Privacy Policy — FY Project

Last updated: 13 November 2026

This policy explains what personal data FY Project collects through the app and our website, why we collect it, who can see it, how long we keep it, and the choices and rights you have. It applies to everyone who uses the app — clients, personal trainers ("PTs"), therapists and admins — and to people who contact us through our website.

1. Who we are

FY Project ("we", "us") is a training and mindset app founded by Julio Fernandez and Ursula Perez, bringing together personal training and therapeutic support in one place. We built FY Project because we believe the body and mind are worked on together, not separately — and because we wanted our own clients to have one simple, private space to track their training, their thinking, and their progress between sessions.

All our therapists are professionally trained in the UK, experienced, and registered with a recognised professional body (such as BACP, UKCP, or BPS). All our personal trainers are professionally trained and registered with a recognised professional body (such as NRPT). Every practitioner holds professional indemnity insurance.

FY Project is operated by Project FY Ltd (company number 13171626), registered office 167-169 Great Portland Street, 5th Floor, London W1W 5PF. For UK GDPR purposes we are the "data controller" for the personal data described in this policy. Contact: hello@fyproject.co.uk

2. The data we collect

Account and profile data:

• Name and email address
• Password (stored securely; we cannot see your actual password)
• Role (client, PT, therapist or admin) and, for clients, which PT and/or therapist you are assigned to

Body / training data:

• Training plans, exercises, sets, reps and weights assigned by your PT
• Your workout completion history and session timing
• Body measurements you choose to log (e.g. weight, chest, waist, hips, biceps, thigh)
• Food diary entries you choose to log (foods, amounts, calories, protein, carbs and fat), and any foods you add yourself
• If you scan a food barcode in the phone app, the camera is used only to read the barcode number. No photos or video are taken, saved or sent
• Calorie calculator details you choose to enter (age, sex, weight, height, activity level and goal) and the daily guide worked out from them or set by your PT
• Messages you send to or receive from your PT
• Your Body assessment, which new clients fill in in the app before Body opens (see section 13)
• Weekly check-ins you choose to send your PT: how hard training felt, how much you enjoyed it, your energy and sleep, what you struggled with and any notes

Mind / mental health data:

The following are "special category data" under UK GDPR because they relate to your mental and emotional health. We only collect them if you choose to use the Mind section of the app, and we ask for your explicit consent before you first use it.

• Mood diary entries — the mood you select, any feelings you choose, your energy level, and any optional notes you write
• Reflections you write against assigned psychoeducation ("WHAT THE HELL?") or exercise ("LET'S DO IT DIFFERENTLY") content, and whether you have marked these as done
• Messages you send to or receive from your therapist
• Your Mind Questionnaire, which new clients fill in in the app before Mind opens (see section 13)
• Any other information you choose to enter into the Mind section of the app

Technical data:

• Device and browser information and IP address, collected automatically by our hosting and database providers to keep the app secure and working
• Pop-up notification registrations for your device, where you have turned them on, and your notification choices
• When you last opened the app, so your PT, therapist and our admins can see whether you are using it
• Reminders you set in the phone app (days and times). These stay on your phone and are not sent to us

GLP-1 medication (in the Body assessment and Mind Questionnaire):

This is health information. We only collect it with your explicit consent, which you give on the form.

• Body assessment, seen by your PT: whether you are taking, thinking about taking, or have recently stopped a GLP-1 medication, and whether your prescriber knows you are starting or changing your training
• Mind Questionnaire, seen by your therapist only (not your PT): whether you are taking, thinking about taking, or have recently stopped a GLP-1 medication and, if you are taking one or have stopped, how your appetite has changed, your eating habits, how you talk to yourself about your body or weight, and anything else you choose to add

If you contact JC:

• If you contact JC by email, WhatsApp, text or phone: your name, contact details and message (see section 12)

