Privacy Policy
Last updated: 13 October 2026
This Privacy Policy explains how we process your personal data when you use our mobile applications (the “App”), our websites, and all related services, features, and content (collectively, the “Service”). It also explains the rights you have in respect of your personal data and the practices we implement to protect your privacy.
By using the Service, you represent that you have read, understood, and acknowledged this Privacy Policy and the data processing described in it, and you are over 18 years of age. If you do not acknowledge or are unable to make this representation, you must not use the Service. In that case, you must: delete your account or contact us to request deletion of your account, cancel any subscriptions, and delete the App from your devices.
Any translation of the English version of this Privacy Policy is provided solely for your convenience. In the event of any inconsistency between the English version (available at upshift-app.com/privacy-policy) and any other translation, the English version shall prevail and shall be the only legally binding version.
Contents:
1. Who we are
2. What personal data we process
3. How we use your personal data
4. How we disclose your personal data
5. International data transfers
6. Security
7. Data retention
8. Data protection rights
9. Children
10. Cookies and other tracking technologies
11. Regional disclosures
12. How to contact us
13. Changes to this Privacy Policy
1. Who we are
“We”, “us”, and “our” refer to Arnor Limited, a company incorporated under the laws of the Republic of Cyprus, with registration number ΗΕ 498843 and its registered address at 84 Spyrou Kyprianou Avenue, 4004 Limassol, Cyprus.
If you have any questions or concerns about how we handle your personal data, you can contact us at support@upshift-app.com or write to our registered office: 84 Spyrou Kyprianou Avenue, 4004 Limassol, Cyprus.
2. What personal data we process
We collect personal data in the following scenarios:
Information you provide directly to us, for example, when you complete onboarding, create an account, set fitness goals, log workouts or meals, chat with a coach, or contact support;
Information we receive about you from third parties, for example, when you sign in through Apple or Google or allow us to access Apple HealthKit, Google Fit, or Google Health Connect;
Information we collect automatically, for example, when you use our Service or connected wearable devices.
You are not legally required to provide personal data to us. However, we need your contact details to create an account for you. If you do not provide this information, we may be unable to create your account or provide the Service. Please ensure that the information you provide is complete and accurate.
2.1. Information you provide directly to us
We process the following categories of personal data provided by you:
| Categories | Details |
|---|---|
| Contact Information | Your name, email address, phone number, delivery address, and any other contact details you provide when you complete onboarding, create an account, or make an order. |
| Personal Characteristics | Basic information we use to personalize your plan, for example, your age, gender, goals, motivation, and country. |
| Wellness & Fitness | Your body measurements and body composition, fitness goals, fitness level, training preferences and routine, workout and exercise sessions, daily activity and movement, food and calorie intake, dietary preferences and restrictions, training plans, programs, and progress. Some information we collect may be considered a special category of personal data or sensitive data (together, “sensitive data”) under certain data protection laws that apply to us. Where this is the case, we will seek your consent to process such data. You may withdraw your consent or update your preferences regarding the processing of your sensitive data at any time by adjusting your preferences directly in your account in the App or by contacting us as described below. |
| Financial Information | When you make payments through the Service, you may need to provide payment data, such as your credit card number, to our third-party service providers (or to the relevant app store, if you purchase through Apple or Google). We do not collect, store, or have access to your full credit card number. However, we may receive limited payment-related information, including redacted credit card data such as the last four digits, a tokenized payment method identifier, and the type of payment method used. |
| Transaction History | Your subscription details, such as payment amounts, dates and times, and payment confirmations. |
| Purchases | The products you order from our online store (such as nutritional supplements, fitness equipment, clothing, accessories and other wellness products) and your order, payment and delivery status and history, including returns, refunds, exchanges and complaints. |
