Exceed OS: Privacy Policy

Last updated: 23 June 2026 Version: 1.0

1. About this Policy

This Privacy Policy explains how Exceed Nutrition Ltd ("Exceed", "we", "us", "our") handles personal data in connection with Exceed OS (the "Platform"), our web platform and all its desks (the Coaching Desk, Meal Plan Desk and Asset Desk), the Academy and The Exceed Way.

Exceed OS is a licensed software-and-content platform (the operating system for nutrition and wellness coaches) providing educational and business-support tooling. Our customers (each a "Member", "you", "your") subscribe as businesses. A Member's own end client is a "Client". Exceed has no contract or relationship with Clients. This is important and explained in Section 5.

We are not a healthcare provider, not a medical service and not an AI health advisor. The Platform retrieves pre-authored, general, educational material; it does not diagnose, give clinical or nutritional advice for any named individual, or generate personalised health recommendations.

This Policy applies to personal data we handle as a controller. It does not, and is not intended to, cover personal data that a Member processes about their own Clients through the tools. See Section 5.

2. Who we are: controller and contact details

For the personal data described in Section 4, the controller is:

• Controller: Exceed Nutrition Ltd
• Company number: company number NI635845
• Registered office: 8 Church Court, Holywood, Northern Ireland, BT18 9FP
• General contact: hello@exceednutrition.com
• Privacy / data protection contact: privacy@exceednutrition.com
• Legal contact: legal@exceednutrition.com

We act as a controller under the UK GDPR and the Data Protection Act 2018 (DPA 2018). Where we have EU/EEA customers, we also have regard to the EU GDPR.

3. Our data posture in plain terms: "we hold almost nothing"

We have deliberately built Exceed OS to hold as little personal data as possible.

• Today the Platform runs largely in your browser. Most of what you create (drafts, selections, the Content you assemble for your Clients) is stored locally on your own device (browser local storage), not on our servers.
• We hold minimal Member data: essentially what we need to give you an account, take payment, and support you.
• Client information that you enter into the tools stays under your control. It is held in your browser / local storage. We do not store, access, review, supervise or otherwise process it. For that data, you are the controller and we are not your processor (see Section 5).
• We do not sell personal data, and we do not use Client data to profile individuals or to train AI/ML models.

If and when we introduce optional account or cloud-storage features, that processing will be governed by an additional Data Processing Agreement (DPA), and we will update this Policy before any such feature affects you. See Sections 5 and 12.

4. Personal data we collect about Members, and why

We collect the following categories of personal data about Members (and, where a Member is a company, about its authorised individual users):

We do not ask Members to provide special-category (health) data about themselves in order to use the Platform. Please do not send us health information about yourself or your Clients.

Legitimate interests. Where we rely on Art 6(1)(f), our interests are operating, securing and improving a subscription platform and communicating with our business customers. We have balanced these against your rights and consider the processing limited and expected. You may object. See Section 11.

Payment processing

We use Stripe to process payments. Card details are entered directly with the payment processor; we receive only limited transaction data (such as a token, the last four digits, and the payment status). The payment processor acts as an independent controller and/or processor for that data under its own terms and privacy notice.

5. Client data: the crucial distinction

This is the most important part of this Policy for coaches.

When you use the tools to prepare materials for, or about, your Clients (for example entering a Client's name, goals, preferences, intake answers, allergens or notes), that personal data is processed by you, on your device, under your control.

• You are the controller of your Client data. You decide why and how it is processed.
• We are not a processor of your Client data, because today that data is held in your browser / local storage and is not transmitted to, stored by, accessed by, reviewed by or supervised by Exceed.
• We owe no duty to your Clients. Clients are not our customers and are not third-party beneficiaries of any contract with us.
• You are responsible for the lawful basis for processing your Client data, for any consent (including explicit consent for health/special-category data), for client-facing privacy notices, for suitability, safeguarding and referrals to healthcare professionals, and for putting your own client-facing terms and consents in place.

Because much Client data in a coaching context will be special-category (health) data, you must ensure you have a valid Art 9 UK GDPR condition (typically the Client's explicit consent) and your own appropriate-policy and records where required.

If we launch cloud storage in future. If we introduce a feature that stores Client data on our servers, our role for that feature will change: we would then act as your processor, and a separate Data Processing Agreement (Art 28 UK GDPR) would govern it. We would not enable cloud storage of special-category/health Client data without a mechanism for your Clients' explicit consent and appropriate safeguards. We will make any such change clear before it takes effect.

6. Local storage: what it is and why we use it

The Platform uses your browser's local storage (and similar technologies) to save your work and settings on your own device.

