Last updated on 30 July 2026
We respect your privacy and are committed to protecting it through our compliance with this privacy policy (“Policy”). This Policy describes the types of personal data and other information we may collect from you or that you may provide (“Personal Information”) on the “Phaze” mobile application (“Mobile Application”), coach.phaze-app.com coaching hub (“Platform”), and any of their related products and services (collectively, “Services”), and our practices for collecting, using, maintaining, protecting, and disclosing that Personal Information. It also describes the choices available to you regarding our use of your Personal Information and how you can access and update it.
If you are accessing the Services on behalf of a company or other legal entity, this Policy applies to your use in that capacity.
We encourage you to read this Policy carefully so that you understand how we collect and use your personal data. This Policy does not apply to the practices of third-party companies or individuals that we do not own or control.
Important notice about health data: Phaze processes sleep data (including sleep stage data, nap data and derived sleep metrics) collected via Apple HealthKit and Google Health Connect. This data is classified as health data and is a special category of personal data under the GDPR. Special category data attracts a higher level of legal protection. We process it only on the basis of Your explicit consent, which is sought separately from Your agreement to this Policy and recorded with a date and time stamp. For further details please see the “Other Data Collected in the Application” and “Legal bases for processing personal information” sections below.
For the purposes of this Privacy Policy:
You can access and use the Services by providing certain Personal Information (for example, your name and email address) that can be used to contact or identify You. We receive and store any information you knowingly provide to us when you create an account, or fill any forms on the Services. When required, this information may include the following:
– Account details (such as user name, unique user ID, password)
– Contact information (email address)
– Basic personal information (such as name and date of birth).
Usage Data may include information such as Your Device’s Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Services that You visit, the time and date of Your visit, the time spent on those pages, unique device identifiers and other diagnostic data.
When You access the Services by or through a mobile device, We may collect certain information automatically and store it in log files. This may be information including, but not limited to, the type of mobile device You use, Your mobile device unique ID, the IP address of Your mobile device, Your mobile operating system, the type of mobile Internet browser You use, unique device identifiers and other diagnostic data.
We may also collect information that Your browser sends whenever You visit our Services or when You access the Services by or through a mobile device.
Information collected automatically is used only to identify potential cases of abuse and establish statistical information regarding the usage and traffic of the Services. This statistical information is not otherwise aggregated in such a way that would identify any particular User of the system.
To provide features of the Application, while using the Application and with Your explicit consent, we may collect Your sleep data using integrations with third-party applications. Sleep data (including sleep stage data, nap data, and derived sleep metrics) is health data and is classified as a special category of personal data under UK GDPR. We only collect and process Your sleep data on the basis of Your explicit consent, which is sought via a separate in-app permission screen when You create Your first schedule, and not as part of Your general acceptance of this Policy.
Our Application has integrations with Apple Health Kit (HK) and Google Health Connect (HC) and uses the data in the following limited way:
Sleep stage data is retrieved from Apple Health or Google Health Connect on a daily basis once You have granted explicit consent for sleep data access. This daily retrieval keeps Your jet lag schedules current and, where You have Coaching Hub access, gives Your coach continuous visibility of Your sleep data, including outside of active trips. A one-time retrieval of Your historical sleep data – up to thirty (30) days or Your registration date, whichever is most recent – is used to baseline Your jet lag schedules and, where You have Coaching Hub access, to give Your coach insight into Your longer-term sleep patterns for more effective coaching. If this historical retrieval is unsuccessful for any reason, it will not be retried.
In addition, the Application collects nap data via a daily in-app question asking whether You took a nap (long nap: more than 45 minutes / short nap: 45 minutes or fewer). Nap data forms part of Your overall sleep information, is classified as health data, and is subject to the same explicit consent requirement and protections as Your sleep stage data. Nap data will also be displayed in the Coaching Hub to assist coaches in interpreting total sleep time.
Pictures and other information from your Device’s camera and photo library may also be collected with your prior Consent.
We use this information to provide features of our Services and to improve and customise our Services. The information may be uploaded to the Company’s servers and/or a Service Provider’s server or it may be simply stored on Your device.
