JTPT

Privacy Policy

Updated 14 November 2026

This policy explains what information the JTPT app (“the app”) collects, why, who can see it, and the choices you have. We keep it to what the app actually does. We don't run adverts, we don't use analytics or tracking tools, and we never sell your information.

Who we are

The app and the JTPT (Joint Therapy & Performance Tracking) platform are provided by INNOVA Software Group Ltd, a company registered in England and Wales (“we”, “us”). We are the controller of your personal information under UK data-protection law (the UK GDPR and the Data Protection Act 2018).

You use JTPT with your Trainer, an independent personal trainer or rehabilitation practitioner who uses the platform to run their practice. Your Trainer can see and update the training and health information described below, and uses it to provide their service to you.

What we collect

Your account

Your first and last name and email address.
Your password, stored only in a hashed form we can't read.
Your phone number, if you choose to add it to your profile.
Which Trainer your account is linked to (via the Trainer code you enter), and whether your account has been approved.
One-time verification codes we email to you when you sign up or reset your password.

Your health and training information

Because the app supports injury rehabilitation and performance training, it holds information about your physical health. This is “special category” data, and we treat it with extra care.

The recovery status of body areas (for example healthy, recovering or injured) and your Trainer's notes about them.
Session records your Trainer creates: date, type and length of the session, the body areas worked on, goals, what happened, notes, and any exercise videos your Trainer uploads.
Your exercise plan, which exercises you mark as done, and the difficulty and discomfort ratings you give them.

Messages

Messages your Trainer sends you in the app, and whether you've read them.

Bookings

If your Trainer offers online booking and you use it: the sessions you book, their date, time and price, and whether they were paid, cancelled or refunded.
Payment card details are entered on Stripe's secure payment page and go to Stripe, not to us. We never see or store your card number.

Your device

If you allow notifications, a push-notification token so we can send you alerts (for example a new message or a morning reminder of what's due). You can turn notifications off at any time in your device's Settings.
The app keeps some information on your phone so it can keep you signed in and load quickly. You can remove it by signing out and deleting the app.

What we don't collect

The app does not access your location, contacts, photos, camera or microphone. It does not use advertising identifiers, analytics or tracking tools.

How we use it

To create and run your account, and to link you with your Trainer.
So your Trainer can plan, record and review your sessions, exercises and recovery, and so you can see them in the app.
To take bookings and payments for sessions, where your Trainer offers them.
To send you verification emails and, if you allow them, notifications.
To keep the service secure and working properly, and to meet our legal obligations.

We don't use your information for advertising, and we don't make automated decisions about you that have legal or similarly significant effects.

Legal bases

Under the UK GDPR we rely on:

Contract: to provide the app and the training service you've signed up for, including bookings.
Explicit consent: for your health information. You give this when you create your account and choose to use the app with your Trainer. You can withdraw it at any time by deleting your account (see below); this doesn't affect anything done before you withdrew it.
Legitimate interests: to keep the service secure and fix problems.
Legal obligation: where the law requires us to keep or share information, such as payment records.

Who can see it

Your Trainer: the Trainer your account is linked to can see and update your training and health information, messages and bookings through their portal.
Service providers who run parts of the service for us, under contracts that only let them use your information to provide that service:
- DigitalOcean: hosting, database and file storage (exercise videos are stored in its London region).
- Resend: sending verification and password-reset emails.
- Expo: delivering push notifications, via Apple's and Google's notification services.
- Stripe: processing payments for booked sessions, where your Trainer uses online booking. Stripe's privacy policy applies to the payment.
When the law requires it: for example to comply with a court order, or to protect someone's safety.

We never sell your information or share it for advertising.

Where it's stored

Your information is stored by our hosting provider, DigitalOcean. Some of our providers (such as Resend, Expo and Stripe) may process information outside the UK, including in the United States. When that happens we rely on safeguards recognised under UK law, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

How long we keep it

We keep your information for as long as your account is open. When you delete your account, your personal information is deleted as described below. Where the law requires us to keep something for longer (for example records of payments), we keep only what's required, for only as long as required.

Your rights

Under UK data-protection law you can ask us to:

give you a copy of your information;
correct information that's wrong or incomplete;
delete your information;
restrict how we use it, or object to how we use it;
send your information to you or another provider in a portable format;
stop using your health information, by withdrawing your consent.

Email [email protected]. We'll respond within one month. If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113, though we'd appreciate the chance to put things right first.

Deleting your account

You can delete your account and its data at any time, in any of these ways:

In the app: open your profile (your initials, top right of Home), tap Delete Account, and confirm with your password.
On the web: go to jttheptinjuryperformance.com/delete-account, sign in with your app email and password, and confirm.
By email: if you can't use either, email [email protected] from the address you signed up with, with the subject “Delete my JTPT account”. We'll delete it within 30 days and confirm once it's done.

Your account, session records, exercise plan and progress, body status and notes, messages and session videos are deleted straight away. Copies in our encrypted backups are removed as those backups expire. Deleting the app from your phone does not delete your account.

Security

Information sent between the app and our servers is encrypted in transit (HTTPS). Passwords are stored only in hashed form, and access to your information is limited to you, your Trainer and the providers listed above. No system is perfectly secure, but we work to protect your information and will tell you and the ICO about a serious breach where the law requires it.

Children

The app isn't intended for children under 13, and we don't knowingly collect their information. Anyone aged 13 to 17 should only use the app with the agreement of a parent or guardian. If you believe a child under 13 has given us information, contact us and we'll delete it.

Changes & contact

If we change this policy we'll update the date at the top, and tell you in the app if the change is significant. Questions or requests: [email protected].