Privacy policy
Last updated 24 October 2026
Unavoidable Health is part of the Unavoidable Health a Unavoidable Studio Ltd Company brand and is run by Unavoidable Health a Unavoidable Studio Ltd Company ("we", "us"), company number 17367981, registered in England and Wales, registered office 152 Osmondthorpe Lane, Leeds, England, LS9 9EG. We are the data controller for the personal data you put into Unavoidable Health. Contact us at support@unavoidable.health about anything in this policy.
Our promise to you
- Your data is stored on our server in the United Kingdom.
- We will never sell your data. We don't share it with advertisers or data brokers, we show no ads, and we use no tracking or analytics.
- Nobody sees anything unless you invite them. Only friends you add, groups you join or boards you choose to join can see your activity, and only the parts you choose.
- Your password is never stored. We keep only a one-way scrambled version (a hash), so not even we can read it.
- You're in control. Download everything we hold, or delete your account and all of it, any time from the app.
The only time we would give your data to anyone else is if UK law required it, such as a court order. If that ever happens we'll tell you, unless the law forbids it.
What we collect
- Account details: your first name, a nickname you choose, email address, password (stored only as a secure hash) and date of birth.
- Profile photo (optional): if you add one, we store a resized copy. We remove hidden details such as location and camera data before saving it.
- Health and fitness details you choose to enter: sex, height, weight and weigh-ins, goal weight, activity level, whether you are pregnant or breastfeeding, the food and drink you log, and your workouts.
- Social activity: your friends list, encouragement you send and receive, and challenges you create or join.
- Foods and products you add: names, brands, barcodes and nutrition values you save or type from a label. These are visible to you and your friends.
- Together boards (only if you join them): the display name you choose, your weekly effort points, workout count and target, medals and streaks, and the groups you create or join.
- Security settings: if you turn on two-step sign-in, an encrypted key for your authenticator app and scrambled (hashed) backup codes.
- Technical data: a sign-in cookie that keeps you logged in, and the IP address of requests, kept for up to 24 hours to stop abuse such as repeated failed sign-ins.
We do not use advertising or analytics trackers, and we do not sell your data.
Why we use it, and our lawful basis
| Use | Lawful basis (UK GDPR) |
|---|---|
| Running your account, saving what you log, showing your progress | Contract: it's the service you signed up for |
| Working out your calorie targets and 12-week plan from your health details | Your explicit consent (Article 9(2)(a)), which you give when you sign up or set up your plan |
| Showing friends what you have chosen to share | Your consent, controlled by your sharing settings |
| Showing you on the Together boards (friends, groups and everyone) | Your consent, given when you join the boards. Withdraw it any time by leaving the boards |
| Password reset emails and essential service messages | Contract |
| Preventing abuse and keeping the service secure | Legitimate interests |
You can withdraw consent at any time by deleting your plan details or your account. That doesn't affect anything we did before you withdrew it.
Who can see your data
- Nobody else by default. Only people you add as friends can see anything, and only what you choose under What friends can see: workouts, food log, and weight (nothing, progress percentage only, or full numbers). Food and weight start as hidden: friends only see them if you turn them on.
- Your nickname is how friends find you. Anyone who knows it can send you a friend request, which you accept or decline; they see nothing about you unless you accept. If you decline, they can't ask again for 30 days, and you can block anyone so they can't find, add or message you. Friend codes and invite links renew every 30 days. Friends see your first name and nickname, never your email.
- Your profile photo is only ever shown to you and, if you choose "Friends", to people you've accepted as friends. It never appears on the public boards, in groups to people you haven't added, or anywhere outside the app. You can make it private or delete it at any time, and it's deleted with your account.
- Together boards are opt-in. If you join them, other members on the boards see your display name, colour, weekly effort points, workout count and target, medals and streaks. They never see your weight, goal weight, BMI, food log, age, height or email. Leaving the boards removes you from every board and group straight away.
- If you join a challenge, your score for that challenge is shown to everyone taking part. Weight challenges show percentage change only, never your weight.
- Your data is stored on our server in the United Kingdom. Our hosting provider looks after the server on our behalf and can't use your data for anything else.
- The people who run Unavoidable Health only look at an account to help when you ask us to, or to keep the service safe. Admins can't see your food, weight or diary, and can't set your password: if you're locked out, we email you a reset link. Admin actions are logged. Feedback you send through the Beta menu is read by our team.
- When you scan a barcode or search for a product, the barcode or search words are sent from your phone to Open Food Facts to look up nutrition. Nothing that identifies you is sent with it.
