CADVYN

Privacy Notice

Effective 3 September 2026

This notice explains how CADVYN uses personal information when you use the website, app, training, nutrition, Community and Connected Health features.

Who is responsible for your information

CADVYN is operated by Cameron Smart, trading as CADVYN, as a sole trader in the United Kingdom. Business address: 31 Hazel Place, CF5 3PR. For privacy, data-protection or account questions, contact support@cadvyn.com.

Age requirement

CADVYN accounts are for people aged 13 or over. CADVYN asks for date of birth through a neutral age screen when an account is created. It uses that date to enforce the 13+ rule, calculate age, support relevant fitness features and apply additional protections to accounts for ages 13–17. Children under 13 must not create or use their own CADVYN account.

Accounts for ages 13–17

CADVYN treats the best interests and safety of young people as a primary consideration. Youth accounts start non-discoverable, are excluded from public leaderboards, do not allow tags or unsolicited friend requests, and keep Community posts limited to accepted friends. These settings are enforced using the protected date of birth held with the account and cannot be relaxed before the account holder turns 18. To correct a date of birth after account creation, contact CADVYN support.

CADVYN uses date of birth rather than publishing it. Coaches and ordinary team members are not shown a young person's date of birth, bodyweight, food diary, raw sleep information or raw Connected Health information through CADVYN Teams. Direct CADVYN Pro purchasing is unavailable to under-18 accounts while an appropriate parent or guardian purchase route is developed.

A young person or their parent or guardian can contact support@cadvyn.com with a privacy or safety question. The account holder can use CADVYN's export and deletion controls, and applicable UK data-protection rights continue to apply.

Information CADVYN may use

Depending on the features you choose, this can include account details; profile and training preferences; date of birth and age; sex, height and weight; body measurements and goals; workout performance and personal bests; food and nutrition logs; Community identity and interactions; nutrition-label images you deliberately submit for scanning; food-catalogue contributions you choose to share; authorised Connected Health information such as steps, activity, sleep, heart-rate context, weight and workout sessions including their timing, duration, activity type and available summary metrics; subscription and entitlement information; security and diagnostic information; records of privacy choices and consent; and, where you allow website analytics, a random browser identifier, page path, referring website host and campaign parameters such as source, medium and creative.

Why we use it

We use information to provide your account, confirm account eligibility, create and adapt programmes, record workouts and progress, calculate nutrition guidance, display trends, operate requested Community and Connected Health features, maintain security, diagnose faults, manage CADVYN Pro access and provide adaptive fitness features through CADVYN's own deterministic engine. With your permission, website analytics also help CADVYN understand how people discover the website, which campaign links bring people to CADVYN and whether a campaign visit later results in a new account.

How CADVYN's adaptive engine works

CADVYN's coaching, programme generation, adaptive training and Progress Intelligence are produced by CADVYN's own deterministic fitness engine and defined calculations. The current product does not use generative AI or a third-party AI model to create those outputs.

The engine can use relevant information you provide or choose to connect, such as your goals, training setup, programme, completed workouts, progress, nutrition evidence, schedule, sport commitments and authorised Connected Health evidence. It applies defined product rules and evidence thresholds to produce recommendations and adaptations rather than sending your profile to a generative-AI service.

CADVYN does not use your account, training, nutrition or Connected Health information to train or improve foundational or generalised AI or machine-learning models.

Lawful bases

Where UK data-protection law requires a lawful basis, CADVYN generally relies on one or more of the following depending on the activity:

Where Connected Health information is special-category health data, CADVYN relies on your explicit consent under Article 9(2)(a) UK GDPR as the additional special-category condition for the Connected Health purposes described below. CADVYN records the consent statement, version and time so it can demonstrate your choice. Connected Health is optional and is not required to use the core CADVYN account.

Website analytics and campaign attribution

Analytics on the public CADVYN website are optional. If you select Allow analytics, CADVYN stores a random browser identifier in your browser so repeat visits from that browser can be counted as one unique visitor within reporting periods. CADVYN may also record the page path, referring website host and campaign parameters included in links, such as Instagram, Facebook, TikTok or a particular advert. If you then create a new CADVYN account, the stored campaign attribution may be linked to that signup so CADVYN can measure visitor-to-signup conversion.

CADVYN does not use campaign analytics to fingerprint your device and does not store raw IP addresses in its campaign analytics records. Page views are measured separately from unique visitors. A different browser or device can therefore count as a separate anonymous visitor. You can decline analytics when asked or reopen Analytics choices from the website to change your choice.

Connected Health and explicit consent

Connected Health features are optional. After you authorise a supported health provider or device health service, CADVYN asks for a separate explicit statement of consent before CADVYN stores or uses Connected Health information. The consent identifies the types of information involved and the purposes for which CADVYN will use them.

If you consent, CADVYN may use supported Connected Health categories such as steps, activity, sleep, heart-rate context, weight and workout information to provide connected tracking, progress and adaptive fitness features. Where your connected provider supplies a workout session, CADVYN may compare its timing, duration and activity information with your CADVYN training history and planned sport schedule. A high-confidence match can be attached to an existing workout or used to mark a matching planned sport session complete; activity that cannot be matched safely is kept separately as observed training evidence.

