1Who we are
EDGE Performance Club Ltd ("EDGE", "we", "us", or "our") operates the EDGE Performance mobile application and associated services. We are the data controller responsible for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Contact: hello@edgeperformanceclub.com · EDGE Performance Club Ltd, registered in England & Wales
We are registered with the UK Information Commissioner's Office (ICO) as a data controller. If you would like to confirm our ICO registration number, please contact us at the address above.
2Data we collect
Account & identity data
When you register, we collect your email address, first name, last name, phone number, and a hashed password. You may optionally upload a profile photo.
Athletic & health data
With your explicit consent we sync performance metrics from:
- WHOOP – recovery scores, HRV, resting heart rate, respiratory rate, sleep stages and duration, strain and workout data.
- Apple Health / Apple Watch – heart rate, active energy, step count, sleep analysis, workout sessions, and related HealthKit metrics you choose to share.
We also collect data you enter directly: wellness questionnaires (daily readiness, mood, fatigue, soreness), RPE scores, and training notes.
Performance & video data
If you use our match analysis features, we process football match metadata and, where applicable, video files you upload for computer-vision analysis. Tracking position data (from ReSpo Vision) is synced with your consent.
Nutrition data
If you use the meal logger, photos you take are transmitted to the LogMeal API for nutritional analysis. EDGE does not retain your meal photos — only the resulting nutritional breakdown (calories, macronutrients) is stored in your account.
Usage & analytics data
We collect standard analytics data via Firebase Analytics (app screens visited, feature usage, crash reports) to improve the service. This data is aggregated and does not identify you individually.
Device & technical data
We collect device type, operating system, app version, IP address (for authentication and rate-limiting), and push notification tokens.
3How we use your data
| Purpose | Data used |
|---|---|
| Providing and personalising the app | Account data, athletic metrics, wellness entries |
| AI coaching insights | WHOOP data, Apple Health data, wellness & RPE entries (processed by Google Gemini) |
| Match & video analysis | Video uploads, ReSpo tracking data, match metadata |
| Transactional emails | Email address (via Resend) |
| Push notifications | Notification token, user preferences |
| Security & fraud prevention | IP address, device data, authentication logs |
| Service improvement & analytics | Aggregated usage data |
| Legal compliance | Any data required by applicable law |
4Legal basis for processing
Contract performance (Article 6(1)(b))
Processing your account data and syncing connected wearables is necessary to deliver the service you signed up for.
Explicit consent (Articles 6(1)(a) & 9(2)(a))
Health and biometric data (WHOOP, Apple Health) is special-category data under UK GDPR. We process it only after you give explicit, informed consent during onboarding. You may withdraw consent at any time by disconnecting the integration in Settings.
Legitimate interests (Article 6(1)(f))
We process limited usage analytics and security logs to keep the service secure and to improve features. We have balanced these interests against your rights and believe they do not override them.
Legal obligation (Article 6(1)(c))
We may retain certain records where required by law (e.g. financial records, fraud prevention).
5Profiling & automated processing
To deliver personalised coaching insights, we process your health, biometric, and wellness data to generate an individual performance profile using Google Gemini AI. This profiling is intended solely to provide you with relevant recommendations within the app.
This profiling does not produce solely automated decisions with legal or similarly significant effects (Article 22 UK GDPR). All AI-generated insights are informational and require human review before being acted upon. You can opt out of AI coaching at any time by disabling the feature in Settings.
6Third-party services
We use the following sub-processors and third-party services. Each is subject to a data processing agreement or equivalent safeguard:
| Service | Purpose | Privacy policy |
|---|---|---|
| Google Firebase | Authentication, push notifications, and analytics | policies.google.com |
| Google Gemini AI | AI coaching insight generation | policies.google.com |
| Sentry | Crash reporting and error monitoring | sentry.io/privacy |
| WHOOP | Recovery & biometric data sync (with your consent) | whoop.com/privacy |
| Apple HealthKit | Health & activity data sync – iOS only (with your consent) | apple.com/legal/privacy |
| ReSpo Vision | Match position tracking data (with your consent) | respovision.com |
| football-data.org | Premier League & Championship fixture and squad data | football-data.org |
| LogMeal | Meal photo nutritional analysis (photo not stored by EDGE) | logmeal.com/privacy |
| Resend | Transactional email delivery | resend.com/privacy |
| Neon (PostgreSQL) | Database hosting – AES-256 encryption at rest | neon.tech/privacy |
We do not sell, rent, or trade your personal data to any third party for marketing purposes.
7Data retention
We retain your personal data for as long as your account is active or as needed to provide the service.
- Account & profile data – retained until you delete your account, then purged within 30 days.
- Health & biometric data – deleted within 30 days of revoking consent or deleting your account.
- Video uploads – retained for 90 days after upload unless you delete them sooner.
- Analytics logs – aggregated and anonymised after 12 months.
- Security logs – retained for 90 days.
You can request immediate deletion of all personal data by emailing hello@edgeperformanceclub.com or using the "Delete Account" option in the app (Settings › Account).
8Your rights (UK GDPR)
Under UK GDPR you have the following rights, which you can exercise free of charge:
- Access – request a copy of the personal data we hold about you.
- Rectification – ask us to correct inaccurate or incomplete data.
- Erasure – ask us to delete your data ("right to be forgotten").
- Restriction – ask us to pause processing of your data in certain circumstances.
- Data portability – receive your data in a structured, machine-readable format.
- Object – object to processing based on legitimate interests.
- Withdraw consent – withdraw consent for health data processing at any time.
- Automated decision-making – we do not make solely automated decisions with legal or similarly significant effects.
To exercise any right, email hello@edgeperformanceclub.com. We will respond within 30 days.
9Security
We implement industry-standard security measures including:
- TLS 1.2+ encryption for all data in transit.
- AES-256 encryption for data at rest, provided by our database host Neon.
- Bcrypt password hashing (we never store passwords in plaintext).
- JWT-based authentication with short-lived tokens.
- Rate limiting and brute-force protection on all authentication endpoints.
- Cryptographic verification of Apple and Google Sign-In identity tokens.
No method of transmission over the internet is 100% secure. If you believe your account has been compromised, contact us immediately at hello@edgeperformanceclub.com.
10Data breach notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:
- Notify the UK Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, where required by UK GDPR Article 33.
- Notify you without undue delay where the breach is likely to result in a high risk to your rights and freedoms (UK GDPR Article 34).
If you discover or suspect a security vulnerability, please report it responsibly to hello@edgeperformanceclub.com.
11Children & young people
The EDGE Performance app is not intended for children under the age of 13. The EDGE Academy product is designed for youth athletes (aged 13–17) and requires a parent or legal guardian to create the account and provide explicit consent before any personal data is collected.
As a service likely to be accessed by users under 18, we are committed to compliance with the UK Children's Code (Age Appropriate Design Code):
- We do not use nudge techniques to encourage young users to provide unnecessary personal data.
- We apply the highest available privacy settings by default for accounts suspected as belonging to a user under 18.
- We do not use children's data for profiling-based advertising.
- Parental consent is required before processing the personal data of any user under 13.
12International transfers
Some of our third-party providers (e.g. Google) process data outside the UK. Where this occurs, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA) or equivalent adequacy decisions, consistent with UK GDPR Article 46.
13Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email or an in-app notification at least 14 days before the change takes effect. The "Last updated" date at the top of this page will always reflect the most recent revision. Continued use of the app after changes take effect constitutes acceptance of the updated policy.
14Contact & complaints
For any privacy enquiries, data requests, or to withdraw consent:
If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.