Start free trial

MVPeak Privacy Policy

Last updated: June 2026

Overview

ABN: 92 424 605 570

Governing Law: Victoria, Australia

Version: 2.0

Last Updated: 26 September 2026

Effective: 26 September 2026

Contact: legal@mvpeak.app

This Privacy Policy is aligned with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Overview

MVPeak is an AI-powered fitness and movement analysis platform operated by MVPeak (ABN 92 424 605 570), a business governed under the laws of Victoria, Australia. This Privacy Policy explains how we collect, use, store, and protect your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

By using MVPeak, including our web app, iOS app, Android app, or marketing site, you agree to the practices described in this policy. If you do not agree, please discontinue use of the platform.

1. Information We Collect

1.1 Information you provide directly

  • Name and email address when creating an account
  • Date of birth, biological sex, height, weight, and fitness goals entered during onboarding
  • Health and fitness data you submit, including exercise logs, meal logs, and form analysis media (images and videos)
  • Heart rate recorded during workouts, where heart rate tracking is enabled on your device
  • Activity and health metrics from Apple Health or Health Connect (steps, active energy, heart rate and workouts), where you choose to connect them, and live heart rate from a paired Bluetooth heart rate monitor (see section 3.1)
  • Equipment images captured via the live equipment scanning feature: photos or video frames of gym equipment captured through your device camera to generate program suggestions. Because this feature is used in gym and fitness facility environments, captured images or footage may incidentally include other people, facility signage, or surroundings present in frame. We do not use this footage to identify other individuals, and it is processed for the sole purpose of equipment recognition.
  • Payment information processed securely via Stripe. MVPeak does not store card details
  • Communications you send to our support team

1.2 Information collected automatically

  • Device identifiers, operating system, and app version
  • IP address and approximate location (country/region level only)
  • Usage data: features accessed, session duration, interaction patterns
  • Error and performance diagnostics generated by our servers

1.3 AI-generated and inferred data

MVPeak uses Google Gemini Vision to analyse exercise form from images and videos you submit. The platform may infer fitness levels, movement patterns, and health trends from your usage data to personalise your coaching experience. This inferred data is treated as personal information under this policy.

2. How We Use Your Information

  • To provide, personalise, and improve the MVPeak platform and your AI coaching experience
  • To generate personalised workout plans, meal plans, and exercise demonstrations
  • To analyse your exercise form and provide movement feedback via AI
  • To process payments and manage your subscription via Stripe
  • To communicate with you about your account, updates, and support requests
  • To send transactional emails (e.g. trial reminders, payment receipts, cancellation confirmations)
  • To comply with our legal obligations under Australian law
  • To detect fraud, security incidents, and protect the integrity of the platform

We do not use your personal information to train third-party AI models or sell your data to advertisers. MVPeak products are ad-free.

3. Health and Sensitive Information

MVPeak collects and processes health-related information including fitness metrics, body measurements, movement data, heart rate, and media submitted for form analysis. Under the Privacy Act 1988, health information is classified as sensitive information and is afforded a higher level of protection.

We collect this information only with your express consent, provided during onboarding. You may withdraw consent at any time by deleting your account. Health information is used solely to power your personal coaching experience and is not disclosed to third parties except as described in Section 5, or to other users as described in Section 6 (Community and Group Features) where you choose to participate in group functionality.

MVPeak is not a medical service. The platform provides general fitness and movement guidance only and does not constitute medical advice, diagnosis, or treatment. Always consult a qualified health professional before starting a new exercise programme, particularly if you have a pre-existing medical condition.

3.1 Apple Health, Health Connect and connected heart rate monitors

With your permission, MVPeak can connect to Apple Health (HealthKit) on iOS and to Health Connect on Android.

  • What we read. Steps, active energy, heart rate and workouts recorded by your device or by other apps.
  • What we write. Workouts you complete in MVPeak, so they appear in your health record alongside your other activity.
  • Connected devices. If you pair a Bluetooth heart rate monitor, we read your live heart rate during a session.

We use this information only to show your daily activity and readiness, to track your sessions, to personalise your coaching, and, only where you have turned sharing on, to show your live heart rate to members of a crew you have joined (see Section 6). Health data from these sources is never used for advertising or marketing, is never sold, and is never used for data mining unrelated to your own coaching. It is not disclosed to third parties except to the service providers listed in Section 5, who process it on our instructions to deliver your coaching (for example, our AI provider receives the relevant metrics as part of your coaching context). MVPeak does not store this data in iCloud.

