Privacy policy

Who we are

Salus (trading as Plena Wellness) is the seller and operator of the Salus fitness and wellness app, and is the data controller for the personal data described in this policy. This policy explains what we collect, why, and what control you have. You can contact us at privacy@plenawellness.com.

What we collect

• Account data: email address, display name, avatar, unit preference, timezone and weekly goal.
• Health and fitness data: activities you log, GPS traces and saved routes, wellness and mindfulness sessions, mood check-ins, hydration and meals, and metrics such as sleep, resting heart rate, HRV and weight.
• Imported data: files you choose to import from other services or devices. We only read the columns you map.
• Community content: posts, comments, reactions and group membership.

Location data

GPS location is read only while you have an activity actively recording, and only after you grant permission. Traces are stored against the activity in your own account. You can delete any activity or route at any time, which deletes its trace.

How your data is used

Your data is used to show you your own history, calculate metrics such as pace, cadence and elevation, drive your reminders, and generate AI insights on request. AI insight generation sends a summary of your own recent activity and metrics to our AI provider to produce the written analysis. It is never used to train third-party models, and it never includes another member's data.

What is private and what is shared

Everything you log is private to your account by default. The only content other members can see is what you deliberately post to the community or a group, along with your display name and avatar.

If you join a group goal, approved members of that group can see your display name, rank, percentage progress and the distance, time or weight change counted toward that goal. For weight goals we never reveal your starting weight, current weight or individual readings.

Legal basis for processing

• Performance of a contract: creating and running your account, storing the data you log, delivering your plan features, and fulfilling subscriptions.
• Explicit consent: health and fitness data, wellness data, GPS location and device/third-party imports. Optional analytics and marketing consent are requested separately and are off unless you choose them.
• Legitimate interests: keeping the service secure, preventing fraud and abuse, and improving the product using aggregated usage data.
• Legal obligation: tax, accounting and responding to lawful requests.

Who we share data with

• Merchant of Record (Paddle): our order process is conducted by our online reseller Paddle.com, which is the Merchant of Record for all our orders. When you buy or manage a subscription, Paddle processes your name, email, billing/location details and payment data as its own controller for payment, subscription management, tax compliance, invoicing and customer service. Paddle shares the subscription status and identifiers we need to grant your plan. See Paddle's privacy notice at https://www.paddle.com/legal/privacy.
• Service providers: hosting and database, product analytics, email delivery, and our AI provider for insight generation — each processing only on our instructions.
• App stores: Apple and Google, where you purchase inside the mobile apps.
• Professional advisers (legal, accounting) and authorities where required by law.

International transfers

Some of our providers, including Paddle, operate outside your country. Where data leaves the UK or EEA we rely on adequacy decisions or Standard Contractual Clauses with appropriate safeguards.

Selling data

We do not sell your personal or health data, and we do not use it for advertising.

Security

We use appropriate technical and organisational measures, including encryption in transit, encrypted storage, row-level access controls so records are only readable by their owner, and least-privilege access for staff.

Cookies

We use essential cookies for sign-in and security. Product analytics does not start unless you opt in, and you can turn it off in Settings. Paddle sets cookies necessary to complete checkout. Blocking essential cookies will break sign-in.

Your consent choices

We keep a dated record of the policy version and each consent choice. Optional analytics and marketing consent can be withdrawn in Settings. Salus cannot provide health and wellness tracking after core health-data consent is withdrawn; export anything you need, then delete your account or contact us to stop that processing. A material policy change will ask you to review and consent again.

Your rights

You can export a full copy of your data or delete your account permanently from Settings. Deletion removes your activities, routes, wellness records, metrics, reminders, insights and community content. It cannot be undone.

Depending on where you live, you also have the right to access, correct, erase, restrict or object to processing, to data portability, to withdraw consent, and to complain to your data protection supervisory authority. Email privacy@plenawellness.com and we will respond within one month.

Retention

We keep your data while your account is open. Deleted accounts are removed from live systems immediately and purged from backups within 30 days.

Children

Salus is not intended for anyone under 16.

Contact

Questions about this policy: privacy@plenawellness.com