Privacy Notice

Organisation: PFRJ Limited (trading as Anxiety Fitness) Issue date: 4 August 2026 Document owner: Peter Ruppert

This Privacy Notice describes how Anxiety Fitness collects, uses and discloses personal data, and explains your rights and how the law protects them.

Who we are and how to contact us

Anxiety Fitness is operated by PFRJ Limited, a company registered in England and Wales (no. 11629871), registered office Soho Works, 180 Strand, London, United Kingdom, WC2R 1EA.

Anxiety Fitness is a peer support community for people living with anxiety. It is not a healthcare provider, and using it does not create a clinical relationship. Nothing on the platform is medical advice.

For almost everything on the platform, PFRJ Limited is the controller — we decide how and why your data is used. There is one significant exception, described under Creators, professionals and space owners: where a professional, organisation or space owner builds their own mailing list through Anxiety Fitness, they decide who to email and what to say, and they are a controller for that in their own right.

If you would like to contact us about this notice, how we use your information, or to exercise your rights:

privacy@anxietyfitness.com

The personal data we collect

Personal data means any information about an individual from which that person can be identified. We collect, use, store and transfer:

• Identity Data — first name, last name, display name, username, a system-generated account identifier, your role on the platform (member, professional, peer contributor, organisation, moderator, admin) and your profile photo where you upload one.
• Contact Data — email address, and any contact details you choose to publish on your own profile.
• Transaction Data — details of payments, subscriptions, tickets and purchases. We do not store card details; see Payments.
• Technical Data — IP address, login records, browser type and version, time zone, operating system, device identifiers, and push notification tokens for the mobile app.
• Profile Data — your username and password, your preferences, spaces you belong to, and content you have saved or unlocked.
• Usage Data — how you interact with the platform: what you view, post, open and click, including which emails from us you open and which links you follow (see Email tracking).
• Marketing and Communications Data — your consent choices, which mailing lists you are on, and your notification preferences.
• User Content — anything you write or upload: posts, wins, questions, session requests, comments, chat and direct messages, images and video.
• Health-related Data — Anxiety Fitness is a community about anxiety, so much of what people write here reveals something about their mental health. We treat User Content on the platform as capable of containing special category data under Article 9, and handle it accordingly, whether or not any individual post does.

We also use anonymised, aggregated data — statistics that cannot identify you — to understand how the community is used and to improve it.

Your journal is different

Anything you write as a journal entry is private to you. It is stored separately from public content, under your own account record, and is readable only by you — not by moderators, not by space owners, and not by our administrators through the platform. It never appears in any feed, search or notification.

How your personal data is collected

Directly from you — when you create an account, write or upload content, join a space, book or attend an event, buy or unlock something, message someone, join a mailing list, or contact us.

Automatically — technical data about your device and how you use the service, and delivery and engagement data about the emails we send you.

From third parties — our payment provider (Stripe) confirms payment and subscription status; the app stores tell us about purchases and app delivery; where you sign in with a third-party identity provider, that provider confirms your identity to us.

How we use your personal data

Legal bases

• Performance of a contract — to give you the service you signed up for.
• Legitimate interests — to run, secure and improve the platform, keep it safe, and prevent abuse, having balanced those interests against your rights.
• Legal obligation — where the law requires it.
• Consent — for marketing email, and for the health-related content you choose to share publicly in the community.

Because Anxiety Fitness is a community about anxiety, what you post publicly is likely to reveal information about your health. We rely on your explicit consent under Article 9(2)(a) for that, given when you choose to post it, and you can withdraw it by deleting the content or your account. Your journal entries are covered by the same basis but are never shown to anyone else.

What we use it for

Links you click on posts and events

When a post or an event carries links to other things on the platform — an event, a resource, a space, a chat — we record which of those links get clicked, and, if you are signed in, that you were one of the people who clicked.

The person who made that post or event can see this. They see how many clicks each link got and, on a paid professional plan, the names of the members who clicked. They cannot see anything about people who were signed out, and they are never shown their own clicks.

We do this so the people producing things here can tell what was useful. If you would rather not be counted by name, sign out before following the link.

Email tracking

When we or a creator send you a marketing email, we record:

• whether the email was opened;
• whether you clicked a link, and which link;
• and we record this against you individually, not only as a total.

The sender can see this, including your email address alongside whether you opened and what you clicked. Senders include Anxiety Fitness and any professional, organisation or space owner whose mailing list you joined.

We do this to understand whether what we send is useful. You can stop it by unsubscribing from marketing email — the unsubscribe link is in every marketing message, and unsubscribing stops both the emails and the tracking.

