Privacy Notice

About this document

Version: 1.0

1. Who controls your information

SOLTYX ENGINEERING STUDIO LTD, a private company limited by shares registered in England and Wales under company number 17200770, with its registered office at 66 Paul Street, London, England, United Kingdom, EC2A 4NA, is the controller responsible for personal information handled through the Repnect mobile application, website and support services ("SOLTYX", "we", "us" or "our"). Repnect is a SOLTYX product and is not a separate legal entity.

Privacy contact: privacy@repnect.com Data protection officer, if appointed or required: No data protection officer is currently appointed. Privacy matters are handled through privacy@repnect.com. SOLTYX must revisit its written DPO assessment before processing becomes large-scale. EU GDPR representative: Not yet appointed. Repnect must not be intentionally offered in the EU/EEA until SOLTYX has signed an Article 27 mandate and published the representative's name and EU contact details.

2. Scope and important health notice

This Notice describes how SOLTYX collects, uses, shares, stores and protects personal information through Repnect and the choices and rights available to you.

Repnect provides general fitness, wellbeing, social, coaching and accountability tools. It is not a medical provider. Some information processed through Repnect may nevertheless reveal information about physical or mental health and may receive special legal protection.

3. Information we collect

Account and identity information

Name, display name, email address, authentication provider, user identifier, age or date of birth, age-assurance result, account status and records of Terms and consent choices.

If you use Sign in with Apple and Hide My Email, we receive an Apple-generated relay address ending in @privaterelay.appleid.com or @private.icloud.com rather than your personal Apple ID email. Apple manages forwarding from that address. Disabling forwarding may prevent Repnect account or security emails from reaching you.

Profile and discovery information

Profile photographs, biography, general area, fitness interests, goals, experience, availability, coaching preferences, coach specialties, client levels and information you choose to make visible.

Fitness, wellbeing and health-related information

Workouts, steps, training minutes, weight, body-fat percentage, sleep, energy, recovery, goals, progress photographs, check-ins, notes and similar entries. If you connect HealthKit, Health Connect or another supported source, we receive only the authorised and technically supported categories.

Location information

With device permission, we may receive precise device coordinates through Repnect to calculate distance and order nearby profiles. Raw coordinates are not intended to be displayed to other users. We may derive a distance or general area for discovery and safety purposes.

Social and coaching information

Connections, requests, blocks, coach-client relationships, selected progress shared with a coach, check-in responses, reviews, messages and related timestamps and delivery information.

User content

Photographs, profile text, progress images, messages, reports, attachments and other material you submit.

Subscription and transaction information

Product, entitlement, store, transaction or receipt identifier, subscription state, trial eligibility, renewal or expiry state and refund or revocation information. Apple or Google handles payment-card information; SOLTYX does not receive full card details through Repnect.

Device, usage and technical information

Device and operating-system type, app version, language, notification token, IP address, timestamps, security and authentication events, crash and diagnostic information, feature interactions and basic service logs.

Support, safety and legal information

Support communications, privacy requests, reports, blocks, moderation decisions, appeals, evidence submitted, and records needed to respond to suspected fraud, abuse, emergencies or legal requests.

What you must and may choose to provide

Account credentials, confirmation that you are at least 18, and the information marked as required during registration are needed to create and secure an account. If you do not provide them, we cannot create or maintain the account.

Profile details beyond required fields, connected health data, precise location, progress photographs, coach sharing and marketing permissions are optional. Refusing or withdrawing an optional permission does not prevent use of unrelated features, but the feature that needs that information may be unavailable or less useful. A particular paid or safety feature may require information clearly identified at the point of use.

4. Where information comes from

We receive information:

• directly from you;
• from device services and permissions;
• from HealthKit, Health Connect or another source you connect;
• from Apple, Google, RevenueCat or another subscription provider;
• from other users when they interact with or report an account;
• from authentication, hosting, security and support providers; and
• where lawful, from authorities or publicly available sources needed to investigate a safety or legal issue.

5. Why we use information and our legal bases

Provide the Service — contract

We use account, profile, content, connections, messages, progress, subscription and technical information to create and operate your account, provide requested features, authenticate you, deliver paid access and respond to support.