You can enable or disable access to this information at any time through Your Device settings.
Phaze Shift Ltd is the Data Controller for all personal data collected and processed through the Services, and is responsible for determining the purposes and means of that processing.
Phaze Shift Ltd uses WharfCastle Consulting Ltd as its Data Processor for development, testing, and operational processing in connection with the Services. WharfCastle Consulting Ltd processes personal data only on Phaze Shift Ltd’s instructions and under a written Data Processing Agreement.
WharfCastle Consulting Ltd also uses a number of individual sub-contractors as Sub-processors, each bound by equivalent data protection obligations under their individual agreements with WharfCastle Consulting Ltd.
The Phaze Coaching Hub is available to users whose accounts are set up through an organisational agreement with Phaze Shift Ltd, or to direct-to-consumer subscribers who have purchased Coaching Hub access or chosen to join another user’s team. Where a user has Coaching Hub access through a corporate client, their derived sleep metrics (including total sleep time, sleep latency, sleep efficiency, and wake after sleep onset), nap data and post-schedule feedback responses, will be visible to employer-nominated coaches or managers who have been whitelisted by Phaze Shift Ltd. Coaches do not have access to Your raw sleep stage data.
Direct-to-consumer subscribers who have not purchased Coaching Hub access or joined a team will not have their data shared with or displayed in the Coaching Hub. Your employer or corporate client operates as a separate, independent data controller in respect of any coaching insights they receive via the Coaching Hub, and has its own legal obligations to inform You about how it further uses that information. We will update this Policy before we introduce any new category of data into the Coaching Hub.
To make the Services available to you, or to meet a legal obligation, we may need to collect and use certain Personal Information. If you do not provide the information that we request, we may not be able to provide you with the requested products or services.
The Company may use any of the information we collect from you for the following purposes:
Processing your Personal Information depends on the specific activity being carried out and how You interact with the Services. The lawful bases we rely on, and the processing activities to which each applies, are set out below:
Depending on the requested Services or as necessary to complete any transaction or provide any Services you have requested, we may share your information with our contracted companies, and Service Providers we rely upon to assist in the operation of the Services available to you and whose privacy policies are consistent with ours or who agree to abide by our policies with respect to Personal Information.
Service Providers are not authorised to use or disclose your information except as necessary to perform services on our behalf or comply with legal requirements. Service Providers are given only the information they need to perform their designated functions and may not use or disclose it for their own marketing or other purposes.
We use third-party Service Providers to monitor and analyse the use of our App. We use the information obtained from these analytics tools to monitor the performance and improve our App. We do not use third-party analytics tools to track or to collect any personally identifiable information of our Users and we will not associate any information gathered from the statistical reports with any individual User.
We may also disclose any Personal Information we collect, use or receive if required or permitted by law, such as to comply with a subpoena or similar legal process, and when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.
All payments for our Direct-to-Consumer (D2C) services are processed securely via our third party payment processor. We do not handle, store, transmit, or have access to your payment details at any time. By choosing to purchase our services, you agree to the payment processor’s own terms and conditions and privacy policy, which govern the handling of your payment information and which are made available to you in-app during the payment process.
We will retain and use your Personal Information for the period necessary to comply with our legal obligations, as long as your user account remains active, until the Services are fulfilled, to enforce our Policy, resolve disputes, and unless a longer retention period is required or permitted by law.
We may use any aggregated data derived from or incorporating your Personal Information after you update or delete it, but not in a manner that would identify you personally. Once the retention period expires, Personal Information shall be deleted.
Full details about our data retention and data deletion processes are documented in the Phaze Shift Data Retention Policy. You xan request a copy of the policy by contacting us using the details in the Contacting Us section.
All personal data collected through the Services is stored on servers located within the United Kingdom and is not transferred outside the United Kingdom for storage purposes. Where sub-processors engaged by Our Data Processor are located within the European Union, any remote access to personal data is covered by the United Kingdom’s adequacy decision in respect of the European Union and does not require additional transfer mechanisms under UK GDPR.
