Zepho Privacy Policy

Last Updated: March 2026

This Privacy Policy explains how Zepho Sports Limited ("Zepho", "we", "us", "our") collects, uses, stores, and protects your personal data in accordance with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and related laws and regulations ("Data Protection Legislation").  when you use our website (www.zepho.ai) ("Site") and our mobile applications ("Apps").

We are committed to protecting your privacy. Please read this Policy carefully to understand how we handle your information.

1. Who We Are

Zepho Sports Limited is a company registered in England and Wales. We act as the data controller for personal data processed through the Site and Apps.

Contact: support@zepho.ai

Registered address: 27-37 St George’s Road, London, SW19 4EU, UK

2. What Personal Data We Collect

We collect data in the following categories:A. Information You Provide

• Account details: name, email address, password

• In-app submissions: feedback, messages, notes on training

• Customer support interactions

B. Automatically Collected Data

• Device information: model, operating system, unique identifiers

• Log data: IP address, pages viewed, timestamps

• App usage information: features used, session duration, interactions

Special Category Data: Wearable and Health Metrics  (If You Choose to Connect)

• Biometric and Heart Rate Data: including resting heart rate, heart rate variability (HRV), and peak heart rate during exercise. 

• Sleep and Recovery Metrics: including sleep duration, sleep stages (REM, deep, light), and recovery scores.

• Location and Movement Data: GPS coordinates, elevation, speed, and specific route maps of your activities. 

• Activity history

• Physiological Analysis: training load, strain, VO2 max estimates, and metabolic data derived from your activity.



  

Third party sources may include Garmin, WHOOP, Apple Health, Zwift, Strava, and similar services.

D. Payment Information

Payments made via the Apple App Store or Google Play Store are processed by those platforms. Zepho does not receive or store your full payment details.

E. Derived and Inferred Data

We use AI and algorithmic models to analyse the data you provide and the data collected automatically to create training insights, performance predictions, and personalised coaching recommendations.

3. How We Use Your Data

We process your personal data based on the following lawful bases under Article 6 of the UK GDPR and, where we process health or wearable data ("Special Category Data"), the condition of explicit consent under Article 9(2)(a) of the UK GDPR:

A. To Provide and Personalise the Zepho Service

• Creating training plans (Lawful Basis: Performance of a Contract;

• Condition for Special Category Data: Explicit Consent) 

• Adapting plans based on feedback and wearable data (Lawful Basis: Performance of a Contract; Condition for Special Category Data: Explicit Consent) 

• Providing coaching guidance (Lawful Basis: Performance of a Contract;

• Condition for Special Category Data: Explicit Consent) 

• Improving app functionality and performance (Lawful Basis: Legitimate Interests)



  

B. To Communicate With You

• Service announcements (Lawful Basis: Performance of a Contract) 

• Updates to features or terms (Lawful Basis: Legal Obligation or Legitimate Interests) 

• Customer support responses (Lawful Basis: Performance of a Contract)



  

C. To Improve Zepho

• Analysing usage patterns (Lawful Basis: Legitimate Interests) 

• Training internal models and AI to improve coaching accuracy (Lawful Basis: Legitimate Interests;

• Condition for Special Category Data: Explicit Consent) 

• Developing new features (Lawful Basis: Legitimate Interests) 

D. Legal and Compliance Purposes

• Preventing misuse and fraud (Lawful Basis: Legitimate Interests) 

• Meeting regulatory obligations (Lawful Basis: Legal Obligation) 

Responding to legal requests (Lawful Basis: Legal Obligation)

4. How We Share Your Data

We may share data with:

A. Service Providers

Third-party processors who act on our instructions to support our operations, including :

• Cloud hosting and infrastructure providers (e.g., AWS) to store your data securely 

• Analytics and performance monitoring providers to help us understand App usage

• Customer support and CRM platform providers to manage your inquiries

• Email and push notification service providers to send you updates 

B. Third Party Integrations

If you choose to connect your Zepho account to third-party services (such as Garmin, WHOOP, Apple Health, or Strava), we will receive data from those services in accordance with the permissions you grant. Please note that these third parties are independent data controllers. Once data is shared with or received from these services, their own privacy policies and terms of service govern how they handle your information. We recommend reviewing their privacy settings and policies regularly. You can disconnect these integrations at any time through the settings menu in the App or within the third-party service itself .

