Security
Built to protect your health data
Your workouts, weight, photos and notes are personal, so we treat protecting them as the first job, not an afterthought. Here's exactly how Unavoidable Health is built and secured, in plain English.
- Where your data lives
- On our server in the United Kingdom, under UK GDPR
- On the way to you
- Encrypted with HTTPS on every page and request
- Most sensitive data
- Encrypted on our server with AES-256
- Passwords
- Stored only as a one-way hash. Nobody can read them, including us
- Sign-in
- Optional two-step sign-in with an authenticator app
- Selling or ads
- Never. No ads, no trackers, no analytics
Your account
Keeping your account yours
The protections around signing in, so only you get into your account.
Two-step sign-in
Add a code from an authenticator app on top of your password, with one-time backup codes in case you lose your phone.
Guessing is blocked
Repeated wrong passwords or codes are slowed down and then blocked, per account and per connection.
Alerts on every important change
We email you when your password, email or two-step settings change, or when someone keeps getting your code wrong.
See and sign out your devices
A list of every device signed in to your account, with one tap to sign any of them out, or all of them at once.
Safe recovery
Password reset links work once and expire after an hour. A new email address only takes over once you have confirmed it, and needs your two-step code too.
Strong sessions
Each sign-in uses a long random key, stored on our side only in scrambled form, in a cookie that scripts on the page cannot read.
Your data
Private by design
What you log stays yours, and you decide who sees what.
Encrypted where it matters most
Progress photos, your private diary and mood notes, your supplements and medicine list, two-step keys and connected-app keys are encrypted on our server, so a copy of the database alone cannot be read.
Only who you invite
Nothing is visible to anyone until you add them as a friend or join a group. You choose exactly what friends see, and anyone who is not your friend only ever sees your nickname.
Progress photos are yours alone
They are never shown to friends or anyone else. Location and camera details are removed before they are stored.
Never sold
We will never sell your data or share it with advertisers or data brokers. There are no third-party trackers in the app.
Download it or delete it
Download everything we hold about you at any time, or delete your account and all of your data, including photos, in the app.
Kept no longer than needed
Security logs of connection addresses are deleted after 24 hours, and old sign-in codes and links are cleared automatically.
How it is built
Engineered properly
The app is built against the most common ways websites get attacked, with several layers of protection rather than one.
Protected against the top web risks
Designed against the OWASP Top 10, the industry list of the most common web security risks: injection, broken access control, cross-site scripting, cross-site request forgery and more.
Every request is checked
The server checks that you are allowed to see or change each record on every single request. Nothing relies on the app hiding a button.
Locked-down browser settings
A strict content security policy, forced HTTPS, protection against being framed by other sites, and other security headers on every page.
Secrets kept separate
Passwords, keys and settings are kept outside the website and out of our code repository, and every code and link is made with secure random numbers.
Tested before every release
Every change goes through version control and an automated set of security checks before it goes live, and can be rolled back in seconds.
Watched around the clock
Uptime and background jobs are monitored all day, every day, with alerts if anything stops working. Our emails are signed (SPF, DKIM and DMARC) so nobody can easily fake them.
Security audit
Checked, not just claimed
In October 2026 we ran a full security audit of the app's code using Cloudflare's open-source security-audit method. Nine separate automated reviewers each hunted for one kind of attack, from sign-in tricks to data leaking between accounts. Every suspected problem was then handed to a fresh reviewer whose only job was to prove it wrong, so only real issues counted.
- No critical or high-severity issues were found. Nobody could see another person's data, take over an account or get into the admin area.
- Every confirmed medium and low issue was fixed and now has an automated test, so it can't quietly come back.
- The fixes were reviewed separately before they went live, and we re-check security every time the app changes.
No system can ever promise to be perfect, which is why we keep testing, keep improving and want to hear from you if you spot anything.
Standards we work to
- UK GDPR and the Data Protection Act 2018: health details are treated as special category data, stored with your consent, and you can withdraw it at any time. See our privacy policy.
- OWASP Top 10: the app is built and tested against the most common web application security risks.
- Responsible disclosure: we publish a security.txt so researchers know how to reach us.
Found a security problem?
Please email support@unavoidable.health with "Security" in the subject, and include what you found and how to see it. We read every report, will keep you updated and will credit you if you'd like. Please don't access or change other people's data, and give us a fair chance to fix the problem before telling anyone else.
Start together.
Join the free beta, share your friend code with a mate, and tell us what you think.