Privacy policy

3.1 Account and profile

Email address, password (stored as a salted hash by our authentication provider), display name, and any profile details you add, including a photograph if you upload one.

3.2 Orders and payments

What you ordered, delivery address, order history, and returns. We never see or store your full card details. Payment is handled by our payment providers, who send us only a confirmation and the last four digits.

3.3 Wellness profile

Age range, sleep window, primary disruptors, exercise frequency, caffeine cut-off, goals and any free-text notes. Voluntary.

3.4 Health and wellbeing data (special category)

If you switch on the relevant features, our servers hold:

• Training sessions, plans, schedules, check-ins, soreness, body goals, and your training thresholds and zones (FTP, threshold heart rate, threshold pace) where you or a coach set them
• Meals logged, protein, energy, plant and portion counts, water, targets, any meal plan, recipe or supplement a coach prescribes, and a coach's comments on meals you have shared with them
• Weight, body measurements, progress entries and progress photographs
• Sleep schedule, declared bedtime and wake times, sleep check-ins and wind-down routines
• Journal entries, symptom tags, habits and weekly check-ins
• Your wellness profile: age range, sleep window, disruptors, exercise frequency, caffeine cut-off, goals and notes
• What you have chosen to share with a coach, your intake form and health questionnaire, coaching check-ins, and the record of what a coach looked at

Some health data never reaches our servers at all and is kept only on your phone:

• Apple Health readings (see the connected sources above)
• WHOOP readings, which pass through our server to the phone and are not stored on it
• The supplement list and reminder times you keep for yourself
• Menstrual cycle tracking, which is off by default

This is special category data under Article 9 of the UK GDPR and we treat it accordingly. Sections 4.2 and 4.3 explain our lawful basis.

3.5 Advisor conversations and memory

Your messages to ORUS Advisor, its responses, and the durable “memory facts” it derives from your conversations. You can view, edit and delete every memory fact and wipe conversations at any time.

3.6 Community and social

Clubs you belong to and follow, posts and comments, people you follow, messages you send, and what you have chosen to share.

3.7 Bookings

Which practitioner, venue, class, event or course you booked, when, what you paid, and whether you were checked in.

3.8 Recommendations from a coach

Where a coach you work with recommends a product to you through ORUS, we record that the recommendation was made, and the note they wrote with it. We never tell a brand who recommended its product.

3.9 Reviews

Rating, review text, photos and the display name attributed to the review.

3.10 Technical

IP address, device and browser type, app version, and error diagnostics collected by our error monitoring tool. Used to keep the service working and secure.

3.11 Cookies and similar technologies

See section 10.

4.1 Ordinary personal data

Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights. You can object at any time. See section 9.

Important. The bases in this table are our Article 6 bases for ordinary personal data. Health and wellbeing data, including anything read from Apple Health, is special category data and needs a second condition under Article 9. For that we rely only on your explicit consent, never on legitimate interests. Sections 4.2 and 4.3 explain this.

4.2 Health and wellbeing data

For everything listed in section 3.4, our condition for processing special category data is your explicit consent under Article 9(2)(a) of the UK GDPR.

That means:

• Each health feature stays off until you turn it on and give clear, specific consent.
• Consent is separate per feature. Turning on nutrition logging does not turn on cycle tracking, and connecting Apple Health does not share anything with a coach.
• You can withdraw consent at any time from Consent and data in the app, without affecting anything we did before you withdrew it.
• Withdrawing consent for a feature means we stop processing that data and delete it, unless we are required to keep something by law.
• We do not rely on legitimate interests for health data, and we will not use it for marketing, profiling for advertising, or automated decisions that produce legal or similarly significant effects.

We have carried out a Data Protection Impact Assessment covering these features. See section 12A.

4.3 The sources you can connect: Apple Health and WHOOP

The app can read from Apple Health on your iPhone so that it can show and interpret your own readings, and it can connect directly to a WHOOP account (section 4.3A). Those are the only two sources today. If we add another, this policy is updated before it goes live, the list below changes, and you are asked to consent to that source separately. Connecting is optional, and separate from every other health feature.

What the app asks to read, each one a separate line on the iOS permission screen that you can allow or refuse individually:

• sleep, including stages and time in bed
• heart rate variability
• resting heart rate
• respiratory rate
• sleeping wrist temperature
• steps
• active energy
• workouts
• weight
• blood pressure (systolic)
• blood pressure (diastolic)

What the app writes: a workout you log in ORUS, only if you allowed writing. Nothing else is written.

Where the readings live: On your phone. Readings are kept in a daily record on the device and are not uploaded to our servers as a stream. The home-screen widget reads the same record. iOS may wake the app in the background when a new sleep, heart or workout reading arrives so that record stays current; that refresh also stays on the phone. There is no table of Apple Health readings in our database. Apple does not tell an app which read permissions were refused; a refused type simply returns nothing.

The one time a summary leaves the phone. When you send a message to ORUS Advisor, the app attaches a summary of your latest readings so the Advisor can answer against your own baseline rather than a general average: your readiness score; last night’s sleep hours, stages, efficiency and sleep debt; heart rate variability, resting heart rate and respiratory rate, each with your recent baseline and the change against it; the direction of your sleeping wrist temperature against its baseline; active energy and steps with their change; today’s workouts as type, duration and energy; the last seven days beside the seven before them as averages of those same readings (sleep hours, readiness, heart rate variability, resting heart rate and workout minutes, with how many nights were recorded); and when the readings were last synced. That summary is used to build the reply and is sent to our AI provider under section 7. It is not stored with the conversation; the words you typed are. You can use every health feature without ever writing to the Advisor.