Connecting Apple Health or Health Connect is optional and every feature of MVPeak works without it. You can withdraw access at any time in the Health app (Profile, Apps, MVPeak) or in Health Connect, and we stop reading new data immediately. Data we have already collected is deleted with your account, as described in Section 8.

4. Data Storage and Security

Your data is stored on infrastructure located in Australia and the United States, including:

  • Database: Neon PostgreSQL (encrypted at rest and in transit)
  • File storage: Cloudflare R2 (images, videos, and AI-generated media)
  • Authentication: Clerk (account credentials and session management)
  • API infrastructure: Fly.io (Sydney region)

We implement industry-standard security measures including TLS encryption for all data in transit, access controls, and regular security reviews. In the event of a data breach affecting your rights, we will notify you as required by the Notifiable Data Breaches scheme under the Privacy Act 1988.

5. Disclosure of Your Information

We may share your information with the following third parties:

  • Stripe: payment processing
  • Google (Gemini API): AI form analysis, coaching and content generation, and automated safety screening of photos you share with a crew (see Section 6)
  • ElevenLabs: voice synthesis for the coach's spoken replies and transcription of your spoken messages when you use voice input. Coach replies are sent as text. Your voice audio is sent only when you speak to the coach, solely to convert it to text.
  • Clerk: authentication and account management
  • Cloudflare: file storage and CDN delivery
  • Email service providers: transactional email delivery, where used (e.g. Resend or equivalent)

We do not sell, rent, or trade your personal information to any third party. We may disclose information if required by law, court order, or regulatory authority, or to protect the rights and safety of MVPeak, our users, or the public.

Where you subscribe via the Apple App Store or Google Play, Apple or Google process your payment information as an independent controller under their own privacy policies; MVPeak does not receive or store your card details in these cases.

6. Community and Group Features: Visibility to Other Users

Unlike the third-party service providers described in Section 5, MVPeak also includes optional community features ("crews") where certain information is made visible to other MVPeak users, specifically users you have invited into a crew, or who have invited you. This is a distinct form of disclosure from our sharing with service providers, and applies only where you choose to join or form a crew.

If you participate in a crew, the following information is visible to other members of that crew:

  • Your display name, profile picture and current XP (experience points) earned
  • Activities you complete for the crew's challenge, including when you completed them, duration, distance where relevant, and points earned
  • Your live heart rate while actively working out, where heart rate tracking is enabled on your device and you have turned heart rate sharing on
  • Photos you submit as workout "proof" within the crew
  • Emoji reactions other crew members leave on your activities and proof photos (text comments are not supported; reactions are limited to a fixed set of emoji)
  • Your votes on the next challenge

Crew membership is invite-only. Your information is visible only to users you have specifically invited, or who have invited you, into a shared crew, not to the MVPeak user base generally, and not through any public or discoverable feed.

We do not use heart rate or other biometric data shared through crew features for any purpose beyond displaying it to your crew as described above and, where applicable, powering your personal coaching experience as described in Section 2. Heart rate is treated as sensitive health information under Section 3 of this Policy.

Reporting, blocking and screening. To keep crews safe, crew and display names are checked automatically against a list of abusive terms, and proof photos are screened automatically by an image safety model before they are shared. You can report an activity, a photo or a member, and you can block a member so that their activity, photos and reactions are hidden from you. When you make a report, we record the report, the reported content and the accounts involved so that our team can review it, and we retain that record for as long as needed to act on it and to keep the platform safe. Crew owners can remove members and remove photos from their crew.

If you no longer wish for other users to see your live heart rate, XP, activities or proof photos, you may remove your own photos, turn off heart rate sharing, leave the relevant crew, or delete your account at any time.

7. Your Rights Under Australian Privacy Law

Under the Privacy Act 1988 and the Australian Privacy Principles, you have the right to:

  • Access your personal information held by MVPeak
  • Correct inaccurate or out-of-date personal information
  • Request deletion of your personal information (subject to legal retention obligations)
  • Withdraw consent to the collection and use of sensitive health information
  • Complain to the Office of the Australian Information Commissioner (OAIC) if you believe your privacy rights have been breached

You can delete your account yourself at any time in the app (Profile, Account & legal, Delete account). Deletion removes your account and personal information as described in Section 8.

