Privacy policy.

Whole Technologies Group Ltd, trading as Whole, is a company registered in England and Wales (Company No. 17311922).

Whole Technologies Group Ltd is the data controller (under UK GDPR) for your personal data.

Information Officer: Joël Samuel Kapepula, reachable at privacy@joinwhole.app.

If you have any questions about this policy or how we handle your data, contact us at privacy@joinwhole.app.

We collect information you provide directly, such as when you create an account, sign up to our waitlist, or contact us. This includes your name, email address, and any preferences you share with us.

When you use the Whole app, we collect data you log (including movement, nutrition, sleep, mood, and soul check-ins) to provide you with personalised insights and recommendations. Much of this data constitutes special category data (health data) under UK GDPR Article 9, which we process on the basis of your explicit consent (see Section 3).

We may also collect usage data such as app interactions and feature usage to improve our product.

Under the UK General Data Protection Regulation (UK GDPR), we rely on the following legal bases to process your personal data:

• Consent: for processing special category data (health data) such as mood, nutrition, sleep, and soul check-ins. You provide this consent when you create your account and begin logging data. You may withdraw consent at any time by deleting your account or contacting us
• Contract: to provide the Whole service to you, manage your subscription, and deliver the features you have signed up for
• Legitimate interests: for product improvement, security, fraud prevention, and analytics, where these interests are not overridden by your rights
• Legal obligation: where we are required to retain or disclose data by law

We use your information to:

• Provide, operate, and improve the Whole app and services
• Personalise your experience and generate your wellness insights
• Send you product updates, newsletters (if you opt in), and service communications
• Respond to your enquiries and support requests
• Comply with our legal obligations

We do not sell your personal data to third parties.

Your data is stored securely using industry-standard encryption in transit and at rest. We use reputable cloud infrastructure providers and apply appropriate technical and organisational measures to protect your personal information.

Access to personal data is limited to those who need it to operate and improve our services.

The Whole app handles special category data under UK GDPR Article 9, including nutrition logs, sleep records, mood check-ins, movement data, and soul practices.

We process this data solely on the basis of your explicit consent, which you provide when you create your account and begin logging. You may withdraw this consent at any time by deleting your data or your account.

We use this data solely to power your personal insights and experience within the app. We do not share individual health data with third parties, advertisers, or insurers.

We are a UK-registered company. Your data may be stored or processed in the United Kingdom and other jurisdictions. Where your data is transferred outside the United Kingdom, we ensure appropriate safeguards are in place in accordance with UK GDPR requirements, including the use of standard contractual clauses or equivalent transfer mechanisms approved by the Information Commissioner’s Office (ICO).

We use essential cookies to operate our website and app. We may use analytics cookies to understand how visitors use our site. You can opt out of these at any time via our cookie preferences.

We do not use advertising cookies or share cookie data with third-party advertisers.

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request erasure of your data
• Restrict processing of your data
• Object to the processing of your data
• Data portability: receive your data in a machine-readable format
• Withdraw consent at any time

To exercise any of these rights, contact us at privacy@joinwhole.app.

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO): https://ico.org.uk | 0303 123 1113

We retain your personal data for as long as your account is active or as needed to provide you with our services. If you delete your account, we will delete your personal data within 30 days, unless retention is required by law.

Whole uses artificial intelligence to generate personalised wellness insights, daily briefings, weekly focus recommendations, and coaching suggestions. To provide these features, certain personal data is transmitted to third-party AI providers for processing.

The data shared with AI providers may include: - Wellness logs (mood, energy, and stress check-ins) - Meal and nutrition data - Sleep records and patterns - Movement and exercise entries - Soul and mindfulness check-ins

The third-party AI providers we use are: - Anthropic (Claude): used for personalised insights, daily briefings, weekly plans, and coaching draft generation - OpenAI (GPT): used for meal analysis, blueprint generation, and supplementary insight processing

Your data is sent to these providers solely to generate your personal results. It is not used to train their AI models, and it is not sold or shared with any other third party. Both Anthropic and OpenAI process data under strict data-processing agreements that prohibit model training on customer inputs.

You are asked for explicit consent before any AI feature processes your data. You may withdraw this consent at any time via Settings > Privacy in the app, which will disable AI-powered features. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

For more information on how these providers handle data, see: - Anthropic: https://www.anthropic.com/privacy - OpenAI: https://openai.com/privacy

Whole may integrate with third-party services such as fitness trackers or wearable devices (e.g. Apple Health, Strava). When you connect these integrations, you authorise us to access and use the data from those services in accordance with this policy.

Each third-party service has its own privacy policy, which we encourage you to review.

Whole is not directed at children under 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will take steps to delete it.

We may update this Privacy Policy from time to time. We will notify you of any significant changes by email or through the app. Your continued use of Whole after changes are posted constitutes your acceptance of the updated policy.

If you have questions about this Privacy Policy or how we handle your data, please contact us at:

Data Protection Contact: Joël Samuel Kapepula Email: privacy@joinwhole.app Entity: Whole Technologies Group Ltd (Company No. 17311922)

If you have concerns about how your data is being handled, you may contact the ICO at https://ico.org.uk.