Privacy at Forma

Who is responsible

Forma Pose Ltd, company number 17392462, is a company incorporated in England and Wales and is the controller for the personal information described here. Its registered office is 23 Albert Embankment, London, United Kingdom, SE1 7GG. The service contact remains 10 York Road, London SE1 7ND, United Kingdom. Contact eric@formapose.com for privacy, support, security, rights, complaints or unsafe-report requests. Forma is intended for UK residents aged 18 or over.

Necessary website storage

The early-access form creates a random request identifier in memory while the page is open so a retry cannot create duplicate records. It does not place the form answers in cookies or browser storage. Forma does not use non-essential advertising or tracking cookies.

To understand which of Forma's own links help people find and request the app, a reviewed link may contain one fixed campaign code. Forma may use that code to increment a daily total when an early-access request is accepted or a Mac or Windows installer link is requested. An installer-request total also records only Mac or Windows and arm64 or x64. The counter stores no raw page address or referrer, arbitrary campaign text, IP address, cookie or browser identifier, signup or account link, desktop event, or posture Health Data. Unknown codes are counted as unattributed. A request is not proof of download, installation or use.

This limited measurement relies on Forma's legitimate interest in assessing its own distribution without third-party tracking. The daily aggregate counters remain in Cloudflare D1 for up to 1,095 days and may be copied into Forma's restricted aggregate product-analytics Workspace file. You may object by contacting Forma, although a daily total that contains no identifier cannot be located or removed as your personal record. Installer navigation does not wait for the counter, and measurement failure does not block the download.

Website early access

Static website delivery creates ordinary request and security logs at the hosting and delivery providers. If you request early access, Forma stores your name, email address, confirmation that you are a UK adult, one or more fixed answers about what you want Forma to help with, optional “Other” text of up to 160 characters, one monthly price range, your Mac/Windows compatibility answer, one fixed install-and-camera-access answer and, for an access blocker, whether support would help. If you request that support, Forma also stores the company, school or organisation name you supply. Forma additionally stores the consent version and time, a random request identifier, delivery state and expiry time. Forma uses this information to send the Forma demo and product access you asked for and to understand product fit, pricing and practical access needs. The form asks no health history, symptom or discomfort question and tells you not to put medical, symptom or other sensitive details in “Other.” Forma does not contact a named organisation from this response, create a result or score, or change access or invitation copy based on an answer.

The record and bounded delivery evidence expire after no more than 180 days. The payload is encrypted and a one-way email hash prevents duplicate signups. Short-lived keyed request values are used for abuse prevention. Early-access information is not sent to the desktop onboarding flow, posture Health Data, reports, operational analytics, Research or external AI. Because a person could nevertheless volunteer sensitive information in “Other,” Forma treats that field as potentially sensitive, does not classify it, and keeps it within this consented early-access purpose. You may withdraw consent or request erasure at any time by emailing eric@formapose.com.

Historical website scorecard records created before this form was retired remain in their restricted stores only until their existing 30-day incomplete or 180-day completed expiry. The public website no longer accepts new scorecard responses. Existing account-link controls remain available only for those historical records during that bounded lifecycle; early-access records cannot be linked.

Account and service security

Forma processes your provider identifier and verified email/name when supplied by Google or Apple, or your encrypted email and salted password verifier for an email account. It also processes agreement receipts, sign-in and last-use times, coarse operating-system family, encrypted sessions, entitlements, quotas, short-lived keyed abuse-prevention values and security events. To avoid repeating setup after a reinstall or on another device, Forma keeps your setup-flow version, coarse furthest stage, completed/dismissed status and times with your account. These progress records contain no survey answer, posture Health Data, report content or free text. Dedicated encrypted onboarding responses are stored separately from progress records and from website early-access records. Historical rows from the retired onboarding assessment and website scorecard remain available only for bounded operations and scheduled expiry; no active public form accepts new scorecard writes. Forma never receives your Google or Apple password and does not build a precise-location or device-fingerprint history.

Account delivery relies on Article 6(1)(b) UK GDPR. Proportionate security, abuse prevention and service reliability rely on Article 6(1)(f). Website early-access contact and storage rely on the consent shown on that form. Limited records may rely on Article 6(1)(c) where necessary for a legal obligation.

Service operations and product improvement

Forma separates service operations from product improvement. Service operations cover providing and securing accounts, check-ins, reports, entitlements, support, reliability and cost control. Cloud-generated reports are a service feature, not a separate analytics purpose.

