Legal

Privacy Policy

Last updated 19 September 2026

1. Who we are

Kova is operated by KOVA FITNESS LTD, a company registered in England and Wales under company number 17402598, with its registered office at 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

We are the data controller for the personal data described in this policy. You can contact us at privacy@getkova.fit.

2. The short version

• Kova collects health and fitness data because that is what the app is for. We cannot provide training, nutrition or recovery guidance without it.
• We do not sell your data, and we do not use your health data for advertising.
• Health data is special category data. We process it only with your explicit consent, which you can withdraw at any time.
• You can export or delete everything we hold from within the app.

3. What we collect

Account information

Your email address and, if you sign in with Apple, the name and email Apple chooses to share with us. If you use Apple's Hide My Email, we only ever see the relay address.

Profile and health information you give us

Height, weight, age, sex, body fat percentage where provided, training experience, available equipment, training goal, injuries and physical limitations, dietary preferences and allergies, and your answers to our pre-exercise health screening — including whether you have indicated pregnancy, being postpartum, or a history of disordered eating.

Data from Apple Health, with your permission

Where you grant access, we read: heart rate and heart-rate variability, resting heart rate, sleep analysis, workouts, active energy, steps, distance, cycling and running metrics, VO₂ max, and workout routes. We also write workouts you record in Kova back to Apple Health. You control this access in the Health app and can revoke it at any time.

Activity you record in Kova

Sessions, sets, weights, repetitions, perceived exertion, session notes, food and drink logs, saved meals and recipes, body weight entries, and progress photos.

Location

For outdoor workouts you choose to track, we record GPS location to produce a route, distance, pace and elevation profile. Location is only collected during an active workout you have started. We do not track your location in the background at any other time.

Technical and usage information

Device model, operating system version, app version, crash diagnostics, error reports, and basic analytics about which features are used and where people stop during setup.

Launch waitlist

If you leave your email address on getkova.fit, we keep it — with your consent — only to tell you when Kova is available on the App Store. We don't use it for anything else and don't share it with anyone beyond our database provider. Email support@getkova.fit and we'll remove it.

4. Health data and our lawful basis

Most of what Kova holds is special category data concerning health under Article 9 of the UK GDPR, which carries stricter protection than ordinary personal data.

• Explicit consent — Article 9(2)(a) — is our condition for processing health data. You give this when you complete onboarding and when you grant Apple Health access. You may withdraw it at any time by revoking Health permissions, or by deleting your account.
• Performance of a contract — Article 6(1)(b) — is our lawful basis for processing your account and subscription information in order to provide the service you have signed up for.
• Legitimate interests — Article 6(1)(f) — covers diagnostics, fraud prevention and keeping the app working, balanced against your rights.

Withdrawing consent does not affect processing that took place before you withdrew it. If you withdraw consent for health data, we can no longer provide the core service.

5. What we use it for

• Generating and adapting your training plan.
• Calculating calorie and macronutrient targets.
• Producing recovery scores, training load, progression suggestions and personal records.
• Providing the in-app coach and answering your questions in context.
• Sending notifications you have opted into, such as session reminders.
• Diagnosing crashes and errors, and improving the app.
• Managing your subscription and providing support.

We do not use your data to make solely automated decisions producing legal or similarly significant effects.

6. The in-app coach and AI processing

Kova's coach is powered by a large language model provided by Anthropic. When you use the coach, we send it a summary of your profile, recent training, nutrition and recovery so it can answer usefully. Anthropic processes this on our behalf as a data processor under contract and, under our commercial terms, does not use it to train their models.

If you would rather this data were not sent, do not use the coach. The rest of the app works without it.

7. Apple Health

Data we read from Apple Health is used only to provide features inside Kova. Specifically, and in line with Apple's requirements, we confirm that we do not use Apple Health data for advertising or marketing, do not sell it or share it with data brokers, and do not disclose it to third parties except the processors listed below who help us operate the service.

8. Who we share it with

We use the following processors and service providers. Each is bound by contract to protect your data and to act only on our instructions.

We may also disclose data where we are legally required to, or to establish or defend legal claims. If our business is sold or reorganised, data may transfer to the acquirer, and we will tell you before that happens.

9. International transfers

Some of our providers are outside the UK. Where personal data is transferred outside the UK, we rely on the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an applicable adequacy decision, together with additional safeguards where appropriate.

10. How long we keep it

• While your account is open — we keep your training, nutrition and health data so the app can show your history and adapt your plan.
• On deletion — we delete your personal data within 30 days of you deleting your account, except where we must retain records for legal, tax or accounting purposes.
• Diagnostics — crash and error reports are retained for up to 90 days.
• Launch waitlist — we delete waitlist email addresses once we've sent the launch announcement, or sooner if you ask.
• Financial records — transaction records are kept for six years as required by UK tax law.

11. Your rights

Under the UK GDPR you have the right to: access a copy of your data; have inaccurate data corrected; have your data erased; restrict or object to processing; receive your data in a portable format; and withdraw consent at any time.

You can export your data and delete your account from within the app. For anything else, contact privacy@getkova.fit and we will respond within one month.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to address it first.

12. Security

Data is encrypted in transit and at rest. Access to your records is enforced at the database level, so one account cannot read another's data. Access by our staff is limited to what is necessary to operate the service and provide support.

No system is perfectly secure. If a breach affects your rights and freedoms, we will notify the ICO within 72 hours and tell you without undue delay where required.

13. Children

Kova is not intended for children. You must be at least 16 years old to create an account. We do not knowingly collect data from anyone under 16; if we discover that we have, we will delete it. If you believe a child has given us their data, contact us.

14. Changes to this policy

We will update this page when our practices change, and revise the date at the top. Where changes are significant we will notify you in the app before they take effect.

15. Contact

KOVA FITNESS LTD
71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
privacy@getkova.fit