Privacy Policy

Flow State Concierge Ltd | Last updated: 14 October 2026

This policy explains what personal data we collect, why we collect it, how we use it, and what rights you have. It applies to anyone who visits our website, applies for membership, is a member of Flow State, or uses the Flow State member app.

If you have questions about how we handle your data, contact us at concierge@joinflowstate.club.

1. Who we are

Flow State Concierge Ltd is the data controller responsible for your personal data.

Contact details: Flow State Concierge Ltd Company number 17311331 Registered office: Suite RA01, 195–197 Wood Street, London E17 3NU Email: concierge@joinflowstate.club Website: joinflowstate.club

Our registration with the Information Commissioner's Office (ICO) as a data controller is in progress. We will publish our registration number here once it is issued.

2. What data we collect

We collect different types of personal data depending on your relationship with us.

When you visit our website: your IP address, browser type, pages visited, and how you found us (via cookies and analytics tools — see section 10).

When you apply for membership: your name, email address, phone number, date of birth, home address, occupation, employer, and any information you include in your application.

When you become a member: payment details (processed by Stripe — we do not store your full card number), direct debit mandate information, emergency contact details, and communication preferences.

When you use our services: health and medical information you provide to trainers or recovery providers (such as injuries, conditions, allergies, and medications), training programme details, session attendance records, facility access logs, and concierge request history.

When you use the member app: the phones you have signed in on (the name you gave the phone, its model, and whether it is an iPhone or an Android phone), a token that lets us send you notifications, the times you sign in, and a record of each change you make to your connections and consents. Your sign-in code is stored only in scrambled form, so we cannot read it. Face ID and fingerprint checks happen on your phone and are never sent to us.

When you connect a wearable or a health app: only if you switch a connection on, and only from the sources you choose. Section 3 sets out exactly what we read.

When you have a blood panel: the laboratory report and the marker values in it. Section 3 covers these too.

When you attend events: photographs or video taken at Flow State events (see section 8).

When you contact us: the content of your emails, messages, or calls with our concierge team.

3. Connected apps, wearables and lab results

This section applies only if you switch a connection on in the member app. Nothing in it happens by default, and each connection is a separate choice.

What we can connect to. WHOOP and Oura, through your account with them. Apple Health on an iPhone and Health Connect on an Android phone, which also carry what your other apps write there, such as a nutrition tracker, a smart scale or a watch. Lucis, or another laboratory, for blood panel results.

What we read. Only the following. Everything except your food log is one figure per day:

• Sleep: how long you slept, the time in each sleep stage, time in bed and sleep efficiency.
• Recovery signals: heart rate variability, resting heart rate, breathing rate, blood oxygen and skin temperature.
• Training: the strain or active energy for the day, and the length of your workouts.
• Body: weight, body fat percentage and VO2 max.
• Nutrition, which has its own switch in the app: what you logged in your own food app, where that app shares it through Apple Health or Health Connect. That is the name of each food or meal you logged, when you logged it, and its calories, protein, carbohydrate and fat. Where your food app shares only a total for the day, we read the total.
• Where your device produces one, its own daily recovery or readiness score.
• From a blood panel: the laboratory report, and each marker's value, unit and reference range exactly as the laboratory printed them.

What we never read. Your step count. Your location or workout routes. Minute-by-minute heart rate. Photographs of what you ate. Your contacts, messages or anything else on your phone. We only read: we never write to your wearable account, to Apple Health or to Health Connect.

Why. So the person who runs your membership can see how you are sleeping, recovering, training and eating, and adjust your week without asking you to report it. That is the only purpose.

Who sees it. You, in the app. At Flow State, only the named concierge responsible for your membership, and each time your health record is opened the system logs who opened it and when. Trainers, therapists, gyms and cover staff do not see this data. If it would help for a provider to see something, we ask you first, each time.

What we never do with it. We do not sell it. We do not use it for advertising or marketing, and nor does anyone else. We do not pass it to data brokers, insurers or employers. Data that reaches us through Oura's or WHOOP's own connection is never read by an AI tool. Your other health data is read by one only if you switch that on in the app, as section 3A explains. No AI makes a decision about you: a person reads what it prepares and decides. We do not use your data to diagnose, treat or predict any medical condition. Flow State is a wellbeing service, not a medical one.

Where it is kept. On our member database in London, encrypted. The keys that let us read your WHOOP or Oura account are held in an encrypted vault on our server and never on your phone. The app keeps no health data on your phone, and none of it is stored in iCloud.

Your permission, and how to stop. Each connection has its own consent in the app, and you give it by switching that connection on. You can switch it off at any time, in the app under Account, then Connections. When you do, we stop collecting at once, we cancel our access with the provider, and we delete what we collected from that source within 72 hours. You can also remove our access from inside the WHOOP or Oura app, or in your phone's health settings.

