Privacy Policy

Effective date: 28 September 2026
Version: 1.1

This Privacy Policy explains how personal information is handled when you use TrueFlow.

TrueFlow is operated by Knowhow Technologies Ltd ("Knowhow", "we", "us", "our"), a company registered in England and Wales under company number 17394261.

Our address is 5 Brayford Square, London E1 0SG, United Kingdom.

For privacy questions or requests, contact support@mytrueflow.uk.

1. Who this policy applies to

TrueFlow is a mobile and web application used by Coaches to manage Clients, create programmes, share resources and track progress.

There are two main categories of user:

Coaches create a TrueFlow account using their own account details.
Clients are added by a Coach and access their plan using a Coach-issued access code. Clients do not currently register with an email address and password.

This policy applies to both.

2. Our role under data-protection law

Our role depends on the information and why it is being processed.

2.1 Information about Coaches and operation of TrueFlow

Knowhow generally acts as the data controller for information we use to create and administer Coach accounts, authenticate users, provide subscriptions, secure and operate TrueFlow, provide support, comply with legal obligations and manage our relationship with users.

2.2 Client coaching and health-related information

Where a Coach decides which Clients to add, what information to record about them, what programme to provide and why that information is used as part of the Coach's services, the Coach will generally be the data controller for that Client information and Knowhow acts as a data processor providing the TrueFlow software on the Coach's behalf.

This can include health-related information and other special-category personal data.

Coaches are responsible for establishing an appropriate lawful basis for their processing, providing any privacy information required in connection with their coaching service, and meeting any additional requirements that apply to special-category data.

Knowhow may separately act as controller where we need to process limited information for our own legal, security or service-administration purposes.

3. Information we process

3.1 Coach information

When a Coach creates or uses a TrueFlow account, we may process:

name;
email address;
authentication information;
Coach type or types selected in the app, including free-text information where "Other" is used;
account and subscription status;
login timestamp and login count;
device type, browser and screen-size information derived from the browser or device; and
communications sent to our support address.

Passwords are handled by our authentication provider, Supabase, and are not available to Knowhow in plaintext.

3.2 Client information

A Coach creates the Client's TrueFlow access. The current product does not require a Client email address, phone number or date of birth.

We may process:

the Client's name;
a hashed version of the Client access code for authentication;
programmes and assigned exercises;
Coach notes and guidance associated with the Client's programme;
exercise completion history;
exercise-progress information;
body measurements, which may include height, weight, waist, chest, arm and thigh measurements;
nutrition and wellbeing information, which may include sleep, calories, protein, fat and carbohydrate information; and
Client acknowledgement records, including the date/time and versions of the Terms of Use and Privacy Policy accepted.

Some of this information, particularly body measurements, nutrition, wellbeing and information revealing physical health or condition, may constitute health data or other special-category personal data under UK data-protection law.

3.3 Coach-created content

Coaches may create and store:

exercises and exercise categories;
coaching notes;
optional external video links;
reusable programme templates; and
resources and written guidance.

TrueFlow may also provide generic starter exercise content and links to third-party demonstration videos that a Coach can choose to import.

3.4 Subscription information

Coach subscriptions are purchased through the Apple App Store or Google Play.

Knowhow does not receive or store payment-card details for those purchases.

Our subscription-management provider, RevenueCat, provides us with information needed to determine subscription entitlement, such as a Coach identifier and subscription or entitlement status.

3.5 Information we do not currently collect

TrueFlow does not currently use third-party advertising or analytics SDKs and does not currently collect precise location, contacts, camera/photo-library content or push-notification tokens as part of the Service.

We do not sell personal information.

We do not currently use Coach or Client information for personalised advertising, automated profiling or training AI models.

If this changes, this Privacy Policy will be updated before or when required by applicable law.

4. How we use personal information

Depending on the user's role and our role as controller or processor, information is used to:

create, authenticate and administer Coach accounts;
allow Coaches to create and manage Clients;
provide Clients with access to programmes assigned by their Coach;
provide exercise, template, resource and progress-tracking functionality;
allow Coaches and Clients to record and review relevant progress information;
administer subscription entitlements;
protect the security and integrity of TrueFlow;
diagnose technical or support issues;
send account-related communications such as email confirmation and password-reset messages;
record Client acceptance of the applicable Terms and acknowledgement of this Privacy Policy;
process account and data-rights requests; and
comply with legal obligations.

