Privacy policy

3.1 Account and profile

Email address, password (stored as a salted hash by our authentication provider), display name, and any profile details you add, including a photograph if you upload one.

3.2 Orders and payments

What you ordered, delivery address, order history, and returns. We never see or store your full card details. Payment is handled by our payment providers, who send us only a confirmation and the last four digits.

3.3 Wellness profile

Age range, sleep window, primary disruptors, exercise frequency, caffeine cut-off, goals and any free-text notes. Voluntary.

3.4 Health and wellbeing data (special category)

If you switch on the relevant features, our servers hold:

• Training sessions, plans, schedules, check-ins, soreness, body goals, and your training thresholds and zones (FTP, threshold heart rate, threshold pace) where you or a coach set them
• Meals logged, protein, energy, plant and portion counts, water, targets, any meal plan, recipe, food or supplement a coach prescribes, shares or suggests, and a coach's comments on meals you have shared with them
• Weight, body measurements, progress entries and progress photographs, and the measurements and fitness test results a coach records about you in a session
• Sleep schedule, declared bedtime and wake times, sleep check-ins and wind-down routines
• Journal entries (with the readings saved beside each, section 4.3), symptom tags, habits and weekly check-ins
• Your wellness profile: age range, sleep window, disruptors, exercise frequency, caffeine cut-off, goals and notes
• What you have chosen to share with a coach, your intake form and health questionnaire, coaching check-ins, and the record of what a coach looked at
• What you send one coach from your phone, only after you switch it on for that coach: a weekly summary from your watch (your 7-day average against your usual, the device it came from, and whether it dropped a lot), kept 35 days; the blood-test results you pick; the name of your current cycle phase; and the record of which coach you allowed to see each

Some health data never reaches our servers at all and is kept only on your phone:

• Apple Health readings (see the connected sources above)
• WHOOP readings, which pass through our server to the phone and are not stored on it
• The supplement list and reminder times you keep for yourself
• Blood-test results you keep in the app, except the ones you choose to share with a coach
• Menstrual cycle tracking, which is off by default. Only the name of your current phase can leave the phone, and only to a coach you allow

This is special category data under Article 9 of the UK GDPR and we treat it accordingly. Sections 4.2 and 4.3 explain our lawful basis.

3.5 Advisor conversations and memory

Your messages to ORUS Advisor, its responses, and the durable “memory facts” it derives from your conversations. You can view, edit and delete every memory fact and wipe conversations at any time.

3.6 Community and social

Clubs you belong to and follow, posts and comments, people you follow, messages you send, and what you have chosen to share.

3.7 Bookings

Which practitioner, venue, class, event or course you booked, when, what you paid, and whether you were checked in.

3.8 Recommendations from a coach

Where a coach you work with recommends a product to you through ORUS, we record that the recommendation was made, and the note they wrote with it. We never tell a brand who recommended its product.

3.9 Reviews

Rating, review text, photos and the display name attributed to the review.

3.10 Technical

IP address, device and browser type, app version, and error diagnostics collected by our error monitoring tool. Used to keep the service working and secure.

3.11 Cookies and similar technologies

See section 10.

3.12 Applications you send us

If you apply to work with ORUS, we keep what the form asks for. Each is ordinary personal data, never health data, and is seen by the ORUS team only.

• Brand and partner applications. If you apply to sell on ORUS as a brand: the brand's name, website and Instagram, your name, role, email and phone number, the country you sell from, what you sell and at what prices, how you ship, your certifications, insurance and track record, your answers to the product safety questions, and any documents you upload with it. We use it to decide whether to accept the brand and to set up selling. Seen by the ORUS team only.
• Expert and coach applications. If you apply as an expert or coach: your name, headline, location, specialties, credentials and links, whether you coach or run classes, your insurance (insurer, policy number, cover and expiry), your certificates and track record, where you work, whether your identity has been checked, and any documents you upload with it. We use it to decide whether to accept you and, if we do, for your expert profile. Seen by the ORUS team only.
• ORUS Athletes applications. If you apply to ORUS Athletes: your name, email, city and country, your sport or field, any level, results and links you give, what you tell us about yourself, what support you asked for, and when you agreed to us keeping it. Seen by the ORUS team only; deleted on request or when you delete your account.
• Club applications. If you apply to start a club: the club's name, kind, city, description and Instagram, how many members you expect, and your name and email. We use it to decide whether to open the club. Seen by the ORUS team only.