| User Content | Depending on your subscription and the services you use, this may include your conversations with our coaches if you subscribe to our coaching services. If you use the AI Features as defined below, this may include your chat messages and the responses generated by those features. It may also include meal photos or other content that you voluntarily choose to share. When you contact our customer support team, this may include your conversation, the details of your request, and any comments you provide. It may also include your answers and feedback if you participate in our surveys, interviews, usability tests, studies, or similar research programs. |
2.2. Information we receive about you from third parties
We may receive the following information from third parties:
| Categories | Details |
|---|---|
| Sign-in Data | Sign-In with Apple When you sign in with Apple to register an account, we receive personal data from your Apple ID account. This may include your name and verified email address. You may choose to share either your real email address or an anonymous email address that uses Apple’s private email relay service. Apple provides detailed privacy information on the Sign in with Apple screen. You can learn more about Sign in with Apple here. Sign-In with Google When you choose to sign in with Google, we receive personal data from your Google Account, such as the name, email address, and profile picture associated with your Google Account. You can revoke the access you granted to us on the Linked apps page. To learn more about how Google processes your data, please visit its Privacy Policy. |
| Health App Data | With your permission, we may read health and fitness data from, or write such data to, Apple HealthKit, Google Fit, or Google Health Connect (collectively, the “Health App”). This may include step count, distance, calories burned, weight, or workouts. This integration helps ensure continuity across your fitness tracking tools and devices. You can control this access at any time through your device settings or directly in the relevant Health App. The specific categories of data covered by the Health App integration will be shown to you by Apple or Google on their native permission screens, which we do not control. For more information, please visit: Apple HealthKit; Google Fit; Google Health Connect. |
2.3. Information we collect automatically
We automatically collect the following information when you interact with the Service:
| Categories | Details |
|---|---|
| Usage Data | How you use our Service, for example, App launches, taps, scrolling, screens and features used, how often and for how long the App is used, and content viewed. |
| Device Information | Technical details about your device and network, such as IP address, coarse location, your device model and type, operating system and version, browser information, time zone. |
| Identifiers | Identifiers tied to your device, browser, or App installation, such as device identifiers and cookie and pixel identifiers. This includes your Apple Identifier for Advertising (“IDFA”) or Android Advertising ID (“AAID”), depending on your device’s operating system. On iOS, Apple allows apps to access the IDFA only if you permit tracking through its App Tracking Transparency prompt. |
| Diagnostic Data | Technical data about how the Service performs such as crash logs, performance data, and other diagnostic data. |
3. How we use your personal data
We use your personal data for the following purposes and on the corresponding lawful bases:
| Purpose | Categories | Lawful basis |
|---|---|---|
| To create your account, let you sign in, and administer your account. | Contact Information Sign-in Data | Contract |
| To onboard you, provide access to your plan, workouts, and content, and connect you with our coaches. | Personal Characteristics Wellness & Fitness Health App Data User Content | Contract Consent (for sensitive data, where required by law) |
| To tailor your training and nutrition plans and advice to your goals, preferences, measurements, and progress, and to recommend workouts, rest days, challenges and other content based on your activity and preferences. | Personal Characteristics Wellness & Fitness User Content Health App Data Usage Data | Contract Legitimate interests in making the Service more useful to you and helps you reach your goals Consent (for sensitive data, where required by law) |
| To provide features powered by artificial intelligence and designed to enhance your training, improve the Service, and help answer your questions more quickly (“AI Features”), using third-party AI providers. AI Features include, for example: Identifying food in a meal photo or text description you submit and estimating its nutritional values, including calories and nutritional quality indicators; Selecting a personalized training plan for you; Providing personalized training guidance, nutrition advice, and recommendations; and Assisting with customer support and responding to your queries. | Personal Characteristics Wellness & Fitness User Content | Contract (providing a feature you have requested) Consent (for sensitive data, where required by law) |
| To process payments, manage subscriptions, and maintain purchase records. We do not collect, store, or have access to your full payment card number. | Contact Information Financial Information Transaction History | Contract Legal obligation |
