Privacy Policy

Who we are

Compound is operated by Compound, a company registered in England and Wales. In this policy, “Compound,” “we,” “us,” and “our” refer to Compound.

What data we collect

Compound collects the following categories of data to provide and improve the service:

Account data

Email address and basic profile information required to create and manage your account.

Self-reported wellness data

Wellness metrics you rate within the app (e.g., energy, skin clarity, focus, sleep quality, appetite stability), supplement and product intake logs, and your Compound Score.

Health data from connected devices

If you choose to connect a wearable device or health platform, we collect health and activity data from those integrations. Supported integrations include:

• Oura
• Whoop
• Garmin
• Apple Health

This data may include sleep metrics, heart rate, heart rate variability (HRV), activity and recovery scores, step counts, and other health indicators provided by these platforms. This data is required for the core functioning of the app — it powers your Compound Score, trend analysis, and personalised insights.

Body composition photos

If you use the body composition photo feature, all images are stored locally on your device. They are never uploaded to our servers, never transmitted to third parties, and never used for any purpose beyond your personal review within the app.

How we use your data

We use your data to:

• Calculate your Compound Score and surface personalised insights
• Identify trends and patterns in your wellness data over time
• Provide streak tracking, consistency analysis, and progress reports
• Improve the accuracy and relevance of the app’s analytics engine
• Send you service-related communications

What we never do with your data

We do not sell your personal or health data. Ever.

Your data is never sold to advertisers, data brokers, supplement brands, insurance companies, or any other third party for commercial purposes. We do not share individually identifiable health data with anyone. Your wellness data exists to serve you and only you.

Lawful basis for processing

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we process your data on the following lawful bases:

• Contract: Processing necessary to provide you with the Compound service
• Consent: For health data from connected wearable devices, which you explicitly authorise when connecting each integration
• Legitimate interest: For analytics that improve the service, where your rights are not overridden

Data security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit and at rest, access controls, and regular security reviews. Health data from wearable integrations is stored in encrypted databases with access limited to the systems required to generate your personalised insights.

Data retention

We retain your data for as long as your account is active. If you delete your account, we will delete all associated personal and health data within 30 days, except where we are required by law to retain it.

Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Rectify any inaccurate or incomplete data
• Erase your data (“right to be forgotten”)
• Restrict processing in certain circumstances
• Port your data to another service in a machine-readable format
• Withdraw consent for wearable integrations at any time by disconnecting the device in the app
• Object to processing based on legitimate interest

To exercise any of these rights, contact us at privacy@getcompound.app.

Third-party services

We use a limited number of third-party services to operate Compound, including hosting (Vercel), database (Supabase), payment processing (Stripe), and analytics. These providers process data only as necessary to deliver their service and under contractual obligations that protect your privacy.

Changes to this policy

We may update this policy from time to time. Material changes will be communicated to you via email or an in-app notification before they take effect.

Contact

If you have questions about this privacy policy or how your data is handled, contact us at privacy@getcompound.app.

Compound
London, United Kingdom