Privacy, in plain English

What we collect

Only what the Index needs, and only what you type in.

Your account

Your email address and a password, held by our authentication provider. We never see your password — it is stored as a one-way hash.

Your measurements

The values you enter: age, sex, bodyweight, VO₂ max, heart-rate recovery, grip strength, fat-free mass index and how it was measured, lower-body power and how it was measured, dead hang, sit-rise, single-leg stand, deep squat hold, and optionally resting heart rate and heart-rate variability.

Your results

The scores calculated from those measurements: your Index, band, Capacity Age, domain scores, confidence interval and priority intervention, with the protocol version that produced them.

Your consents

Which consents you gave, the moment you gave each one, and the version of the wording you agreed to.

If you contact us

For a booking: your name, email, phone if you give it, preferred times and anything you tell us about injuries or illness. For a company enquiry: your name, company, team size and email.

What we do not collect: we do not run advertising trackers, we do not sell anything to anyone, we do not build a profile of you across other websites, and the Field Test at /field-test sends nothing anywhere — it calculates entirely in your browser and stores nothing.

Why we hold it, and on what basis

We ask for two separate consents, because they are two separate things and you are entitled to say yes to one and no to the other.

Required — processing

“Process the health data I enter to calculate and store my Evolution Index.” This is the one that makes the product work. Without it there is nothing we are permitted to calculate, so we will not let you past it. You can withdraw it at any time by deleting your account, which deletes the data.

Optional — research

“Include my anonymised results in Evolution research to improve the norms.” Anonymised means your name, email and account identifier are stripped before the data reaches any analysis. Saying no changes nothing about your own results or what you can use. You can withdraw it whenever you like, from your account page, and it takes effect immediately for future analysis.

For bookings and company enquiries the basis is simply that you asked us to get in touch, and we use your details for that and nothing else.

You must be 18 or over. The Index is normed from age 18; below that the thresholds are not measured. We do not knowingly hold data on anyone younger.

Where it is held

Your account and your results are held in a managed Postgres database hosted in the European Union (eu-west-1, Ireland). Access is enforced at the database itself by row-level security: the rules permit each account to read and write only its own rows, so one member cannot see another's data even in principle.

The website itself is served from a content delivery network. Payment is handled by Revolut — we never see or store your card details; the card is entered on Revolut's own page, and all we receive back is confirmation that a payment succeeded.

How long we keep it

Your account and results

For as long as you keep the account. The point of the Index is the change over years, so we do not quietly delete your history — but the moment you delete your account, it goes.

If you delete your account

Your profile, your consents, every result, your training log and your purchase record are deleted immediately and permanently. There is no thirty-day grace period and no archive copy.

Bookings and enquiries

Kept while we deal with them and for a reasonable period afterwards for our own records, then removed.

Anonymised research data

If you consented to research, results already stripped of anything identifying you may remain in the research set after your account is deleted — by then they are no longer your data, because nothing connects them back to you. If you would rather they were excluded, tell us before you delete and we will remove them first.

Getting your data back, or destroyed

Both are buttons, not a request form. Sign in and open Account at Your Index:

Export my data

Downloads a complete JSON file of everything held against your account — your profile, your consents, every result, your training log and your purchase record. Nothing is withheld.

Delete my account and data

Deletes your profile, your consents, every result, your training log and your purchase record, permanently, and signs you out.

One thing we will not pretend about: that button removes all of your data, but the login record itself — the row holding your email address and password hash — is removed manually by us for now. Email us at the address below and we will delete it and confirm. Until we do, an empty login remains, holding nothing but your email address. We would rather tell you that than imply an automation we have not built yet.

You also have the right to ask us to correct anything wrong, to object to how we are using it, and to complain to the Information Commissioner's Office if you think we have handled it badly.

Who to contact

Matt Roberts Evolution
32 Grosvenor Square
London W1

Email: see below

Ask for the data protection contact and your message will reach the right person. We aim to answer any request about your data within one working week, and are required to within one month.