Where We use Service Providers located outside the European Union, we will only transfer personal data to them where the transfer is governed by a UK International Data Transfer Agreement (IDTA) or other legally compliant mechanism providing appropriate safeguards. You may request a copy of the applicable transfer safeguard by contacting us using the details in the Contacting Us section.
Disclosures for residents of the UK and the EU/EEA
If you are a resident of the United Kingdom (“UK”) or European Union (“EU”), the European Economic Area (“EEA”), you have certain rights in relation to your Personal Information based on the UK Data Protection Act 2018 and UK General Data Protection Regulation (GDPR) that we comply with as part of our commitment to your privacy. Unless otherwise expressly stated, all terms in this section have the same meaning as defined in the UK GDPR.
(a) Right to withdraw consent: You have the right to withdraw consent where you have previously given your consent to the processing of your Personal Information. To the extent that the legal basis for our processing of your Personal Information is consent, you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing before the withdrawal.
(b) Right to access: You have the right to learn if your Personal Information is being processed by us, obtain disclosure regarding certain aspects of the processing, and obtain a copy of your Personal Information undergoing processing.
(c) Right to rectification: You have the right to verify the accuracy of your information and ask for it to be updated or corrected. You also have the right to request us to complete the Personal Information you believe is incomplete.
(d) Right to object to the processing: You have the right to object to the processing of your information if the processing is carried out on a legal basis other than consent. Where Personal Information is processed for the public interest, in the exercise of an official authority vested in us, or for the purposes of the legitimate interests pursued by us, you may object to such processing by providing a ground related to your particular situation to justify the objection.
(e) Right to restrict processing: You have the right, under certain circumstances, to restrict the processing of your Personal Information. These circumstances include: the accuracy of your Personal Information is contested by you and we must verify its accuracy; the processing is unlawful, but you oppose the erasure of your Personal Information and request the restriction of its use instead; we no longer need your Personal Information for the purposes of processing, but you require it to establish, exercise or defend your legal claims; you have objected to processing pending the verification of whether our legitimate grounds override your legitimate grounds.
Where processing has been restricted, such Personal Information will be marked accordingly and, with the exception of storage, will be processed only with your consent or for the establishment, to exercise or defense of legal claims, for the protection of the rights of another natural, or legal person or for reasons of important public interest.
(f) Right to delete: You have the right, under certain circumstances, to obtain the erasure of your Personal Information from us. These circumstances include: the Personal Information is no longer necessary in relation to the purposes for which it was collected or otherwise processed; you withdraw consent to consent-based processing; you object to the processing under certain rules of applicable data protection law; the processing is for direct marketing purposes; and the personal data have been unlawfully processed.
However, there are exclusions of the right to erasure such as where processing is necessary: for exercising the right of freedom of expression and information; for compliance with a legal obligation; or for the establishment, to exercise or defense of legal claims.
(g) Right to data portability: You have the right to receive your Personal Information that you have provided to us in a structured, commonly used, and machine-readable format and, if technically feasible, to have it transmitted to another controller without any hindrance from us, provided that such transmission does not adversely affect the rights and freedoms of others.
(h) Right to complaint: You have the right to complain to a data protection authority about our collection and use of your Personal Information. If you are not satisfied with the outcome of your complaint directly with us, you have the right to lodge a complaint with your local data protection authority.
For more information, please contact your local data protection authority in the UK or EU/EEA. If you are located outside the UK or EU/EEA, you may have similar privacy rights under your local law; please contact us using the details in the Contacting Us section.
Any requests to exercise Your rights can be directed to us at hello@phaze-app.com or using the postal address provided in this document. To delete Your trip schedule data or permanently close Your app account, You can do so directly from the Account Management section within the Application. Users of the Phaze Coaching Hub may request account closure by emailing hello@phaze-app.com. We will respond to all rights requests within one calendar month of receipt. In complex or high-volume cases we may extend this period by a further two months, in which case we will notify You within the first month and explain the reason for the extension. We may ask You to verify Your identity before responding to such requests, and Your request must include sufficient information to allow Us to confirm Your identity or authority.