| To process, fulfill, and deliver your online store orders for physical products, send status updates, and handle returns, refunds, exchanges, complaints, and disputes. | Contact Information Financial Information Transaction History Purchases | Contract Legitimate interests in protecting our business from fraudulent and abusive orders |
| To send you essential notifications about your account security, payments, orders, and policy updates. | Contact Information Transaction History Purchases | Contract Legal obligation |
| To send you reminders to help you use the Service consistently and follow your plan, as well as other information about the Service, special offers, updates, new features, wellness tips, and motivational content, by push notification or email. You can turn off push notifications in your device settings and unsubscribe from marketing emails using the link in the footer of each email. | Contact Information Usage Data | Legitimate interests in encouraging you to use our Service consistently and build healthy habits, promoting our Service Consent (where required by law) |
| To provide customer support, answer your inquiries, address technical issues, and handle complaints and disputes. | Contact Information User Content Other categories, as relevant to your request (e.g., Transaction History) | Contract Legitimate interests in responding to people who contact us (including people who do not have an account with us) and keeping the Service secure and reliable |
| To understand how people use our Service, for example, which features and workouts are most valuable, and to use these insights to improve existing features and develop new workouts, nutrition options, or products. | Usage Data Device Information Identifiers | Legitimate interests in improving our Service based on how people actually use it, so that we can provide a better experience (for example, to make the Service more intuitive and enjoyable, or to develop and test new features that meet your needs) Consent (where required by law) |
| To invite selected groups of users to take part in interviews, usability tests, surveys, studies, or similar research programs, and to analyze the answers and feedback you choose to give us. | Contact Information Personal Characteristics User Content Usage Data | Legitimate interests in improving our Service based on how people actually use it Consent (for example, when you participate in our interviews) |
| To test different versions of screens, features, and onboarding flows, for example, by showing different onboarding screens to different users, to learn which works better, and to refine the Service based on actual usage. | Usage Data Device Information Identifiers | Legitimate interests in improving our Service based on how people actually use it Consent (where required by law) |
| To detect, investigate, and fix crashes, bugs, and other technical errors, including troubleshooting and refining the AI Features and detecting and preventing their misuse. | User Content Device Information Identifiers Diagnostic Data | Legitimate interests in keeping the Service secure and reliable, and making sure the AI Features work as intended and produce accurate results, and protecting them from misuse |
| To make advertising more relevant, we may show you ads related to fitness goals similar to yours, or present offers at times when they are most relevant to your journey. For example, you may see our ads in your social media feed if you have previously used our Service. | Usage Data Device Information Identifiers | Legitimate interests in promoting our Service by showing you content that is more likely to be relevant to your interests Consent (where required by law) |
| To learn which ads and campaigns led you to our Service, verify impression accuracy and ad placement and quality, measure how well our ads work, and confirm compliance with industry standards. | Usage Data Device Information Identifiers | Legitimate interests in ensuring the accuracy and quality of our advertising campaigns and complying with industry standards Consent (where required by law) |
| To detect, prevent and respond to fraud, payment abuse and unauthorized use of our Service, keep your account and our systems secure, and enforce our Terms of Service and other agreements. | All categories, as relevant, in particular Contact Information, Financial Information, Transaction History, Purchases, and Usage Data | Legitimate interests in protecting our business and our customers from fraudulent and abusive orders, and preventing and addressing fraud or unauthorized use of the Service |
| To meet our legal obligations, such as tax reporting, financial record-keeping, data protection compliance, and maintaining legally required records. | All categories, as relevant to the specific obligation, in particular Contact Information, Financial Information, Transaction History, and Purchases | Legal obligation Legitimate interests in responding to requests from public authorities |
