Please login to access this website.
Back In Shape Program Limited Effective from: 1 June 2026 Version: 2.0 (full rewrite — replaces all prior versions)
Back In Shape Program Limited (“Back In Shape”, “we”, “us”, “our”) respects your privacy and takes the protection of your personal information seriously. This Privacy Policy explains what data we collect about you, why we collect it, how we use it, and what rights you have over it.
We’ve written this policy to be clear and direct rather than legalistic. If anything is unclear, please contact us at [email protected].
This policy applies to:
We are required to provide this information to you under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If you are in the European Union or Switzerland, your data is protected by equivalent provisions of the EU GDPR or revFADP.
Back In Shape Program Limited is a company registered in England and Wales. We are the “data controller” for the personal information we hold about you. This means we decide how and why your data is processed.
We are registered with the UK Information Commissioner’s Office (the ICO).
Contact us:
The person responsible for data protection within Back In Shape is Mike Fatica, the founder.
We collect different kinds of data depending on how you interact with us.
To generate your personalised SRI report, we collect:
Some of this information is health-related, which the law treats with extra care. We handle this carefully and only with your explicit consent. See “Special category (health) data” below for the detail.
To create and run your account, we collect:
To deliver the programme and help you track progress, we collect:
If you complete our deeper onboarding profile (the Spine Resilience Profile), we also collect:
If you complete periodic check-ins, we collect:
Like most websites, we collect some information automatically when you visit:
We use cookies and similar technologies for some of this. See “Cookies and tracking” below for details and how to control them.
If you contact us by email, social media, or any other channel, we keep a record of our communications so we can follow up properly.
Information about your physical health — your pain, your diagnoses, your symptoms, your rehabilitation progress — is considered “special category data” under data protection law. We treat it with particular care.
How we handle it:
You can withdraw your consent at any time by contacting us. Withdrawal of your consent to process health information for service delivery effectively means you’re cancelling your membership, since we cannot deliver a personalised rehabilitation programme without it. We’ll explain the implications clearly if you contact us.
Under UK GDPR, we need a clear legal reason (“lawful basis”) for processing your data. Here’s how we map our different processing activities:
When you become a member, we form a contract with you to deliver the programme. We process most of your data on the basis of performing this contract. This covers:
We rely on your consent for:
You can withdraw any consent at any time. We explain how below.
We rely on legitimate interests for some processing where we have a genuine business need that doesn’t override your rights:
You have the right to object to processing based on legitimate interests. See “Your rights” below.
We retain some data because we’re legally required to:
We don’t sell your data. We don’t share your data with advertisers or marketing networks.
We do share specific data with the following service providers (“data processors”) who help us run Back In Shape. Each is contractually obliged to handle your data only for the purposes we instruct, with appropriate security and confidentiality.
| Provider | What they do | What data they handle |
|---|---|---|
| Stripe (Ireland, with US sub-processing) | Payment processing | Name, email, payment details, billing address |
| ScoreApp (UK/EU) | Hosts the SRI assessment | SRI responses, name, email |
| Klaviyo (USA) | Email marketing and profile management | Name, email, marketing preferences, engagement data, SRI responses (limited fields) |
| SendGrid (USA) | Transactional emails (password resets, etc.) | Name, email, transaction context |
| BuddyBoss (USA) | Community platform | Name, email, profile information, community posts |
| Cloudflare (USA) | Content delivery, video, security | Technical access data |
| Cloudways/DigitalOcean | Website hosting | Technical access data |
| Rapyd (managed by BuddyBoss) | Members area hosting | All members area data |
| Zapier, Uncanny Automator | Workflow automation | Data transiting between systems |
| Google Workspace | Internal records | Limited operational records |
| ManyChat (USA) | Social media DM automation | Names and conversation content where members start a chat |
We also use AI-assisted analytical tools (from providers including Anthropic, OpenAI, and Google) for strategic analytical work and operational efficiency. We never share information that could identify you with these tools. Only aggregate or fully anonymised data is processed in this way.
We may share your data more broadly if we are legally required to (for example, in response to a court order), or to protect the rights, property, or safety of Back In Shape, our members, or others.
If Back In Shape were ever sold, merged, or reorganised, your data would be one of the assets transferred, and the new owners would be bound by the same protections. We would notify you in advance if this happened.
Some of our service providers are based outside the UK, primarily in the United States. When we transfer your data to these providers, we use approved legal mechanisms to ensure your data has equivalent protection to that required by UK law. These mechanisms include:
If you’d like more detail about the protections in place for any specific transfer, please contact us.