Optional health and connected-source features — consent and explicit consent

Where required, we rely on your consent and explicit consent to collect and use health-related information from connected platforms, manual entries and optional coach-sharing controls. You can withdraw future consent in the app or device settings. Withdrawal does not make earlier lawful processing unlawful, but some features may stop working.

Nearby discovery — consent and contract

We use location with device permission to calculate proximity and provide nearby discovery. You can disable location permission. Where exact location is not required, we seek to minimise or coarsen it.

Safety, moderation, fraud prevention and security — legitimate interests and legal obligations

We use reports, messages relevant to a report, account data and technical records to protect people, prevent fraud, secure the Service, enforce rules and establish or defend legal claims. Our interests are operating a safe, authentic and reliable adult service. We consider user rights and limit access to what is reasonably necessary.

Service communications — contract or legitimate interests

We send account, authentication, security, subscription, moderation and important service messages. These are not optional marketing where necessary to provide or protect the Service.

Marketing — consent or another lawful permission

We send promotional email, SMS or push notifications only where we have the required permission. You can opt out without losing core service messages.

Legal compliance — legal obligation

We process information to comply with consumer, privacy, online-safety, tax, accounting, law-enforcement and court obligations.

Improvement and analytics — legitimate interests or consent

We use appropriately minimised usage, reliability and diagnostic information to fix errors and improve features. Where an analytics or tracking technology requires consent, we request it before use.

6. Health-information safeguards

We do not use connected health information for targeted advertising, sell it to data brokers, or use it to make insurance, credit, employment or similar eligibility decisions.

A coach receives only information made available through the relevant relationship and sharing controls. Coach access must not be assumed from a pending request or connection alone. Revoking sharing stops future in-service access, subject to information already seen or lawfully retained.

Apple Health data is handled subject to Apple's health-data restrictions. Health Connect data is handled subject to Google Play and Health Connect requirements.

7. Who can see or receive information

Other users

Other users can see information you place on a visible profile. Connected users can use messaging and connection features. Do not place private health, address or financial information in public profile fields.

Coaches and clients

Coaches and clients can see relationship information and only the progress, check-in or other categories made available through the Service. They act independently when using information for their own coaching relationship and must comply with applicable duties.

Service providers

We use providers for cloud database and hosting, authentication, media storage, push notifications, subscriptions and entitlements, app-store payments, security, diagnostics, email and support. Current material provider categories include Supabase, Google Firebase, Apple, Google, RevenueCat and Cloudflare. Cloudflare Turnstile may process browser, device, network and interaction signals, including IP-address-related information, on public request forms to distinguish people from automated abuse. We use it as a strictly necessary security measure and not for advertising. A current subprocessor list will be available at https://repnect.com/subprocessors.

Authorities, advisers and corporate transactions

We may disclose information where legally required; where reasonably necessary to protect a person, investigate serious abuse or fraud, or establish a legal claim; to professional advisers under confidentiality; or as part of a genuine merger, financing, acquisition or reorganisation with appropriate safeguards.

We do not sell personal information.

8. International processing

SOLTYX operates Repnect from the United Kingdom. Providers may process information in the United Kingdom, the European Economic Area, the United States and other countries in which our documented providers operate.

For transfers protected by UK or EU data-protection law, we use an adequacy decision where available or contractual and supplementary safeguards such as the applicable standard contractual clauses, UK International Data Transfer Agreement or UK addendum. You may request information about the relevant safeguard by contacting privacy@repnect.com.

For Australian information disclosed overseas, we take reasonable steps required by Australian Privacy Principle 8 and may remain accountable for an overseas recipient's handling.

9. How long we keep information

We apply the following working retention rules, subject to final technical and legal validation:

• Account and profile information: while the account is active, then deletion or de-identification following a verified deletion request.
• Exact location: only for the minimum operational period required to update nearby discovery; live precise coordinates should be replaced when refreshed and deleted or de-identified within 24 hours after location is disabled, except short-lived security logs.
• Imported health and progress entries: until deleted by the user or account deletion, unless a shorter control is offered.
• Messages: while accounts and conversations remain active; messages are removed or de-identified from the deleted user's account within 30 days; a copy visible in another user's conversation may remain until that user deletes the conversation, subject to safety and legal holds.
• Subscription and transaction records: for the period required for entitlement, accounting, fraud and legal obligations.
• Reports, moderation and appeals: for normally three years after case closure, extended only where severity, repeat-abuse prevention or a legal hold justifies it, taking account of severity, repeat abuse and legal claims.
• Security and diagnostic logs: for normally 12 months, with shorter periods for high-volume diagnostics and longer retention only for an investigated security incident or legal hold.
• Support and privacy requests: for normally two years after the request closes; privacy-rights completion records and contractual acceptance records may be retained for six years where needed to demonstrate compliance or handle claims.
• Backups: removed or overwritten within 90 days, unless isolated for a legal or security reason.

