Privacy notice

Who we are

Forge Life Ltd (company number 17224646) is responsible for your personal data (the data controller). Our registered office is Grand Union Studios, 332 Ladbroke Grove, Studio 5.01, London W10 5AD.

Our Data Protection Officer is Ines Cheaib. For each question about your data, email dpo@forge.life.

What we collect

When you book: your name, email, phone, age, sex, activity level and how you heard about Forge. When you first sign in: your date of birth.

Before and during your assessment: your answers about your health, for example conditions, medicines, pain, falls, sleep and mood. Also your height and weight, your goals and your exercise history, and the results of the movement tests.

After your assessment: your report, and the next step that you take, for example a trial class or a referral to your GP.

We also keep a record of your consents, your sign-ins with your IP address and browser, and a log of who opened or changed your record (a Forge team member or you), and when.

Why we use it

We use your data to check that exercise is safe for you, to choose the right classes for you, to make your report, and to measure your progress. We also use it, without your name, to see how well the Forge assessment works.

The law lets us use your personal data because you ask us for an assessment. Your health data is special category data. We use it only with your explicit consent, which you give in the health data consent.

You do not have to give us your data. But without your health data, we cannot do a safe assessment or plan your classes.

We keep the log of who opened your record to protect your data. The law lets us do this because it is in our legitimate interests and it is part of our duty to keep your data safe.

Recordings

We do not record your assessment, and we do not use AI to assess you. The only exception is if you sign the optional audio recording consent. That consent tells you what we record and why.

Decisions about you

The Forge software calculates your results from your answers and your test values. Your coach checks them and chooses your classes with you. No decision about you is made only by a computer.

Who can see it

Your coach and the Forge admins can see your record. We do not sell your data. We do not give your record to insurers or advertisers. We give your data to your GP or another person only if you ask us, or if the law tells us to. We can give insurers totals for many members, which do not identify you.

These companies process data for us under a contract. They can use it only to give us their service: Vercel (hosting, London), Neon (database, London), Calendly (bookings, United States), Sentry (error reports, logs and app speed, Frankfurt), PostHog (website statistics, Frankfurt), Anthropic (AI tools that help us fix software errors, United States: they can see an error report, which we clean of personal data first) and Google (staff sign-in and our register of data requests). If you sign the audio recording consent: Neon (recording storage, Frankfurt) and Microsoft (speech to text, London).

Calendly and Anthropic are in the United States. When your data goes there, we protect it with a safeguard that UK law approves: the UK-US data bridge or the UK International Data Transfer Agreement. Email dpo@forge.life for a copy.

Our website and apps count page visits and some steps, for example a sent questionnaire or a booking, with PostHog. PostHog uses no cookies and does not identify you.

Cookies

Our website asks before it uses advertising cookies. If you select "Accept", it uses the Meta cookie _fbp (kept for 90 days) to measure our adverts on Facebook and Instagram. Meta (United States) then gets the pages that you visit on our website, and can link them to your Meta account. Meta does not get your booking, your answers or your health data. If you select "Decline", the website uses no advertising cookies and works the same. To change your choice, select "Cookie settings" at the bottom of each page.

How long we keep it

If you do not join Forge, we delete your data 12 months after your last assessment, or after your booking if there is no assessment. If you join, we keep it while you are a member, and for 6 years after you leave. The law lets us keep it for this time to make or defend a legal claim. We keep the log of who opened your record for 6 years. Deleted data stays in our backups for up to 35 days.

Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete it, or ask us to stop or limit how we use it. You can withdraw a consent at any time. If you withdraw your health data consent, we cannot assess you, and we delete your health data.

To ask, email dpo@forge.life or tell your coach. We check that the request comes from you, and we reply within one month.

Your right to object

You can object to the log of who opened your record. We keep the log while we hold your health data, because it protects that data. We then tell you our reason.

If you are not happy with how we use your data, tell us first. You can also complain to the Information Commissioner's Office (ICO): ico.org.uk or 0303 123 1113.

Changes

If we change how we use your data, we publish a new version, and we ask you to read it again before your next visit.