Privacy Policy

1. Who We Are

BlockFit is operated by BlockFit Ltd, a company registered in England and Wales (company number 17160331), with its registered office at 128 City Road, London, United Kingdom, EC1V 2NX. We are the data controller responsible for your personal data.

We are not required to appoint a Data Protection Officer under Article 37 of the UK GDPR. The senior person responsible for data protection at BlockFit can be reached at privacy@blockfit.co.

We are registered with the Information Commissioner's Office under registration number ZC133615.

2. What Data We Collect

We collect the following categories of personal data:

• Account information. Name, email address, and password (hashed). If you sign in via Google SSO, we receive your name, email, and Google account identifier from Google (which Google's privacy policy also governs).
• Profile data. Display name, profile photo (if you upload one), fitness preferences, favourite class types, and similar personalisation choices.
• Location data. Approximate or precise geolocation, only when you actively use the app to find nearby classes. We never collect location data in the background, and you can revoke location permission in your device settings at any time.
• Payment data. Payment-method tokens processed by Stripe. We never store your card number, CVV, or full card details on our servers.
• Booking history. Class bookings, cancellations, and Studio interactions.
• Messages. Communications sent via the in-app messaging system between you and Studios.
• Health-related information you choose to share. We do not ask you for any health information. However, if you tell us, a Studio, or an instructor about a health condition, injury, pregnancy, or similar matter — for example through the messaging system or a class-booking note — we treat that as special-category data under Article 9 UK GDPR. We rely on your explicit consent under Article 9(2)(a) to process that information for the limited purpose of facilitating the relevant booking and communication. You can withdraw consent at any time by deleting the message or by emailing privacy@blockfit.co.
• Marketing preferences. Whether you have opted in to marketing emails, what channels you have chosen, and your unsubscribe history.
• Support correspondence. Any messages, emails, or chats you send to our support team.
• Waitlist data. Email address submitted on our pre-launch landing page.
• Technical data. IP address, browser type, device type, mobile device identifier, app version, crash and diagnostic logs, and cookies and similar identifiers (see clause 9).
• Product analytics data. Aggregated and event-level data about how you use the Platform — for example which screens you visit, which classes you view, and which features you use. Where this is linked to your account, we treat it as personal data.

We do not collect biometric data, payment-card numbers, or special-category data beyond what you voluntarily share with us as described above.

3. How and Why We Use Your Data

Under UK GDPR, we must have a lawful basis for processing your personal data. The table below sets out each purpose, the legal basis, and (where relevant) the additional Article 9 condition for special-category data.

Where we rely on legitimate interests, we have carried out a balancing test (“legitimate interests assessment”) to ensure your rights and freedoms are not overridden. You can request a summary of any LIA by emailing privacy@blockfit.co.

We do not currently use your personal data for any automated decision-making that has legal or similarly significant effects on you. If we ever introduce such processing, we will tell you in advance, give you a meaningful explanation of the logic involved, and apply the safeguards required by Article 22 UK GDPR (as updated by the Data (Use and Access) Act 2025).

We do not sell your personal data, and we do not make your personal data available to third parties for use as training data for artificial-intelligence models.

4. Who We Share Your Data With

We share your data only where necessary to provide our service. We do not allow our processors to use your data for their own purposes.

5. How Long We Keep Your Data

We keep your data only for as long as necessary for the purposes set out in this Privacy Policy.

If you would like more detail about retention for a specific data type, email privacy@blockfit.co.

6. International Data Transfers

Your data is primarily stored and processed in the United Kingdom and the European Economic Area (EEA). The UK government has recognised EEA countries as providing an adequate level of protection for personal data.

Where we transfer your data outside the UK or EEA — for example to certain US-based service providers such as Stripe, Google, or our analytics and crash-reporting providers — we rely on one or more of the following safeguards:

• the UK extension to the EU–U.S. Data Privacy Framework (the “UK Data Bridge”, in force from 12 October 2023), where the recipient organisation is certified;
• the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, supported by a Transfer Risk Assessment;
• any other safeguard or derogation permitted by Article 46 or 49 UK GDPR.

