Privacy policy
Last updated 27 September 2026
Who we are
UpShift Fit ("we", "us") is a meal planning and workout service operated by Sydo IT Services Ltd, a company registered in England and Wales (company number 13609540), registered office Cavendish House, Littlewood Drive, Cleckheaton, BD19 4TE, United Kingdom. We are the data controller for the personal data described here.
For any privacy question, use our contact form.
What we collect
| Data | Why | Lawful basis |
|---|---|---|
| Your email address and password (stored only as a secure hash) | To create your account and sign you in | Contract |
| Household and member details: names, age, sex, height, weight, calorie and protein targets, goals, training habits, food likes and dislikes, allergies and intolerances, and any notes you add | To generate meal plans that suit you | Contract, and your explicit consent for health-related details |
| Your plans, meals eaten out, holiday dates and what you tick off | To run the plan and rebalance it | Contract |
| Food you log, and meal photos you choose to take (for ratings, meals out, the food log and healthy remakes) | To estimate what you ate, keep your totals, and show the photos back to you | Contract |
| Readings from Apple Health or Health Connect, only if you connect them: weight, body fat, steps, active energy, resting heart rate and sleep | To show your progress and estimate your maintenance calories | Your explicit consent |
| A device token for reminders, if you turn them on | To send meal, cooking and shopping reminders | Consent |
| Optional connections you set up, such as a calendar or a fitness app | To send your plan where you asked | Consent |
| Technical data: IP address, browser type, sign-in times and failed sign-in attempts | To keep the service secure and working | Legitimate interests (security) |
| Payment details, when subscriptions launch | To take payment | Contract |
Health-related information
Allergies, intolerances, weight and health goals are "special category" data under UK GDPR. We only collect them because you choose to enter them, and we ask for your explicit consent when you sign up. You can withdraw that consent at any time by deleting those fields or your account. We do not use them for anything except generating and adjusting your plans.
Apple Health and Health Connect
If you choose to connect Apple Health (through our iPhone app or an iPhone Shortcut you set up) or Google Health Connect (through our Android app):
- What we read: your weight, body fat percentage, steps, active energy, resting heart rate and sleep time. We only read the types you allow.
- What we write: the meals you've eaten (from your plan, meals out and your food log), as calories, protein, fat and carbohydrate.
- What we use it for: only your own progress report and maintenance-calorie estimate inside UpShift Fit. Readings are not sent to the AI provider.
- What we never do: use it for advertising or marketing, sell it, share it with data brokers or other third parties, or use it to train AI models.
- Where it's kept: on our server with the rest of your account, and never in iCloud.
- Stopping: turn the connection off on the Apple Health page in UpShift Fit, or remove UpShift Fit's access in the Health app or Health Connect settings. Deleting your account deletes the readings we hold. Anything we wrote into Health stays on your phone under your control.
Use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements. Data from Apple HealthKit is used in line with Apple's rules for HealthKit apps.
How your data is used with AI
To write and rebalance your plans, we send your household's planning details (names, targets, likes, dislikes, allergies, cooking and shopping notes, what you ate when you eat out, and food you log) to Anthropic, which provides the AI model. When you take a meal photo to estimate a meal or make a healthy remake, that photo is sent too. Your Apple Health or Health Connect readings are not. We do not send your email address, password or payment details. Anthropic processes this data on our behalf under their commercial terms and does not use it to train their models. No automated decision with a legal or similarly significant effect is made about you.
Who else we share it with
- Anthropic (USA) — AI plan generation, as above.
- IONOS, our hosting provider, where the servers and database sit (United Kingdom / EU).
- Microsoft — only if you use the optional Microsoft 365 calendar sync, or when we email you.
- Your calendar provider — only if you subscribe to your plan's calendar feed.
- Apple and Google — only on your own phone, if you connect Apple Health or Health Connect, and to deliver reminders you turn on.
- Stripe — when subscriptions launch, to take payment. We never see or store your full card details.
We do not sell your data or use it for advertising. Where a provider is outside the UK, the transfer is covered by the UK International Data Transfer Addendum or equivalent safeguards.
How long we keep it
- Your account and plans: while your account is open.
- Meal photos: up to 12 months, then deleted automatically.
- After you delete your account: deleted straight away, apart from backups, which are overwritten within 90 days.
- Security logs: up to 12 months.
- Billing records: 6 years, as UK tax law requires.
Cookies
We use one essential cookie to keep you signed in, and your browser's local storage to remember settings such as your workout history and which person's meals you are viewing. We do not use advertising or analytics cookies, so there is no cookie banner to click through.
Your rights
Under UK GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or withdraw consent. Use our contact form and we will respond within one month. You can delete your account and data yourself at any time in the app (Profiles → Delete account); here's how, and what is deleted. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.
Security
Passwords are stored only as salted hashes, traffic is encrypted, sign-in attempts are rate limited, and access to the servers is restricted to named administrators. No service can promise perfect security, but we will tell you and the ICO about any breach affecting your data, as the law requires.
Children
UpShift Fit is not intended for under-18s, and accounts are for adults only.
Changes
If we change this policy we will update the date above and, for significant changes, tell you by email.