If we receive your request from an authorised representative, we may request evidence that you have provided such an authorised representative with power of attorney or that the authorised representative otherwise has valid written authority to submit requests on your behalf.
You must include sufficient details to allow us to properly understand the request and respond to it. We cannot respond to your request or provide you with Personal Information unless we first verify your identity or authority to make such a request and confirm that the Personal Information relates to you.
We do not knowingly collect any Personal Information from children under the age of 18. If you are under the age of 18, please do not submit any Personal Information through the Services. If you have reason to believe that a child under the age of 18 has provided Personal Information to us through the Services, please contact us to request that we delete that child’s Personal Information from our Services.
Cookies are small text files that websites place on your computer or device to store information about Your visit. They help websites remember your preferences, enhance functionality, and provide a more seamless user experience.
The Phaze Coaching Hub website uses cookies to improve Your browsing experience and remember Your cookie preferences. By using our website, You consent to our use of cookies in accordance with this policy.
Both the PHPSESSID and coach_token cookies are categorised as Necessary cookies. These cookies are essential for the operation of the Coaching Hub website and enable core functionality such as security, authentication, and session management. For this reason, they cannot be rejected or disabled by users through the cookie preferences panel.
We offer push notifications to which you may voluntarily subscribe at any time. To deliver them, we rely on a device token unique to your device issued by your operating system; this token does not reveal your identity, unique device ID, or contact information to us. If you wish to stop receiving push notifications at any time, simply adjust your device settings accordingly.
The Services may contain links to other resources that are not owned or controlled by us. Please be aware that we are not responsible for the privacy practices of such other resources or third parties. We encourage you to be aware when you leave the Services and to read the privacy statements of each and every resource that may collect Personal Information.
We secure information you provide on computer servers in a controlled, secure environment, protected from unauthorised access, use, or disclosure. We maintain reasonable administrative, technical, and physical safeguards to protect against unauthorised access, use, modification, and disclosure of Personal Information in our control and custody. However, no data transmission over the Internet or wireless network can be guaranteed.
As the security of Personal Information depends in part on the security of the device you use to communicate with us and the security you use to protect your credentials, please take appropriate measures to protect this information.
In the event we become aware that the security of the Services has been compromised or Users’ Personal Information has been accessed, disclosed, altered, or destroyed without authorisation, we will promptly assess the risk to individuals’ rights and freedoms. Where a personal data breach is likely to result in a risk to those rights and freedoms, we are legally required to notify the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of the breach. We will also take all other reasonably appropriate measures, including investigation and reporting, and notification to and cooperation with law enforcement authorities where required.
Where a breach is likely to result in a high risk to Your rights and freedoms, we will also notify You directly without undue delay, in accordance with Our obligations under UK GDPR. When we do, we will send You an email to the address associated with Your account. If You have any concerns about the security of Your personal data, or wish to report a suspected data protection incident, please contact our data protection team at hello@phaze-app.com.
We reserve the right to modify this Policy or its terms related to the Services at any time at our discretion. When we do, we will revise the updated date at the top of this page. We may also provide notice to you in other ways at our discretion, such as through the contact information you have provided.
An updated version of this Policy will be effective immediately upon the posting of the revised Policy unless otherwise specified. Where any change materially affects how we process your personal data in a way that requires your consent, we will seek that consent before the change takes effect. We will not, without your consent, use your Personal Information in a manner materially different from what was stated at the time your Personal Information was collected.
If you have any questions, concerns, or complaints regarding this Policy, the information we hold about you, or if you wish to exercise your rights, please contact our data protection team at hello@phaze-app.com or by post using the address below.
Phaze Shift Ltd is registered with the Information Commissioner’s Office (ICO) as a data controller under registration number ZB866846. We will attempt to resolve complaints and disputes and make every reasonable effort to honour your wish to exercise your rights within the timescales provided by applicable data protection laws.
Phaze Shift Ltd,
9a Denmark Terrace
Brighton
England
BN1 3AN
https://phaze-app.com/contact-us
If you believe your concerns have not been adequately addressed, you can also complain to the Information Commissioner’s Office (ICO).
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113