Privacy

Privacy policy

Version 1.0. Last updated 8 October 2026.

This policy covers the ArcForm app in the United Kingdom, the United States, Canada, Australia and New Zealand, and our website, getarcform.com. The website sets no cookies and has no analytics or tracking tools. Cloudflare, which serves it, handles your IP address to deliver and protect it.

The short version

• The camera picture is read on your phone and thrown away. We never record or upload video, photos or audio.
• What you tell ArcForm, and the numbers from your sessions, include health information. We keep a copy on our server under your account so your plan can run. We only do this with your clear agreement.
• For each set we keep the record of where your joints were, frame by frame, as numbers, together with the numbers worked out from it. We never record or keep video.
• Arc is an AI. What Arc needs is sent through our server to Anthropic, the company that makes it. Anthropic does not use it to train its models.
• We only use your data to improve ArcForm for everyone if you say yes to "Help ArcForm get better for everyone".
• No adverts. No analytics or tracking tools. We never sell your data.
• You can download everything, or delete your account, in Settings.

1. Who we are

ArcForm is provided by GETARCFORM LTD, a company registered in England and Wales with company number 17505698. Our registered office is 5th Floor, 167-169 Great Portland Street, London, W1W 5PF.

We decide how your data is used, which makes us the "controller" under UK data protection law. We are registered with the UK Information Commissioner's Office. Our registration number is C2060705.

Privacy questions and requests: privacy@getarcform.com. Everything else: support@getarcform.com.

2. What we collect

Your account

You can make an account with Sign in with Apple, or with an email address and a password.

• Sign in with Apple: the account id Apple gives us, and your email address. If you chose Apple's "Hide My Email", we get Apple's relay address instead of your real one. We also keep a sign-in token from Apple, so we can switch off the link with Apple when you delete your account.
• Email and password: your email address, and a salted hash of your password. That is a scrambled form of it that cannot be turned back into the password. We never keep the password itself, and nobody at ArcForm can read it.
• The one-time codes we email you to confirm your address or to set a new password. A code lasts ten minutes, is kept in scrambled form, and is deleted as soon as it is used.
• A session key so you stay signed in, which lasts about 180 days.

About you

• Your first name, age and gender.
• The kit you have, the sports you do and the days you train.
• If you add a profile picture, it stays on your phone. It is never sent to us or to anyone else.

Where it is sore, and your answers about it

• Where it is sore, including the spot you mark on the body.
• Pain from 0 to 10, how it started, and what you want to get back to.
• Your answers to the safety questions, and whether it has been looked at. If you confirm you have been seen and told it is fine to exercise, we keep that answer with the date and the exact words you agreed to.

Measurements from the camera

• From the movement check and from your sessions: for each set, the record of where your joints were in each frame, as numbers, together with the numbers worked out from it (reps, holds, range, tempo, timings, which side).
• Never video, photos or audio. We never record or keep video. The camera picture is processed on your phone and never leaves it. Our server only accepts the numbers: it refuses a file that holds video, a picture or sound.

Your plans and reports

• Every plan, each change to it and why, and your reports.

After each session

• Your ratings of how it went, pain scores, the kind of pain and when it came on, and any comments.

Arc

• Your messages to Arc and Arc's replies.
• The notes Arc writes each week so it can remember you between chats.
• If you speak instead of typing, your iPhone turns your speech into text on the phone. Only the text is used. No audio leaves your phone.

What ArcForm works out about you

• A training focus: one to three codes that the AI picks from our fixed list when it builds your plan. They are in our own plain words, such as which area to build up. They are not medical terms and they do not name a condition.
• The level of each exercise, and how the rules change it over time.
• If a get-it-checked notice was shown, a short note in plain words of why.

All of this is part of your data. You see it in "Download my data".

Other things

• Feedback you send us from the app, with its topic, the app version and the time.
• Your choices: each agreement you give or take back (health data, AI, emails, helping ArcForm get better), with the date and the version of the wording you saw.
• Subscription status: Apple's signed record that your introductory offer or subscription is running and when it runs out. We never get your card details.
• Technical data: counts of your requests, so the limits work, and basic server logs (which part of the server was called, a random code that stands for your account, whether it worked, how long it took). The logs do not contain your name, your email, what you said or your health information. Cloudflare, which runs our server, handles your IP address to deliver and protect the service. We do not keep IP addresses with your account.

If you sign up to test ArcForm on our website

We keep the email address you give us and the date you signed up, and nothing else. We use it only to send you emails about the beta: how to install the test version through Apple's TestFlight, reminders, short questionnaires, and news of the launch. Your legal basis is that you asked us to (consent). We keep it until the beta and launch are over, or until you ask us to delete it: email privacy@getarcform.com, or reply to any of our emails. Resend sends these emails for us (see section 5).