| To establish, exercise, or defend our legal rights in disputes, claims or legal proceedings, and to manage payment disputes, including chargebacks and refund requests, by: Documenting our contractual relationship (subscription details, payment confirmations, purchase dates and service access records); Recording your Service interactions and content consumption patterns to verify actual service delivery; Logging feature usage, workout completions, content access timestamps and session durations; and Maintaining audit trails of user-initiated actions within the Service. | All categories, as relevant, in particular Contact Information, Financial Information, Transaction History, Purchases, and Usage Data | Contract (maintaining evidence of service delivery) Legitimate interests in protecting our business from fraudulent claims and demonstrating that we delivered the Service in line with our contract with you |
| To plan and complete a sale of our business, a divestiture, merger, consolidation, or asset sale, and to share data within our group of companies. | All categories, as relevant | Legitimate interests in developing, reorganizing, or selling our business. Consent (where required by law) |
4. How we disclose your personal data
4.1. Business partners
We use business partners to run the Service and support our business activities. We put contractual arrangements in place with them and require appropriate protection for the information they receive. We disclose your personal data to the following categories of business partners:
| Categories of business partners | Purpose of processing |
|---|---|
| Cloud hosting and storage | To host the Service, provide the technical infrastructure needed for its operation, and store and manage data. For example, to host personal data and enable our Service to operate, we use Amazon Web Services (AWS). |
| Payment processing | To process payments, route transactions through payment networks, and support the payment methods available through the Service. |
| Email verification | To validate and verify email addresses, improve email deliverability and open rates, and remove invalid, spam, or inactive addresses from our lists. |
| Communication and feedback | To facilitate customer support, conversations with our coaches, and other communications through the Service, deliver push notifications and in-app messages, and conduct surveys and analyze feedback to improve the Service. |
| Service performance and monitoring | To monitor the Service’s performance and reliability, detect and diagnose crashes and errors, resolve technical issues, and identify software vulnerabilities. |
| Analytics, attribution, and product improvement | To understand how you use the Service, measure engagement and marketing effectiveness, identify the channels through which users discover the Service, and guide product improvements. These providers also support feature testing, content customization, and analysis of interactions. |
| Marketing and advertising | To send marketing communications, manage advertising campaigns, build advertising audiences, display personalized ads on third-party websites and apps, and measure and improve advertising effectiveness. |
| Online store, order fulfillment, and delivery | To operate our online store, display physical products, manage orders and inventory, and arrange order preparation, packing, shipping, delivery, and returns. These business partners may include store platform providers, fulfillment and warehousing providers, delivery carriers, and manufacturers or suppliers that ship products directly. |
| AI technology | To provide the AI Features, we use AI technology from Google, OpenAI, and Anthropic. When you use the AI Features, we send these providers only the data needed to process your request and generate a response: Your inputs, such as chat messages, questions, and meal photos; Relevant information from your profile, such as your goals, preferences, and questionnaire answers; and Limited device and usage data needed to process your request. Each AI provider acts as our processor or service provider. Under our contracts with them, each provider: Processes your data only on our behalf and on our instructions; Does not use your data to train or improve its AI models; and Does not “sell” or “share” your data, as those terms are defined in U.S. state privacy laws. Please share only what your request needs. Do not include your full name, payment details, or information about medical conditions, injuries, medications, or symptoms. To learn more, read the following policies: Google; OpenAI; Anthropic. |
4.2. Group companies
Where needed, we may disclose your personal data to other members of our group of companies for the following purposes:
- Ensuring uninterrupted business processes;
- Obtaining legal, compliance, or financial assistance;
- Fulfilling our regulatory obligations;
- Conducting reporting and overseeing group activities;
- System maintenance support and hosting of data; and
- Maintaining business continuity in the event of a merger or takeover.
Entities within our group are required to implement appropriate technical and organizational measures, including security measures, to safeguard your personal data.
4.3. Public authorities and legal proceedings
We may disclose your personal data to public authorities where applicable law requires or allows it. This can include responding to a lawful request or court order, bringing or defending legal claims, or safeguarding the rights, privacy, safety, or property of us, our group companies, you, or others.