Coaches see none of it by default. Connecting Apple Health shares nothing with any coach, club or practitioner. Sharing a stream with a coach is a separate switch per stream on the Your coach screen, off until you turn it on, and each change is written to a consent ledger you can read.

Disconnecting is on the Wearables screen in the app. It stops the app reading Apple Health and clears the record held on your phone. Because nothing from Apple Health is held on our servers, there is no keep-or-delete question to answer. A summary already inside a stored Advisor reply stays until you wipe that conversation.

Who controls what. Apple Health is Apple’s, on your phone, under Apple’s terms with you. We do not control what it records or how accurate it is. What the app reads becomes a copy on the device that we are responsible for, under this policy. We do not use Apple Health data for advertising or marketing, we do not share it with third parties for their own purposes, we do not use it to train AI models, and we do not sell it. This is required by Apple and it is also our own policy.

4.3A WHOOP, connected directly

On the Wearables screen you can connect a WHOOP account. You are sent to WHOOP's own sign-in page, where WHOOP asks you to allow ORUS access; you can refuse, and you can revoke it later from either side.

What we ask WHOOP for, each a separate permission on WHOOP's screen:

• sleep: hours asleep, efficiency and respiratory rate
• recovery: WHOOP's recovery score, heart rate variability and resting heart rate
• daily strain and energy
• workouts: the sport and how long
• your WHOOP user id, so WHOOP's change notices can be matched to your account

What our server holds: the connection itself, meaning an access token, a refresh token and your WHOOP user id, in a table no app or website session can read. Where the readings live: On your phone. Our server holds the connection and fetches readings only when your phone asks, handing them straight to the phone's daily record; no reading is kept on the server. When a record changes, WHOOP sends our server a notice carrying only the record's id and kind; our server then asks your phone to fetch the latest, and the readings still go to the phone alone.

Disconnecting is on the same Wearables screen. It asks WHOOP to revoke our access and deletes the connection from our server. Because no reading is held on the server, there is nothing else to delete there; the copy on your phone clears with the rest of your health record.

Who controls what. WHOOP is WHOOP's, under WHOOP's terms with you. What the app fetches becomes a copy on your device that we are responsible for, under this policy, and everything said above about Apple Health data applies to it: no advertising, no third parties for their own purposes, no model training, no sale.

MY.1 Who the controller is

Until a Malaysian operating company is incorporated and named in this annex, Eight Hours Group Ltd is the data controller for the Malaysia market, at the address in section 16. When a Malaysian operating company takes over that role we will update this annex and tell affected users before the change takes effect.

MY.2 How the law differs from the UK

• The Act is consent-led. There is no general “legitimate interests” basis, so where the main policy relies on legitimate interests we rely instead on your consent or on a specific ground in the Act.
• Sensitive personal data, which includes health data and anything read from Apple Health, requires your explicit consent. This matches how we already treat it.
• The Act uses the term “data controller”, which replaced “data user” under the 2024 Amendment Act.
• Your rights of access, correction, withdrawal of consent, and to limit processing come from the Act. The rights listed in section 9 are given effect in Malaysia through the equivalent provisions.

MY.3 Your local contact and our Data Protection Officer

Where the Act requires it, we appoint a Data Protection Officer who is resident in Malaysia or readily contactable there, and who is proficient in Bahasa Melayu and English. Their contact details are published on the Malaysia store and notified to the Commissioner as required. Until that appointment is published, contact hello@orus.uk, marked for the attention of the Malaysia data protection contact.

We keep the appointment under review against the thresholds in the Act, which include processing the personal data of a large number of people, processing sensitive personal data at scale, and carrying out regular and systematic monitoring. Continuous health tracking is capable of meeting the last of these.

MY.4 Data breaches

Where a breach affecting Malaysian personal data causes or is likely to cause significant harm, or affects a large number of people, we notify the Commissioner as soon as possible and in any event within the period the Act requires, and we notify affected individuals where the Act requires it. This is a separate route from the UK notification described in section 13, and where a breach affects both markets we make both notifications.

MY.5 Data leaving Malaysia

Our infrastructure is hosted outside Malaysia: the database in the EU, and some providers in the United States, as set out in section 7. Before transferring Malaysian personal data we carry out a transfer impact assessment and rely on the grounds available under the Act, including your consent where required, and contractual protections with each recipient equivalent to those described in section 7.

MY.6 Apple Health

Section 4.3 applies in Malaysia, with two differences: your explicit consent is required for the sensitive personal data read, and the transfer of the Advisor summary outside Malaysia is covered by MY.5. Apple remains an independent party in the sense described in section 4.3, under its own terms with you.

MY.7 Complaints

Raise anything with us first at hello@orus.uk. If you are not satisfied, you may complain to the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi), whose contact details are at pdp.gov.my. The Information Commissioner’s Office in the United Kingdom does not supervise processing carried out under this annex.

MY.8 Language

This policy is provided in English. Where we publish a Bahasa Melayu translation and there is a conflict, the English version governs, except where Malaysian law requires otherwise.