The short version: PAMO runs on health data. We collect it to run your fitness targets, AI coaching and squad features. We don't sell it, share it beyond the processors listed here, or use it for advertising. You can export or delete everything from Settings at any time.
PAMO is a trading name of Pace and Motion Limited, a company registered in England and Wales. We are the data controller responsible for your personal data.
Contact: privacy@wearepamo.com
Address: Alcock House, 99 Chapel Street, Salford, Lancashire, M3 5EH
We are registered with the Information Commissioner's Office (ICO) under registration number [INSERT ONCE OBTAINED].
We collect the minimum data needed to provide the service. Here is every category, why we collect it, and the legal basis under UK GDPR:
| Data | Purpose | Legal basis |
|---|---|---|
| Email address, password hash | Account creation and authentication | Contract (Art 6(1)(b)) |
| Name, avatar colour | Squad profile display | Contract (Art 6(1)(b)) |
| Sex, age, height, weight | Calorie target and macro calculation; AI coaching | Explicit consent (Art 9(2)(a)) — health data |
| Workout logs, exercise sets | Squad feed, leaderboard points, AI coaching | Explicit consent (Art 9(2)(a)) — health data |
| Meal logs, calorie and macro entries | Nutrition tracking; calorie target progress | Explicit consent (Art 9(2)(a)) — health data |
| Progress photos | Personal transformation tracking; week-on-week comparisons | Explicit consent (Art 9(2)(a)) — health/biometric data |
| Weight log history | Progress charts; AI coaching; calorie target adjustment | Explicit consent (Art 9(2)(a)) — health data |
| Location (approximate) | Discover: surfacing public squads near you | Consent (Art 6(1)(a)) — only when Discover is enabled |
| Device health data (steps, calories) | Automatic activity logging; leaderboard points | Explicit consent (Art 9(2)(a)) — synced from Apple Health or Garmin with your permission |
| Payment data | Processing Pro subscriptions and Founding Member payments | Contract (Art 6(1)(b)) — handled directly by Stripe; we never see card numbers |
| Email address for marketing | PAMO product updates and news | Consent (PECR / Art 6(1)(a)) — separate opt-in; withdraw any time in Settings |
| Consent records | Audit log of what you consented to and when | Legal obligation (Art 6(1)(c) / Art 7) |
We do not collect data we do not need. We do not use your data for advertising. We do not sell your data to any third party.
Weight, body measurements, workout logs, meal logs, progress photos and synced device health data are special category data under Article 9 of the UK GDPR. We process this data only on the basis of your explicit consent, given when you set up your account.
You can withdraw consent at any time by going to Settings → Your data → Withdraw health data consent. Withdrawal will prevent further processing; it does not make past processing unlawful. If you withdraw consent, core features of PAMO will no longer function and we will prompt you to delete your account or keep a basic account without health features.
PAMO's AI coaching feature is powered by Claude, made by Anthropic. When you use the Coach feature, relevant data from your account — including recent workout logs, meal summaries, weight history and your stated goal — is sent to Anthropic's API to generate your coaching response.
We share your data only with the processors listed below, all under written Data Processing Agreements:
| Processor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| Supabase | Database, authentication, file storage | EU (London region) | Within UK adequacy / EU |
| Anthropic | AI coaching | United States | Standard Contractual Clauses (IDTA) |
| Stripe | Payment processing | United States | UK-US Data Privacy Framework |
| Vercel | Application hosting and delivery | United States / Edge | Standard Contractual Clauses (IDTA) |
We do not share your data with any other third parties, including advertisers, data brokers, or analytics companies.
PAMO is a social product. Understanding what other squad members can see is important:
We keep your data for as long as your account is active. If you delete your account:
Accounts with no login activity for 3 years will receive a notice email. If no response is received within 30 days, the account and associated health data will be deleted.
Under UK GDPR you have the following rights:
We will respond to all rights requests within one calendar month.
PAMO uses only strictly necessary cookies and local storage to maintain your login session. We do not use advertising cookies, tracking pixels or third-party analytics scripts. No cookie consent banner is required as a result.
PAMO is intended for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you become aware that a minor has created an account, please contact us at privacy@wearepamo.com and we will delete the account promptly.
We protect your data using industry-standard measures: all data is encrypted in transit (TLS 1.2+) and at rest; database access is controlled by row-level security policies so each user can only access their own data; progress photos are stored in private buckets inaccessible without a signed URL; and access to the production database is restricted to named personnel.
In the event of a personal data breach that is likely to result in high risk to your rights, we will notify you without undue delay and report to the ICO within 72 hours of becoming aware, as required by UK GDPR Article 33.
If we make material changes to how we process your personal data — particularly special category health data — we will notify you in the app and ask for fresh consent before the change takes effect. The policy version number and effective date at the top of this document will be updated. Non-material changes (wording, formatting) will be published without notice.
For any privacy question or to exercise your rights:
Email: privacy@wearepamo.com
Post: Pace and Motion Limited, [REGISTERED ADDRESS]
We aim to respond within 5 working days and will always respond within the statutory one-month limit.