Privacy Policy

Max handles some of the most personal data there is: your body, your health and how you train. This policy explains what we collect, why, who else sees it and the control you have over it. The short version: we use your data to coach you, we never sell it, and nothing from Apple Health goes to AI or advertisers.

1. Who we are

Max is run by Maxed Labs UK Ltd. We are the controller of your personal data. Contact us about anything in this policy at support@themaxapp.co.uk.

2. The data we collect

Account details: your name, email address and password (stored only as a secure hash).
Sign in with Apple: if you choose it, Apple shares your name the first time and an email address, which may be a private relay address that forwards to you. We keep the Apple account identifier and a token that lets us end the link when you delete your Max account.
Profile and coaching details: your age range, gender, height, weight, goals, experience, where and how often you train, the session length you prefer, and your answers to the health screening questions.
Health data: injuries or body areas you tell us you train around, body measurements, weigh-ins, check-ins, workout and cardio logs, food, water and supplement logs, and heart rate shared from your watch during a session.
Apple Health: only if you turn it on in your profile in the iOS app. Max then reads your steps, active energy, heart rate, resting heart rate, heart rate variability, sleep, cardio fitness (VO2 max), heart rate recovery, water and workouts from Apple Health, plus your weight, body fat, lean body mass, waist and blood pressure for your weekly check-in and body composition, and saves your finished sessions and the food and water you log. Data from Apple Health is used only to show you your own activity and progress in Max, and to suggest a lighter session after a poor night, by fixed rules in the app. It is never sent to AI providers, never used for advertising and never sold. You can turn it off in your profile or in the Health app at any time.
Messages, photos and videos: what you write to Max, and photos of meals or lifts. A photo you send Max goes to Google Gemini to read what is in it and is not kept by Max. A form check video you upload is stored privately with Microsoft Azure. Only you, and the Max admin when reviewing your form, can open it, through a link that stops working after 15 minutes. It is deleted with your account.
Device and usage data: your IP address, device and browser type, app version, sign-in times, push notification tokens, and which pages you visit in Max, recorded in our own systems.

3. Why we use it, and our lawful basis

To run your account and coach you (contract): creating your account, building and adjusting your plan, logging, reminders you turn on, and Apple Watch, widget and Apple TV features.
Health data (your explicit consent): health data is special category data, so we only use it because you choose to give it to us for coaching. You can withdraw consent at any time by deleting the entries, turning off Apple Health or AI features in your profile, or deleting your account. Max cannot coach you properly without some of it, such as your weight and training logs.
AI features (your consent): nothing goes to Google Gemini until you allow AI features, and you can turn them off in your profile.
To keep Max secure and working (our legitimate interests): preventing abuse, fixing errors, and understanding which features are used so we can improve them. We keep this to what is necessary and it never outweighs your rights.
To meet the law (legal obligation): for example keeping records if we take payments, or responding to a lawful request.

We do not use your data for advertising, we do not build advertising profiles, and we never sell your personal data.

4. Max, the AI coach

Max uses Google Gemini to answer your messages, build and adjust training plans, check workout form and estimate nutrition from photos and descriptions. When you talk to Max or send a photo, Gemini receives what you type or send and the details it needs to answer: your first name, age, goals, weight and height, training plan and recent training, nutrition targets, the body areas you train around and your earlier messages to Max. It never receives your surname, email address or anything from Apple Health.

Max makes automatic changes to your training plan, such as raising a weight after a strong session. You can see and undo these in your profile. Max does not make decisions about you that have legal or similarly significant effects.

6. Data outside the UK

Our main systems are in Europe. Some providers, including Google, may process data in other countries such as the United States. Where they do, we rely on UK adequacy regulations (including the UK-US data bridge) or the UK International Data Transfer Addendum to the EU standard contractual clauses, so your data has the same level of protection.

7. How long we keep it

We keep your data while your account is open, so your history and progress stay with you.
When you delete your account in Profile, we delete your data and stored videos, and end any Sign in with Apple link. Copies in our encrypted backups are overwritten within 35 days.
Error reports in Sentry are deleted automatically within 90 days.
If we take payments, we keep the financial records the law requires, usually six years.

8. Keeping it safe

Data is encrypted in transit and at rest, access is limited to the people who need it to run Max, and sign-in is protected against repeated guessing. No system is perfectly secure, but if a breach puts your rights at risk we will tell you and the regulator as the law requires.

9. Cookies and storage on your device

We use one essential cookie to keep you signed in, and store your settings and any workouts logged offline on your device so Max works in the gym. We do not use advertising or third-party analytics cookies, which is why you do not see a cookie banner.

10. Children

Max is for adults aged 18 and over. If we find that a child has signed up, we will delete the account.

11. Your rights

Under UK GDPR, and EU GDPR if you live in the EU, you have the right to:

Access your data. Profile, under Your data, lets you download everything we hold.
Correct anything that is wrong.
Delete your data. Profile, under Your data, lets you delete your account.
Object to or restrict how we use it.
Move it to another service, using the export in Profile.
Withdraw consent at any time, without affecting what we did before.

For anything you cannot do in the app, email support@themaxapp.co.uk. We will reply within one month. If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner’s Office at ico.org.uk, or, in the EU, to your local data protection authority.

12. Changes to this policy

If we change how we use your data in a way that matters, we will tell you in the app or by email before it happens, and ask for your consent again where the law requires it. Our terms of service cover the rest of your use of Max.