To exercise any other rights, contact us at legal@mvpeak.app. We will respond within 30 days of receiving your request.

8. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services. If you delete your account, we will delete or anonymise your personal information within 90 days, except where required by law (e.g. financial transaction records retained for 7 years under Australian taxation law).

Media submitted for AI form analysis (images and videos) is retained for the duration of your account and deleted upon account closure unless you request earlier deletion.

9. Cookies and Tracking Technologies

Our web app and marketing site use cookies and similar technologies for authentication, session management, and analytics. We do not use tracking cookies for advertising purposes. You can control cookie settings through your browser. Disabling cookies may limit certain functionality of the platform.

10. Children's Privacy

MVPeak is intended for users aged 16 and over. We do not knowingly collect personal information from anyone under the age of 16. Users aged 16 to 17 must have obtained prior consent from a parent or legal guardian before creating an account. By registering on behalf of a 16 to 17 year old, the parent or guardian confirms they have read and accepted these Terms, consent to the collection and use of the minor's personal information as described in this Privacy Policy, and accept responsibility for the minor's activity on the platform.

If you are a parent or guardian and believe your child under 16 has provided us with personal information without your consent, please contact us immediately at legal@mvpeak.app and we will take prompt steps to delete it.

11. International Data Transfers

Some of our third-party service providers are based outside Australia. Where personal information is transferred overseas, we take reasonable steps to ensure it receives comparable protection to that required under the Australian Privacy Principles, including through contractual data processing agreements with our service providers.

12. Singapore Users: Personal Data Protection Act (PDPA)

If you are located in Singapore, the following provisions apply in addition to the rest of this Privacy Policy, to the extent required by the Personal Data Protection Act 2012 (Singapore) ("PDPA"):

  • Consent. We collect, use, and disclose your personal data based on your consent, given during onboarding and at other points where new categories of data are collected. Where the PDPA permits us to rely on an exception to consent (for example, for fraud prevention or business improvement purposes), we do so only within the scope permitted by law.
  • Purpose limitation. We only collect, use, and disclose your personal data for the purposes described in this Privacy Policy, or other purposes you have been notified of and have not objected to.
  • Data Protection Officer. MVPeak has designated a Data Protection Officer responsible for our compliance with the PDPA. You can contact our Data Protection Officer at legal@mvpeak.app.
  • Access and correction. In addition to the rights described in Section 7, Singapore users may request access to, or correction of, their personal data held by MVPeak. We aim to respond to such requests within 30 days.
  • Overseas transfer. Your personal data may be transferred to, and stored in, Australia and the United States as described in Section 4. Before doing so, we take steps to ensure the recipient is bound by legally enforceable obligations to protect your personal data to a standard comparable to the protection under the PDPA, including through contractual data processing terms with our service providers.
  • Data breach notification. Where a data breach involving your personal data is assessed to be notifiable under the PDPA (broadly, where it is likely to result in significant harm to affected individuals, or affects 500 or more individuals), we will notify the Personal Data Protection Commission (PDPC) and affected individuals as required by law.
  • Retention. Personal data is retained in accordance with Section 8 of this Policy, and we cease retaining it once it is reasonable to assume the purpose for which it was collected is no longer being served and retention is no longer necessary for legal or business purposes.
  • Complaints. If you believe MVPeak has not complied with the PDPA, you may lodge a complaint with the Personal Data Protection Commission of Singapore (pdpc.gov.sg).