4.4. Corporate transactions
Personal data may form part of a transaction involving our business or assets, including an acquisition, disposal, merger, consolidation, or bankruptcy. In those circumstances, it may be disclosed or transferred to a recipient that must handle it in accordance with applicable data protection law. We will give any legally required notice of the transaction and any resulting change of controller.
5. International data transfers
We work with business partners in various countries, including countries outside the European Economic Area (“EEA”) and the United Kingdom (“UK”). These countries may not provide the same level of protection for personal data. Where a transfer is subject to the EU General Data Protection Regulation (“GDPR”) or the UK GDPR, we rely on one of the transfer mechanisms:
| Transfer mechanism | Description |
|---|---|
| Adequacy decision | We may transfer personal data to countries, territories, or recipients covered by an applicable adequacy decision of the European Commission or UK adequacy regulations. Further information is available on EEA adequacy decisions and UK adequacy arrangements. |
| Appropriate safeguards | Where applicable, we use contractual safeguards, such as the European Commission’s Standard Contractual Clauses and, for UK transfers, the UK Addendum or International Data Transfer Agreement. We apply additional safeguards where necessary to protect your personal data. |
| Derogations | In specific circumstances, we may rely on a permitted exception, such as your explicit consent, a transfer necessary to perform a contract with you, important reasons of public interest, or legal claims. We rely on these exceptions only where their legal conditions are met. |
Please contact us if you would like further details of the mechanism used for your personal data or a copy of the relevant safeguards.
6. Security
We use appropriate technical and organizational safeguards to protect personal data against accidental or unlawful loss, destruction, alteration, unauthorized access, or disclosure. Access is restricted to people who need the information for legitimate business purposes.
Please be aware that no security measure is perfect or impenetrable, and we cannot guarantee absolute security. If you have an account, you are responsible for keeping your login credentials confidential.
If you believe your account has been compromised, please contact us immediately.
7. Data retention
We do not keep your personal data for longer than necessary. The specific period for which we retain your personal data may vary depending on the circumstances.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process the data, whether we can achieve those purposes through other means, and any applicable legal requirements.
When we no longer need to retain your personal data, we securely delete it or irreversibly anonymize it.
Even after your account is deleted or after we process your erasure request, we may need to retain certain personal data to comply with our legal and regulatory obligations (including accounting, tax, and record-keeping obligations), resolve legal disputes, and enforce our agreements.
8. Data protection rights
8.1. Your rights
Depending on where you live, you may have some or all of the rights described below. These rights are not absolute, apply only in certain circumstances, and, in some cases, we may deny a request as permitted or required by law.
| Right | Description |
|---|---|
| Access | You may ask us to confirm whether we process your personal data and request a copy of it, together with information about how we process it. You may also be able to use the data access feature in the profile section of the App. |
| Rectification | You have the right to review, edit, or change the personal data you previously provided to us, and to have inaccurate data corrected. You can log in to your account and update the available information at any time, or contact us. |
| Erasure | You can delete your account in your account settings or ask us to delete your personal data, as permitted by applicable data protection laws. After receiving your request, we will make reasonable efforts to comply within the timeframes required by law. Please note that we may continue to process some of your data even after honoring your deletion request, such as to comply with our legal obligations or defend against legal claims. |
| Restriction | You may ask us to restrict processing in certain circumstances, for example, while we check the accuracy of your personal data or assess an objection you have raised. |
| Objection | You may object, on grounds relating to your particular situation, to processing based on our legitimate interests. If you do, we will stop processing your personal data unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or we need the data to establish, exercise, or defend legal claims. You may also object at any time, free of charge and without giving reasons, to the use of your personal data for direct marketing. We will then stop using your data for that purpose. To opt out of marketing communications: Push notifications: go to your device’s Settings > Notifications > select the App > turn off notifications; Marketing emails: click the “Unsubscribe” link in the footer of any marketing email from us. If you have allowed us to access your device’s advertising identifier (IDFA or AAID), you can stop the collection at any time: iPhone or iPad: go to Settings > Privacy & Security > Tracking. There you can turn off tracking for the App, or turn off “Allow Apps to Request to Track” for all apps; Android: go to Settings > Privacy > Ads and tap Delete advertising ID. Menu names may differ depending on your device manufacturer and operating system version. You can also contact us using the details below. |