If you ask to be in one of our videos

We keep your email address, the date, and the answers you give on the questions page: your first name, age, sport, where it hurts and what it's like, how it started and what you want to get back to. Some of that is health information, so we only keep it if you tick the box agreeing that we can use it in a video (explicit consent). We use it only to pick people and make videos about them, and we only ever use your first name in a video. It isn't linked to an app account. Fred, who makes the videos, is the only person who reads it. We keep it for up to 12 months, or until you ask us to delete it: email privacy@getarcform.com. Resend sends the email with your link (see section 5).

What we do not collect

Video, photos, audio recordings, precise location, contacts, your photo library, Apple Health data, advertising identifiers, or anything from other apps or websites. A profile picture you choose or take is kept on your phone only.

Where it comes from

Almost all of it comes from you and from your phone's camera while you use the app. If you use Sign in with Apple, your account id and email come from Apple when you sign in. If you sign in with an email and password, they come from you. Your subscription status comes from Apple. The training focus, plan changes and Arc's notes are produced by ArcForm from what you gave it.

3. Why we use it, and our legal basis

Health information gets extra protection in law. In the UK it is "special category data". We only use yours with your explicit consent. You give it on the sign-in page, before you sign in and before setup, by ticking the box that says ArcForm can keep your health and movement details and use AI to build your plan. The box starts unticked. Agreeing to the Terms of Use is a second, separate box.

If you take back your consent for health data or for AI, we can no longer run ArcForm for you, because the service cannot work without them. You do this in Settings. It ends the service, and you can then delete your account.

Saying no to helping ArcForm get better, or to emails, changes nothing about the service. You can change either in Settings at any time.

We do not use your data for advertising. We do not sell it. We do not share it for anyone else's marketing.

4. AI

Arc is an AI, built on Claude models made by Anthropic. Arc is not a person. AI is used to:

• ask follow-up questions in setup
• build your first plan from our exercise library, and pick your training focus from our fixed list
• write your reports and explain changes
• chat with you, and write its notes about you.

To do that, our server sends Anthropic what the task needs. Depending on the task that can include your first name, age, gender, kit, sports and training days, where it is sore and your answers about it, your safety answers, movement-check and session numbers, your plan, your ratings and pain scores, your chat and Arc's notes.

We do not send Anthropic your email address, your password, your Apple account id or your raw joint-position recordings.

Anthropic acts on our instructions. Under its commercial terms it does not use what we send to train its models, and it deletes inputs and outputs within 30 days by default. If Anthropic's automated safety systems flag a message as breaking its usage rules, Anthropic can keep that message for up to two years, and its safety scores for up to seven.

AI can be wrong. A separate check on our server stops Arc's replies naming medical conditions before they reach you.

5. Who receives your data

We use these companies to run ArcForm.

Cloudflare, Anthropic and Resend are our processors. They act only on our instructions, under written data processing agreements. Apple acts for itself under its own privacy policy.

If you opt in to emails about news and offers, the company that sends them for us will receive your email address and first name. We will name it here before we send any.

We may also disclose data if the law requires it, or to establish or defend a legal claim. If another company ever takes over ArcForm, your data would move to it under this policy, and we would tell you first.

We do not sell your data. We do not share it for advertising. Nobody else receives it.

6. Sending data outside your country

We are in the UK. Our providers are in the United States, and Cloudflare runs on a worldwide network. So your data is processed outside the UK, and outside Canada, Australia and New Zealand if you live there.

For data from the UK, the safeguard we rely on is contractual. Our agreements with Anthropic and with Cloudflare each include the UK Addendum to the European Commission's standard contractual clauses, approved by the UK Information Commissioner. These clauses bind the provider to protect your data to the UK standard. Where a provider is also certified under the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge"), that applies as well, but we do not depend on it.

You can ask us for a copy of these clauses at privacy@getarcform.com.

The law in the United States is different from the law where you live. Courts and authorities there may be able to require access to data held there.

7. How long we keep it

When you delete your account we delete your data from our live systems straight away. We do not keep your rows with the name taken off. Only true totals across many people remain.

8. Your rights

Wherever you live, you can:

• See and download your data. Settings, then "Download my data". You get everything we hold, including Arc's notes and what ArcForm has worked out about you, in a file you can keep or move elsewhere.
• Delete your data. Settings, then "Delete account". This removes everything on our server, including your email address and the hash of your password, and switches off the Sign in with Apple link if you used it. It does not cancel your subscription with Apple, so cancel that first.
• Correct your data. Change your answers in the app, or ask us.
• Take back consent. In Settings, at any time. It does not affect what was done before.
• Object to, or ask us to limit, uses we base on legitimate interests.
• Complain. To us first if you are willing, then to your regulator (see section 12).