- If a barcode or food isn't found there, our server may look it up with fatsecret or the US Department of Agriculture's FoodData Central. Only the barcode number or search words are sent, from our server, never your name, email or anything else about you.
- Emails (password resets and security alerts) are sent through our hosting provider's mail service.
- Apple Health and Android imports (optional): when you choose an export from Apple Health, Health Connect, Google Fit or Samsung Health, it's read on your phone. Only workouts (type, time, duration, distance, calories) and weigh-ins are sent to us. Heart rate, sleep and everything else stays on your phone. Before each import you choose whether friends can see the imported workouts or whether they stay just for you.
- Strava (optional): if you connect Strava, we receive your activities (type, name, time, duration, distance) and keep your Strava sign-in key encrypted. Strava workouts are only ever shown to you, never to friends, groups or boards. Disconnecting deletes them from Unavoidable Health. Strava's own privacy policy covers your Strava account.
How we protect it
- Everything travels over encrypted HTTPS, and browsers are told never to connect without it.
- Passwords are stored only as bcrypt hashes. Well-known passwords, and passwords containing your name or email, are refused.
- Repeated wrong passwords lock sign-in for that account and connection for 15 minutes.
- Two-step sign-in (You → Privacy and security): add a code from an authenticator app on your phone, with one-time backup codes, so a stolen password alone can't get into your account.
- Profile photos are stored outside the website and only ever sent to you and the friends you allow. Every photo is re-saved to remove hidden location data.
- Changing your password or email signs out every other device and emails you, so you'd know if it wasn't you. Changing your email needs your password.
- You can sign out of every device at once from You → Privacy and security.
- Your sign-in cookie can't be read by scripts and is only sent to the app itself.
How long we keep it
| Data | How long |
|---|---|
| Your account, workouts, food log, weigh-ins, plan, photo, friends and messages | Until you delete them or your account. Deleting your account removes all of it straight away |
| Health details only (body details, plan, weigh-ins, and your food diary if you choose) | Until you use Delete my health details, which removes them straight away and keeps the rest of your account |
| Sign-in sessions | Up to 120 days, or until you sign out |
| Password reset links and two-step sign-in checks | 1 hour and 5 minutes |
| Email confirmation links | 3 days |
| Friend requests and declined requests | 90 days and 30 days |
| Encouragement messages and high-fives | 1 year |
| Record of admin actions (which admin did what to which account) | 2 years |
| Security logs (IP addresses of sign-in attempts and rate limits) | 24 hours |
| Beta feedback you send | The message is kept to improve the app. Your email and device details are removed after 2 years, and all of it is deleted if you delete your account |
| Server backups | Roll off within 30 days |
Accounts that are unused for 3 years may be deleted after we email you.
Cookies and storage on your device
We use one cookie, which keeps you signed in. It is strictly necessary for the app to work, so we don't ask for consent for it. The app also saves some things on your phone (such as a workout in progress, your settings and an offline copy of the app) so it works without a signal. Your own food diary is kept on the phone for offline use and wiped when you sign out or delete your account; friends' diaries are never stored on your phone. We use no advertising, analytics or tracking cookies, and the website uses no third-party scripts or fonts.
Automated calculations
Your calorie and protein targets, plan and weekly check-in suggestions are worked out automatically from the details you enter. They're suggestions only, have no legal or similar effect on you, and you can change any target yourself at any time.
Where your data goes
Your personal data stays on our server in the United Kingdom. Barcodes and search words (not personal data) may be looked up with Open Food Facts in France and fatsecret or the USDA in other countries, as described above.
Your rights
Under UK GDPR you have the right to:
- Access your data: You → Privacy and security → Download everything we hold about me gives you all of it straight away.
- Portability: the same download is machine-readable (JSON), and your workouts, food log and weigh-ins are also available as spreadsheets (CSV).
- Correct it: edit your details, plan and entries in the app at any time.
- Delete it: delete single entries, your health details only, or your whole account, in the app.
- Withdraw consent for health data: Delete my health details, or stop sharing with friends or leave the boards.
- Restrict or object to how we use your data, and ask about anything here: email us and we'll reply within one month.
If you're unhappy with how we've handled your data, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
If something goes wrong
If there were ever a data breach that put your rights at risk, we would tell the ICO within 72 hours and tell you without delay, as the law requires.
Age
Unavoidable Health is for adults aged 18 and over. We don't knowingly hold data about anyone younger.
Health information
Unavoidable Health gives general estimates, not medical advice. If you are pregnant, have a medical condition, or have a history of disordered eating, please speak to your GP before changing how you eat or exercise.
Changes
If we change this policy in a way that matters, we'll tell you in the app before it takes effect.