You can request a copy of the relevant transfer mechanism for any specific transfer by emailing privacy@blockfit.co.

7. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — ask us to correct inaccurate or incomplete data.
• Right to erasure — request deletion of your data, subject to legal retention obligations.
• Right to restrict processing — ask us to limit how we use your data.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests, including for direct marketing (which you can opt out of at any time).
• Right to withdraw consent — withdraw consent at any time for any consent-based processing (for example marketing emails or location access).
• Right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects on you (Art. 22 UK GDPR). We do not currently make any such decisions about Members.

To exercise any of these rights, contact us at privacy@blockfit.co. Where we cannot identify you from your request, we may ask you to provide additional information to verify your identity. We will respond within one calendar month, but we may extend by up to two further months for complex or numerous requests, in which case we will tell you within the first month.

You also have the right to lodge a complaint with the Information Commissioner's Office. We ask that you raise the complaint with us first using privacy@blockfit.co; we will acknowledge within 30 days and respond as soon as practicable. You can contact the ICO at ico.org.uk/make-a-complaint or by calling 0303 123 1113.

8. Data Security

We take the security of your personal data seriously and use industry-standard measures to protect it, including:

• encryption in transit using HTTPS/TLS across all connections;
• encrypted database storage via Supabase;
• secure password hashing — we never store plaintext passwords;
• payment data handled entirely by Stripe and never stored on our servers;
• access controls and the principle of least privilege for our staff and contractors;
• account-lockout protection against brute-force login attempts;
• regular review of our security practices and supplier controls.

While no system is 100% secure, we continuously review and improve our security practices.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of it. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you without undue delay.

9. Cookies and Similar Technologies

In accordance with regulation 6 of the Privacy and Electronic Communications Regulations 2003, we are transparent about the cookies and similar technologies we use.

For more detail, see our Cookie Policy.

10. Children's Privacy

BlockFit is intended for use by adults aged 18 and over. We do not knowingly collect personal data from anyone under 18.

We have considered the Information Commissioner's Office's Age Appropriate Design Code (the “Children's Code”). Although BlockFit is not directed at children, we apply the Code's principles where relevant, including default high-privacy settings, minimal data collection, geolocation off by default and only on at your active request, and clear language. We do not use nudge techniques to encourage you to share more data than necessary.

If you believe we have inadvertently collected data from someone under 18, please contact us immediately at privacy@blockfit.co and we will delete it without undue delay.

11. Aggregated and Anonymised Data

We may produce aggregated or anonymised data from the data described in this Privacy Policy — for example to publish trends about class popularity in a city. Once data is genuinely anonymised it is no longer personal data and is not subject to this Privacy Policy.

12. Sources of Personal Data

We collect most of your personal data directly from you. We may also receive data from:

• Google, if you sign in with Google SSO;
• Stripe, in connection with payments and chargebacks;
• Studios, in respect of your bookings, attendance, and any feedback they provide; and
• Public sources, where you have submitted reviews or referenced your account publicly.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to the law or to our service. Where the change is material, we will notify you by email (if you have an account) and through a prominent in-app notice at least 30 days before the change takes effect.

If a change introduces processing that requires your consent — for example a new marketing channel or use of advertising cookies — we will obtain fresh consent before relying on it. We will not assume consent based on continued use of the Platform.

You can always view the current Privacy Policy at this URL, and the previous version is available on request.

14. Contact Us

Revision history

• v1.0 — 26 April 2026 — Initial publication
• v2.0 — 28 April 2026 — UK GDPR / DUAA 2025 review: aligned children's age with TOS, added Article 9 / health-data treatment, restructured marketing lawful bases under PECR reg 22(3), updated international transfers to UK Data Bridge / IDTA, recharacterised Studios as independent controllers, added DPO statement, expanded data categories and recipients, added retention rationale, added breach-notification commitment, identity-verification language, automated-decision-making rights, cookie list, data sources, aggregated data clause, and removed “continued use constitutes acceptance”.