How long each is kept is in section 11.

3.13 Your location, when you ask for things near you

The app asks for your location only when you tap Use my location, to find classes, studios and coaches near you. It asks your phone for an approximate position, never a precise one, keeps it in memory until the app closes, and sends it with that search so our server can look 10, 25 or 50 km around it. We do not store it. Because it travels in the search address, our hosting provider’s request logs can record it for as long as those logs are kept. On orus.uk, finding clubs near you rounds your browser’s position to about a kilometre and keeps it in a cookie for 24 hours; the distance shown beside a class is worked out in your browser and not sent to us.

3.14 When you open the app, and what happens to notifications

We record the days you open the app (one line per day), and for each notification we send you, whether it was sent, whether you opened it, and when you switch a kind of notification off or on. We use these to decide when a reminder is worth sending and to keep within the number of nudges you chose, and, counted across everyone and never by name, to see how many people come back after 7 and 30 days and which kinds of notification people find useful. They are never used for advertising.

3.15 If you are a coach: Google Calendar

If you are a coach and connect Google Calendar, we send your ORUS sessions (title, time, place or video link) to your Google Calendar and read only the start and end times of events you are busy for, so clients cannot book you then. We never read or store what those events are. You can disconnect at any time in your calendar settings.

We keep the Google account address you connected, an encrypted access and refresh token, and which Google event matches which session. A session title can contain a client’s name if you wrote one. Disconnecting removes ORUS’s future events from your Google Calendar, revokes our access and deletes the busy times and tokens we hold.

4.1 Ordinary personal data

Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights. You can object at any time. See section 9.

Important. The bases in this table are our Article 6 bases for ordinary personal data. Health and wellbeing data, including anything read from Apple Health, is special category data and needs a second condition under Article 9. For that we rely only on your explicit consent, never on legitimate interests. Sections 4.2 and 4.3 explain this.

4.2 Health and wellbeing data

For everything listed in section 3.4, our condition for processing special category data is your explicit consent under Article 9(2)(a) of the UK GDPR.

That means:

• Each health feature stays off until you turn it on and give clear, specific consent.
• Consent is separate per feature. Turning on nutrition logging does not turn on cycle tracking, and connecting Apple Health does not share anything with a coach.
• You can withdraw consent at any time from Consent and data in the app, without affecting anything we did before you withdrew it.
• Withdrawing consent for a feature means we stop processing that data and delete it, unless we are required to keep something by law.
• We do not rely on legitimate interests for health data, and we will not use it for marketing, profiling for advertising, or automated decisions that produce legal or similarly significant effects.

We have carried out a Data Protection Impact Assessment covering these features. See section 12A.

4.3 The sources you can connect: Apple Health, Health Connect and WHOOP

The app can read from Apple Health on your iPhone so that it can show and interpret your own readings, from Health Connect on Android (section 4.3B), and it can connect directly to a WHOOP account (section 4.3A). Those are the only three sources today. If we add another, this policy is updated before it goes live, the list below changes, and you are asked to consent to that source separately. Connecting is optional, and separate from every other health feature.

What the app asks to read, each one a separate line on the iOS permission screen that you can allow or refuse individually:

• sleep, including stages and time in bed
• heart rate variability
• resting heart rate
• heart rate during your workouts, to work out your training zones when you ask
• respiratory rate
• sleeping wrist temperature
• steps
• active energy
• workouts
• weight
• blood pressure (systolic)
• blood pressure (diastolic)

Heart rate during your workouts, only when you ask ORUS to work out your training zones. It is read on your phone; the readings are not uploaded, only the zone thresholds you choose to save.

