Privacy notice.

1. Who we are

UTOVA is the trading name of David Stelfox, a sole trader in England. For privacy questions or requests, email [email protected] or write to the correspondence address shown below.

For business-account administration, billing, security and direct enquiries, UTOVA decides why and how personal information is used and acts as the controller. For member information processed through a participating gym, studio or personal trainer, that fitness business is normally the controller and UTOVA acts as its processor.

2. Information we use

• Business and account details: name, email address, role, business name and location, sign-in identifiers and account settings.
• Member and booking details: contact details, membership requests, bookings, attendance, passes and notes entered by the fitness business or member.
• Payment information: Stripe customer, subscription, payment and refund identifiers and payment status. Card details are entered into Stripe-hosted forms and are not stored by UTOVA.
• Support and enquiry information: messages sent to us, including early-access forms submitted through FormSubmit.
• Technical and security information: IP address, browser/device details, authentication records, error data and security logs.

Some notes about injuries, accessibility or training goals may reveal health information, which is special category data. Fitness businesses must collect only what they need and must identify an appropriate lawful basis and additional condition before entering it.

3. Why we use it

Where UTOVA acts only on a fitness business’s instructions, that business is responsible for telling members its own purposes and lawful bases.

4. Who receives information

We use carefully selected service providers to run UTOVA, including Cloudflare for hosting and security, Google/Firebase for authentication, Stripe for payments and FormSubmit for website enquiries. They receive only the information needed for their service and may process it under their own notices where they act as independent controllers.

Information may also be disclosed where required by law, to protect people or the service, or as part of a business reorganisation with suitable safeguards.

5. International transfers

Some providers may process information outside the UK. Where UK data protection law requires it, we rely on an adequacy regulation or approved contractual safeguards and assess the protection available.

6. Retention

We keep personal information only while it is needed for the purposes above. Account and workspace information is generally kept while the account is active and for a limited period after closure to handle recovery, disputes and security. Payment, invoice and tax records may be kept for the period required by law. Support and security records are kept according to their relevance and risk, then deleted or anonymised. Backup copies expire on their normal rotation.

The controlling fitness business sets retention periods for its member records. Businesses can export their data and can ask UTOVA to assist with deletion where required.

7. Cookies and local storage

The public website does not currently use advertising or analytics cookies. The UTOVA app uses essential browser storage and authentication technology to keep you signed in, remember app state, support installation and protect the service. Blocking essential storage may stop the app working correctly.

8. Your rights

Depending on the circumstances, you may ask for access, correction, deletion, restriction, portability or an objection to use of your information. You may withdraw consent where consent is the basis. Contact the fitness business first for member data it controls, or email UTOVA if the request concerns your UTOVA account, billing or enquiry data. We may need to verify your identity.

You may complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint. We would appreciate the chance to address the concern first.

9. Security and changes

We use access controls, encrypted connections, tenant separation, payment-provider controls and operational monitoring appropriate to the service. No online service can promise absolute security. We will update this notice when our practices materially change and will show the revision date above.

Contact