Privacy policy

Pulsix is a data-first fitness and health platform. Privacy is not a compliance afterthought for us — it is part of the product. This policy explains what personal data we collect, why, what we do with it, and the rights you have over it. It applies to the Pulsix product at app.pulsix.io and to this website (pulsix.io).

1. Who we are

Pulsix is operated from the United Kingdom (“Pulsix”, “we”, “us”). For the personal data described in this policy, Pulsix is the data controller under the UK GDPR and, where applicable, the EU GDPR. You can reach our privacy team at privacy@pulsix.io.

2. What we collect

Account data

• Email address, display name and password (stored as a strong one-way hash).
• Optional security factors you enrol: authenticator-app (TOTP) secrets and passkey/ WebAuthn credentials, plus recovery codes.
• Your preferences (for example metric/imperial units).

Health and fitness data (special category)

The point of Pulsix is to unify the signals you choose to capture. Depending on what you log, connect or upload, this can include: workouts and sets, cardio sessions, bodyweight and girth measurements, blood pressure and resting heart rate, DEXA body-composition scans, blood-test results (including hormones), nutrition entries, sleep, habits, mood, goals, and content you exchange with the AI coach. This is special-category data under Article 9 GDPR and we treat it accordingly — see our data protection page for the safeguards.

Connected sources

When you connect an integration (for example Strava) we store the connection, encrypted access tokens, and the data the source provides. The MyFitnessPal connector reads your public diary by username only — we never ask for or store your MyFitnessPal password. When you upload a file (DEXA PDF, blood-test PDF/CSV, Apple Health export, ChatGPT export) we process the file to extract the data, show you the result, and save only what you confirm.

Billing data

Payments are processed by Stripe. We do not receive or store your full card details; we hold your subscription state, tier and Stripe customer reference.

Technical data

Standard server logs (IP address, user agent, timestamps) and security events (logins, failed attempts, coach access), kept for security, audit and abuse prevention. This marketing website sets no cookies and runs no analytics or ad trackers — see the cookie policy.

3. Why we process it (lawful bases)

• To provide the service (contract): storing your captured data, syncing your connected sources, rendering your charts, timeline and reports, and operating your account and subscription.
• Health-data processing (explicit consent): we process your health and fitness data because you explicitly choose to log, connect or upload it for the purpose of receiving the product’s analysis and coaching. You can withdraw consent at any time by deleting the data or your account.
• AI coaching (contract + explicit consent): generating insights, adaptive targets, reports, chat answers and coach check-in drafts from your data.
• Security and abuse prevention (legitimate interests): logs, rate limiting, audit trails and fraud prevention.
• Service emails (contract): transactional email such as password resets and billing notices, sent via SendGrid. We do not run marketing email lists unless you explicitly opt in, and we never buy or sell lists.

4. The AI coach and your data

Pulsix’s coaching features send relevant slices of your own data to our AI provider (Anthropic) to generate grounded answers, insights, targets and report text. Calls are scoped to a single athlete at a time; your data is never mixed into another user’s context. We use API terms under which the provider does not use our customers’ data to train its models. AI chat content is stored encrypted at rest with an additional application-level layer.

5. Who sees your data

• You. Your data belongs to you. You can export all of it, or delete your account entirely, self-service in the app (Settings → Privacy).
• A coach — only with your consent. If you connect with a coach, they see your data strictly within the consent you grant. You can revoke that consent at any time, and coach access is audited.
• Our subprocessors — the infrastructure and service providers listed on the data protection page (AWS, Stripe, Anthropic, SendGrid, and Google only if you sign in with Google), each bound by data-processing agreements.

We do not sell personal data, share it with advertisers or data brokers, or use it for advertising. Ever.

6. Where your data lives

Customer data is hosted on AWS in the London region (eu-west-2) — database, file storage and backups. Some subprocessors (Stripe, Anthropic, SendGrid) process limited data outside the UK/EEA; those transfers are protected by appropriate safeguards (UK International Data Transfer Agreement/Addendum and EU Standard Contractual Clauses).

7. How long we keep it

• Your captured data: for as long as your account exists. Deleting your account permanently deletes it.
• Backups: encrypted backups are retained on a rolling window (up to 35 days) and then expire; deleted data leaves the backup cycle as it rotates.
• Billing records: kept as required by tax and accounting law (typically 6 years in the UK).
• Security logs: kept for up to 12 months unless needed for an ongoing investigation.

8. Your rights

Under UK/EU GDPR you have the rights of access, portability, rectification, erasure, restriction, objection, and the right to withdraw consent. Export (access + portability) and erasure are self-service in the app; for anything else email privacy@pulsix.io. Full detail, including how each right works in Pulsix, is on the data protection page. You also have the right to complain to the UK Information Commissioner’s Office (ico.org.uk) or your local EU supervisory authority.

9. Security

Data is encrypted in transit (TLS) and at rest; integration tokens and AI chat content carry an additional application-level encryption layer (AES-256-GCM). Tenant isolation is enforced at the database layer so that queries outside your own account context return nothing by default. Multi-factor authentication (authenticator apps and passkeys) is available to every account. Coach access to athlete data is consent-scoped and audited.

10. Children

Pulsix is not intended for children under 16 and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.

11. Not medical advice

Pulsix provides coaching insights, not medical advice. It is not a medical device and does not diagnose, treat or prevent any condition. If a biomarker is flagged as out of range, discuss it with your GP or a qualified clinician.

12. Changes to this policy

If we make material changes we will notify account holders by email or in-app before the change takes effect, and update the date at the top of this page.