What the app writes: a workout you log in ORUS, only if you allowed writing. Nothing else is written.

Where the readings live: On your phone. Readings are kept in a daily record on the device and are not uploaded to our servers as a stream. The home-screen widget reads the same record. iOS may wake the app in the background when a new sleep, heart or workout reading arrives so that record stays current; that refresh also stays on the phone. There is no table of Apple Health readings in our database. The one exception is a journal entry, below. Apple does not tell an app which read permissions were refused; a refused type simply returns nothing.

When a summary leaves the phone: the Advisor, only with your permission. The first time you open ORUS Advisor with Apple Health connected, the app asks whether the Advisor may use a summary of your latest readings. You can change your answer at any time in Settings, under Advisor, and we record each answer. Only while it is on, when you send a message to ORUS Advisor, the app attaches a summary of your latest readings so the Advisor can answer against your own baseline rather than a general average: your readiness score; last night’s sleep hours, stages, efficiency and sleep debt; heart rate variability, resting heart rate and respiratory rate, each with your recent baseline and the change against it; how far your sleeping wrist temperature was from your own baseline, in degrees Celsius (for example 0.4 degrees above), and whether that is raised, steady or lower (never the temperature itself); active energy and steps with their change; today’s workouts as type, duration and energy; the last seven days beside the seven before them as averages of those same readings (sleep hours, readiness, heart rate variability, resting heart rate and workout minutes, with how many nights were recorded); and when the readings were last synced. That summary is used to build the reply and is sent to our AI provider under section 7. It is not stored with the conversation; the words you typed are. You can use every health feature without ever writing to the Advisor.

When readings are saved with a journal entry. When you start a journal entry, the app saves beside it the readings you had at that moment, so that the entry can show the night and the day you wrote it in: sleep hours, sleep efficiency and sleep debt, heart rate variability, resting heart rate and respiratory rate, active energy and steps, how far your sleeping wrist temperature was from your own baseline in degrees Celsius, and the day’s workouts as type and minutes. This snapshot is stored on our servers with the entry, under the journal in section 3.4. It is never updated afterwards, and it is deleted when you delete the entry or your account.

Coaches see none of it by default. Connecting Apple Health shares nothing with any coach, club or practitioner. The one way a reading reaches a coach is the weekly summary in section 4.4, which you switch on per coach and per kind of reading, off until you turn it on, and each change is written to a consent ledger you can read.

Disconnecting is on the Wearables screen in the app. It stops the app reading Apple Health and clears the record held on your phone. Nothing from Apple Health is held on our servers except the readings saved with a journal entry, which stay with that entry until you delete it, and a weekly summary you share with a coach (section 4.4), which is deleted when you switch it off. A summary already inside a stored Advisor reply stays until you wipe that conversation.

Who controls what. Apple Health is Apple’s, on your phone, under Apple’s terms with you. We do not control what it records or how accurate it is. What the app reads becomes a copy on the device that we are responsible for, under this policy. We do not use Apple Health data for advertising or marketing, we do not share it with third parties for their own purposes, we do not use it to train AI models, and we do not sell it. This is required by Apple and it is also our own policy.

4.3A WHOOP, connected directly

On the Wearables screen you can connect a WHOOP account. You are sent to WHOOP's own sign-in page, where WHOOP asks you to allow ORUS access; you can refuse, and you can revoke it later from either side.

