Privacy
Your health data deserves grown-up handling.
Shift collects only the information needed to run the service you choose to use. Optional health tracking is separately controlled, exportable and erasable.
Who controls your data
Shift Some Timber Ltd is the controller for the personal information collected through this website and My Timber unless a separate service clearly names another controller. Contact: hello@shiftsometimber.co.uk.
What we collect
- Account and contact: name, email, optional phone number, account/session information and communication preferences.
- Optional health tracking: information you choose to record in My Timber, including weight, waist, blood pressure, resting heart rate, steps, sleep, mood/wellbeing notes, Health MOT/check-in answers, progress photos and related progress history.
- Product use: saved plans, Grub/Fit preferences, feedback, hydration logs and similar member choices.
- Technical and privacy records: security, consent, audit and necessary service logs. Optional analytics are controlled by your cookie choice.
Why we use it
We use account information to provide account access and support. We use optional health information only to provide the tracking, progress, personalisation or decision-support feature you asked to use. Shift does not use My Timber data to make an automated clinical or prescribing decision.
Health information and explicit consent
Health information can be special-category personal data. For optional My Timber health tracking, Shift uses a consent-led model: consent for the processing and explicit consent for the health-data element. Health tracking is optional and separate from basic account access. You can withdraw that consent in My Timber Settings; withdrawal stops new optional health-tracking entries under that consent-led flow. Withdrawal and erasure are different: use the health-history erasure control if you also want to remove the supported optional history. Necessary consent and privacy records remain separate.
Who we share data with
We use service providers where necessary to host, secure and operate Shift. They are limited to the role needed to provide the service and are subject to appropriate contractual and security controls. Shift does not sell personal information. A regulated healthcare provider or pharmacy is not treated as part of Shift merely because we link to or work with it; if a separate regulated service needs personal information, its controller role and privacy information must be made clear before that data is shared.
Coaching and help requests
The everyday My Timber coach stores the goals, routine details and feedback you confirm. Its fixed-action coaching does not send that saved coaching snapshot to a model. The separate Ask Timber question-and-answer service is a different feature. You can correct or erase coaching memory. Coaching audit and preparation history older than 90 days is pruned when the snapshot is next changed; this is not a nightly purge of inactive accounts. If you explicitly send a help request, its message enters the separate SHIFT support queue. Erasing coaching does not erase that support record.
Retention
| Information | Working retention rule |
|---|---|
| Account/profile | While the account is active, then deleted or retained only where a legal/security need applies. |
| Optional health tracking and progress history | While you keep it, until you erase that history, or until the account is deleted, subject to limited legal/security records. |
| Progress photos | Until you delete the photo/history or close the account. |
| Consent and privacy audit records | Retained as an accountability record after withdrawal/deletion where necessary to demonstrate the choice that was made. |
| Contact/support messages | Only for as long as needed to deal with the enquiry and reasonable follow-up/legal record needs. |
Your controls
- Export account data through the member controls.
- Erase optional health-tracking history without deleting the whole account.
- Request account deletion separately. Submitting the request signs you out of current sessions and sends it for review; it does not immediately erase every record. We will explain the outcome and any records that must be retained.
- Withdraw optional health-tracking consent.
- Ask for access, correction, restriction, objection or other applicable data rights by contacting us.
Security and data minimisation
Shift uses account-scoped access, secure session controls, input limits, audit/security logging and privacy filtering around analytics. We design health-data features to collect what the feature needs rather than everything it could possibly ask. No online system can honestly promise zero risk.
DPIA and governance
Shift maintains a Data Protection Impact Assessment for the current optional non-clinical My Timber health-tracking scope, together with a data map, retention schedule and governance controls. New uses of health data, new processors or any regulated clinical pathway must be assessed before the processing changes.
Clinical boundary
Shift Some Timber does not diagnose, prescribe or supply medication. This privacy policy covers Shift's information, member and decision-support services. A separate regulated provider must explain its own clinical-data processing where applicable.
Complaints
Start with us at hello@shiftsometimber.co.uk. You also have the right to raise a data-protection concern with the UK Information Commissioner's Office.