3. Why we use your data, and our legal basis

• To provide the core service — showing you your training plan, mood diary and mindset practice, and letting your PT/therapist assign and review these. Legal basis: performance of a contract with you.
• To let you message your assigned PT and/or therapist and our support team. Legal basis: performance of a contract with you.
• To process Mind-section data (mood diary, reflections, therapist messages). Legal basis: your explicit consent, which you give separately in the app before first using Mind. You can withdraw it at any time (see section 8).
• To process your Body assessment and Mind Questionnaire, so your PT and therapist can plan safe training and tailor your support. Legal basis: your explicit consent, which you give on each form (see section 13).
• To show you “My Week”: your own training days next to your own mood check-ins, week by week, with a simple pattern or two worked out automatically. Only you see this combined view of your own data, and no decisions are made from it. Legal basis: performance of a contract with you, and your explicit consent for the Mind data in it.
• To keep the app secure, prevent misuse and fix problems. Legal basis: our legitimate interest in running a secure, working service.
• To send you notifications you have chosen to receive. Legal basis: your consent (see section 7).
• To reply when you contact JC and to set up your programme. Legal basis: taking steps at your request before entering a contract, and our legitimate interest in replying to enquiries (see section 12).

4. Who can see your data

We keep access deliberately narrow:

• Body data (training plan, workouts, measurements, PT messages, your Body assessment, weekly check-ins and a weekly summary of the sessions you completed) is visible to you and to the PT assigned to you. For the food diary, your PT sees only your daily guide and each day's totals (calories, protein, carbs and fat), not the foods you logged.
• From your Mind Questionnaire, your PT sees only a short summary: what gets in the way and what helps your brain work best, and how your brain works only if you said your PT may know. Your PT never sees the rest of it, or your GLP-1 answers.
• Mind data (mood diary, reflections, therapist messages, your Mind Questionnaire and a weekly summary of your mood and energy) is visible to you and to the therapist assigned to you. It is not visible to your PT unless the same person is also your therapist.
• Our admins can see client information, including Mind data, so they can manage the service, assign staff and keep people safe. This includes both forms and your weekly training and mood summaries side by side. They can read, but not send, messages in your PT and therapist conversations, and only look at the content of your mood diary, reflections, forms and messages when necessary for support or safeguarding.
• Your PT, therapist and our admins can see when you last opened the app.

We do not sell your data, and we do not share it with third parties for their own marketing.

5. FY Project is not a crisis service

FY Project, including its messaging, is not a crisis or emergency service. Messages are not monitored in real time or answered instantly. If you are in crisis or at immediate risk, please contact emergency services (999 in the UK) or a crisis line such as Samaritans (116 123) rather than messaging through the app.

6. Storage, security, and who processes data for us

Your data is stored using Supabase, a database and backend hosting provider, in its EU West (Ireland) region. Supabase acts as our data processor for account data, training, measurement and food diary records, weekly check-ins, mood diary entries, reflections, messages, your Body assessment and Mind Questionnaire, and exercise images, under a data processing agreement. We use industry-standard measures — encryption in transit, access controls, and database rules so that, for example, a client's data is only reachable by that client and their assigned PT/therapist (and our admins) — though no system can be guaranteed 100% secure. Where backups are enabled, they are kept for a short period (around 7 days).

Other services involved in running FY Project:

• IONOS — sends our app emails from hello@fyproject.co.uk, including sign-in emails (invites and password resets, with a one-time code), reminder emails about unread notifications, and a copy of your Body assessment or Mind Questionnaire answers to your PT or therapist when you send or change them (see section 13). Reminder emails to clients contain no names, message content or health information — only a generic prompt and a link back into the app. Reminder emails to our staff say which client did what (for example “Sam sent you a message”), never the message itself. IONOS also hosts our website.
• Expo (EAS Hosting) — hosts and serves the web app's files. Like any website host, it can see visitors' IP addresses and basic technical request details; it does not store your account or app data.
• Google, Apple, Mozilla and Microsoft — deliver pop-up notifications to your device (via Chrome/Android, Safari/iPhone, Firefox and Edge respectively). They receive only a device address and an encrypted notification.
• GitHub — stores the app's code only. It never holds user data.
• USDA FoodData Central and Open Food Facts — the food databases the food diary searches. When you search for a food or enter a barcode, only the search words or barcode are sent, from our server rather than your device. They are not told who you are and never receive your diary.
• Stripe (payment processing): see “Payments” below.
• Google Analytics — counts visits to our website, only if you accept analytics cookies there (see “Website analytics” in section 12). It is not used in the app.