What we ask WHOOP for, each a separate permission on WHOOP's screen:

• sleep: hours asleep, efficiency and respiratory rate
• recovery: WHOOP's recovery score, heart rate variability and resting heart rate
• daily strain and energy
• workouts: the sport and how long
• your WHOOP user id, so WHOOP's change notices can be matched to your account

What our server holds: the connection itself, meaning an access token, a refresh token and your WHOOP user id, in a table no app or website session can read. Where the readings live: On your phone. Our server holds the connection and fetches readings only when your phone asks, handing them straight to the phone's daily record; no reading is kept on the server. When a record changes, WHOOP sends our server a notice carrying only the record's id and kind; our server then asks your phone to fetch the latest, and the readings still go to the phone alone.

Disconnecting is on the same Wearables screen. It asks WHOOP to revoke our access and deletes the connection from our server. Because no reading is held on the server, there is nothing else to delete there; the copy on your phone clears with the rest of your health record.

Who controls what. WHOOP is WHOOP's, under WHOOP's terms with you. What the app fetches becomes a copy on your device that we are responsible for, under this policy, and everything said above about Apple Health data applies to it: no advertising, no third parties for their own purposes, no model training, no sale.

4.3B Health Connect, on Android

On Android, ORUS reads the same kinds of data from Health Connect, except sleeping wrist temperature. Heart rate variability there is RMSSD. Readings from more than 30 days before you first connect are not read, and readings refresh when you open the app. ORUS’s use of information received from Health Connect follows the Health Connect Permissions policy, including its Limited Use requirements.

What the app asks to read, each a separate permission in Health Connect:

• sleep
• heart rate variability (RMSSD)
• resting heart rate
• respiratory rate
• steps
• active calories
• exercise sessions
• weight
• blood pressure

What the app writes: a finished ORUS workout (type, start and end only), when you allow it. Nothing else is written.

Health Connect (Android): with the member's permission in Health Connect, ORUS reads sleep, heart rate variability (RMSSD), resting heart rate, respiratory rate, steps, active calories, exercise sessions, weight and blood pressure. When the member allows it, ORUS writes a finished ORUS workout (type, start and end only). Readings stay on the phone. They leave it only as the advisor summary when switched on, a journal entry's note of the day, a Sync latest copy of weight or blood pressure into the progress log, and what the member shares with a coach. Not used for advertising, not sold, not used to train AI models. Revoked in Health Connect, App permissions, ORUS.

4.4 What you can send a coach from your phone

Three things that otherwise stay on your phone can be sent to a coach you work with through ORUS. Each is off until you switch it on, for one coach at a time, from Your team in the app. Turning one on for one coach shares nothing with any other coach, and a coach you add later sees nothing until you switch it on for them. Before anything is sent you are shown what it is, and each change is written to the consent ledger you can read. Switching it off, or the coaching ending, deletes what was sent from our servers.

A weekly summary from your watch. For each of steps, sleep, heart rate variability and resting heart rate that you switch on, the wording you see is: “Share a weekly summary from your watch with [Coach]. [Coach] sees your 7-day average against your usual and which device it came from (for example Steps · Amazfit), and is told when it drops a lot. Your daily readings stay on this phone. Switch it off any time and the summary is deleted.” The phone works out the summary from its own record: the average of the last seven days with a reading, the average of the four weeks before, the device that recorded most of it, and, when the week has dropped well below your usual, a line saying so, which appears among the reasons on your coach’s client list. Only those figures are sent, never a daily reading. Each summary is kept for 35 days.

Your blood-test results. The wording you see is: “Share my blood-test results with [coach]. You can stop sharing at any time.” You then pick which results to send. The coach sees each marker, its value and unit, the range you typed from your report, the date and the lab. Results you do not pick stay on your phone. Stopping deletes them from our servers.

The phase of your cycle. The wording you see is: “Let [coach] see which phase of your cycle you are in, to adjust your training. Not your logs, dates or notes. Switch it off any time.” Only the name of the current phase (period, follicular, around ovulation or luteal) leaves the phone, and it is replaced as the phase changes.

A coach who sees any of this receives it as a coach you chose, under section 8. We record when a coach was shown it, on the record of what a coach looked at, which you can read in the app.

