DRAFT — NOT LEGAL ADVICE. This document was drafted to unblock development and testing. It has not been reviewed by a qualified legal practitioner and must be before GRYH accepts real users. The
consentsledger records the version string above, so replacing this text requires a version bump, not an edit in place.
Who we are
GRYH ("we", "us") provides an AI-assisted personal training and nutrition application. We are the responsible party under the Protection of Personal Information Act, 2013 (POPIA) in South Africa, and the data controller under the UK GDPR.
Contact: support@gryh.co.za
What we collect
Account data — your email address and an encrypted password credential, handled by our authentication provider.
Health and fitness data — the information you give us during onboarding and as you use the app: gender, date of birth, height, bodyweight, training experience, training goal, available equipment, training schedule, and any injury or contraindication flags you record. Later, this extends to the workouts, sets and food entries you log.
Technical data — the IP address and browser user agent recorded at the moment you give or withdraw consent, kept as evidence that consent was freely given.
We do not collect payment card details. When subscriptions launch, payments are handled by a third-party payment provider and card data never reaches us.
Special category data
Health data is special personal information under POPIA section 26 and special category data under UK GDPR Article 9. We process it only with your explicit consent, which we ask for before you enter any of it, and which we record in an append-only ledger.
Why we process it
| Purpose | Lawful basis |
|---|---|
| Generating and adapting your training programme | Explicit consent |
| Calculating calorie and macronutrient targets | Explicit consent |
| Showing your training and bodyweight history | Explicit consent |
| Operating and securing your account | Contract / legitimate interests |
We do not sell your personal information, and we do not use it for advertising or profiling beyond producing your own training and nutrition plan.
Automated processing
Your programme is generated and periodically revised using a combination of rules and a large language model. This shapes what exercises and targets you are shown. It has no legal or similarly significant effect on you, you can override any recommendation, and you can ask us to review any output you disagree with.
Where your data is stored
Your data is stored in the European Union / United Kingdom region of our infrastructure provider, in London. If you are in South Africa, this means your personal information is transferred outside South Africa. POPIA section 72 permits this because the destination is subject to UK GDPR, which affords a comparable level of protection.
Who we share it with
Only the service providers we need to operate: our hosting provider, our database and authentication provider, our transactional email provider, and the provider of the language model used for programme generation. Each processes data on our instructions under a written agreement.
How long we keep it
For as long as your account is open.
You can delete your account yourself, at any time, from Account in the app. Deletion is immediate and permanent: your profile, body measurements, programme, every logged session and set, your personal records and your consent record are removed in a single operation. There is no grace period and no backup we can restore you from.
Your rights
Under POPIA and UK GDPR you may: access the personal information we hold about you; correct anything inaccurate; delete your account and data; object to or restrict processing; receive your data in a portable format; and withdraw consent at any time. Withdrawing consent for health data processing means we can no longer generate or adapt your programme.
Withdrawal does not affect processing that already happened lawfully.
Deletion is self-service — Account in the app, no request needed. Email support@gryh.co.za to exercise any of the others.
Complaints
South Africa — Information Regulator: https://inforegulator.org.za United Kingdom — Information Commissioner's Office: https://ico.org.uk
Children
GRYH is not for people under 18. We do not knowingly collect personal information from children. POPIA requires the consent of a competent person for anyone under 18, and we do not currently operate such a process.
Changes
Material changes mean a new version and a fresh request for your consent. The version that applied when you consented is recorded against your account.