Payments. If you pay through our website, your payment is handled by Stripe. Stripe collects and processes your card details and billing information. We never see or store your full card number. We receive confirmation of your payment, the amount, and your name and email, so we can set up your sessions or plan and keep our accounts. Our legal basis is performing our contract with you, and keeping financial records as the law requires. Stripe is a separate controller for the information it holds and may process data outside the UK under safeguards. Read how Stripe uses data at Stripe's privacy policy.

In the app, we do not use any analytics, advertising, tracking or error-monitoring tools, and we do not use cookies beyond what is needed to keep you signed in, which is held in your browser only until you close the app.

7. Notifications

We send notifications in three ways:

• In the app — always shown in your notifications list (the bell icon), whatever your other settings
• Pop-ups on your device — for example a new message or your new weekly practice, if you turn them on. Pop-ups for clients never show names or message content. Pop-ups for our staff show the client’s name and what happened, never the message itself.
• Reminder emails — if something stays unread, a short email with a link back into the app. For clients it has no personal, message or health content; for our staff it lists which client did what, without the messages themselves

You manage these on the notifications screen: tap the bell in the top right of your home screen. There you can turn pop-ups on or off for each device, turn reminder emails on or off, and choose which types of notification (for example messages or training plan updates) may pop up or be emailed. Turning something off never removes it from your in-app list.

8. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your data — clients can delete their own account at any time from the Help tab → Delete my account (you type DELETE to confirm). Staff accounts are removed by an admin.
• Restrict or object to certain processing
• Receive a copy of your data in a portable format
• Withdraw your consent for the Mind section at any time, from the bottom of the Mind menu. Mind then locks until you agree again; the Body side is not affected.
• Complain to the UK Information Commissioner's Office (ico.org.uk) if you believe your data has been mishandled

To exercise any of these rights, contact us at hello@fyproject.co.uk. We'll respond within one month.

9. How long we keep your data

What	How long we keep it
Body assessment and Mind Questionnaire filled in in the app, and the copy emailed to your PT or therapist	Deleted when you delete your account, or 12 months after your app access is paused
Body assessment sent through our website form (health declaration and signature)	6 years after your training ends
Mind Check-in sent through our website form	While you receive FY Project support and for 12 months afterwards
App account data (plans, measurements, mood diary and similar)	12 months after your app access is paused, then deleted

You can ask for a copy of your data, or ask us to delete it, at any time. We delete data after these periods, or sooner if you ask.

When you delete your account, your personal data is deleted immediately — your login and profile, ticked sets, weights and workout times, body measurements, food diary entries, calculator details and foods you added, weekly check-ins, your Body assessment and Mind Questionnaire, mood diary entries, mindset practice ticks and reflections, messages you sent to your PT, therapist or support, and your notifications.

If you stop training with JC and are not on the online plan, we switch off your access. We keep your account for 12 months so you can come back and carry on. After 12 months, we delete your account and your data. You can delete your account at any time from Help → Delete my account, or ask us to delete your account and all your data, and we will.

A basic client record (your name, email and any staff notes) stays on file for up to 12 months, linked to your training plan, your therapist's schedule of assigned topics (with your ticks and reflections already removed) and messages staff sent you. It is then removed automatically — or sooner, if our team closes your account.

Copies of deleted data may remain in secure backups for a short additional period where backups are enabled (see section 6), and basic sign-in logs (email and IP address) are kept by our database provider for a short period under its standard retention terms.

10. Children

FY Project is for adults only. There is no public sign-up for app accounts — accounts are created only when our team or a PT sends you a direct invitation, and we don't knowingly invite anyone under 18. Our website is also for adults only.

11. Changes to this policy

We may update this policy from time to time. If we make material changes, we will let you know via the app before they take effect.

12. If you contact JC, and our website

When you contact JC by email, WhatsApp, text or phone, we receive your name, contact details and message. We use them only to reply to you and to set up your programme.

• Legal basis: taking steps at your request before entering a contract, and our legitimate interest in replying to enquiries.
• Who handles it: your message passes through the service you choose to use (for example WhatsApp, your phone network or your email provider), and we receive it on our own phone and in our email, which is provided by IONOS.
• How long we keep it: if you become a client, we keep it as part of your account (see section 9). If you don't, we delete your enquiry when we no longer need it to reply to you, or when you ask us to.
• Sharing: we don't sell your details or share them with anyone for their own marketing.

