Privacy at Forma

Where your information is stored

• On-device posture features and local reports: camera analysis, posture history, workspace information and notification interactions stay in protected local storage. Local reports use supported posture, comparable history and estimated timeline evidence, with explicit handling for limited or uncertain observations. Their rules, guidance and results remain on your device; local report generation makes no report-data network request. In ordinary use, camera images never leave your computer; camera video and audio are not uploaded. Local history is not automatically copied into a research study.
• Account and service records: Forma stores information such as your account identity, agreements, security records, setup status and any billing or support records. Eligible UK accounts also sync the onboarding answers described below. These records are separate from your local posture history.
• Historical cloud-report records: cloud report generation is retired. Previously generated inputs, outputs and usage records remain subject to the existing limit of up to 30 days and earlier account deletion or applicable data-rights removal. Saved reports on your device remain available until local deletion.
• Optional research: if you join a hosted study, Forma stores the selected study information on behalf of the named research organisation for the period stated in its study notice, subject to your choices, withdrawal and applicable law. The separate Forma Research programme has its own derived-data and camera-clip choices and is currently closed to new participation; it is unavailable to United States residents.

“Local” describes where your posture information is processed and stored; it does not mean Forma holds no personal information about you. Sending health-related information in a support message also gives Forma that information for handling your request. Please send only what is needed and do not email camera recordings or passwords.

Who is responsible

Forma Pose Ltd, company number 17392462, is a company incorporated in England and Wales and is the controller for the personal information described here. Its registered office is 23 Albert Embankment, London, United Kingdom, SE1 7GG. The service contact remains 10 York Road, London SE1 7ND, United Kingdom. Contact eric@formapose.com for privacy, support, security, rights, complaints or unsafe-report requests. Forma is intended for United Kingdom residents aged 18 or over, and for United States residents who are 18 or over or have reached the age of majority in their state.

Necessary website storage

Forma does not use non-essential advertising or tracking cookies. To understand which of Forma's own links help people find the app, a reviewed link may contain one fixed campaign code. Forma may use that code to increment a daily total when a Mac or Windows installer link is requested. An installer-request total records only Mac or Windows and arm64 or x64. The counter stores no raw page address or referrer, arbitrary campaign text, IP address, cookie or browser identifier, signup or account link, desktop event, or posture Health Data. Unknown codes are counted as unattributed. A request is not proof of download, installation or use.

This limited measurement relies on Forma's legitimate interest in assessing its own distribution without third-party tracking. The daily aggregate counters remain in Cloudflare D1 for up to 1,095 days and may be copied into Forma's restricted aggregate product-analytics Workspace file. You may object by contacting Forma, although a daily total that contains no identifier cannot be located or removed as your personal record. Installer navigation does not wait for the counter, and measurement failure does not block the download.

Historical website forms

Forma no longer accepts early-access or scorecard responses from the public website. Historical records remain in their restricted stores only until their existing retention period ends: no more than 30 days for incomplete scorecards and no more than 180 days for completed scorecards, download requests, or early-access records and delivery evidence. You may request erasure of an eligible historical record by emailing eric@formapose.com.

Account and service security

Forma processes your provider identifier and verified email/name when supplied by Google or Apple, or your encrypted email and salted password verifier for an email account. It also processes agreement receipts, sign-in and last-use times, coarse operating-system family, encrypted sessions, entitlements, quotas, short-lived keyed abuse-prevention values and security events. For accounts eligible for the bounded service and feedback messages below, authenticated app startup records the operating system’s IANA time zone only to schedule them; Forma does not infer location from IP or email. To avoid repeating setup after a reinstall or on another device, Forma keeps your setup-flow version, coarse furthest stage, completed/dismissed status and times with your account. These progress records contain no survey answer, posture Health Data, report content or free text. Dedicated encrypted onboarding responses are stored separately from progress records and from website early-access records. Historical rows from the retired onboarding assessment and website scorecard remain available only for bounded operations and scheduled expiry; no active public form accepts new scorecard writes. Forma never receives your Google or Apple password and does not build a precise-location or device-fingerprint history.