TrueFlow does not currently provide an in-app Coach-Client messaging service.

5. Legal bases where Knowhow is controller

Where Knowhow acts as controller, our legal bases may include:

Contract

We process information where necessary to enter into or perform our contract with a Coach, including creating and administering the Coach account, authenticating access, providing the Service and managing subscription entitlement.

Legitimate interests

We may process limited account, login, device and technical information where necessary for our legitimate interests in:

protecting TrueFlow and its users;
preventing and investigating misuse;
diagnosing technical problems;
providing support; and
operating and improving the reliability of the Service.

We balance these interests against the rights and interests of affected individuals.

Legal obligations

We may process or retain information where necessary to comply with applicable law, respond to lawful requests or establish and protect legal rights.

Client data processed for a Coach

Where Knowhow acts as processor for Client coaching or health-related information, the Coach is responsible for identifying the applicable Article 6 lawful basis and, where special-category data is involved, an appropriate Article 9 condition.

TrueFlow's first-use acknowledgement of the Terms and Privacy Policy is a record that the Client has agreed to use TrueFlow and has been shown the relevant documents. It is not represented by Knowhow as a standalone Article 9 explicit-consent mechanism for the Coach's processing of health data.

6. First-use Client acknowledgement

Before accessing the Client area for the first time, a Client is required to confirm that they agree to the TrueFlow Terms of Use and have read this Privacy Policy.

We record:

the date and time of acceptance;
the Terms version; and
the Privacy Policy version.

If a materially changed version requires re-acceptance, the Client may be asked to complete the acknowledgement again.

7. Who receives information

We use service providers to operate TrueFlow. Depending on the service, these providers may act as processors or independent controllers for particular activities.

Current providers include:

Provider	Purpose	Information involved
Supabase	Database hosting, authentication and backend functions. TrueFlow's primary database is hosted in the West EU (Ireland) region.	Account, Client, programme and application data as required to provide TrueFlow
RevenueCat	Subscription and entitlement management	Coach/user identifier and subscription/entitlement information
Apple	App distribution and App Store subscription processing	Purchase/account information handled by Apple; TrueFlow receives relevant purchase/entitlement information
Google	App distribution and Google Play subscription processing	Purchase/account information handled by Google; TrueFlow receives relevant purchase/entitlement information
Vercel	Web application hosting	Technical information necessary to serve the web application and associated hosting logs
Resend	Delivery of account-related email through the authentication setup	Coach email address and information necessary to deliver the relevant message

We may also disclose personal information:

where required by law, court order or a competent authority;
where reasonably necessary to establish, exercise or defend legal rights;
to protect the security or rights of users or the Service; or
as part of a merger, acquisition, restructuring, financing or sale of all or part of the business, subject to appropriate protections.

We do not sell Client or Coach personal information.

8. International transfers

TrueFlow's primary Supabase database is hosted in the West EU (Ireland) region. Some of our other service providers, or their subprocessors, may process information outside the United Kingdom.

Where UK data-protection law requires safeguards for an international transfer, we use or require an appropriate lawful transfer mechanism, which may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another mechanism permitted by applicable law.

For information about a particular transfer or safeguard, contact support@mytrueflow.uk.

9. Data retention and deletion

We keep personal information only for as long as reasonably necessary for the purposes for which it is processed, including applicable legal, security and dispute-resolution requirements.

Clients: how deletion works

A Client record can be deleted in two ways:

By the Coach. A Coach can remove a Client from their account.
By the Client. A Client can delete their own TrueFlow client account directly in the app (More → Delete account) after a confirmation prompt. No email or support request is needed.

In either case:

the Client is removed from the Coach's active Client view;
the Client's access code stops working and they can no longer log in;
the Client record is marked for deletion; and
the Client record and associated completions, daily_logs and exercise_logs are scheduled for permanent deletion after 30 days.

Reinstating a Client record within the 30 days

The 30-day period is an operational safeguard against accidental deletion. There is no self-service “undo” in the app. If, within the 30 days, a Client (or, where a Coach removed the Client, that Coach) asks us at support@mytrueflow.uk to reverse the deletion, we may be able to reinstate the record (including the Client's programme, history and access code) provided it has not yet been permanently deleted. We may need to verify the request first. Reinstatement is at our discretion and is not guaranteed.