Current production provider position: CADVYN's production service does not request restricted Google Health API OAuth scopes. In the native Android app, CADVYN uses Android Health Connect as its Connected Health provider. Health Connect shows the Android permission screen and you choose which supported data types CADVYN may read. CADVYN does not request Health Connect write access, background health-data access or extended health-history permission in the current Android beta. Apple Health is available in the native iOS app as an optional read-only connection. The web/PWA does not directly read Health Connect or Apple Health.

Health Connect information is read on the Android device after you grant the relevant Android permissions. CADVYN then sends the supported health evidence you chose to share to the authenticated CADVYN service so it can be stored with your account and used for the Connected Health purposes described here. CADVYN normally limits foreground Health Connect import to the recent period needed by the product and re-checks permissions because you can change them in Android at any time.

CADVYN uses Connected Health information and derived fitness signals only within its own deterministic engine to provide connected tracking, progress and adaptive fitness features. CADVYN does not send this information to an AI provider, and does not use, transfer or permit it to be used to create, train or improve foundational or generalised AI or machine-learning models.

You can withdraw Connected Health consent by disconnecting the relevant provider or disabling its permissions. Withdrawal stops future Connected Health processing based on that consent. CADVYN removes provider-imported Connected Health copies that are covered by the disconnect flow while keeping unrelated information you entered directly into CADVYN. Where provider evidence enriched a workout you recorded directly in CADVYN, the provider enrichment can be removed while the underlying CADVYN workout remains. CADVYN may keep a minimal record that consent was withdrawn so it can respect and demonstrate that choice.

If you previously connected Google Health, disconnecting removes imported Google Health daily metrics, sleep records, Connected Health weight entries and standalone imported workout observations, and removes Google Health enrichment from CADVYN workouts while keeping the underlying workout you recorded in CADVYN. A previous Google Health connection may also be paused or retired as CADVYN moves production Connected Health to platform-native providers.

Google Health API Limited Use

The use of information received from Google Health API and/or Developer Tools will adhere to the Google Health API Developer and User Data Policy, including the Limited Use requirements.

CADVYN does not currently request Google Health API restricted OAuth scopes in its production service. Where CADVYN previously received Google Health information, or receives it in separately configured authorised development/testing, the Limited Use restrictions continue to apply to raw information and to information that is aggregated, anonymised, de-identified or derived from it. CADVYN does not use Google Health information for advertising, data brokerage, credit decisions or model training.

Community, usernames and social features

If you create a CADVYN username, it may be visible to other CADVYN users in features such as people search, friends, leaderboards, challenges, achievements, tags or activity sharing. Your account email is not used as your public Community identity. Activity sharing is optional and supported privacy controls let you restrict discoverability and visibility.

For accounts aged 13–17, CADVYN overrides the ordinary Community options with the stronger youth defaults described above. When the account holder reaches 18, the settings remain private until they deliberately choose otherwise.

Adaptive engine and nutrition-label scanning

CADVYN's coaching, programme, adaptive training and Progress Intelligence use the CADVYN deterministic engine. They do not use generative AI or a third-party AI model.

CADVYN's nutrition-label photo reader uses local on-device text recognition on the image you select. The image is not sent to CADVYN or a third party and is not added to your account or shared food catalogue. Text recognition can still be inaccurate, so check and edit every scanned value against the packet before saving or relying on it. Fitness guidance is not medical advice.

My Foods and the shared food catalogue

My Foods stays private to your account. If you separately select Help CADVYN grow, CADVYN sends the food name, brand, barcode, serving basis and nutrition values to a moderation queue. Your notes and public Community identity are not included. Approved food facts may become searchable by other members. If your account is deleted, CADVYN removes the link back to your account but may retain an approved non-personal food record so the catalogue remains useful.

Payments and service providers

CADVYN uses service providers for hosting and database services, authentication, payments and relevant platform functionality. Android Health Connect provides the device health permission and data-sharing layer for the native Android Connected Health feature. Information is shared only where needed to provide, administer or secure the relevant feature. Stripe handles web card details; CADVYN stores the subscription identifiers and status needed to provide paid access.

Some service providers may process information outside the United Kingdom. Where UK data-protection law requires safeguards for an international transfer, CADVYN uses an appropriate transfer mechanism or relies on another permitted basis for the transfer.

Retention and security

CADVYN aims to keep personal information only for as long as it is needed for the purpose collected, account administration, security, legal obligations, dispute handling or the establishment, exercise or defence of legal claims. Retention periods can differ by data type and may change where a legal or security reason requires it. A record of a withdrawn consent choice may be retained where reasonably necessary to demonstrate and respect that withdrawal.

Authenticated access, database row-level controls and server-side protection are used for privileged operations. No online service can promise absolute security, but CADVYN aims to limit access and data collection to what is needed for defined purposes.

Your rights

UK data-protection law provides rights that can include access, rectification, erasure, restriction, portability, objection and rights relating to automated decision-making, depending on the circumstances and legal basis. Where CADVYN relies on consent, you can withdraw it without affecting the lawfulness of processing carried out before withdrawal. Account data export and deletion controls are available within CADVYN. You can request deletion of selected data while keeping your account, use the account-deletion process, or email support@cadvyn.com.

Complaints and changes

If you have a data-protection concern, contact support@cadvyn.com first if you would like CADVYN to investigate it. You also have the right to raise a concern with the UK Information Commissioner's Office. This notice will be updated when material data practices change.

← Back to CADVYN