For eligible accounts, Forma may send one service check-in at the first 08:55 local time after at least two days from account creation, then one optional feedback request at the first 08:55 local time after at least fourteen days. Europe/London is used if no valid system time zone is available. You can reply directly; the final request may also offer a ten-minute feedback call and two months of Forma Pro credit as thanks for completing that call. The sequence does not use posture Health Data, questionnaire answers, analytics behaviour or inferred engagement, and it is not a newsletter. Its delivery table stores only your account ID, message type, timing, governing time zone, status and bounded provider/error evidence; the Worker resolves your current verified account email only when it sends. A “no follow-up” request suppresses every unsent message. The sequence relies on Article 6(1)(b) for the service check-in and Article 6(1)(f) legitimate interests in finding service issues and seeking genuine, optional product feedback. You may object at any time by replying or emailing Forma, without losing access.

Account delivery relies on Article 6(1)(b) UK GDPR. Proportionate security, abuse prevention and service reliability rely on Article 6(1)(f). Website early-access contact and storage rely on the consent shown on that form. Limited records may rely on Article 6(1)(c) where necessary for a legal obligation.

Service operations and product improvement

Forma separates service operations from product improvement. Service operations cover providing and securing accounts, check-ins, reports, entitlements, support, reliability and cost control. Current reports are generated on your device. Historical cloud-report records remain limited to their existing delivery, safety, reliability, support and deletion purposes; they are not reused for product improvement without its separate authority.

For product improvement, Forma records one account-linked marker for a UTC day when the service or app is used, plus counts of completed manual or automatic check-ins, successful check-in or daily reports, and fixed onboarding milestones. It uses these facts to understand activation, find reliability problems and prioritise improvements. This analytics record does not contain posture scores or measurements, presence, landmarks, images, video, audio, report input or text, survey answers, free text, workplace context, IP address, a precise device or advertising identifier, or location. It is not used to target or score you, change access, advertise, contact you, or enrol you in Research.

This limited product-improvement processing relies on Forma's Article 6(1)(f) legitimate interests in understanding whether the service activates and works reliably. Linked rows remain in Cloudflare D1 for no more than 180 days. Forma then keeps daily aggregate metrics for up to 1,095 days. Google Workspace receives only aggregate product metrics; any cell representing fewer than five people is suppressed. Access is limited to named authorised product-improvement accounts. You may object at any time without losing the service by emailing Forma. Forma will stop new collection and remove your linked analytics rows; an aggregate that can no longer be linked back to you cannot be reconstructed or removed as your personal record.

On-device camera and posture processing

Forma Web requires a separate Forma Web account before onboarding or camera access. Email registration, inbox verification, agreement acceptance, sign-in, password recovery, session refresh and sign-out use Forma’s Cloudflare Worker as described under Account and service security. The Worker places the random refresh credential in a host-only, HttpOnly, Secure and SameSite=Strict cookie limited to the Forma Web authentication routes; page scripts cannot read it. These account requests contain no camera, posture or profile-choice content.

After sign-in, Forma Web asks for your preferred name, one or more bounded work-setup patterns, one bounded support preference and one bounded focus area. Selecting “Other” for work setup or support allows up to 240 characters, with a prompt not to include medical or symptom details. Forma Web may retain a separate bounded cloud-report preference from its onboarding form. That preference does not enable report requests; cloud report generation is retired. These answers, onboarding completion state and the opaque Web-account owner remain only inside the protected browser record; they are not sent to the Worker, joined to the desktop account, projected to Workspace, or used for analytics, reports or Research.

Forma Web asks for a separate express choice before creating that protected record or requesting camera access. It downloads Forma’s self-hosted model files and analyses each brief manual 18-frame check-in in the current page. You may separately enable automatic check-ins every 5, 15 or 30 minutes after Forma confirms camera access from that action. Each automatic check-in analyses three frames and runs only while the Forma Web document is visible. Hidden, frozen, sleeping, overlapping or missed slots do not activate the camera and do not create catch-up captures. Camera frames, raw and world landmarks and interim assessments remain in device memory only. The local record also contains the choice time, independent automatic-check-in and page-reminder preferences and due state, the latest collapsed missed automatic slot, and up to 2,048 check-in trigger modes, scheduled/completion times, aggregate scores and subscores, confidence, usable-frame count and capture/model provenance in one ciphertext of at most 2 MiB. It is encrypted with AES-GCM using a non-exportable key held by this browser profile in IndexedDB. Another Forma account in the same browser profile cannot open it. Forma Web sends no camera frame, landmark, posture result or profile choice to the Worker.