Open tracking works by loading a small invisible image, which is not exact: some email apps load it automatically whether or not anyone reads the message, and others never load it at all. We do not track opens or clicks in service emails — password resets, receipts, security notices and notifications.

Creators, professionals and space owners

People who run spaces, sell resources or host sessions on Anxiety Fitness can build their own mailing lists. When you join one of those lists, that person or organisation decides what to send you and when, and is a controller for that relationship. We provide the tools and send the email on their behalf.

That means they can see your email address, your name where you gave one, and the engagement data described under Email tracking. They cannot see your journal, your private messages with other people, or anything you have not shared with them.

You can leave any of these lists at any time from the unsubscribe link in their emails, or from your profile.

Opting out of marketing

You can stop marketing email at any time using the unsubscribe link in any marketing message or from your profile settings. You will still receive service messages that are necessary to run your account.

Who we share your personal data with

We do not sell your data. We share it with service providers who process it on our instructions under contract, and only for the purposes below.

Cookie consent is handled by us directly; your choices are stored in your browser and, if you have an account, on your account record.

We may also disclose personal data in a business transfer, to law enforcement or public authorities where legally required, and where necessary to protect the rights, property or safety of our users or the public.

Where files are stored

Our database, file storage and server functions are all in the EU. Older uploaded files that had been held in the United States were moved to the EU on 4 August 2026.

International transfers

Several of the processors above are based in, or transfer data to, the United States. Where personal data leaves the UK or EEA we rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, together with the UK and EU adequacy decisions for the US Data Privacy Framework where the provider is certified. You can request details of the safeguards in place by contacting us.

Data security

Access to personal data is limited to those who need it, and data is encrypted in transit and at rest. We never store your password in a readable form.

Your journal is private. Entries and anything in them are visible only to you.

How long we keep it

We keep personal data only as long as necessary for the purposes in this notice, and to meet legal, accounting or reporting requirements.

• Your account and the content on it — until you delete them, or you delete your account, at which point both go.
• Content you delete — removed from the platform immediately. Copies may persist in encrypted backups for a limited period before those backups age out.
• Transaction records — retained as long as tax and accounting law requires (currently six years).
• Email engagement data — kept alongside the record of the broadcast it belongs to, and deleted with it.
• Anonymised, aggregated data — indefinitely, since it can no longer identify you.

When you delete your account we remove your account record, your profile, your journal, the files you uploaded, everything you posted to the community — wins, questions, events, event requests and bulletins — your place on any mailing list, and your sign-in credentials.

Two things are treated differently, and both are about other people.

Comments you left on other people's posts, and your direct messages, are kept but detached from you. They stay readable to the person you were talking to, attributed to a deleted account rather than to you. Removing them outright would take away one side of somebody else's conversation.

Purchase records are kept and stripped of anything that identifies you. We are required to retain transaction records for tax and accounting; what we are not required to keep is your name, email or the answers you typed at checkout, and those go.

A ticketed event you hosted that has already taken place stays, without you on it. People paid for a seat and its recording, so removing the event would take away what they bought. Your name comes off it.

If you own a space that has other members, or you are hosting a ticketed event that has not happened yet, we will ask you to hand it over or close it before we can delete your account — otherwise the people who joined or paid would lose access without warning.

Your rights

You have the right to request access to your data, correction of it, erasure in certain circumstances, restriction of processing, and portability. You may object to processing based on legitimate interests, and you have an absolute right to object to direct marketing at any time. Where we rely on consent, you may withdraw it at any time, without affecting processing carried out before you did.

To exercise any of these, contact us at privacy@anxietyfitness.com.

There is normally no fee. We may charge a reasonable fee, or refuse, if a request is clearly unfounded, repetitive or excessive. We may need to confirm your identity first. We aim to respond within one month, and will tell you if a complex request needs longer.

Children

Anxiety Fitness is for adults. You must be 18 or over to hold an account, and we do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

Cookies

We use cookies and similar technologies that are necessary for signing in, security and remembering your preferences, and — with your consent — for measurement and advertising. See our Cookie Policy for the detail and to change your choices.

Complaints

Please contact us first — we would like the chance to put things right. You also have the right to complain to the Information Commissioner's Office (ico.org.uk), the UK regulator for data protection.

Changes to this notice

We keep this notice under review. This version was issued on 4 August 2026. Please keep your details accurate and tell us if they change.

Payments

Paid features are processed by Stripe. We never receive or store your card details — they go directly to Stripe, whose use of your information is governed by their own privacy notice.

Third-party links

The platform contains links to third-party sites, including links posted by other members. We do not control them and are not responsible for their privacy practices.