C. Legal or Regulatory Authorities

We may disclose your personal data to law enforcement, taxation authorities, courts, or other public authorities where we have a legal obligation to do so, or where we believe in good faith that such disclosure is necessary to: (i) comply with a legal process or court order; (ii) respond to lawful requests by public authorities, including to meet national security or law enforcement requirements; (iii) protect and defend the rights, property, or safety of Zepho, our users, or the public; or (iv) establish, exercise, or defend legal claims .

We do not sell personal data.

5. International Transfers

We may transfer your personal data to countries outside the UK and EEA (including the United States). Where the destination country is not deemed 'adequate' by UK regulators, we ensure appropriate safeguards are in place, typically including:

• The UK International Data Transfer Agreement (IDTA) 

• The UK Addendum to the European Commission's Standard Contractual Clauses (SCCs) 

• Frameworks or certifications recognised by regulators

6. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected. To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it, and applicable legal requirements. Our specific criteria include:

• provide the Zepho service (typically for the duration of your active account plus 6 years to manage potential legal claims); 

• comply with legal, tax, or accounting requirements (such as keeping transaction records for 7 years);

• resolve disputes and enforce our agreements. 

If you delete your account, we will remove or anonymise your data within a reasonable time, except where retention is legally required.

7. Security

We use technical and organisational measures to protect your data against loss, misuse, and unauthorised access. These include:

• encryption

• secure servers

• access controls

• activity monitoring

No system is perfectly secure, but we work to maintain a high security standard.

8. Your Rights

Depending on your location, you may have the following rights:

• Access your data

• Correct inaccurate data

• Delete your data

• Restrict processing

• Object to processing

• Data portability

• Withdraw consent at any time where we rely on it to process your data (such as for wearable and health data);


  

  • Complain to a supervisory authority, such as the Information Commissioner’s Office (ICO) in the UK (www.ico.org.uk), if you are unhappy with how we use your data.

To exercise these rights, contact support@zepho.ai

We may need to verify your identity before processing your request.

9. Children’s Data

Zepho is not intended for users under 18. In accordance with the UK Age Appropriate Design Code, we do not knowingly collect or process personal data from children under 18. We may use age-verification technologies to ensure users meet this threshold. If we discover we have collected data from a minor without appropriate parental or legal guardian consent, we will delete that information immediately. If you believe a child has used Zepho without consent, please contact us.

10. Cookies and Tracking Technologies

We use cookies and similar tracking technologies (such as web beacons and pixels) to enhance your experience, analyse performance, and provide secure authentication. These technologies fall into the following categories :

• Essential Cookies: Necessary for the Site and Apps to function, such as for secure login and session management. These do not require your consent.

• Analytics and Performance Cookies: Used to understand how users interact with Zepho, allowing us to improve app functionality and coaching accuracy. These are only deployed with your explicit consent.

• Preference Cookies: Used to remember your settings and provide a personalised experience. These are only deployed with your explicit consent.

• preferences

We use a consent management platform that allows you to manage your preferences and opt-in to non-essential cookies before they are deployed. You can withdraw or change your consent at any time through the 'Cookie Settings' link on our Site or within the App settings. For more information, please see our full Cookie Policy. 

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If changes are significant, we will notify you by email or through the Apps.

Continued use of Zepho after updates indicates acceptance of the revised policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy or your personal data, you can contact us at:

support@zepho.ai

Zepho Sports Limited

27-37 St George’s Road
London, SW19 4EU
United Kingdom