We keep your data only as long as we need it for the purposes set out in this policy, or as long as we’re legally required to.
| Type of data | How long we keep it |
|---|---|
| Active member data | While you’re a member, plus 24 months after cancellation (then anonymised or deleted) |
| Financial / billing records | 6 years from end of the relevant accounting period (UK legal requirement) |
| Health information (workout logs, pain reports, SRP) | While you’re a member, plus 24 months after cancellation, then deleted (special category data we don’t retain longer than needed) |
| SRI lead data (if you don’t become a member) | 24 months from quiz completion if there’s no further engagement, then deleted |
| Email engagement data | 24 months from last engagement |
| Unsubscribe records | Indefinitely (legal requirement so we don’t email you again) |
| Consent records | 6 years after cancellation (audit trail) |
| Server logs (IP, browser, etc.) | 90 days |
| Cookies | As specified in our Cookie Policy, typically 12 months |
When data reaches the end of its retention period, we either delete it or, where it has continued analytical value (for example, helping us understand patterns in member outcomes), we anonymise it — meaning we strip out everything that could identify you, leaving only patterns. Once truly anonymised, the data is no longer considered personal data.
You have a number of rights over the personal data we hold about you. These are:
You have the right to be told how we use your data. This policy is how we discharge that duty.
You can ask us for a copy of the personal data we hold about you. We’ll respond within one calendar month (or up to three months for complex requests, with notification).
If any of the data we hold about you is wrong or out of date, you can ask us to correct it.
You can ask us to delete the personal data we hold about you. We’ll do this except where we have a legal obligation to keep certain records (for example, financial records or unsubscribe lists).
Important clarification on erasure and anonymised data: When you ask us to delete your data, we will remove all information that identifies you personally. However, we may retain data that has been fully anonymised — where everything that could trace back to you has been removed — as part of our overall service-improvement and outcomes records. Anonymised data is no longer considered personal data under UK GDPR. We do this because it lets us continue to learn from broad patterns in how the programme works, without holding anything that connects to you as an individual.
You can ask us to stop processing your data while a dispute or query is being resolved.
You can ask us for your data in a structured, machine-readable format so you can take it to another service if you wish.
You can object to processing we do on the basis of legitimate interests. You can also opt out of marketing communications at any time (every marketing email contains an unsubscribe link).
We don’t make automated decisions about you that have a significant effect on you. Our SRI assessment recommends a tier of membership based on your responses, but you make the actual decision about whether to join.
Email us at [email protected]. We’ll acknowledge your request within a few working days and respond fully within one calendar month.
If you’re unhappy with how we handle your data, please tell us first so we can try to put it right. You also have the right to lodge a complaint with the UK supervisory authority:
Information Commissioner’s Office (ICO)
If you’re in the EU, you can complain to your national data protection authority.
We’re transparent about our use of AI-assisted analytical tools. Many businesses don’t disclose this; we think you should know.
We use AI tools (currently including services from Anthropic, OpenAI, and Google) for strategic work — analysing patterns, drafting communications, generating ideas, summarising information. We do this on commercial plans that explicitly do not train their models on our inputs.
Our policy:
This means an AI tool we use will never see “Jane Smith reported pain in her lower back.” It might see “42% of members in cohort X reported improvements after 8 weeks.” That second example, properly anonymised, is no longer personal data.
Our website uses cookies and similar technologies. Some are strictly necessary for the site to work (for example, keeping you logged in). Others are optional and used for analytics or improving your experience.
When you first visit our site, you’ll see a cookie banner asking your permission for the optional cookies. You can change your preferences at any time.
For full details of the cookies we use, please see our Cookie Policy.
Back In Shape is intended for adults. Our services are not directed at anyone under 18, and we do not knowingly collect data from anyone under 18.
If you’re a parent or guardian and you believe your child has provided us with personal data, please contact us immediately at [email protected] and we will remove it.
We take security seriously and use industry-standard measures to protect your data:
That said, no system is perfectly secure. We work to minimise risk, and we’ll notify you and the ICO promptly in the unlikely event of a serious data breach affecting your data.
We may update this policy from time to time. If we make significant changes, we’ll notify you by email and prominently on the website. The “Effective date” at the top of the policy will always reflect the latest version.
We encourage you to review this policy periodically.
For any questions about this policy or about how we handle your data:
Email: [email protected]
Post: Back In Shape Program Limited Units B2, Staverton Connection Cheltenham GL51 0TF United Kingdom
Back In Shape Program Limited is a company registered in England and Wales. © Back In Shape Program Limited 2026. All rights reserved.