Privacy policy

Who is responsible for your data

• If you are a client of a coach who uses Conquest: your coach's business is the controller of your coaching data (your programme, logs, check-ins, messages, intake answers and health figures). We process it on their behalf and only on their instructions, under our data processing agreement. Questions or requests about that data are best sent to your coach first; if you contact us, we will pass them on and help them respond.
• If you run, or work for, a coaching business on Conquest, or you visit our website, join the waitlist or ask for access: we are the controller of that data, which is your account, your organisation's settings and how you use the service.

As a controller, Dodds Holdings UK Ltd is registered with the Information Commissioner's Office, registration number 0000000000.

You can contact us about anything in this policy at [email protected].

What we collect

Account details: your name, email address, password (stored only as a one-way hash), time zone, and, if you choose, your Sign in with Apple identifier.

Coaching business details: organisation name, handle, logo and colours, team members and their roles, programmes, exercises, food guides and meal ideas.

Client coaching data, entered by clients and their coaches:

• Intake answers, including goals, routine, occupation, location, training history, injuries and the answers to a pre-exercise health questionnaire (PAR-Q).
• Body and activity figures such as weight, sleep, steps, energy and food intake, either typed in or read from Apple Health when the client connects it on their iPhone.
• Workouts read from Apple Health when the client connects it: the type of activity, start and end times, duration, distance, energy burned, average and maximum heart rate, and the name of the app that recorded each one.
• Further figures read from Apple Health when the client allows them: resting heart rate and heart rate variability; sleep stages (deep, REM, core and awake time); body fat, lean body mass and waist measurement; cardio fitness (VO2 max); exercise minutes, stand hours, distance walked or run and flights climbed; mindful minutes; caffeine, sugar, sodium and saturated fat; blood pressure; and blood glucose. These are stored as one set of figures per day.
• A Recovery rating worked out from the client's resting heart rate, heart rate variability and sleep, shown to the client and their coach. It is information only and sends no notifications.
• Training sessions: exercises, sets, weights and reps, and notes.
• Check-ins, progress figures, messages with the coach, coach notes and dietary preferences, allergies and dislikes.

Waitlist and access requests: the email address you give us and, for an access request, your name, business name and message.

Technical data: sign-in sessions, the device's push notification token if you allow notifications, IP addresses used for security and rate limiting, and an audit log of administrative actions.

We do not use advertising trackers or third-party analytics, and we do not sell personal data.

Health data

Some client coaching data is data about health, which UK and EU law treat as special category data. The coach's business decides to collect it and is responsible for having a lawful basis and the client's explicit consent where that is needed. We only store and process it to provide the service to that business.

Apple Health data is read on the client's iPhone only after they grant permission in iOS, only for the figures listed when they connect, and only to fill in their daily log, their list of activities and their health figures and Recovery rating for their coach. It is never used for advertising or shared with anyone other than the coaching business the client chose. Conquest does not read cycle tracking, clinical records, medications or ECG data.

When a client finishes a session in the app, Conquest writes it to Apple Health as a strength workout, with its start and end times, if the client has allowed that in iOS. Conquest does not write calories to Apple Health.

How we use it and our lawful bases

• To provide the service you or your coaching business signed up for (performance of a contract).
• To send account emails: confirming your address, password resets, invitations, security notices and the replies to access requests (performance of a contract, and our legitimate interest in keeping accounts secure).
• To tell you when your place on the waitlist is ready, after you have confirmed your email address (consent, which you can withdraw at any time through the unsubscribe link).
• To keep the service secure, prevent abuse and fix problems, including rate limiting and audit logs (legitimate interests).
• To meet legal obligations, such as answering lawful requests from authorities (legal obligation).

Who we share it with

We use a small number of service providers (sub-processors) to run the service. Each only receives what it needs:

• Railway: hosting for the application and its database.
• Cloudflare (R2): storage for organisation logo uploads, and encrypted database backups.
• Resend: sending emails.
• Apple: Sign in with Apple, push notifications to iPhones, and Apple Health on the client's own device.
• Google (Gemini API): generating meal ideas when a coach asks for them. It receives dietary preferences, allergies, dislikes and calorie and macro targets, never a client's name or contact details.

Inside a coaching business, a client's data is visible to the coaches and assistants that business gives access to. Platform administrators at Conquest can see data when needed to support the service, and every such action is recorded in an audit log.

We may disclose data if the law requires it, or to protect the rights and safety of our users or the public.

International transfers

Some providers may process data outside the UK. Where they do, we rely on UK adequacy regulations or the International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses, so the data keeps an equivalent level of protection.

How long we keep it

• Account and coaching data: for as long as the account or the coaching business's subscription is active. When a person deletes their account it is removed, and a coaching business can remove a client.
• Waitlist entries: until you unsubscribe, ask us to remove you, or we invite you, and in any case no longer than 24 months after you last confirmed.
• Access requests: for 12 months after they are decided.
• Security and audit logs: for up to 12 months, unless needed longer to investigate an incident.

Your rights

You have the right to access, correct, delete or move your data, to restrict or object to how it is used, and to withdraw consent at any time. You can change your name, time zone and password, and delete your account, from the Account page. For anything else, email us.

If your data is held for a coaching business, we will forward your request to them and help them answer it. We reply to requests within one month.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to put things right first.

Security

Data is encrypted in transit. Passwords are hashed, sign-in tokens and email links are stored only as hashes, and access inside each coaching business is limited by role. We restrict who can reach production systems and record administrative actions.

Children

Conquest is not intended for anyone under 16. Coaching businesses must not add clients under 16 without the consent of a parent or guardian and must take responsibility for doing so.

Changes to this policy

We will update the date at the top when this policy changes, and tell account holders by email about any significant change.