For product improvement, Forma records one account-linked marker for a UTC day when the service or app is used, plus counts of completed manual or automatic check-ins, successful check-in or daily reports, and fixed onboarding milestones. It uses these facts to understand activation, find reliability problems and prioritise improvements. This analytics record does not contain posture scores or measurements, presence, landmarks, images, video, audio, report input or text, survey answers, free text, workplace context, IP address, a precise device or advertising identifier, or location. It is not used to target or score you, change access, advertise, contact you, or enrol you in Research.

This limited product-improvement processing relies on Forma's Article 6(1)(f) legitimate interests in understanding whether the service activates and works reliably. Linked rows remain in Cloudflare D1 for no more than 180 days. Forma then keeps daily aggregate metrics for up to 1,095 days. Google Workspace receives only aggregate product metrics; any cell representing fewer than five people is suppressed. Access is limited to named authorised product-improvement accounts. You may object at any time without losing the service by emailing Forma. Forma will stop new collection and remove your linked analytics rows; an aggregate that can no longer be linked back to you cannot be reconstructed or removed as your personal record.

On-device camera and posture processing

Forma requests camera access for short assessments and, if enabled, recurring check-ins while the app is running. Camera frames are analysed transiently on your computer. Ordinary Forma use does not upload camera images, video or audio. Optional Forma Research is a separate programme with its own explicit choice. The app creates pose landmarks, camera-visible measurements and scores, confidence and quality values, presence/away states, coarse active-display counts, setup and posture-pattern classes, times, failures, reports and software/model provenance.

Local Health Data is stored in one versioned encrypted document protected through Electron’s operating-system-backed secure storage. It remains until account deletion or you remove the app data. Readable exports are not password protected; an optional transfer backup is password-encrypted and account-bound.

Because posture information can reveal physical wellbeing, Forma asks for express consent under Article 9(2)(a), alongside the Article 6(1)(b) basis for providing requested posture features. You can stop future camera processing by turning check-ins off, revoking camera permission or deleting the account.

Cloud-generated reports

Eligible first-assessment and daily reports are a Forma feature. The desktop sends a versioned report request to Forma’s Cloudflare Worker. The Worker strips unknown fields, constructs a fixed safety-constrained prompt and sends Runware only:

• assessment or report-window timestamps, observation counts and manual/automatic trigger;
• 0–100 posture scores and subscores;
• allow-listed derived angles, ratios and movement-robust summaries;
• confidence, measurement quality, coverage, presence and validation states;
• coarse workplace-setup and posture-pattern classes; and
• analysis, capture-protocol and pose-model versions.

The Runware request does not contain camera images, video, audio, raw pose landmarks or coordinate arrays, your name, email address, provider identity, Forma account or check-in identifiers, your IP address or device identifier, display identifiers/names/resolutions, window or application activity, local file paths, or user-authored free text. The Worker creates a random provider task identifier that is not a Forma user identifier. As with any API call, Runware may receive ordinary network metadata from Forma’s server connection; this is not your device’s network address.

Runware returns generated text plus provider task, model, usage and cost metadata. Forma stores the minimised report input, output and usage record for up to 30 days for delivery, retry, safety, reliability and support; the report stored on your computer remains until local deletion. Cloud reports remain unavailable unless Forma has a binding processor contract and a valid transfer mechanism for every restricted transfer.

Cloud reports rely on Article 6(1)(b) for service delivery and Article 9(2)(a) explicit consent for the health-related input and output.

Preferences during onboarding

Desktop onboarding asks for your preferred name and three bounded questions about what you notice during focused work, the kind of support you want and the posture area you want to focus on. If you select “Other” for work setup or support, you may enter up to 240 characters. A separate choice controls whether personalised reports may use these preferences. There are no pricing, company or detailed discomfort-area questions.

Encrypted responses remain with your account for no more than 180 days and are used to tailor onboarding and, only when selected, personalised reports. A replace-only copy may appear in Forma's restricted account-operations Workspace file so named operations users can support onboarding and understand the current setup state; the same 180-day expiry and earlier deletion are reflected on the next sync. They do not change posture measurements or access, and are excluded from website early access, posture Health Data, aggregate product analytics and Research. Account deletion removes them.

Sources, requirements and recipients

Forma receives information from you, the app and device features you choose, Google or Apple when used for sign-in, service providers acting for Forma and records generated while delivering and securing the service. Account and Forma agreement information is required to create and operate an account. Camera permission and express health-data consent are required for posture features. Research, early-access and newsletter information remains optional and is governed by the choices shown at collection.