WHOOP, Oura, Apple and Google. These companies hold your data under their own privacy policies. Connecting them to Flow State does not send them anything about you from us. It lets us read from them. We handle what we read under their rules for health data as well as UK law. Apple's and Google's rules bar any use of Apple Health or Health Connect data for advertising or for sale, and so do we.

3A. How we use AI

We use AI tools made by Anthropic to help our team prepare work. The AI drafts and suggests. A person at Flow State reads everything it produces, changes what needs changing, and decides whether to use it. Nothing an AI writes reaches you unless a person sends it.

We use it for these jobs:

• Drafting replies to your messages. It reads the conversation, your preferences and your upcoming sessions.
• Drafting meal plans. It reads your food preferences, your request and, if you share it, your food log.
• Finding trainers, venues and events for the sports you tell us you like. It reads your sports, your home city, your trips and the days you are free. It never reads your health data for this.
• Filling in a session-note form from what your trainer sent us.

Your health data, only if you say so. There is a separate switch in the app, under Account, called "Let AI read my health data". It is off until you turn it on. With it on, the AI may read what your phone's health store holds (Apple Health or Health Connect, including anything your Oura or WHOOP app writes there) and lab reports you send us. We use that to suggest a recovery treatment, to plan your week, and to copy the values from a lab report so that we can check them against the report. A person checks every lab value before you see it. Data from Oura's or WHOOP's own connection is never read by AI, even with the switch on. You can turn the switch off at any time, and the AI stops reading your health data from that moment. Turning it off changes nothing else about your membership.

Anthropic's role. Anthropic processes this data only on our instructions, under a data processing agreement, as our processor. It does not use your data to train its models.

4. Why we collect it and the legal basis

Under UK GDPR, we need a lawful basis for processing your personal data. Here is what we rely on and why.

Contract. Most of the data we collect is necessary to deliver your membership. Without it, we cannot arrange gym access, book training sessions, coordinate recovery, or manage your account. This covers: your contact details, payment information, session bookings, concierge requests, and facility access.

Legitimate interest. We use your data for purposes where we have a genuine business reason and where your privacy rights are not overridden. This covers: improving our services based on usage patterns, sending you relevant updates about your membership, internal record-keeping, and fraud prevention. You can object to processing based on legitimate interest at any time (see section 9).

Consent. We rely on your explicit consent for: processing health and medical data (which is a special category under UK GDPR), including each wearable, health app or laboratory connection described in section 3, which you consent to one at a time in the app, letting AI read your health data (section 3A), which has its own switch, using your image in marketing materials, and sending marketing communications about new services or events beyond what relates directly to your existing membership. You can withdraw consent at any time without affecting the lawfulness of processing that happened before withdrawal.

Legal obligation. We may process your data where we are required to do so by law, for example to comply with tax, accounting, or regulatory obligations.

5. Who we share your data with

We share your personal data only where necessary to deliver your membership services or where required by law. We do not sell your data to anyone.

Partner gyms and facilities. We share your name and membership status with partner gyms and studios so they can grant you access. We may also share relevant health information with facility staff where necessary for your safety, but only with your consent.

Personal trainers and recovery providers. We share your name, contact details, and health information you have provided with your assigned trainers, physiotherapists, and massage therapists so they can deliver safe and appropriate sessions. These providers are independent contractors or third-party partners, not Flow State employees.

Payment processors. Your payment data is processed by Stripe, which acts as our payment processor. Stripe's own privacy policy applies to their handling of your payment information. We do not store your full card details on our systems.

Technology providers. We use a small number of companies to host and run our systems. Our member database is hosted in London by Supabase. Notifications reach your phone through Apple and Google, and they carry no personal content: they say only that something is waiting for you in the app. These providers act on our instructions under contract and cannot use your data for their own purposes. Data from your connected apps (section 3) is not shared with anyone else at all.

AI provider. Anthropic PBC processes the information described in section 3A for us, as our processor. It cannot use it for its own purposes, and it does not use it to train its models.

Professional advisers. We may share data with our accountants, lawyers, or insurers where necessary for business administration, legal claims, or insurance purposes.

Law enforcement and regulators. We will disclose your data if required to do so by law, regulation, or court order, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

We do not share your data with any other third parties for their own marketing purposes.

6. International transfers

Your data is primarily stored and processed in the United Kingdom.

If we arrange gym access or services for you while travelling abroad, we may need to share limited personal data (such as your name and membership status) with international facility providers. Where this involves a transfer of personal data outside the UK, we will ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement or transfers to countries with an adequacy decision from the UK Government.