4.5 Reading a printout or label from a photo

Instead of typing them, you can photograph an InBody or DEXA printout, or a supplement label, and the app fills the form for you. The photo is sent to our AI provider (section 7) to read the figures; you check every field before anything is saved. We do not keep the photo, and the figures are saved only when you press save, in the same place as figures you type. Before your first photo the app tells you this and asks you to agree, and we record your answer. Each photo counts as one photo scan, the same as a meal photo.

4.6 How your bests compare with your age group

If you switch on Compare with my age group, ORUS shows beside a personal best what share of other ORUS members in your age band, who log the same lift or event, you are ahead of. To do this we use your age band and your personal bests, and the same from other members who have also switched it on. Only a percentage is ever shown: never a name, never anyone else’s numbers, and nothing at all until at least 20 members in your age band log that lift. Switching it on also includes your bests in other members’ comparisons; switching it off takes them out of the next one. Nothing new is stored: the comparison is worked out each time you open your bests. Our condition for this is your explicit consent (section 4.2), and you can withdraw it at any time with the same switch, on Personal bests in the app.

MY.1 Who the controller is

Until a Malaysian operating company is incorporated and named in this annex, Eight Hours Group Ltd is the data controller for the Malaysia market, at the address in section 16. When a Malaysian operating company takes over that role we will update this annex and tell affected users before the change takes effect.

MY.2 How the law differs from the UK

• The Act is consent-led. There is no general “legitimate interests” basis, so where the main policy relies on legitimate interests we rely instead on your consent or on a specific ground in the Act.
• Sensitive personal data, which includes health data and anything read from Apple Health, requires your explicit consent. This matches how we already treat it.
• The Act uses the term “data controller”, which replaced “data user” under the 2024 Amendment Act.
• Your rights of access, correction, withdrawal of consent, and to limit processing come from the Act. The rights listed in section 9 are given effect in Malaysia through the equivalent provisions.

MY.3 Your local contact and our Data Protection Officer

Where the Act requires it, we appoint a Data Protection Officer who is resident in Malaysia or readily contactable there, and who is proficient in Bahasa Melayu and English. Their contact details are published on the Malaysia store and notified to the Commissioner as required. Until that appointment is published, contact hello@orus.uk, marked for the attention of the Malaysia data protection contact.

We keep the appointment under review against the thresholds in the Act, which include processing the personal data of a large number of people, processing sensitive personal data at scale, and carrying out regular and systematic monitoring. Continuous health tracking is capable of meeting the last of these.

MY.4 Data breaches

Where a breach affecting Malaysian personal data causes or is likely to cause significant harm, or affects a large number of people, we notify the Commissioner as soon as possible and in any event within the period the Act requires, and we notify affected individuals where the Act requires it. This is a separate route from the UK notification described in section 13, and where a breach affects both markets we make both notifications.

MY.5 Data leaving Malaysia

Our infrastructure is hosted outside Malaysia: the database in the EU, and some providers in the United States, as set out in section 7. Before transferring Malaysian personal data we carry out a transfer impact assessment and rely on the grounds available under the Act, including your consent where required, and contractual protections with each recipient equivalent to those described in section 7.

MY.6 Apple Health

Section 4.3 applies in Malaysia, with two differences: your explicit consent is required for the sensitive personal data read, and the transfer of the Advisor summary outside Malaysia is covered by MY.5. Apple remains an independent party in the sense described in section 4.3, under its own terms with you.

MY.7 Complaints

Raise anything with us first at hello@orus.uk. If you are not satisfied, you may complain to the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi), whose contact details are at pdp.gov.my. The Information Commissioner’s Office in the United Kingdom does not supervise processing carried out under this annex.

MY.8 Language

This policy is provided in English. Where we publish a Bahasa Melayu translation and there is a conflict, the English version governs, except where Malaysian law requires otherwise.