Privacy Policy

ShiftFit is a wellness and fitness platform built specifically for NHS healthcare workers. We are operated by Patrick Mwambila, trading as ShiftFit (https://shiftfit.health).

For any privacy-related questions, please contact us at: patrick@shiftfit.health

When you sign up for early access or use ShiftFit, we may collect the following personal data:

• Name — first name or full name (optional at sign-up)
• Email address — used to contact you and send product updates
• NHS role — e.g. Nurse, Doctor, HCA (optional)
• Hospital / Trust — your place of work (optional)
• Fitness goals and shift pattern — to personalise your experience (optional)
• Usage data — pages visited, features used, interaction logs
• Device and browser information — for security and analytics purposes

We do not collect any special category health data (e.g. medical records, diagnoses) beyond what you voluntarily share in free-text fields.

We use your personal data for the following purposes:

• To provide and improve the ShiftFit platform and experience
• To send you product updates, wellness content, and important notices (you can opt out at any time)
• To personalise content based on your NHS role and fitness goals
• To respond to your enquiries and provide support
• To analyse usage patterns and improve our services
• To comply with legal obligations

We will never sell your personal data to third parties.

Under the UK General Data Protection Regulation (UK GDPR), we process your data on the following legal bases:

• Consent — you have given your explicit consent when signing up (e.g. ticking the consent checkbox on our form)
• Legitimate interests — to operate and improve our service, prevent fraud, and ensure security
• Contract performance — to provide the service you signed up for
• Legal obligation — where required by law

By joining the ShiftFit early access list, you consent to receive welcome emails, product updates, and wellness content from us. You can unsubscribe from marketing emails at any time by clicking the unsubscribe link in any email or by emailing patrick@shiftfit.health.

We use Resend to send transactional and marketing emails. Resend processes email data on our behalf as a data processor.

We share your data with a limited number of trusted third-party services that help us operate ShiftFit:

• Base44 — our platform provider (database, authentication, hosting)
• Resend — email delivery
• Google Sheets — internal CRM and data management (admin only)

All third-party processors are contractually obligated to handle your data securely and in accordance with UK GDPR.

We do not transfer your data outside the UK/EEA without appropriate safeguards in place.

We retain your personal data for as long as necessary to provide our services and comply with legal obligations. If you request deletion of your account and data, we will remove your personal information within 30 days, except where we are required to retain it by law.

You have the following rights regarding your personal data:

• Right to access — request a copy of the data we hold about you
• Right to rectification — request correction of inaccurate data
• Right to erasure — request deletion of your data ("right to be forgotten")
• Right to restrict processing — ask us to limit how we use your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — withdraw consent at any time without affecting prior processing

To exercise any of these rights, please email us at patrick@shiftfit.health. We will respond within 30 days.

ShiftFit uses essential cookies and local storage to keep you logged in and maintain your preferences. We may also use analytics tools to understand how users interact with our platform. We do not use intrusive advertising trackers.

By using ShiftFit, you consent to the use of essential cookies required for the platform to function.

We take data security seriously. Your data is stored on secure servers with encryption at rest and in transit. Access to personal data is restricted to authorised personnel only. We regularly review our security practices to ensure your data is protected.

In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority (ICO) within 72 hours of becoming aware.

ShiftFit is intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18. If you believe a child has provided us with personal data, please contact us immediately.

We may update this Privacy Policy from time to time. We will notify you of any significant changes by email or by posting a prominent notice on our website. The "Last updated" date at the top of this page reflects the most recent revision.

Continued use of ShiftFit after changes are posted constitutes your acceptance of the revised policy.

If you have any questions, concerns, or complaints about how we handle your personal data, please contact us:

• Email: patrick@shiftfit.health
• Website: https://shiftfit.health

You also have the right to lodge a complaint with the UK's data protection supervisory authority, the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.