| Data portability | Where processing is carried out by automated means and is based on your consent or a contract, you may receive the personal data you have provided to us in a structured, commonly used, machine-readable format and transmit it to another controller. Where technically feasible, you may ask us to transmit it directly. |
| Withdrawing consent | Where we rely on your consent to process your personal data for a specific purpose, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before your consent was withdrawn. |
| Automated decision-making | We do not make decisions about you that produce legal effects or similarly significantly affect you based solely on automated processing. Nevertheless, under applicable data protection laws, you have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you. Where such a decision is made, you may request human intervention, express your point of view, and contest the decision. |
| Complaint | You may lodge a complaint about the way we process your personal data with the competent data protection authority, in particular in the country where you habitually reside or work, or where you believe an infringement has occurred. We encourage you to contact us directly so that we can address your concerns. Customer satisfaction is our top priority, and we strive to dedicate sufficient resources and effort to providing high-quality customer support. In most cases, we will be able to resolve your request directly. This does not affect your right to complain to a competent data protection supervisory authority. |
8.2. How to exercise your rights
If you wish to exercise any of your data protection rights, please contact us using our contact details provided below from the email address associated with your account:
| Request process | Details |
|---|---|
| Response time | We are committed to responding to all legitimate requests in accordance with applicable data protection laws and will process your request as promptly as possible, generally within one month under the GDPR and UK GDPR. |
| Identity verification | To protect your personal data, we need to be reasonably confident that the request comes from you or from someone authorized to act on your behalf. We may ask you to confirm information we already hold and, where the request is high-risk and we cannot otherwise verify your identity, we may ask for additional proof of identity. We ask for as little information as possible and use it only to verify the request. If we cannot verify your identity, we may not be able to act on your request, and we will explain why. |
| Authorized representative | You may use an authorized representative to make a request on your behalf. We will ask the representative to provide proof that you have authorized them, such as a signed authorization or a valid power of attorney. We may also contact you directly to confirm the authorization and verify your identity. |
| Fee | Exercising your rights is free, unless your request is manifestly unfounded or excessive, in which case applicable law may allow us to charge a reasonable fee or refuse the request. |
9. Children
The Service is not intended for or directed to children under 18, and we do not knowingly collect or solicit information from anyone under 18 or knowingly allow anyone under 18 to use our Service.
If you are under 18, do not use the Service or provide any information about yourself to us, including your name, email address, or health-related data.
If you are a parent or guardian and believe that we have collected information from your child who is under 18, please contact us as described below, and we will take steps to delete such information.
10. Cookies and other tracking technologies
We, our third-party analytics tools, and ad partners use cookies, software development kits (“SDKs”), and other tracking technologies such HTML5 local storage, local shared objects, beacons, and pixels to process your data, enhance your user experience, optimize ads, and analyze traffic. These technologies may be activated when you interact with the Service, use our Apps, or when you enable certain features.
10.1. Types of cookies and other tracking technologies we use
We may use the following types of cookies and other tracking technologies:
| Type | Description |
|---|---|
| Strictly necessary | These cookies and other tracking technologies are essential for the Service to operate and provide functions such as navigation and security. They do not require your consent and cannot be disabled through our consent management platform. You can block them through your browser settings, but some parts of the Service may not work properly. |
| Functional | These cookies and other tracking technologies remember your preferences, such as language or region, to provide a more personalized experience. |
| Performance / Analytics | These cookies and other tracking technologies collect information about how visitors use the Service, such as which pages they visit. They help us understand usage patterns and improve the Service’s usability and performance. |
| Marketing | These cookies and other tracking technologies collect information about your browsing activity, including across websites, to deliver advertising relevant to your interests and measure its effectiveness. |
10.2. How to manage cookies and other tracking technologies
Where consent is required, we ask for it through our consent management platform before using the relevant cookies or other tracking technologies. You can change your choices and withdraw your consent at any time using the controls available in the Service. Some parts of the Service may not function properly if you refuse cookies or similar tracking technologies, but the basic functionality of the Service will remain available.
