Privacy
Raw By Design is designed to use personal information only where it improves a defined product decision, protects the service or fulfils a legal obligation. This notice explains the intended data-handling standard for the RBD app.
Controller and scope. For this notice, Raw By Design ("RBD", "we", "us") is the controller of personal data processed through the app. Questions or rights requests: shefan@rawbydesign.app. The service is intended for people aged 18 or over.
Information we may process
- Account and access dataEmail address or account identifier, authentication records, account status and security events.
- Baseline and preference dataObjective, age context, height and weight where provided, normal sleep, energy, stress, movement, training, nutrition, hydration, focus, routine, interaction, constraints, available time and communication preferences.
- Current-state and outcome dataCheck-in responses, immediate priorities, action completion, reported effect, disagreement and corrections.
- Optional connected dataMovement, training, sleep, wearable or calendar information only when the user deliberately connects the source and grants the relevant permission.
- Technical and support dataApp and device version, limited diagnostic events, security logs and correspondence. RBD is designed not to place questionnaire answers, sensitive free text, passwords or access tokens in analytics or error logs.
Why we use information
- To provide the serviceCreate and maintain an account, save a baseline, produce decision support, personalise actions, preserve history and respond to requests. This is generally necessary to perform the user agreement.
- To protect and improve the servicePrevent misuse, maintain reliability, investigate faults and evaluate whether the decision system is functioning. Legitimate interests are used only where they are not overridden by the user's rights, with minimised or aggregated data where practical.
- With permissionOptional integrations, non-essential notifications, research participation, marketing and any future use that requires consent. Consent may be withdrawn without affecting earlier lawful processing.
- To meet legal obligationsComply with applicable law, enforce rights and respond to lawful requests.
Sensitive or health-related information
Some optional responses may reveal information about health, injury or limitation. RBD should collect no more detail than necessary, clearly mark optional fields, and use an appropriate lawful basis plus a separate special-category condition. Where explicit consent is used, it must be specific, recorded and withdrawable. RBD is not a healthcare provider and does not use these inputs to make clinical diagnoses.
Automated analysis and AI
RBD uses automated analysis and profiling to rank possible current constraints and produce non-clinical decision support. The output does not determine access to employment, credit, insurance, healthcare or public services and is not intended to create legal or similarly significant effects. Users can inspect evidence, correct inputs and disagree with the result.
RBD does not sell personal data. Onboarding answers or free text should not be sent to an external AI provider unless the feature identifies the purpose, data involved, provider category and user control before transmission. Language generation, where used, should not silently replace governed decision logic.
Who may process information
Data may be processed by selected providers supporting authentication, cloud hosting and database services, app distribution, email support, security and user-enabled integrations. RBD may also disclose information to professional advisers or authorities where legally required. Providers may process data only under appropriate instructions and safeguards.
Where data is processed outside the United Kingdom, RBD will use an applicable transfer mechanism and assess whether protection is materially lower than UK standards.
Security
RBD applies access controls, encryption in transit, platform or provider encryption at rest, restricted server privileges and controlled logging. No system is risk-free. Material incidents will be assessed, contained and notified where the law requires.
Retention and deletion
Account and baseline information is kept while the account is active and only as long afterwards as required for security, legal or dispute purposes.
Unsynchronised onboarding drafts may be held in encrypted local storage for no more than seven days and should be removed on completion, logout, account switch or account deletion.
Support and security records are retained according to their purpose. When an account is deleted, live account data is removed or anonymised through the controlled deletion process, subject to lawful retention and backup cycles.
Your rights
Depending on the processing and applicable exemptions, users may request access, correction, erasure, restriction, portability or objection, and may withdraw consent. RBD may need to verify identity before acting.
Requests and complaints
Send requests to shefan@rawbydesign.app. Users may also complain to the Information Commissioner's Office. Some rights are not absolute and may be limited by law.
Changes to this notice
Material changes will be stated clearly in-app or in an updated notice. Continued use will not be treated as consent where the law requires a separate affirmative choice.