Free consultation requests. If you send the free consultation form on our website, we receive your name, email address, phone number (if you give it) and, if you completed the training quiz on that page, your quiz answers and the training type it showed you. We use these only to arrange your consultation and reply to you, and they are kept and deleted in the same way as other enquiries (see above). The quiz itself runs in your browser: it does not store or send your answers unless you send the form.

Website visitors. Our website is hosted by IONOS, which may log visitors' IP addresses and basic technical details to keep the site running and secure. The site loads its fonts from Google Fonts, so Google receives your IP address when you visit. We don't use advertising cookies on the website.

Website analytics (Google Analytics). If you press “Accept” on our website's cookie banner, we use Google Analytics to count visits: which pages are viewed, roughly where visitors are (country and city, worked out from the IP address, which Google Analytics does not keep), the type of device and browser, and how visitors arrived (for example from Google, Instagram, WhatsApp or a QR code). It also counts which parts of the homepage a visitor scrolls to, when a visitor taps a WhatsApp, email, phone or payment button, plays one of our videos (and how much of it is watched), finishes the training type quiz (with the training type shown) or sends the quiz consultation form. It never receives what you type into a form. It sets cookies named _ga and _ga_… in your browser, which last up to 13 months. We use this only to understand how people find and use the site; it does not tell us who you are, and we do not use it for advertising.

• Legal basis: your consent. If you press “Reject”, or don't choose, no analytics cookies are set and nothing is sent to Google Analytics.
• Who handles it: Google, as our processor. Google may process the data outside the UK under safeguards.
• How long we keep it: detailed visit data is deleted after 2 months; we keep only overall totals (for example, visits per month).
• Your choice: it is remembered in your browser for 12 months. You can change it at any time in cookie settings.

13. Health information

Before you start, we ask new clients to complete two forms in the app: the Body assessment (including a health questionnaire, PAR-Q) and the Mind Questionnaire. Body and Mind open once the matching form is sent. We collect this health information only to plan safe training and tailor your support. Your answers are stored securely in the app (see section 6). When you send or change a form, a copy of your answers is also emailed to the FY Project email account of your PT (Body assessment) or therapist (Mind Questionnaire), or of our admins if you do not have one yet; this email account is provided by IONOS. You can view or change your answers at any time at any time from your Home screen. We use this information only for your programme. Our legal basis is your explicit consent, which you give on each form.

Clients who joined before the forms moved into the app may have completed them on our website. Those answers were not saved on our website: they were sent to us by email and are stored securely in our email account, which is provided by IONOS. They are kept as set out in section 9.

Body assessment:

• What it collects: your name, date of birth, phone number and email address; your GP's name or surgery; an emergency contact (another person's name and phone number, so please check they are happy for you to share it); your PAR-Q health answers; GLP-1 medication; injuries and recent surgery; lifestyle, stress and sleep; your goals and mindset; and your signature
• Why: only to plan safe training for you. Legal basis: your explicit consent, which you give on the form
• Who sees it: you, your PT and our admins
• How long we keep it: in the app and the emailed copy, until you delete your account, or 12 months after your app access is paused; website forms, for 6 years after your training ends. You can ask us to delete it sooner
• How to ask for deletion or a copy: email jc@fyproject.co.uk at any time

Mind Questionnaire:

• What it collects: how you are feeling (wellbeing, energy and how kind you are to yourself about your body and exercise); what helps you and what gets in the way; how you respond when things feel hard; GLP-1 medication, appetite, eating habits and how you talk to yourself about your body or weight, if you answer them; anything you choose to write in your own words; how your brain works, including any neurodivergence (diagnosed or suspected); and topics you would like handled with care. Everything except consent is optional
• Why: only so a therapist can tailor your mind support. Legal basis: your explicit consent, which you give on the form
• Who sees it: you, your therapist and our admins. Your PT sees only the short summary described in section 4, and never your GLP-1 answers. If your answers suggest your training should be adjusted or paused, your therapist may ask your PT to do that without telling them what you wrote
• How long we keep it: in the app and the emailed copy, until you delete your account, or 12 months after your app access is paused, unless you ask us to delete it sooner
• How to ask for deletion or a copy: email hello@fyproject.co.uk at any time

14. Contact us

Project FY Ltd (company number 13171626), 167-169 Great Portland Street, 5th Floor, London W1W 5PF — hello@fyproject.co.uk