After the 30 days, deletion is permanent and cannot be reversed. We will not reinstate a Client record if the Client has asked us to erase their information.

A Client may separately exercise a legal right to erasure. Where the right applies, we and/or the relevant Coach will handle the request in accordance with applicable data-protection law and may delete information sooner where required.

Coach accounts

A Coach can delete their account directly in the app (More → Delete account) after a confirmation prompt. Coach account deletion takes effect immediately and is permanent. It deletes:

the Coach's profile and login;
the Coach's Clients and all of their associated records, including completions, daily logs and exercise logs; and
the Coach's programmes, exercise library, templates and resources.

Because a Coach's Clients' records are deleted along with the Coach account, those Clients will lose access immediately. The 30-day period described above does not apply to Coach account deletion, and a deleted Coach account cannot be reinstated.

A Coach may also ask us to delete their account by emailing support@mytrueflow.uk. We may need to verify the request before processing it.

Deleting TrueFlow data does not automatically cancel a subscription held through Apple or Google, and it does not delete information held by Apple, Google or RevenueCat in connection with a subscription; that information is handled separately under the relevant provider's terms and policies. Subscription cancellation must be handled separately through the relevant store.

Certain limited records may be retained for longer where required by law or reasonably necessary to establish, exercise or defend legal claims.

10. Security

We use technical and organisational measures designed to protect personal information.

Current measures include:

Coach authentication through Supabase;
cryptographic hashing of Client access codes before database storage;
row-level database security restricting Coach access to the data they are authorised to access;
controlled backend functions for Client operations; and
access controls intended to prevent unauthorised database writes.

A Client's device may retain information needed to maintain their local session. Users should therefore keep their device secure and should not share their Client access code.

No internet or software service can guarantee absolute security.

If you believe your account, access code or personal information has been compromised, contact support@mytrueflow.uk.

11. Your data-protection rights

Where UK GDPR applies, you may have rights including:

access to your personal data;
correction of inaccurate information;
erasure in certain circumstances;
restriction of processing;
data portability in certain circumstances;
objection to certain processing; and
withdrawal of consent where processing is based on consent.

These rights are subject to legal conditions and exceptions.

Coaches

For information for which Knowhow is controller, Coaches can contact support@mytrueflow.uk.

Clients

For Client coaching and health-related information, the Client's Coach will generally be the controller and should normally be the first point of contact.

Clients may also contact support@mytrueflow.uk. Where Knowhow acts only as processor, we may need to refer the request to, or work with, the relevant Coach. We may ask for information reasonably necessary to verify the request and protect the Client's data.

You also have the right to complain to the Information Commissioner's Office (ICO). Information about making a complaint is available on the ICO's website.

12. Children and young people

TrueFlow may be used by Coaches who work with children or young people. TrueFlow does not currently collect a Client's date of birth or operate an age-verification process.

Where a Coach uses TrueFlow in connection with a child or young person, the Coach is responsible as controller for determining the appropriate lawful basis for that processing and for obtaining any parental or guardian authority, consent or other safeguards required by applicable law and their professional obligations.

Knowhow will process Client information on the Coach's instructions in accordance with our processor obligations and applicable law.

TrueFlow is not intended to enable children to independently purchase services or create a Coach account on behalf of a coaching business.

13. External links and resources

TrueFlow may contain links to external websites or videos, including links included by Coaches or in generic starter exercise content.

If you follow an external link, the third party may process information under its own privacy policy. Knowhow does not control the privacy practices of external websites or video providers.

14. Changes to this Privacy Policy

We may update this Privacy Policy where TrueFlow, our providers, our legal obligations or our processing activities change.

The current version and effective date will be displayed with the policy.

Where a change materially affects how personal information is handled, we will take reasonable steps to provide notice and, where appropriate, require a Client to acknowledge the updated version before continuing to use TrueFlow.

15. Contact us

For privacy questions, data-rights requests or concerns about how TrueFlow handles personal information:

Knowhow Technologies Ltd
Company number: 17394261
Address: 5 Brayford Square, London E1 0SG, United Kingdom
Email: support@mytrueflow.uk
ICO registration number: ZC232183