Privacy Policy

Effective: 26 March 2026 · Last updated: 20 October 2026

P247 ("we", "us", "our") operates the P247 mobile application and the website at p247.io (together, the "Service"). This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights regarding that data.

P247 is operated by Commit-IT (ABN 60 137 471 615), based in New South Wales, Australia. We serve users internationally and comply with applicable data protection laws including the Australian Privacy Act 1988, the EU General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act (CCPA).

1. Data We Collect

1.1 Account Data

When you create an account, we collect:

1.2 Health and Fitness Data

With your explicit consent, we collect health and fitness data from:

Important: Health data is sensitive personal data. We only collect it after you grant explicit permission through the HealthKit consent screen or by connecting a third-party account via OAuth. You can revoke access at any time through your device settings or the P247 app.

1.3 Security Data

We automatically collect:

1.4 Website Analytics

Our website uses Google Analytics 4 (GA4) to understand traffic and usage patterns. GA4 collects anonymised usage data including page views, session duration, and referral sources. See our Cookie Policy for details.

2. How We Use Your Data

Purpose Data Used Legal Basis (GDPR)
Provide the Service (daily briefs, trend analysis, coaching) Health data, account data, manual entries Contract (Art. 6(1)(b)) for account data; explicit consent (Art. 9(2)(a)) for health data
Provide the daily brief and weekly performance report (rule-based) Health data, training history, check-ins, events Explicit consent (Art. 9(2)(a))
AI features: the coach, goal plans and plan adjustments, workout summaries and reading workout programme photos, processed by Anthropic (see section 4) Health data, nutrition, body measurements, workouts and programmes, events, injuries, coaching preferences, sleep plan, chat messages and photos you attach Explicit consent (Art. 9(2)(a)), given on the AI features screen, or in Settings
Read and summarise your blood test results, processed by Anthropic (see section 4) Blood test photos or PDFs, or values you enter; markers and reference ranges Explicit consent (Art. 9(2)(a))
Improve the website Anonymised website usage data (see section 1.4) Legitimate interest
Respond to support requests Account data, communications Contract (Art. 6(1)(b))
Prevent fraud and ensure security IP address, access logs Legitimate interest

3. How Your Data Is Analysed

3.1 Rule-based analysis (our infrastructure)

The daily brief (recovery score and the call for the day) and the weekly performance report (main decision, priorities, confidence level, data gaps and actions) are calculated by fixed rules applied to your own data on our infrastructure. They are not written by an AI model, and they don't send your data to an AI provider.

3.2 Blood test results

Blood test results are sensitive health data. We collect them only if you choose to add them. They are used to show you your markers, how they change between tests, and a plain-English summary for training context. Reading and summarising them uses Anthropic, as described in section 4. They are not used for advertising and are not shared with anyone else. Blood test summaries are not a diagnosis or medical advice; talk to a qualified health professional about any result that concerns you.

4. AI Features and Anthropic

Some P247 features use Anthropic, PBC ("Anthropic"), an AI company based in the United States, through its Claude API. Anthropic acts as our service provider (a data processor): it processes the data we send only to produce a response for P247, under Anthropic's Commercial Terms of Service and Data Processing Addendum. The daily brief and weekly report don't use AI (see section 3).

4.1 Which features use Anthropic, and what each one sends

Each feature sends only the data it needs:

Your profile name and email address are not sent to Anthropic, and if your full name or email appears in text we send, it is replaced first. Messages you type, and photos and files you upload such as blood test reports, are otherwise sent as you provide them and may contain identifying details.

4.2 Your consent, and how to withdraw it

A one-time "AI features" screen in the app explains what is sent, with the choice to Agree or choose Not now. The same screen is also available in Settings > Health data and privacy. In the app, the coach, blood test reading and programme photo reading send data only after you agree on that device. Goal plans and workout summaries are also checked by our server against your account setting. If you choose Not now, the coach, goal plans and plan adjustments, new workout summaries, blood test reading and programme photo reading stay off. Your saved plans, workout metrics and the rest of P247 keep working.

Your choice for the coach, blood test reading and programme photo reading is stored on each device. Your goal plans and workout summaries choices are saved to your P247 account and apply on all your devices. Agreeing on the AI features screen turns workout summaries on. Choosing Not now or turning AI features off turns goal plans and workout summaries off for your account. If what these features send changes, the app may ask you again before sending anything new.

You can withdraw consent at any time by turning AI features off in Settings > Health data and privacy. This stops new requests, including new goal plans and plan adjustments; requests already sent may finish. Saved plans and workout summaries already made aren't deleted, and saved plans stay readable.

4.3 How long Anthropic keeps data

Anthropic's published policy for API customers says: "For Anthropic API users, we automatically delete inputs and outputs on our backend within 30 days of receipt or generation". The exceptions under that policy are: where a customer uses an Anthropic service with longer retention, or has agreed a different arrangement with Anthropic; where Anthropic needs to keep data longer to enforce its Usage Policy; and where the law requires it. If Anthropic's automated trust and safety systems flag content as violating its Usage Policy, Anthropic says it may keep the inputs and outputs for up to 2 years, and trust and safety classification scores for up to 7 years. See Anthropic's article "How long do you store my organization's data?" for the current terms, as Anthropic may update them.

4.4 Model training

Anthropic does not use inputs or outputs from its commercial API to train its models by default (see "Is my data used for model training?"). P247 does not use your data to train AI models.

4.5 Deleting your data

Deleting your P247 account deletes P247's copy of your data (see section 7). Backups, including those taken before maintenance, are deleted within 30 days. Deleting your account does not recall data already sent to Anthropic; Anthropic keeps and deletes that data under its own retention terms, described in section 4.3.

4.6 Not sold, not used for advertising

We do not sell your data, to AI companies or anyone else, and we do not use it for advertising.

4.7 Processing outside Australia

Anthropic is based in the United States. When you use these features, the data they send is disclosed to Anthropic as an overseas recipient and may be processed in the United States or in other countries where Anthropic or its subprocessors operate. Anthropic processes it under its Commercial Terms of Service and Data Processing Addendum, which incorporates the EU Standard Contractual Clauses. See also section 11.

5. Data Sharing

We do not sell your personal data. We share data only in these circumstances:

6. Data Storage and Security

7. Data Retention

8. Your Rights

All Users

EU/UK Residents (GDPR)

In addition to the above, you have the right to:

California Residents (CCPA)

You have the right to:

Australian Residents

Under the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs), you have the right to access and correct your personal information. You may also complain to the Office of the Australian Information Commissioner (OAIC) if you believe we have breached the APPs.

9. Apple HealthKit Compliance

P247 complies with Apple's HealthKit guidelines:

10. Children's Privacy

P247 isn't directed at children under 13, and we don't knowingly collect personal information from children under 13. If you're under 18, please use P247 with a parent's or guardian's permission. If you believe a child under 13 has given us personal information, contact us and we'll delete it.

11. International Data Transfers

P247 is based in Australia and serves users globally. Your data may be transferred to and processed in countries other than your own. In particular, if you use the AI features in section 4, the data they send is disclosed to Anthropic, which is based in the United States. Network delivery and security for the Service are provided by Cloudflare, Inc., which is also based in the United States. When we transfer data internationally, we use:

12. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes via email or a notice in the app. The "Last updated" date at the top reflects the most recent revision.

13. Contact Us

For privacy inquiries, data access requests, or complaints:

We aim to respond to all privacy requests within 30 days (or sooner where required by law).