Who we are
Regem plans your training and meals at gymmie.co.uk. It is provided by Stargit Solutions Ltd ("we", "us"), which decides how your personal data is used and is responsible for it under UK data protection law.
For anything about your data, email privacy@gymmie.co.uk. For help with the app, email support@gymmie.co.uk.
Who can use Regem
You must be 16 or older. If we learn that someone under 16 has an account, we will delete it. If you are under 18, your plan never cuts your calories, whatever goal you choose: your training does the work.
What we collect
- Your account — your email address and password. Our sign-in provider stores the password only in scrambled form; we never see it.
- Your profile — name, age, sex, height, weight, target weight, goal, training level, training days and session length, the equipment at your gym, units, country, cuisine and food preferences, dietary needs, and a profile photo if you add one.
- Your health — injuries and joint limits you tell us about, pain you report at a check-in, and your sleep, energy, stress, mood and soreness answers. See "Your health information" below.
- Your training and food — the sessions we plan and the ones you log (exercises, sets, reps, weights, effort and timings), sessions you log from elsewhere, weigh-ins and body measurements, the meal plans you use, and the meals you mark as eaten.
- Messages to the coach — what you type in the coach chat.
- Reminders and notifications — whether you turned them on, when, your timezone, and a record of each one we sent. For phone and browser notifications, the address your browser gives us to reach that device, and the browser type.
- Invites — if you join through a friend's link, or share your own, which account invited which. Neither of you is shown the other's name.
- How you use the app — a short, fixed list of actions, such as opening the installed app or sharing your invite link, recorded against your account.
- Technical data — your IP address and device details in our servers' logs, used to keep the service running and to stop abuse, and error reports when something breaks.
- Payments — if you subscribe, Stripe takes the payment. We never see or store your card number; we receive your subscription status.
Your health information
Injuries, joint limits, pain, and your sleep, mood, stress and soreness answers are health information. UK law gives it extra protection, and so do we. We treat your weight and body measurements the same way, because together they say something about your health.
We use it only to plan your training and meals and to explain that plan to you. We rely on your explicit consent: the app asks for it before your first health question, and you can withdraw it at any time in Profile. We never use it for marketing and never sell it. Regem is fitness guidance, not a medical service: it does not diagnose, treat or monitor any condition.
Why we use your data, and our legal basis
- To give you the service you signed up for — your account, your training and meal plans, your history, your subscription. Our basis is our contract with you. Without your profile and activity we cannot plan for you.
- To use your health information in your plan — your explicit consent.
- To send reminders and notifications — your consent, given separately for each kind. They are off until you turn them on.
- To keep the service secure, fix errors, stop abuse, credit invites, and see in totals how the service is used — our legitimate interest in running a safe and working service. You can object (see "Your rights").
- To keep tax and accounting records for payments — our legal obligation.
We do not sell your personal data, and we do not use it for advertising.
How your plan is made
Your plan is made automatically. A fixed set of sports-science rules chooses your exercises, sets, reps and weights from what you tell us and what you log. No person reviews each plan, and AI never chooses them: it only writes the coach's explanations and chat replies. A plan is a suggestion you are free to change, swap or skip. If you want a person to look at how your plan was made, email us.
Optional reminder emails
Reminder email is off by default. When you choose to enable it, you can enable training and review reminders separately, change your choice in the app, or use the one-step unsubscribe link in an email. We limit reminders to one training reminder and one review reminder in your local day, and do not use reminder email for unrelated marketing.
Reminder content is deliberately generic. We do not put injury notes, readiness, recovery, weight, nutrition, or other health details in a reminder subject line, preview, or body.
Optional notifications
The daily check-in notification is also off by default. You turn it on in Profile, and your browser asks for its own permission too. It says only that your check-in is waiting and how many days in a row you have checked in. Turning it off in Profile stops it on every device.
Who processes it for us
- Supabase — our database, sign-in and photo storage. Your data is stored in the EU (Ireland).
- Vercel — runs the app. Our servers run in London.
- Upstash — a short-lived copy of your dashboard, so it loads faster.
- Inngest — runs scheduled jobs, such as planning your week overnight and sending reminders. It receives your account ID and what the job needs, not your profile.
- OpenAI — writes the coach's explanations and chat replies. It receives your messages and the parts of your plan and profile needed to answer, which can include your goal, recent training and the joint limits you have told us about. Under OpenAI's terms for business use, it does not use this to train its models.
- Sentry — error reports: what broke, on which page and browser.
- Resend (Plus Five Five, Inc.) — sends optional reminder emails. We send only the recipient email address, a generic reminder, and delivery information needed to operate the channel.
- Google, Apple or Mozilla — depending on your browser, its push service delivers a notification to your device. The message is encrypted so the push service cannot read it.
- Stripe — takes payments, if you subscribe.
Each provider works under a contract with us and only on our instructions. Several are based in the United States, so your data may be processed there. When it leaves the UK we rely on the UK's adequacy rules (for the EU), the UK Extension to the EU–US Data Privacy Framework where the provider is certified, or standard contractual clauses with the UK Addendum.
How long we keep it
- Your account and everything in it — for as long as your account exists. You can delete your account yourself at any time from Profile → Account. Your profile, photo, health information, training and food history, coach messages, reminder and notification settings, and invite records are removed at once.
- Records while your account exists — delivery and bounce records for 90 days; the list of app actions for 90 days; system logs for up to 180 days; and the records of how each plan was made for up to 400 days, so we can explain and check a plan after the fact. All of them go when your account is deleted.
- Your reminder choices — we keep a record of each time you turned reminders on or off, so we can show we respected your choice. It is kept while your account exists and deleted with it. We do not keep copies of the emails we send.
- Invite links — the invite cookie lasts 30 days, or until you finish signing up.
- Backups — copies in our database provider's backups are removed as those backups expire.
- Payments — Stripe keeps invoices for as long as tax law requires.
Cookies and storage on your device
- Sign-in cookies — keep you signed in and the service secure. The app cannot work without them.
- Invite cookie — set only if you say yes when you open a friend's invite link. It holds the invite code and nothing about you, so that the invite counts when you sign up. It lasts 30 days, or until you finish signing up.
- Settings on this device — your light or dark theme, and the date of your last check-in.
- Offline page — the app saves one page to show when you have no connection. It holds none of your data.
We do not use advertising or tracking cookies.
Your rights
Under UK data protection law you can:
- get a copy of your data;
- have it corrected;
- have it deleted — you can delete your account yourself in Profile → Account;
- restrict how we use it, or object to uses based on our legitimate interest;
- get the data you gave us in a common format, to take elsewhere;
- withdraw your consent at any time, in Profile: turn reminders and notifications off, or withdraw consent to your health information — then we cannot plan for you until you agree again.
Email privacy@gymmie.co.uk and we will reply within one month. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Keeping it safe
Your data is encrypted on its way to and from the app, only the people who run the service can reach it, and each account can see only its own data.
Changes
If this policy changes in a way that matters, we will change the date at the top and tell you in the app.