Your member record, including anything from your connected apps, is stored in London. Connecting WHOOP or Oura does not transfer your Flow State data to them; it lets us read from the account you already hold with them.

Anthropic, our AI provider, processes the information described in section 3A in the United States. That transfer is covered by the safeguards in Anthropic's data processing agreement, such as the UK International Data Transfer Addendum.

Stripe, our payment processor, may process payment data in the United States and other countries. Stripe relies on standard contractual clauses and other approved transfer mechanisms for international transfers.

7. How long we keep your data

We keep your data only for as long as we need it. Here is our general approach:

Active members: We retain your data for the duration of your membership plus 6 years after termination (to cover the limitation period for contractual claims under English law).

Health and medical data: Retained for the duration of your membership plus 3 years, then securely deleted. If a health-related incident occurs during your membership, we may retain relevant records for up to 6 years from the date of the incident.

Data from connected apps and wearables: kept only while that connection is switched on and you are a member. Switch a connection off, ask us to delete it, or leave Flow State, and we delete what we collected from that source within 72 hours. Encrypted backups age out within 30 days. This is shorter than the general health data period above, and it takes priority.

Payment records: Retained for 6 years after the relevant transaction, as required for tax and accounting purposes.

Applicants who do not become members: Application data is deleted 12 months after the decision, unless you ask us to delete it sooner.

Website analytics: Anonymised analytics data is retained indefinitely. Data that identifies you personally is deleted after 26 months.

Marketing consent records: We keep records of when and how you gave or withdrew consent for as long as needed to demonstrate compliance.

8. Photography and marketing

We may photograph or film at Flow State events for use on our website, social media, and marketing materials.

If you do not want to appear in photographs or video, let us know at any time by emailing concierge@joinflowstate.club. We will make reasonable efforts to exclude you from future materials and will remove existing images featuring you within 30 days of your request where practicable.

We will never use your image in a way that implies endorsement of a specific product or service without your separate written consent.

9. Your rights

Under UK GDPR, you have the following rights over your personal data:

Access. You can ask for a copy of the personal data we hold about you.

Correction. You can ask us to correct inaccurate or incomplete data.

Deletion. You can ask us to delete your personal data. We will do so unless we have a legal reason to keep it (such as an ongoing contractual obligation or legal claim).

Restriction. You can ask us to restrict how we use your data in certain circumstances — for example, while we verify accuracy following a dispute.

Portability. You can ask us to provide your data in a structured, commonly used, machine-readable format, or to transfer it directly to another organisation where technically feasible.

Objection. You can object to processing based on legitimate interest. We will stop unless we can demonstrate compelling grounds that override your interests.

Withdraw consent. Where we rely on consent, you can withdraw it at any time. This does not affect anything we did with your data before you withdrew consent.

In the member app, the Account tab shows every connection and consent, lets you switch any of them off, and lets you ask for a full export of everything we hold or for your record to be deleted. To exercise any of these rights another way, email concierge@joinflowstate.club. We will respond within 30 days. If your request is complex or we receive a high volume of requests, we may extend this by up to 60 days and will let you know.

We will not charge a fee for most requests. If a request is clearly unfounded or excessive (for example, repeated identical requests), we may charge a reasonable fee or refuse the request, and we will explain why.

10. Cookies and website analytics

Our website uses cookies and similar technologies.

Strictly necessary cookies are required for the website to function. These cannot be disabled.

Analytics cookies help us understand how visitors use our site. We use Google Analytics with IP anonymisation enabled. You can opt out of analytics cookies through your browser settings or by using the Google Analytics opt-out browser add-on.

Marketing cookies are only placed with your consent and are used to measure the effectiveness of our advertising.

You can manage your cookie preferences at any time through the cookie settings on our website.

11. Data security

We take reasonable technical and organisational measures to protect your personal data from unauthorised access, loss, or misuse — including encryption of data in transit and at rest, a second sign-in factor for every member of our team, access rules enforced inside the database so that each person sees only what their role allows, and a log of every time a member's health record is opened. We keep health details out of WhatsApp: results and documents are only ever sent inside the app.

No system is completely secure. If we become aware of a data breach that poses a risk to your rights, we will notify the ICO within 72 hours. If the breach poses a high risk to you personally, we will contact you directly.

12. Children

Our services are not directed at anyone under 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from someone under 18, we will delete it promptly.

13. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you by email or through our website. The "last updated" date at the top of this page shows when the policy was last revised.

14. Complaints

If you are unhappy with how we have handled your data, please contact us first at concierge@joinflowstate.club. We will do our best to resolve the issue.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office:

Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Website: ico.org.uk Helpline: 0303 123 1113

Flow State Concierge Ltd Registered in England and Wales Company number 17311331 Website: joinflowstate.club Contact: concierge@joinflowstate.club