Privacy
Your health data deserves grown-up handling.
Shift collects only the information needed to run the service you choose to use. Optional health tracking is separately controlled, exportable and erasable.
Who controls your data
Shift Some Timber Ltd is the controller for the personal information collected through this website and My Shift unless a separate service clearly names another controller. Contact: [email protected].
What we collect
- Account and contact: name, email, optional phone number, account/session information and communication preferences.
- Optional health tracking: information you choose to record in My Shift, including weight, waist, blood pressure, resting heart rate, steps, sleep, mood/wellbeing notes, Health MOT/check-in answers, progress photos and related progress history.
- Product use: saved plans, Grub/Fit preferences, feedback, hydration logs and similar member choices.
- Technical and privacy records: security, consent, audit and necessary service logs. Optional analytics are controlled by your cookie choice.
Why we use it
We use account information to provide account access and support. We use optional health information only to provide the tracking, progress, personalisation or decision-support feature you asked to use. Shift does not use My Shift data to make an automated clinical or prescribing decision.
Health information and explicit consent
Health information can be special-category personal data. For optional My Shift health tracking, Shift uses a consent-led model: consent for the processing and explicit consent for the health-data element. Health tracking is optional and separate from basic account access. You can withdraw that consent in My Shift Settings; withdrawal stops new optional health-tracking entries under that consent-led flow.
Who we share data with
We use service providers where necessary to host, secure and operate Shift. They are limited to the role needed to provide the service and are subject to appropriate contractual and security controls. Shift does not sell personal information. A regulated healthcare provider or pharmacy is not treated as part of Shift merely because we link to or work with it; if a separate regulated service needs personal information, its controller role and privacy information must be made clear before that data is shared.
Retention
| Information | Working retention rule |
|---|---|
| Account/profile | While the account is active, then deleted or retained only where a legal/security need applies. |
| Optional health tracking and progress history | While you keep it, until you erase that history, or until the account is deleted, subject to limited legal/security records. |
| Progress photos | Until you delete the photo/history or close the account. |
| Consent and privacy audit records | Retained as an accountability record after withdrawal/deletion where necessary to demonstrate the choice that was made. |
| Contact/support messages | Only for as long as needed to deal with the enquiry and reasonable follow-up/legal record needs. |
Your controls
- Export account data through the member controls.
- Erase optional health-tracking history without deleting the whole account.
- Delete the account separately.
- Withdraw optional health-tracking consent.
- Ask for access, correction, restriction, objection or other applicable data rights by contacting us.
Security and data minimisation
Shift uses account-scoped access, secure session controls, input limits, audit/security logging and privacy filtering around analytics. We design health-data features to collect what the feature needs rather than everything it could possibly ask. No online system can honestly promise zero risk.
DPIA and governance
Shift maintains a Data Protection Impact Assessment for the current optional non-clinical My Shift health-tracking scope, together with a data map, retention schedule and governance controls. New uses of health data, new processors or any regulated clinical pathway must be assessed before the processing changes.
Clinical boundary
Shift Some Timber does not diagnose, prescribe or supply medication. This privacy policy covers Shift's information, member and decision-support services. A separate regulated provider must explain its own clinical-data processing where applicable.
Complaints
Start with us at [email protected]. You also have the right to raise a data-protection concern with the UK Information Commissioner's Office.