How Digital Intelligence Holdings Ltd handles your information in the Gravitas8 app and on this website.
This policy explains what personal information Digital Intelligence Holdings Ltd (referred to in this document as "we", "us" or "Gravitas8") collects when you use the Gravitas8 mobile application, why we collect it, how long we keep it, who we share it with, and the rights you have over your information.
We are committed to protecting your privacy. This policy is written in plain English so you can make informed decisions about your data. If anything is unclear, please contact our data protection point of contact at support@gravitas8.com and we will explain.
Digital Intelligence Holdings Ltd is the data controller for the personal information described in this policy. We are registered in England and Wales with company number 17110569 and our registered office is at Crown House, 94 Armley Road, Leeds, LS12 2EJ, United Kingdom.
If you have any questions about this policy or wish to exercise any of the rights listed below, please contact us at support@gravitas8.com.
Account information: your email address, your name, the password you set (stored as a salted one-way hash, never as plain text), and any sign-in credentials you supply through Sign in with Apple or Sign in with Google.
Profile and plan information: your age, gender, height, current weight, goal weight, activity level and pace, plus any optional details you add such as maternal status, diabetic status or food preferences.
Health and nutrition data (special category personal data under UK GDPR Article 9): your meal log, weight history, manual glucose readings, HbA1c results, mood check-ins, dossier notes, photos of meals, fridge contents or lab reports, and voice recordings you record for voice-logging.
Wearable data: when you connect Oura, WHOOP or another supported wearable, we receive readiness, sleep, heart-rate variability, resting heart rate, activity score and total energy expenditure for the previous fourteen days. We do not receive any other data from your wearable account.
Apple Health and Health Connect: only if you grant permission, we read the types you allow, which can include weight and body composition, steps, workouts, active energy, exercise, heart rate, heart rate variability, VO2 max, respiratory rate, blood pressure, sleep and blood glucose. We use this only to personalise your targets and coaching. We never read the route or location of a workout. Data from Apple Health or Health Connect is never used for advertising or marketing, never sold, and never shared with third parties except the processors below that are needed to provide the service.
Continuous glucose monitors: if you connect a supported CGM account, we receive your glucose readings so the app can show them alongside your meals.
Calendar: only if you grant permission, we read when your events happen over the next two weeks and the general kind of event, so your plan can work around your diary. Event titles, locations and guests are never sent or stored.
Camera form checks: when you use Coach Eyes to check your exercise form, the video is analysed on your device and is never saved or uploaded.
Usage analytics: which screens and features you use (for example, opening the membership screen or finishing onboarding), linked to a random account number and never to your name or email. These events never include your food, health, chat or voice content. You can switch this off at any time in Settings > Legal & account > Share usage analytics.
Payment data: if you subscribe to a paid plan, your subscription status is processed by RevenueCat on behalf of Apple or Google. We never see your card details. We receive only the subscription status (trial, active, paused, cancelled) and the entitlement set.
Communications metadata: if you opt into outbound coaching channels (Telegram, WhatsApp, SMS or phone), we store the channel identifiers (phone number, Telegram chat ID) needed to deliver those messages, and a record of when each message was sent.
Performance of a contract (UK GDPR Article 6(1)(b)): for account, profile, plan and subscription management. Without this information we cannot provide the service you have asked us to provide.
Explicit consent (Article 9(2)(a) for special category data): for your health and nutrition data, your wearable data, your mood check-ins, your maternal mode data and your diabetes mode data. You give this consent when you enable each feature, and you can withdraw it at any time by disabling the feature or deleting your account.
Legitimate interest (Article 6(1)(f)): for usage analytics used to understand which features help members and to keep the service running and secure. You can opt out via Settings > Legal & account > Share usage analytics.
Legal obligation (Article 6(1)(c)): where we are required to retain or disclose information by law.
To deliver the core service: to compute your daily targets, generate your weekly meal plan, render your AI coaching responses, send your scheduled reminders, and surface predictive nudges based on patterns Cal detects in your recent data.
To improve the service: to monitor performance, fix bugs and understand which features are used. We aggregate and pseudonymise where possible.
To communicate with you: to respond to support requests, to send you the in-app and outbound coaching messages you have opted into, and (rarely) to notify you about material changes to this policy or the Terms of Service.
We do not use your information for advertising, and we do not sell or rent it to third parties.
We work with a small set of carefully chosen processors. Each is bound by a data processing agreement and uses your information only on our instructions.
MongoDB Atlas: our primary database. Data is stored in their UK or EU region. Their privacy notice is at https://www.mongodb.com/legal/privacy/privacy-policy.
Render: our hosting provider. Render operates the servers that run the Gravitas8 API. Their privacy notice is at https://render.com/privacy.
Google Cloud Storage: to store recipe images and the narrated coach stories made for you. Their notice: https://policies.google.com/privacy.
Google (Gemini API): for AI inference used by the coaching, meal planning, photo logging, voice logging and fridge vision features. Inputs and outputs are not used to train Google's models when accessed through the developer API tier. Their notice: https://policies.google.com/privacy.
Anthropic (Claude API): used as a fallback for the same coaching and inference features. Inputs and outputs are not used to train Anthropic's models when accessed through the developer API tier. Their notice: https://www.anthropic.com/legal/privacy.
ElevenLabs: for the voice agent and the spoken coach replies. Voice clips and transcripts are processed only to generate the response. Their notice: https://elevenlabs.io/privacy.
