to Avlo's director, and is used only to give you support, to fix faults, for security, or where the law requires it.
How long we keep it. Health summaries (the daily rows and the workout summaries) roll off after 90 days: anything older is deleted automatically. If you disconnect Health Connect or delete your account, we stop reading and delete everything above straight away, not at the end of the 90 days.
How to delete it.
- In Formm: Profile > Health Connect > Disconnect and delete. This deletes every health summary and workout summary we hold, and the record of your Health Connect consent.
- Delete your account (Profile > Delete my account), which deletes everything, including health summaries.
- Or email formm@avlo.uk from the address on your account.
- Removing Formm's access in the Health Connect settings on your phone stops us reading more data, but does not delete the summaries already stored. Use one of the options above for that. The original data stays in Health Connect on your phone under your control.
6. Our lawful bases
| Purpose | Lawful basis |
|---|---|
| Creating and running your account and the coaching service | Contract (Article 6(1)(b)) |
| Processing health information (including Health Connect data) to personalise coaching | Explicit consent (Article 9(2)(a)) together with Article 6(1)(b) |
| Keeping the service secure, preventing abuse and fixing faults | Legitimate interests (Article 6(1)(f)) |
| Meeting legal obligations, for example responding to a lawful request | Legal obligation (Article 6(1)(c)) |
7. How we use your information
- To build and adjust your training plans and to write the coach's notes, daily briefs, session notes and replies.
- To take your recovery into account (sleep, resting heart rate and recent training) if you have connected Health Connect.
- To show your history, progress and personal bests.
- To estimate the calories and macros of meals you describe or photograph, and to look up the nutrition on a food barcode you scan. These are estimates and are not dietary advice.
- To read your voice recordings as text, to read coach notes aloud, and to hold a live voice conversation, if you choose to use voice.
- To keep the service safe, fix problems and improve how the app works.
Coaching uses automated systems. The coach's plans, notes and replies are written by automated language models using the information you have given us, including Health Connect data if you connect it. They are not written by a human coach and are not checked by a health professional. A low readiness level can make the coach suggest an easier session, but you decide what to do. We do not make decisions about you that have legal or similarly significant effects.
8. Who we share it with (processors)
We use these providers to run Formm. Apart from Google Play and the App Store (the last row), they process your data on our instructions and not for their own purposes.
| Provider | What they do | Data involved | Location |
|---|---|---|---|
| Supabase | Hosts our database and sign-in (authentication) | Everything in your account: profile, injuries, training, food log, messages, consent records, and your Health Connect summaries | United Kingdom (London, eu-west-2) |
| Anthropic | Runs the language model that writes plans, notes, replies and meal estimates | The text needed for each request: for example your goal, injuries (with the details and notes you wrote) and check-ins, the moves you love or hate, the optional health context you chose to share (a GLP-1 medication, perimenopause or menopause), only if you did, recent sessions, the food log summary, your messages, what you tell us you are working towards and your check-in answers, the meal text you typed, a photo of a meal if you choose to take one (sent only to read what is on the plate), and, if you connect Health Connect, a short summary of your recovery (sleep, resting heart rate against your usual, and recent workouts, and a low, normal or high readiness level). Not raw readings. For a product name we don't recognise, Anthropic's web search tool looks it up on the public web; only the product name is sent. When you type what you love or hate, or what hurts about an injury, the language model reads those words once to turn them into lists, and shows you what it understood before anything is saved. | United States, and possibly other countries: Anthropic routes requests globally by default, so processing is not guaranteed to stay in the United States. Under Anthropic's commercial terms it may not train its models on our content. For the models we use, Anthropic says it does not retain prompts and outputs by default; it may keep content that its safety systems flag, for up to 2 years, or where the law requires. |
| ElevenLabs | Turns your voice recordings into text and coach notes into speech. Also runs the live voice conversation with the coach (only if you use voice) | Audio recordings you make, the text of the notes you choose to hear, and, for a live conversation, your speech, the coach's spoken replies, the transcript, and the same coaching context the written coach uses, which can include your injuries (with your notes), what you love or hate, the optional health context you chose to share and, if connected, your recovery summary | United States: ElevenLabs stores customer data there by default, and processing can also happen elsewhere through its affiliates and subprocessors. We do not use its EU storage option, which is an Enterprise-plan feature. Live voice conversations use zero retention, so ElevenLabs does not store the audio or the transcript after the call, and it does not train on them. Dictated meals and read-aloud notes (speech-to-text and text-to-speech requests) are kept by ElevenLabs under its standard terms. |