The camera stops after each result, cancellation, error, page hiding/freezing, sign-out, session-verification failure or page close. Optional 2- or 4-hour reminders have a separate page timer: they work only while the page remains open and never start the camera. Weekly charts compare brief foreground check-ins and do not claim continuous monitoring, time at your desk, away time or a causal change. You can immediately delete the protected key and record in Settings. If the page remains open, Forma purges them at the exact seven-day boundary; otherwise it checks and purges them the next time the originating account opens Forma Web. Browser or site-data controls may remove them earlier, so Forma does not promise cross-device continuity, hidden/closed-browser cadence or deletion while the browser remains unopened. A wrong-owner, damaged, future or undecryptable record fails closed and is not silently replaced. Static-site and Worker delivery still create ordinary request and security logs, but posture content is absent from those requests.

The desktop application separately requests camera access for short assessments and, if enabled, recurring check-ins while the app is running. Camera frames are analysed transiently on your computer. Ordinary Forma use does not upload camera images, video or audio. The Forma Research programme is run by Forma and is unavailable to United States residents; hosted research studies are run by an organisation and are available with your separate per-study consent, under which Forma receives and stores only the listed derived categories on that organisation’s behalf. If you join such a study, its listed categories can include your notification log entries for the study period — what each reminder did and how you responded — which Forma shares with that organisation. The app creates pose landmarks, camera-visible measurements and scores, confidence and quality values, presence/away states, coarse active-display counts, setup and posture-pattern classes, times, failures, reports and software/model provenance.

Desktop Local Health Data is stored in one versioned encrypted document protected through Electron’s operating-system-backed secure storage. It remains until account deletion or you remove the app data. Readable exports are not password protected; an optional transfer backup is password-encrypted and account-bound. Forma Web is a separate, one-browser record and does not join or copy desktop Health Data.

Because posture information can reveal physical wellbeing, Forma asks for express consent under Article 9(2)(a), alongside the Article 6(1)(b) basis for providing requested posture features. In the browser, you can stop future processing by turning automatic check-ins off, deleting the browser data, cancelling or closing a check-in, signing out, hiding/closing the page, or revoking site camera permission. In the desktop app, you can stop future camera processing by turning check-ins off, revoking camera permission or deleting the account.

Local reports and historical cloud-report records

Forma assembles first-assessment and scheduled daily reports on-device from versioned deterministic rules and prewritten guidance. Report generation makes no LLM inference or AI-provider request and creates no cloud report input, cloud report text or provider usage record. The local result remains health-related information with the same privacy protections and deletion rights.

This release retires cloud report generation. Older desktop releases must update to generate new reports; their stored cloud preference does not enable external inference. Existing saved reports remain readable on your device. Forma retains historical cloud report inputs, outputs and usage for no more than the existing 30-day period, and processes account deletion and applicable data-rights requests. Previously permitted information contained bounded derived posture evidence and excluded camera media, direct identifiers and user free text. Runware remains relevant only to its historical processing and any continuing contractual deletion or rights assistance. Turning off report creation does not itself erase an earlier report.

Historical cloud reports relied on Article 6(1)(b) for requested service delivery and Article 9(2)(a) explicit consent for the health-related input and output. That historical report payload does not contain camera images, video, audio, raw pose landmarks or coordinate arrays, Forma account or check-in identifiers, or user-authored free text.

Research choices and server storage

Research is off unless you actively join a specific study or the separately offered Forma Research programme. Joining a hosted study does not authorise access to your entire local history or enrol you in another study. Forma creates a separate study copy only of the categories listed for that study and permitted by your recorded choices. Before joining, you can review the organisation, purpose, categories, recipients, retention, withdrawal rules and the organisation’s privacy notice. Check-in timing is required for hosted studies; other categories depend on the study and any category opt-outs it offers. United States participants give separate, unticked choices for collection and sharing in addition to the study consent.

A hosted study can collect permitted check-in timing, sampled presence and quality, posture scores and measurements, workday load, reminder interactions and monitoring-status events. These are sampled observations, not a continuous recording of your activity. A study may change reminder or check-in settings only as disclosed in its participant information. Automated study capture sends no camera images, video, audio or pose coordinates. If a study requests paperwork, you may separately upload a PDF, PNG or JPEG document; those files can contain personal or health information and are stored for authorised review.

