Kinesa

Privacy Policy

Last Updated: 12 August 2026
Effective Date: 12 August 2026

Introduction

Your privacy matters to us. This Privacy Policy explains how GrandPoint Ltd ("we," "us," "our") collects, uses, stores, and protects your personal information when you use the Kinesa fitness and wellness tracking application ("App," "Service").

This policy explains what we do and why we are allowed to do it. Using the app is not itself your consent to everything in here: where we rely on your consent, we ask you for it separately and you can take it back. The "Lawful basis" section below sets out exactly which parts need your consent and which do not.

Key Information

Lawful basis

We are regulated by the UK GDPR, the EU GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003. Those are the laws we answer to. This section is the separate question they require us to answer: for each thing we do with your data, on what basis are we allowed to do it.

Health data comes first, because that is most of what Kinesa holds

Almost everything Kinesa is for involves what the law calls "special category" data: data concerning your health. That includes your weight and body measurements, your sleep, your mood and energy, what you eat, your workouts and activity, anything you tell us about a condition such as being pregnant or having a heart condition, and any progress photos you add.

Article 9(1) of the UK GDPR prohibits processing that kind of data unless one of the conditions in Article 9(2) applies. The condition we rely on is Article 9(2)(a), your explicit consent. That is a higher bar than ordinary consent: it has to be a clear, separate, affirmative act, given for a purpose we have described to you.

So we ask you, in the app, in plain words, before we process it. We ask separately for three different things, because they are three different decisions:

  1. Health data you record in Kinesa. Article 6(1)(a) consent, and Article 9(2)(a) explicit consent.
  2. Connecting Apple Health or Google Health Connect. Article 6(1)(a) consent, and Article 9(2)(a) explicit consent. This is separate because granting your phone's permission is not the same as agreeing that we may process what it releases, and because you may be willing to log in the app without connecting your whole health history.
  3. AI features. Article 6(1)(a) consent, and Article 9(2)(a) explicit consent. Separate because it involves sending your information to another organisation (see Section 4.2), which you can reasonably refuse while still using everything else.

You can give or withdraw any of these at any time in Settings, under Your permissions, where you can also read the full wording of each one again. We keep a record of which version of that wording you agreed to and when, because Article 7(1) requires us to be able to demonstrate your consent rather than just assert it.

Refusing is a real option. Kinesa keeps working without any of these. You lose the features that need the data, and nothing else. We do not make the app conditional on consent you would rather not give, because consent obtained that way is not freely given (Article 7(4)) and so is not valid.

Everything else

What happens if you say no, or change your mind

Withdrawing a consent stops the processing it covered from that point on. It does not by itself delete what we already hold: you can do that separately, and at any time, under Settings, Data Management, which also lets you export everything or delete the account outright. Withdrawing is as easy as giving, in the same place, as Article 7(3) requires.

Exercising any of these rights is free (Article 12(5)). None of them are behind the paid tier, and none of them ever will be.

1. Information We Collect

1.1 Information You Provide Directly

Account Information:

Fitness and Health Data (voluntarily provided by you):

Payment Information:

1.2 Information from Third-Party Integrations

Wearable Devices and Health Platforms:

If you connect Apple Health (iOS) or Google Health Connect (Android), we read the following:

We also write two things back to your health platform, so a session you record in Kinesa sits alongside the rest of your history rather than being stranded in this app:

The list is the same on both platforms, with one exception: Health Connect does not provide a separate "time in bed" figure, so on Android we do not ask for it.

Two separate permissions apply here and it is worth being clear about the difference. Your phone's health permission is what allows your device to release the data to us; it belongs to the device, so it can persist across different accounts on the same handset. Our Article 9(2)(a) explicit consent is what allows us to process that data, and it belongs to your account. We ask for ours before asking for the phone's, and we do not read anything from your health platform until you have given it.

You control which data types we access through device permissions, and can revoke access at any time in your device settings. You can withdraw our consent at any time in Settings → Data Management → Your permissions.

1.3 Food and Nutrition Data Sources

Kinesa's food search and nutrition information comes from the following sources, some bundled in the app and some queried through Kinesa's own food search service:

Attribution for these data sources is available in the app under Settings → About → Data sources.

1.4 Information Collected Automatically

Usage Data:

We use analytics to improve the app, not for advertising.

1.5 Information We Do Not Collect

We do not collect:

2. How We Use Your Information

We use your data to:

3. How We Share Your Information

We do not sell your data. We share data only as follows:

Service Providers:

Community Features (Unity):

Legal Requirements:

We may disclose data if required by law or to protect our rights.