| Google (Gemini), through ElevenLabs | During a live voice conversation only: ElevenLabs sends the words of the conversation as text, with the coaching context, to Google's Gemini language model, which writes the coach's spoken replies. Google is ElevenLabs's sub-processor, not a provider we contract with directly | The words of the conversation as text and the same coaching context, which can include your injuries, the optional health context you chose to share and, if connected, your recovery summary. Not your audio | Google Cloud, through ElevenLabs, which lists Google Cloud among its sub-processors for language model services. ElevenLabs does not say which Google region handles a given model, so we cannot tell you which country these requests are processed in, and we do not use ElevenLabs's Enterprise data residency options. Live conversations use ElevenLabs's zero retention mode, so ElevenLabs does not keep the call, and we use a model that works with that mode. What Google itself keeps, and whether it trains on these requests, is set by ElevenLabs's agreements with Google, which ElevenLabs does not publish, so we cannot state it. |
| RepDB (repdb.co) | Supplies the exercise pictures and step-by-step instructions the app shows | Nothing. The pictures are stored with Formm and shown from there, so RepDB receives no request, no account detail and no personal information from you or from us | Not applicable: no personal data is shared with RepDB |
| Exercise media provider (AscendAPI / ExerciseDB), for the few moves RepDB does not cover | Supplies exercise demonstration images and muscle information | The name of the exercise you open. The request comes from our server, not your phone, so no personal information is sent | Not applicable: no personal data reaches this provider |
| Open Food Facts | A free, open database of packaged foods. We ask it for the nutrition on a food you scan or name | The barcode number of a product you scan, or the brand and product name of a packaged food in a meal you log. The request comes from our server, so it carries no account details, and it is cached so the same product is not asked for twice | France (Open Food Facts is run by a non-profit association) |
| Netlify | Hosts the server functions that connect the app to the services above | Requests pass through Netlify, including your messages, meal text, meal photos and the coaching context, so it may keep ordinary server logs | United States: our functions run in Netlify's US East (Ohio) region, and the website is served from Netlify's global network. Netlify says it keeps function logs for at least 24 hours, and for up to 7 days on some plans. |
| Sentry | Receives crash and freeze reports from the app so we can fix faults (error reporting) | Only when the app crashes or freezes: the error and its stack trace (where in the app code it happened), the app version, your phone model and operating system version. Before a report leaves your phone our code removes anything personal: it sends no name, email address, account ID, request details or screenshots, and it strips emails, tokens and any text you typed, said or measured (meals, messages, injuries, health values). We do not use Sentry to track what you do in the app, and it collects no performance data | European Union: we use Sentry's EU region, so reports are stored in the EU. Sentry is a US company, so see the transfers paragraph below |
| Postmark | Sends the emails Formm sends you (email delivery): account emails such as the sign-in confirmation, the reminder that a free trial is ending, and the warning that an account unused for 24 months will be deleted | Your email address and the text of the email, for example the date your trial ends and the price, or the date an unused account will be deleted. No health information, injuries or messages | United States: Postmark says its primary data and servers are in a data centre near Chicago and on Amazon Web Services, and that it has no plans for EU servers. Postmark keeps the content and details of each email for 45 days and then removes them (addresses that bounced, complained or unsubscribed are kept so we do not email them again). Its data processing terms use the Standard Contractual Clauses for transfers. |
| RevenueCat | Manages subscriptions: checks with the app store (Google Play or the App Store) that a purchase is valid, tells our server whether you have an active subscription or free trial, and keeps your purchase history. Used for everyone who uses the app, not only subscribers, so that the app knows whether you are on the free plan or Formm Pro | Your Formm account ID (a random identifier, not your name or email), your purchase and subscription details (the product, trial and renewal dates, whether it is active, cancelled or refunded, and the app store's purchase token), and the technical information its app code collects, such as your device type and IP address. No health information, injuries or messages. If you delete your account, we ask RevenueCat to delete your record | United States: RevenueCat says customer data is sent to Amazon Web Services data centres in the United States. How long it keeps purchase data, and the safeguards it uses for transfers, are set out in RevenueCat's own privacy policy and data processing addendum, which apply to the data it holds for us. |
| Google Play (Google) or the App Store (Apple), whichever app you downloaded | Takes payment for Formm Pro and handles trials, renewals, cancellations and refunds. This is Google's or Apple's own service: it decides how it uses your payment details under its own terms, not on our instructions | Your Google account or Apple Account and payment details, which Google or Apple holds and we never see (we are told only whether a purchase is valid and when it renews or ends) | Wherever Google or Apple processes payments, under their own privacy policies. They are independent providers, not processors acting on our instructions: Google and Apple decide for themselves how they use your payment details. |
Health data and these providers. Because Anthropic, ElevenLabs and Google (through ElevenLabs) are processors acting on our instructions, sending them your information to write or speak the coach's replies is not a sale or a transfer for their own use. We do not allow them to use your information to train their models or for advertising. Health data may be processed outside the UK, in the places listed above.
We may also share information if the law requires it, or to protect people's safety, or in a business sale or reorganisation (the new owner would have to honour this policy).