In addition, your browser provides controls for removing cookies or preventing them from being stored. The following links explain how to manage your cookie preferences:
- Information about cookies in general;
- How to manage your cookies in Mozilla Firefox;
- How to manage your cookies in Chrome;
- How to manage your cookies in Safari;
- How to manage your cookies in Microsoft Edge.
The following industry programs let you opt out of interest-based advertising from participating companies:
- Network Advertising Initiative;
- Digital Advertising Alliance;
- Digital Advertising Alliance (Canada);
- Digital Advertising Alliance (EU);
- DAA AppChoices (mobile).
11. Regional disclosures
11.1. U.S. State Privacy Notice
Applicability
This U.S. State Privacy Notice supplements the rest of this Privacy Policy and provides the disclosures required by U.S. state consumer privacy laws. It applies to you if you are a resident of a state that has enacted such a law, including Alabama, California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Louisiana, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oklahoma, Oregon, Rhode Island, Tennessee, Texas, Utah, Vermont, and Virginia, as well as additional states as their laws come into force.
For California residents, this U.S. State Privacy Notice also serves as our Notice at Collection and as our privacy policy under the California Consumer Privacy Act.
The rights and obligations described in the U.S. State Privacy Notice apply only to the extent the relevant state law applies to us and to the personal information at issue. Each state’s law has its own definitions, thresholds, and exemptions. The definition of “personal information” varies by state. Generally, it means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to a particular consumer or household.
The Service is a general wellness and fitness product. It is not designed to maintain medical information for the diagnosis, treatment or management of a medical condition, and we do not make the information you provide available to a provider of health care.
What personal information we process
Section 2 (“What personal data we process”) and Section 3 (“How we use your personal data”) of this Privacy Policy describe the categories of personal information we collect, the sources from which we collect it, and the purposes for which we use it. We may also process de-identified data in a way that prevents it from reasonably being linked back to you. We are committed to maintaining and using de-identified data responsibly and will not attempt to re-identify such data unless necessary to validate our de-identification measures.
How we disclose your personal information
Certain U.S. state privacy laws require us to disclose the categories of personal information that we have disclosed to third parties for business purposes in the preceding 12 months. During this period, we have disclosed all categories of personal information described in Section 2 (“What personal data we process”) of this Privacy Policy for business purposes. For example, we disclose personal information to service providers that support us with cloud hosting and storage.
We do not sell personal information in exchange for money. However, several state privacy laws define “sale”, “sharing”, and “targeted advertising” broadly enough to include the use of cookies and other tracking technologies. We treat these activities as the sale or sharing of personal information and as targeted advertising, and we offer you the right to opt out.
We do not knowingly sell or share the personal information of consumers under 16 years of age, and we do not knowingly engage in targeted advertising directed to them.