4. AI-Powered Features

Kinesa includes several AI features:

4.1 In-Workout AI Coach (On-Device, Rule-Based)

The AI Coach that provides real-time workout guidance, progressive overload suggestions, fatigue awareness, and form reminders during gym sessions:

4.2 AI Fitness Coach Chat (Third-Party AI Sub-Processor)

The AI Fitness Coach chat feature provides personalised fitness coaching, workout recommendations, form guidance, and fitness advice:

Before using an AI feature for the first time you are shown the wording in full: what is sent, why, the lawful basis, and how to withdraw. Withdrawing stops anything further being sent. It does not by itself delete past coach conversations, which may contain health data you described; you can delete those under Settings → Data Management.

The information sent can include data concerning your health: your sleep, activity, workouts, nutrition, body measurements, age, gender and weight, and anything you have told us about a condition such as being pregnant or having a heart condition, so that advice can account for it. This is why AI features carry their own Article 9(2)(a) explicit consent rather than sitting under the general one.

4.3 Smart Nutrition Logging (Describe Your Meal and Meal Photos)

Kinesa can turn a plain-English description of a meal, or a photo of a meal, into a food log entry:

4.4 Voice Input and Speech Recognition

Throughout Kinesa you can dictate instead of typing (for example, to describe a meal, a workout, your sleep, or a goal):

4.5 Progress Photo Analysis (Kinesa Pro)

If you have added progress photos, Kinesa Pro can compare two of them and describe the visible physical changes between them:

5. Data Retention

We retain your data while your account is active. Upon account deletion:

6. Data Security

We use industry-standard security practices including:

No system is 100 percent secure. If you become aware of a security issue, contact privacy@kinesa.app.

7. Your Rights Under UK GDPR and EU GDPR

You have the right to:

Most of these you can exercise yourself, immediately, without contacting anyone. Settings → Data Management holds export (in a portable format), deletion of your health data, and deletion of the account. Settings → Data Management → Your permissions holds every consent, in both directions.

For anything else, contact privacy@kinesa.app. We respond within 30 days.

Exercising any of these rights is free of charge (Article 12(5)), and none of them is limited to paying subscribers.

8. Children's Privacy

Kinesa is intended for users 16 years and older. Users aged 13-15 may use Unity community features only with verified parental or guardian consent. We do not knowingly collect personal data from children under 13.

9. International Data Transfers

Your data is primarily stored on Firebase servers, and Kinesa's own backend functions that handle AI requests run in the UK region (London).

Some processing takes place outside the UK and EEA:

These transfers rely on appropriate safeguards, being the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or an adequacy decision where one applies.

10. Community Features (Unity)

10.1 Data We Collect in Unity

When you participate in Unity features, we collect:

10.2 Who Sees Your Data

Other participants can see:

We never share your email, exact location, or full health data with other participants without your explicit consent.

10.3 Your Choices

You can:

10.4 Data Retention for Unity

10.5 Reporting Content

If you report a post, message, challenge content, or member profile using the in-app Report tool, we collect the report so our moderation team can review it. A report contains your user ID (as the reporter), a reference to the reported content and its author, the reason you selected, and any optional comment you add. Reports are used only to keep the community safe (to review, remove, or act on content that breaches our Terms) and are visible only to GrandPoint Ltd, never to the member you reported. We retain reports for as long as needed for moderation and safety record-keeping.

11. Camera, Microphone, and Barcode Scanning

Kinesa requests camera access for:

Kinesa requests microphone access only for voice input (dictation), as described in Section 4.4.

Camera and microphone access are requested only when you use these features, and can be revoked at any time in your device settings. Barcode images are processed on-device and are not stored or transmitted; only the decoded barcode number is sent to retrieve product information.

12. Notifications

Kinesa may send push notifications for:

You can manage notification preferences in Settings or your device settings.

13. Cookies and Tracking Technologies

Kinesa is a native mobile app and does not use cookies. Firebase SDKs may store small amounts of data locally for analytics and crash reporting.

14. Marketing and Communications

We may send occasional marketing communications about new features. You can opt out at any time. Transactional communications (account security, important account changes) cannot be opted out of.

15. Third-Party Links and Services

Kinesa may link to third-party services. Their privacy policies apply when you use those services.

16. Changes to This Privacy Policy

We may update this policy from time to time. When we make material changes, for example introducing a new way of processing your data, we will notify you within the app the next time you open it, and ask you to review and acknowledge the updated policy before you continue using affected features. The "Last Updated" date and Document Version at the foot of this policy tell you when it last changed. For non-material changes we may simply update the policy in the app. Your continued use of Kinesa after an update, once you have been notified, constitutes acceptance of the updated policy.

17. Contact Us

Document Version: 7.0

Consent notice version: 2026-08-03.1. Each consent you give is recorded against the version of the wording you were shown, so that if we materially change what a consent covers we ask you again rather than assuming the old answer still applies.