International transfers. Some providers are based outside the UK, or process data outside it. Where personal data leaves the UK we rely on these safeguards. For Anthropic, the Standard Contractual Clauses with the UK Addendum in its data processing terms. For ElevenLabs, the UK Extension to the EU-US Data Privacy Framework (which covers its US entity), and Standard Contractual Clauses with the UK Addendum. For Google, which only receives data as ElevenLabs's sub-processor, the safeguards in ElevenLabs's own agreements with it, which ElevenLabs does not publish. For Netlify, the UK Extension to the EU-US Data Privacy Framework, and Standard Contractual Clauses. For Sentry, which stores our reports in its EU region but is a US company whose staff may reach them, the Standard Contractual Clauses with the UK Addendum in its data processing terms. For Supabase, which stores our data in London, Standard Contractual Clauses approved by the European Commission or the UK Information Commissioner for any transfer outside the UK.
9. How long we keep it
- Account data, training, injury, food and conversation records: until you delete them or delete your account. If you do not use Formm for 24 months, we delete your account and everything in it, and we email you a warning 30 days before we do.
- Health Connect summaries: while Health Connect is connected and your account exists, as set out in section 5. Deleted when you disconnect and delete, or delete your account.
- Meal photos: Formm does not keep them. The photo is shrunk on your phone, sent to Anthropic only to read the meal, and dropped; only the foods it finds are saved to your log. The camera is used for nothing else, never records video, and nothing is saved to your photo library.
- Voice recordings for meals and read-aloud notes: Formm does not keep them. They are sent to ElevenLabs for transcription or speech, and ElevenLabs keeps these requests under its standard terms.
- Reported coach replies: if you report a coach reply as wrong, unsafe or offensive (by holding the message in the chat, or from the end of a voice call), we store the text of that reply, the reason you chose, any note you add and your account ID. We store them to improve safety, and they are deleted with your account.
- Live voice conversations: Formm does not keep a copy of the audio. ElevenLabs runs the conversation on our behalf with zero retention: it does not store the audio or the transcript after the call, and it does not train on them. The words go through Google's Gemini model on the way, under ElevenLabs's arrangements with Google.
- Deleted accounts: when you delete your account we delete your profile, injuries, training history, food log, conversations, plans and Health Connect summaries from our live database straight away. Copies in provider backups are removed when those backups expire, which is 7 days (our database host keeps daily backups for 7 days). This includes your consent record: once your account is deleted we keep nothing about you, not even a record that you gave consent.
- Body details (optional sex, height and weight): until you change or remove them in Profile or delete your account. They are used only to estimate nutrition targets.
- Goals, check-ins, plan changes and body measurements: until you delete them or delete your account. You can change or drop your goal from Today, undo a plan change, and delete your account in Profile to remove all of it.
- Crash and freeze reports: kept by Sentry for a limited period (between 30 and 90 days, depending on the plan we are on) and then deleted by Sentry. They contain no account ID or name, so we cannot look one up by account, and deleting your account does not change them. They are not linked to you.
- Server logs: kept by our hosting providers for a short period for security and fault-finding. Netlify keeps function logs for at least 24 hours, and for up to 7 days on some plans. Supabase keeps API and database logs for 7 days on our plan.
10. Deleting your account
In the app go to Profile > Delete my account and confirm twice. This deletes your account and the information listed above, including any Health Connect summaries. It cannot be undone. If you cannot use the app, the page Delete your Formm account explains how to ask us, or email formm@avlo.uk from the address on your account and we will do it for you.
11. Your rights
Under UK GDPR you can:
- be informed about how we use your data (this policy),
- access a copy of your data,
- ask us to correct anything wrong (you can edit most of your profile in the app),
- ask us to erase your data,
- ask us to restrict or object to some processing,
- ask for your data in a portable format (portability), where it applies,
- withdraw consent at any time,
- not be subject to solely automated decisions with legal or similar effects.
To use these rights email formm@avlo.uk. We aim to reply within one month. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk, 0303 123 1113. We would appreciate the chance to put things right first.
12. Security
Data is sent over encrypted connections. Access to your data in our database is limited to your own account using row-level security, and our server functions check who is asking before they read your data. Your Health Connect summaries are stored in the same protected database and cannot be changed from the app directly. No system is perfectly secure; if a breach puts your rights at risk we will tell you and the ICO as the law requires.
13. Not medical advice
Formm is coaching, not medical advice. It does not diagnose, treat or prevent any condition, and the sleep, resting heart rate and activity figures it uses are estimates from your devices, which can be wrong or missing. Talk to a doctor or physiotherapist before starting a training or nutrition programme, especially if you are injured, pregnant, unwell or have a medical condition. Stop and seek advice if something hurts or if a reading worries you.
14. Changes to this policy
If we change this policy in a way that matters we will tell you in the app before it takes effect, and ask for consent again if the way we use your health information changes.
15. Contact
Avlo Ltd, 34 West Woodside, Bexley, DA5 3PQ, United Kingdom (company number 17095752, registered in England and Wales) Email: formm@avlo.uk