Your privacy rights
| Right | Description |
|---|---|
| Access | You may request confirmation of whether we process your personal information and access to it, including the categories of personal information we collected about you, the categories of sources, the business or commercial purposes for collecting, selling or sharing it, the categories of third parties to whom we disclosed it, and the specific pieces of personal information we collected about you. California residents may request information collected before the 12 months preceding the request. |
| Data portability | You may obtain a copy of your personal information in a portable and, where technically feasible, machine-readable format. |
| Correction | You may request that we correct inaccurate personal information we maintain about you. |
| Deletion | You may request that we delete the personal information we have collected from or about you. We will use commercially reasonable efforts to fulfill your request, subject to applicable law. We may need to retain certain information, for example, to complete a transaction, comply with our legal obligations, defend against legal claims, or as otherwise permitted by law. |
| Opt out of sale, sharing, and targeted advertising | Depending on where you reside, you have a right to opt out of the “sale” or “sharing” of your personal information or to opt out of the processing of your personal information for purposes considered to be “targeted advertising”, as defined in applicable privacy laws. You can exercise your right to opt out by using the “Your Privacy Choices” link. You may also enable the Global Privacy Control signal in a supporting browser or extension. |
| Limit the use and disclosure of sensitive personal information | California law provides this right where sensitive personal information is used for purposes other than to deliver a requested product or service. We do not use or disclose sensitive personal information for such purposes. |
| Opt out of profiling | You may opt out of profiling in furtherance of decisions that produce legal or similarly significant effects. We do not engage in such profiling |
| Withdrawing consent | Where we process your personal information based on your consent, you may withdraw it at any time. |
| Appeal | If we decline to take action on your request, you can appeal our decision as described below. |
| Non-discrimination | We will not discriminate or retaliate against you for exercising your privacy rights, for example, by denying you the Service, charging you different prices, or providing a different level of quality, except as permitted by law. Some features may not be available if you ask us to delete, or withdraw your consent to, data that is needed to provide them. |
| California “Shine the Light” | California residents have the right to request, once per year, a list of the third parties to whom we disclosed their personal information for those third parties’ direct marketing purposes during the prior calendar year. To request this information, please contact us using the details below and include “Request for California Shine the Light Privacy Information” in the subject line. Please also include your state of residence and email address in the body of your message. |
If you wish to exercise your privacy rights, please contact us using our contact details provided below, from the email address associated with your account:
| Request process | Details |
|---|---|
| Response time | We are committed to responding to all legitimate requests in accordance with applicable privacy laws and will process your request as promptly as possible, generally within 45 days under U.S. state privacy laws. |
| Identity verification | To protect your personal information, we need to be reasonably confident that the request comes from you or from someone authorized to act on your behalf. We may ask you to confirm information we already hold and, where the request is high-risk and we cannot otherwise verify your identity, we may ask for additional proof of identity. We ask for as little information as possible and use it only to verify the request. If we cannot verify your identity, we may not be able to act on your request, and we will explain why. |
| Authorized agents | You may use an authorized agent to make a request on your behalf. We will ask the agent to provide proof that you have authorized them, such as a signed authorization or a valid power of attorney. We may also contact you directly to confirm the authorization and to verify your identity. |
| Appeals | If we decline your request, you may appeal by replying to our decision or emailing us with the subject line “Privacy Request Appeal”, explaining why you believe our decision was wrong. We will inform you in writing of our decision on the appeal and our reasons within the period required by your state’s law. If your appeal is denied, you may contact the Attorney General of your state to submit a complaint. |
Data retention
Section 7 (“Data retention”) of this Privacy Policy describes how long we keep personal information. In summary, we retain each category of personal information for as long as reasonably necessary for the purposes described, unless a longer period is required or permitted by law. This may include retaining information to comply with tax and accounting obligations, resolve disputes, enforce our agreements, or protect against fraudulent or unlawful activity.
11.2. U.S. consumer health data
If you live in Washington or Nevada, or your consumer health data is otherwise covered by a U.S. state consumer health data law, our Consumer Health Data Privacy Policy applies to you. It explains how we collect, use, share, and protect “consumer health data”, as defined in those laws, and how you can exercise your rights over that data.
The Consumer Health Data Privacy Policy supplements and forms part of this Privacy Policy. If there is any conflict between the two documents, the Consumer Health Data Privacy Policy prevails with respect to consumer health data.
12. How to contact us
For any questions about this Privacy Policy or how we handle personal data, or to exercise your data protection rights, you can contact us at support@upshift-app.com or write to our registered office: 84 Spyrou Kyprianou Avenue, 4004 Limassol, Cyprus.
13. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. The current version will always be available on the Service, with the date of the latest revision shown at the top. Where required by law, we will provide additional notice of material changes. We encourage you to review this Privacy Policy periodically.