For a hosted study, the named organisation is the controller and Forma processes the selected information on its behalf under a written agreement, using Cloudflare for hosting and storage. Study observations follow the stated rolling retention period, between 30 and 365 days; the default is 365 days. Withdrawal and applicable deletion rights can require removal sooner. Uploaded paperwork also expires no later than the study’s rolling period from upload; its disclosed post-withdrawal period can require earlier deletion. Exported datasets keep the original source-data deadlines. Research organisations can opt into email reminders 10, 5 and 1 day before an export deadline; reminders do not confirm deletion. Selected observations awaiting upload may remain in an encrypted, account-specific queue on your device until delivered or cleared through withdrawal or deletion. A failed or pending upload is not confirmation that the study received it.

The separately offered Forma Research programme is run by Forma as controller and is currently closed to new participation. Its derived-data and silent camera-clip choices are separate; camera clips require the paired derived-data choice. This programme is unavailable to United States residents. Its research copies have a 30-day retention deadline from capture; retries do not restart that clock. Historical consent-authorised report-improvement copies keep their existing removal rules; current local reports are not sent to an AI provider.

Research participation does not change Free or Pro access. Leaving stops the relevant research sharing and does not erase ordinary local posture history. Consent is limited to the described purpose and recipients; it does not authorise unrelated model training, AI inference, advertising or sale. Study data is encrypted in transit and at rest, and authorised Forma operators and study personnel can access it for the permitted platform and study purposes. A participant code reduces direct identification but is not a guarantee of anonymity.

Preferences during onboarding

Desktop onboarding asks for your preferred name and three bounded questions about what you notice during focused work, the kind of support you want and the posture area you want to focus on. If you select “Other” for work setup or support, you may enter up to 240 characters. Older releases also record a separate cloud-report preference. Releases with local report generation do not use these answers as report inputs and do not need cloud-report permission. There are no pricing, company or detailed discomfort-area questions.

Encrypted responses remain with your account for no more than 180 days and are used to tailor onboarding. They are excluded from the current local report input. Historical use by an older cloud-report release remains subject to the choice and report boundary described above; older releases cannot use them to request new cloud reports. A replace-only copy may appear in Forma's restricted account-operations Workspace file so named operations users can support onboarding and understand the current setup state; the same 180-day expiry and earlier deletion are reflected on the next sync. They do not change posture measurements or access, and are excluded from website early access, posture Health Data, aggregate product analytics and Research. Account deletion removes them.

Sources, requirements and recipients

Forma receives information from you, the app and device features you choose, Google or Apple when used for sign-in, service providers acting for Forma and records generated while delivering and securing the service. Account and Forma agreement information is required to create and operate an account. Camera permission and express health-data consent are required for posture features. Research, early-access and newsletter information remains optional and is governed by the choices shown at collection.

Cloudflare provides static-site hosting and delivery, authentication, Workers, D1, private R2, email delivery, security and update delivery. Google and Apple provide the identity method you choose. Runware was the processor for historical cloud-report inference; no new report information is sent to it. Historical contractual deletion and rights-assistance duties continue. Separate restricted Google Workspace files may hold account-operations records including current onboarding responses, aggregate product and website-acquisition metrics, newsletter records, early-access records or historical website scorecard responses; product cohort cells representing fewer than five people are suppressed, and access to one purpose does not grant access to another. During the controlled hosting migration and rollback window, Vercel may serve the same static files without Forma-configured health-data analytics or form processing. Professional advisers, insurers, auditors, regulators and authorities may receive information where reasonably necessary and lawful. Forma does not sell personal information or use it for advertising, employment or insurance decisions.

International processing

Providers may process information in the United Kingdom and other countries identified in their current service terms and Forma’s processing records. Before Forma initiates a restricted transfer, it uses an applicable UK adequacy regulation or legally effective safeguards such as the UK International Data Transfer Agreement or UK Addendum, completes the required data-protection test and supplementary measures, and requires the relevant processor contract. Contact Forma to request information about the safeguard that applies to a transfer. External report generation is retired in this release.

Business changes

Forma may disclose proportionate information under confidentiality to professional advisers, funders and prospective buyers while evaluating an investment, financing, reorganisation, incorporation or sale. Forma may transfer information, contracts and responsibility to an incorporated successor or buyer of the Forma business where lawful. The new controller must continue to honour applicable choices and safeguards, and Forma will notify affected people before a material controller or purpose change takes effect. Research media is not made available for general investor due diligence.