• This is strictly necessary for the Platform to function and to deliver the service you have asked for.
• It is used for service delivery, not tracking. We do not use local storage to build advertising profiles or to follow you across other websites.
• Because it is strictly necessary for a service you have requested, it does not require consent under the Privacy and Electronic Communications Regulations 2003 (PECR) / the ePrivacy rules.

You can clear local storage through your browser, but doing so will delete locally-saved work that is not stored elsewhere.

7. Cookies and analytics

Our current posture is minimal and essentially cookieless: we use only strictly necessary cookies/storage required to run the Platform and keep it secure. We do not currently run advertising cookies or non-essential third-party tracking.

If we introduce non-essential analytics or marketing technologies in future, we will:

• present a consent banner with a genuine, granular opt-in (non-essential cookies off by default, "reject all" as easy as "accept all"), in line with PECR and ICO guidance; and
• update our cookie information accordingly.

8. Sub-processors and other recipients

We share Member personal data only with the service providers we need to run the Platform, and only as necessary. Current categories include:

We may also disclose personal data to professional advisers, to a buyer (or prospective buyer) in connection with a sale or reorganisation of our business, and to regulators, courts or law enforcement where required by law.

A current list of sub-processors and recipients is available on request from privacy@exceednutrition.com.

We require our processors to act only on our instructions and to keep personal data secure (Art 28 UK GDPR).

9. International transfers

Some of our providers (Section 8) may process personal data outside the UK/EEA, including in the USA.

Where we transfer personal data outside the UK, we rely on:

• transfers to countries covered by UK adequacy regulations (and, for EU data, an EU adequacy decision) where available; or
• the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs); and the EU SCCs for EU/EEA-origin data; together with any supplementary measures required.

A copy of the relevant safeguards is available on request from privacy@exceednutrition.com.

10. How long we keep data (retention)

We keep personal data only as long as we need it:

• Account data: for the life of your subscription and then deleted or anonymised on closure, save where we must keep limited records (see below).
• Billing and financial records: retained for 6 years after the relevant financial year to meet UK tax and accounting obligations (HMRC).
• Support correspondence: typically 24 months after the matter is closed.
• Security/usage logs: kept for a short period for security and diagnostics, typically 90 days.
• Marketing data: until you withdraw consent or object, then suppressed/deleted.

On closure, we delete or anonymise your account data, subject to the limited records we are legally required to keep. Work held only in your browser's local storage remains on your device and is your responsibility to retain or delete.

11. Your rights

Under the UK GDPR (and, for EU data, the EU GDPR) you have the right to:

• access your personal data;
• rectify inaccurate or incomplete data;
• erasure ("right to be forgotten"), where applicable;
• restrict processing in certain circumstances;
• data portability for data you provided where processing is based on consent or contract and is automated;
• object to processing based on our legitimate interests, and to object to direct marketing at any time; and
• withdraw consent at any time where we rely on consent (this does not affect prior processing).

To exercise any of these rights, contact privacy@exceednutrition.com. We will respond within one month (extendable for complex requests). We may need to verify your identity. There is normally no charge.

Note that for Client data you control, individuals should exercise their rights with you, the Member, not with us, because we do not hold or control that data (Section 5).

Complaints

If you have a concern, please contact us first so we can try to resolve it. You also have the right to complain to the UK supervisory authority, the Information Commissioner's Office (ICO): ico.org.uk. If you are in the EU/EEA, you may complain to your local supervisory authority.

12. Future account / cloud features and AI

If we introduce optional account or cloud-storage features that involve us storing personal data (including Client data) on our servers, additional terms (including a Data Processing Agreement for any Client data we process on your behalf) will apply, and we will update this Policy beforehand.

Any future AI features will be designed to retrieve authored Content, not to generate personalised health advice. Member (human) judgement will always be required. We will not make automated decisions producing legal or similarly significant effects about Clients, and we will not use individual Client data as input to train or fine-tune AI/ML models.

13. Children

The Platform is intended for business users aged 18 and over. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. Members are responsible for any age-related rules and consents that apply to their own Clients.

14. Security

We use appropriate technical and organisational measures to protect personal data, including access controls, encryption in transit, and minimising what we hold. No system is perfectly secure, but our "we hold almost nothing" posture is itself a core safeguard.

15. Changes to this Policy

We may update this Policy from time to time. We will change the "Last updated" date and, for material changes (including any move to cloud storage or new analytics), give you reasonable notice by email or in-Platform before the change takes effect.

16. Governing law

This Policy and any non-contractual obligations arising from it are governed by the law of England and Wales, and the courts of England and Wales have jurisdiction, subject to any mandatory data protection and consumer protections that apply in a consumer-Member's home country.