We restrict retained information to the relevant purpose. Where deletion is not possible or required immediately, we de-identify or isolate information where appropriate.

10. Security

We use technical and organisational measures appropriate to the sensitivity and risk of the information, including encrypted transmission, access controls, role separation, authentication controls, logging, provider oversight, backup controls and incident response.

No service can guarantee absolute security. Protect your device and account and do not share passwords or one-time codes.

11. Automated processing and recommendations

We may automatically order or recommend profiles, coaches, connections or features through Repnect using factors such as location, stated preferences, availability, relationship state and activity. These suggestions support discovery and do not make medical, legal, employment, credit or similarly significant decisions about you.

If we introduce automated processing that produces a legal or similarly significant effect, we will provide required information and safeguards before or when it applies. From 10 December 2026, the Australian section of this Notice will also describe applicable automated decisions that significantly affect rights or interests.

12. Your choices

You can:

• edit profile information;
• control profile visibility and connections;
• block users;
• adjust location, photo, camera, notification and health permissions;
• control coach sharing;
• opt out of marketing;
• cancel a subscription through Apple or Google; and
• delete your account through the app or public deletion page.

Changing a device permission stops future access through that permission but does not automatically delete information already imported. Use the in-app deletion controls or contact us for deletion.

13. Your UK and EU/EEA rights

Subject to conditions and exceptions, you may request:

• access to personal information;
• correction;
• deletion;
• restriction of processing;
• portability of information you provided;
• objection to processing based on legitimate interests or direct marketing; and
• withdrawal of consent.

You may complain to the UK Information Commissioner's Office or the data-protection authority in your EU/EEA country. Contact us first if you would like us to investigate.

We normally respond within one month, subject to lawful extensions. We may verify identity and clarify a request.

14. Your Australian rights

You may request access to and correction of personal information and complain about our handling under the Australian Privacy Principles. We will acknowledge and investigate complaints and respond within a reasonable period.

If unresolved, you may complain to the Office of the Australian Information Commissioner. Information about overseas recipients and complaint handling appears in sections 7, 8 and 17.

15. Account deletion

Use Settings → Delete Account in the app or the public Account Deletion page. The normal in-app flow makes the account inactive immediately and schedules permanent deletion after a 28-day recovery period. Signing in during that period does not by itself cancel deletion; you must expressly select Restore my account. You can also choose immediate permanent deletion. A verified deletion request removes the account and associated information from active systems, subject to limited retention disclosed in section 9.

Deletion is not merely deactivation. It is irreversible after completion. Account deletion does not cancel a subscription managed by Apple or Google.

16. Children and age assurance

Repnect is for people aged 18 or over. We process age or an age-assurance result to enforce this rule and meet safety obligations. We minimise age-assurance information and do not retain identity documents where a provider can return only an age result.

If we learn that an under-18 person created an account, we may restrict it, investigate and delete associated information, while retaining limited safety evidence where lawful and necessary. Report an underage account through the Safety page or safety@repnect.com.

17. Privacy complaints

Submit a complaint using https://repnect.com/privacy-request or privacy@repnect.com. Include the account, issue and outcome requested. Do not send passwords, one-time codes or unnecessary health information.

For UK complaints, we acknowledge the complaint within 30 days and respond without undue delay. For Australia, we explain how we will deal with the complaint and respond within a reasonable period. EU/EEA users may also contact the relevant supervisory authority.

18. Breaches and notifications

We investigate suspected personal-data breaches and notify regulators and affected individuals where required. Notification timing and content depend on applicable UK, EU/EEA and Australian law and the risk of harm.

19. Changes to this Notice

We may update this Notice to reflect product, provider or legal changes. We will show the effective date and provide appropriate notice of material changes. Where a new purpose requires consent, we will request it rather than relying only on an updated Notice.