You can also email privacy@getarcform.com. We may need to check it is really you. We do not charge.

We reply within one month, or sooner where your country's law says so (30 days in Canada and Australia, 20 working days in New Zealand). If a request is complicated we may need longer, and we will tell you within the first month.

We acknowledge complaints about how we use your data within 30 days, look into them without delay, and tell you the outcome.

9. Age

ArcForm is for people aged 18 and over. The age question in setup stops anyone under 18 going further. We do not knowingly collect data from anyone under 18. If you think someone under 18 has used ArcForm, tell us and we will delete their data.

10. Security

• Data is encrypted while it travels between your phone, our server and our providers.
• Data on our server is encrypted at rest by Cloudflare.
• Each person's data is kept apart under their own account, and the server only answers a signed-in person for their own data.
• Files on your phone use iOS data protection, which locks them when your phone is locked.
• Our server logs do not contain your health information.
• Very few people can access the server, and access is protected with two-step sign-in.

If you back up your iPhone to iCloud or a computer, Apple's backup may include ArcForm's files on your phone. Apple's own protections apply to that.

No system is perfectly secure. If a breach puts you at risk, we will tell you and the relevant regulator as the law requires.

11. Automated decisions

ArcForm makes decisions about your training automatically, with no person involved:

• AI builds your first plan from your answers and our exercise library.
• Fixed rules make exercises easier, harder or keep them the same, from your ratings and pain scores.
• Fixed rules decide what happens if you report a serious sign. For two of them ("can't put weight on it", and numbness or spreading) no plan is built until you confirm you have been seen and told it is fine to exercise.

These decisions affect only your training plan inside the app. We do not think they have a legal or similarly significant effect on you. Even so, you can ask why a decision was made, tell us you disagree, and ask for a person to look at it. Email support@getarcform.com.

12. Extra information for your country

United Kingdom

UK GDPR and the Data Protection Act 2018 apply. You have the rights in section 8, including access, correction, deletion, restriction, objection and data portability.

You can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would like the chance to put things right first.

United States

• We do not sell your personal information. We do not share it for cross-context behavioural advertising. We do not use it for targeted advertising or for profiling that produces legal or similarly significant effects.
• We collect sensitive information, including health information, only with your consent and only to provide ArcForm.
• Whichever state you live in, you can use the rights in section 8: to know, access, correct, delete and get a copy of your data, and to take back consent. We will not treat you differently for using them.
• If we refuse a request, you can appeal by replying to our decision or emailing privacy@getarcform.com with "Appeal" in the subject. We will answer in writing within 45 days. If you are still unhappy you can contact your state's Attorney General.
• Washington and Nevada. We have a separate Consumer Health Data Privacy Policy that covers the rights given by Washington's My Health My Data Act and Nevada's consumer health data law. It is at getarcform.com/consumer-health-data and linked from the home page of our website.
• California. The categories of personal information we collect are in section 2, the purposes in section 3, and who receives it in section 5. The app does not track you over time or across other companies' apps and websites, so it has nothing to change in response to a "Do Not Track" signal.
• ArcForm is not covered by HIPAA. We are not your healthcare provider.

Canada

• We handle your personal information under PIPEDA and the provincial laws that apply to you. By ticking the box on the sign-in page you give express consent to the collection, use and disclosure described here.
• Your information is processed outside Canada, in the United Kingdom and the United States, and can be accessed by courts and authorities there under their laws.
• You can ask for access to, or correction of, your information. We answer within 30 days.
• The person responsible for personal information at ArcForm is our director. Contact: privacy@getarcform.com.
• You can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca, or to your provincial privacy commissioner.

Australia

• We handle your personal information in line with the Privacy Act 1988 and the Australian Privacy Principles. Health information is sensitive information, and we collect it only with your consent.
• If you do not give us the information we ask for, we cannot build or run your plan.
• We disclose your information to recipients overseas: ourselves in the United Kingdom, and Cloudflare, Anthropic and Resend in the United States.
• You can ask for access to, or correction of, your information. We answer within 30 days.
• To complain, email privacy@getarcform.com. We will answer within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

New Zealand

• We handle your personal information under the Privacy Act 2020 and its information privacy principles.
• Your information is held outside New Zealand, in the United Kingdom and the United States, under the safeguards in section 6.
• You can ask for access to, or correction of, your information. We answer within 20 working days.
• You can complain to the Office of the Privacy Commissioner at privacy.org.nz.

13. Changes to this policy

We will update this policy when ArcForm or the law changes. The date at the top shows the latest version. If a change matters, we will tell you in the app before it applies. If we ever want to use your health information for a new purpose, we will ask for your consent first.