RevenueCat: for subscription management. They receive your purchase token and subscription status. Their notice: https://www.revenuecat.com/privacy.
Twilio: when you opt into voice or SMS coaching channels. They process only the phone number and message content for delivery. Their notice: https://www.twilio.com/legal/privacy.
Expo Application Services: for our mobile app build and over-the-air update infrastructure, and for push notification delivery. Their notice: https://expo.dev/privacy.
PostHog: for the usage analytics described above, hosted in the European Union. Session recording and automatic tap capture are switched off. Their notice: https://posthog.com/privacy.
Stripe: only if you subscribe through our website rather than the App Store or Google Play. Stripe processes your payment details; we never see your card number. Their notice: https://stripe.com/privacy.
Our email delivery provider: to send account, report and support emails you have asked for.
Oura, WHOOP and other connected wearables: data flows from the wearable provider to us via their API after you authorise the connection. We do not send any of your information back to them.
Some of the processors listed above are based in the United States. Where this is the case, we rely on the UK International Data Transfer Agreement or the European Commission's Standard Contractual Clauses (with the UK Addendum) to ensure your information receives equivalent protection to that provided under UK law.
If you would like more information about the safeguards in place for any specific transfer, please contact us at support@gravitas8.com.
Account, profile and plan data: kept for as long as your account is active. If you delete your account, all of this data is permanently removed within 30 days, except for limited records we are required to retain by law.
Health and nutrition data: kept for as long as your account is active. Subject to the same 30-day deletion on account deletion.
Photos and voice clips: photos and voice clips you submit to the AI features are processed in memory and are not retained beyond the request. We do not store the binary content on our servers.
Usage analytics: kept for up to 12 months, then deleted.
Subscription and billing metadata: kept for 7 years to comply with UK tax law.
Under UK GDPR you have the right to:
Access (Article 15): request a copy of the personal information we hold about you. The in-app Export option in Settings provides this for most fields; the rest is available on request.
Rectification (Article 16): correct any inaccurate information. Most fields can be edited directly in the app.
Erasure (Article 17): request that we delete all of your personal information. The in-app Delete my account flow does this, with a 30-day grace period during which the deletion can be cancelled.
Restriction (Article 18): ask us to limit how we process your information in specific circumstances.
Portability (Article 20): receive your information in a structured, commonly used, machine-readable format. The in-app Export covers this.
Object (Article 21): object to specific processing based on legitimate interest, including the usage analytics described above.
Withdraw consent (Article 7(3)): withdraw consent for any feature you previously enabled. Disabling the feature in Settings withdraws that consent.
To exercise any of these rights, contact us at support@gravitas8.com. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office at https://ico.org.uk.
Gravitas8 is intended for use by adults aged 18 and over. We do not knowingly process information about anyone under 18. If we become aware that a person under 18 has created an account, we will close that account and delete the information.
We use industry-standard technical and organisational measures to protect your information, including TLS encryption in transit, encryption at rest for our database, salted password hashing, role-based access controls for any administrative access, and audit logging of any access to special category data by our staff.
No system is perfectly secure. If we ever experience a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the UK Information Commissioner's Office within 72 hours and notify you directly where the law requires it.
The Gravitas8 mobile app does not use cookies. The companion website gravitas8.com uses only strictly necessary cookies (for the publicly-accessible Privacy Policy and Terms pages and for sign-in session management on any future web app).
We may update this policy from time to time. When we make material changes we will notify you in-app and ask you to re-accept. The version number and last-updated date below tell you which version of the policy you are currently looking at.
Version 1.1.0, last updated 12 October 2026.
Data Protection point of contact: support@gravitas8.com.
General support: support@gravitas8.com.
Postal address: Digital Intelligence Holdings Ltd, Crown House, 94 Armley Road, Leeds, LS12 2EJ, United Kingdom.
This part covers pre-registering as a Founding Member and trying Cal on gravitas8.com. The controller, your rights and how to contact us are the same as in Part 1.
| What we keep | Why |
|---|---|
| Your email address and, if you give it, your first name | To email you about the launch and your Founding Member perks, and to apply those perks to your account at launch |
| The wording you agreed to and when | To show what you consented to |
| Your invite code, and the code of whoever invited you | So friends who join with your link get the same perks |
| Which page you signed up from | To know which parts of the site work |
| Your browser's language | So Cal's welcome message and our emails can be in your language |
| The meal plan you built with Cal, if you built one | To email it to you and load it into the app at launch. We keep the meals and shopping list only, not the answers you gave to build it |
| Cal's welcome voice message, if you play it | A short recording of Cal welcoming you by your first name, made by our voice provider the first time you play it, so you can listen again from your email |
Our lawful basis is your consent. We do not store your IP address with your registration, and we never sell or rent your details.
We use these providers to run the site, under contracts that limit what they can do with your data: Render (hosting), MongoDB Atlas (database), our email delivery service, Google (Gemini) as our AI model provider with Anthropic (Claude) as a fallback, and ElevenLabs (voice). Some may process data outside the UK, in which case we rely on the UK's approved safeguards.
Until 12 months after launch, unless you become a member, in which case your registration becomes part of your account. If you unsubscribe we stop emailing you straight away, and your Founding Member place stays saved for launch. Ask us at any time and we will delete your registration completely, including any meal plan and Cal's welcome message.