13. New Zealand Users: Privacy Act 2020

If you are located in New Zealand, the following provisions apply in addition to the rest of this Privacy Policy, to the extent required by the Privacy Act 2020 (NZ):

  • Information Privacy Principles. We collect, use, hold, and disclose your personal information in accordance with the 13 Information Privacy Principles (IPPs) set out in the Privacy Act 2020, covering matters such as the manner of collection, storage and security, access and correction, and limits on use and disclosure.
  • Health Information Privacy Code. Because MVPeak collects health and fitness-related information (see Section 3), we also have regard to the Health Information Privacy Code 2020, which applies additional rules to the collection, storage, and disclosure of health information about identifiable individuals in New Zealand.
  • Overseas disclosure. Your personal information may be transferred to, and stored in, Australia and the United States as described in Section 4. Before doing so, we take reasonable steps to ensure the overseas recipient is subject to privacy safeguards comparable to those in the Privacy Act 2020, including through contractual data processing terms with our service providers, or we otherwise rely on an applicable exception under IPP 12, such as your express authorisation.
  • Access and correction. In addition to the rights described in Section 7, New Zealand users have the right under IPPs 6 and 7 to request access to, and correction of, personal information we hold about them. We aim to respond to such requests within 20 working days, in line with the timeframe set out in the Act.
  • Notifiable privacy breaches. Where a privacy breach involving your personal information has caused, or is likely to cause, serious harm, we will notify the Privacy Commissioner and affected individuals as soon as practicable, in accordance with the notifiable privacy breach requirements of the Privacy Act 2020.
  • Retention. Personal information is retained in accordance with Section 8 of this Policy. We do not keep personal information for longer than is required for the purpose it was collected, consistent with IPP 9.
  • Complaints. If you believe MVPeak has not complied with the Privacy Act 2020, you may contact us in the first instance at legal@mvpeak.app, or lodge a complaint with the Office of the Privacy Commissioner (privacy.org.nz).

14. Hong Kong Users: Personal Data (Privacy) Ordinance (PDPO)

If you are located in Hong Kong, the following provisions apply in addition to the rest of this Privacy Policy, to the extent required by the Personal Data (Privacy) Ordinance (Cap. 486) (Hong Kong) ("PDPO"):

  • Data Protection Principles. We collect, hold, use, and disclose your personal data in accordance with the six Data Protection Principles (DPPs) set out in the PDPO, covering the purpose and manner of collection, accuracy and retention, use, security, openness about our policies, and your right of access and correction.
  • Sensitive data. The PDPO does not currently define a separate "sensitive personal data" category the way some other jurisdictions' laws do; instead, all personal data, including the health and fitness information described in Section 3, is protected under the same six Data Protection Principles, including the requirement that collection be necessary and not excessive for the purpose.
  • Access and correction. In addition to the rights described in Section 7, Hong Kong users may submit a Data Access Request (DAR) for access to, or correction of, their personal data. We aim to respond within 40 days, as required by the PDPO.
  • Cross-border data transfer. Section 33 of the PDPO, which would restrict the transfer of personal data outside Hong Kong, has been enacted but is not currently in force. As a matter of practice, and consistent with the Privacy Commissioner's non-binding guidance on cross-border data transfers, we take reasonable steps to ensure your personal data continues to receive protection comparable to the PDPO's Data Protection Principles when transferred to Australia and the United States as described in Section 4.
  • Data breach notification. Notification of data breaches to the Privacy Commissioner for Personal Data (PCPD) and affected individuals is not currently mandatory under the PDPO, although the PCPD has published guidance recommending voluntary notification, and has indicated an intention to introduce a mandatory notification regime. Consistent with that guidance, we will notify the PCPD and affected individuals of a data breach involving your personal data where we assess there to be a real risk of significant harm, even though not currently required to do so by law. This position may change if and when the PDPO is amended, and we will update this Policy accordingly.
  • Retention. Personal data is retained in accordance with Section 8 of this Policy, consistent with DPP2, which requires that personal data not be kept longer than necessary for the purpose for which it is used.
  • Complaints. If you believe MVPeak has not complied with the PDPO, you may lodge a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD) (pcpd.org.hk).

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email or an in-app notification at least 14 days before the changes take effect. Continued use of MVPeak after the effective date constitutes acceptance of the updated policy.

16. Contact Us

Business

MVPeak

ABN

92 424 605 570

Governing law

Victoria, Australia

Email

legal@mvpeak.app

Response time

Within 30 days for privacy requests

Complaints (Australia)

Office of the Australian Information Commissioner (OAIC), oaic.gov.au

Complaints (New Zealand)

Office of the Privacy Commissioner, privacy.org.nz

Complaints (Singapore)

Personal Data Protection Commission, pdpc.gov.sg

Complaints (Hong Kong)

Office of the Privacy Commissioner for Personal Data, pcpd.org.hk