Cloudflare provides static-site hosting and delivery, authentication, Workers, D1, private R2, email delivery, security and update delivery. Google and Apple provide the identity method you choose. Runware may provide text inference for cloud reports only while Forma has the required binding processing and transfer arrangements. Separate restricted Google Workspace files may hold account-operations records including current onboarding responses, aggregate product and website-acquisition metrics, newsletter records, early-access records or historical website scorecard responses; product cohort cells representing fewer than five people are suppressed, and access to one purpose does not grant access to another. During the controlled hosting migration and rollback window, Vercel may serve the same static files without Forma-configured health-data analytics or form processing. Professional advisers, insurers, auditors, regulators and authorities may receive information where reasonably necessary and lawful. Forma does not sell personal information or use it for advertising, employment or insurance decisions.

International processing

Providers may process information in the United Kingdom and other countries identified in their current service terms and Forma’s processing records. Before Forma initiates a restricted transfer, it uses an applicable UK adequacy regulation or legally effective safeguards such as the UK International Data Transfer Agreement or UK Addendum, completes the required data-protection test and supplementary measures, and requires the relevant processor contract. Contact Forma to request information about the safeguard that applies to a transfer. Cloud reports remain unavailable where Forma cannot establish the required processor and transfer arrangements.

Business changes

Forma may disclose proportionate information under confidentiality to professional advisers, funders and prospective buyers while evaluating an investment, financing, reorganisation, incorporation or sale. Forma may transfer information, contracts and responsibility to an incorporated successor or buyer of the Forma business where lawful. The new controller must continue to honour applicable choices and safeguards, and Forma will notify affected people before a material controller or purpose change takes effect. Research media is not made available for general investor due diligence.

Retention and deletion

• Local encrypted posture history and reports: until account deletion or local app-data removal on the applicable device.
• Cloud report inputs, outputs and usage: up to 30 days.
• Linked product-improvement events and daily counters: up to 180 days, or earlier objection/account deletion; aggregate daily product metrics: up to 1,095 days.
• Aggregate daily website-acquisition counters: up to 1,095 days.
• Operations access logs: 90 days.
• Access sessions: 15 minutes; refresh sessions: up to 30 days.
• Abuse-prevention records: about 24 hours; security events: 90 days; historical assessment-link codes: 10 minutes and one use.
• Account identity and current setup status: while the account remains active; granular setup-stage events: up to 180 days.
• Minimal agreement, transaction, complaint, security and deletion evidence: while needed to operate the account and for up to six years after closure where reasonably necessary for legal obligations, disputes or legal claims. Special-category evidence is retained only where an applicable Article 9 condition also permits it.
• Onboarding preferences: up to 180 days or account deletion.
• Website early-access records and delivery evidence: up to 180 days or earlier consent withdrawal or erasure.
• Historical incomplete website scorecards: up to 30 days; historical completed scorecards, download requests and email receipt: up to 180 days; newsletter as described above.

Scheduled deletion jobs and account deletion remove the applicable Forma-controlled cloud records. Backups and provider systems may complete deletion on their documented schedules. Genuinely anonymised information that no longer relates to an identifiable person may be retained and used for statistical, operational and product-improvement purposes.

Your choices and rights

Settings lets you turn automatic check-ins off, export readable posture information, create an encrypted transfer backup, manage optional Forma Research separately, remove supported onboarding responses, and delete your account. Depending on the circumstances, you may ask to access, correct, erase, restrict or receive your information, object to legitimate-interests processing, and withdraw consent. In particular, you may withdraw website early-access consent or object to linked product analytics without losing access to Forma. Withdrawal does not affect processing that was lawful beforehand.

Email eric@formapose.com or write to the service address above. Forma will acknowledge a data-protection complaint within 30 days, investigate it fairly, keep you appropriately informed and communicate the outcome without undue delay. You may also complain to the Information Commissioner’s Office.

Security, wellbeing boundary and changes

Controls include encryption, TLS, server-held credentials, schema allow-lists, rotating sessions, one-use security challenges, least access and fail-closed local storage. No system is completely secure; Forma maintains incident and rights procedures appropriate to its scale.

Forma is intended solely for general wellbeing and workday awareness. It is not intended for diagnosis, prognosis, treatment, clinical monitoring, emergency use or medical decision-making and is not a substitute for professional advice. Forma assesses a material change to purpose, data, recipient or consent before use. It records consent versions separately from ordinary notice corrections, brings material changes to affected users’ attention and seeks a new choice when required.