Retention and deletion

• Local encrypted posture history and reports: until account deletion or local app-data removal on the applicable device.
• Historical cloud report inputs, outputs and usage: up to 30 days.
• Linked product-improvement events and daily counters: up to 180 days, or earlier objection/account deletion; aggregate daily product metrics: up to 1,095 days.
• Aggregate daily website-acquisition counters: up to 1,095 days.
• Operations access logs: 90 days.
• Access sessions: 15 minutes; refresh sessions: up to 30 days.
• Abuse-prevention records: about 24 hours; security events: 90 days; historical assessment-link codes: 10 minutes and one use.
• Account identity and current setup status: while the account remains active; granular setup-stage events: up to 180 days.
• Account lifecycle-email timing, suppression and delivery receipts: while the account is active, with account-deletion cascade; bounded provider/error evidence is not retained after that account lifecycle.
• Minimal agreement, transaction, complaint, security and deletion evidence: while needed to operate the account and for up to six years after closure where reasonably necessary for legal obligations, disputes or legal claims. Special-category evidence is retained only where an applicable Article 9 condition also permits it.
• Onboarding preferences: up to 180 days or account deletion.
• Local encrypted notification history on your device, recording reminder decisions and your responses: until account deletion or local app-data removal. Forma retains the available history for your full dataset export; there is no automatic age-based expiry of this local log. A separately consented research copy follows the research retention period, not this local period.
• United States consent and arbitration receipts (the statement version, a hash of the exact statement shown, a keyed hash of your normalised email address, and the study and time where relevant): detached from your account when you delete it and kept for six years as evidence, so a later claim or opt-out can be matched.
• Website early-access records and confirmation/invitation delivery evidence: up to 180 days or earlier consent withdrawal or erasure.
• Historical incomplete website scorecards: up to 30 days; historical completed scorecards, download requests and email receipt: up to 180 days; newsletter as described above.

Scheduled deletion jobs and account deletion remove the applicable Forma-controlled cloud records. If deletion fails, affected encrypted records or files and the custody information needed to retry may remain pending cleanup; a pending state is not confirmation of completed erasure. Backups and provider systems must follow applicable deletion duties and deadlines. Genuinely anonymised information that no longer relates to an identifiable person may be retained and used for statistical, operational and product-improvement purposes.

How to stop processing and remove your data

1. Stop future camera processing: turn automatic check-ins off, stop a running check-in or revoke camera permission. This stops new camera analysis but does not delete existing local information or previously shared copies.
2. Leave a hosted study: open its study entry in Forma Settings and choose the withdrawal control. Once withdrawal is confirmed, Forma stops new sharing and deletes its stored study observations and survey delivery records. Uploaded paperwork is scheduled for removal after the period disclosed by the study, normally 30 days after withdrawal and never longer than its stated retention. If you want paperwork or other retained information erased sooner, make a separate deletion request using the contact below; a study setting does not override applicable law. Leaving the separate Forma Research programme stops that programme’s collection and starts deletion of the research copies Forma controls.
3. Delete your account and local account data: in desktop Settings, open Privacy and data and select Withdraw consent & delete account. Confirm control of your inbox when prompted. The app completes server-side deletion before clearing that account’s data on this device. If an operation cannot finish, it remains pending and offers Retry; a pending message is not confirmation that every copy has been erased. Subscription resolution may be needed to close a paid account, but you can still make a data-rights or withdrawal request separately. Removing onboarding answers is also available in Settings where supported and resets the historical cloud-report preference to on-device. It does not delete saved local reports or prevent on-device report generation.
4. Delete browser or other local copies: Forma Web Settings lets you delete its protected record and key in that browser profile. Removing app or site data affects that device or browser, not a previously shared study copy or your server-side account. Clear local Forma data on other devices too. Delete any readable exports and transfer backups you saved or shared if you no longer want those copies; Forma cannot remotely erase files you control.
5. Request deletion or help without closing your account: email eric@formapose.com from your account email where possible, identifying the account and any relevant study and saying what you want removed. You do not need to create a new account, use legal terminology or send a password, camera recording or identity document by default. We may ask for proportionate verification before acting. Use the same contact if you cannot sign in, the app is unavailable, deletion remains pending or you need confirmation of what was removed.

We remove information from the systems Forma controls and notify the relevant processors and recipients of a valid deletion request where required. For hosted studies, we also coordinate with the research organisation, which must handle the copies it has already exported under its notice and applicable law. Forma cannot directly erase the organisation’s independent systems, but this does not remove our own duties to assist with and communicate a request. We will explain any remaining information, the lawful reason and applicable retention or backup-deletion period. A withdrawal or deletion request does not undo genuinely anonymised findings that can no longer be linked to you. A participant code or removal of your name alone does not make information anonymous.

Deletion is subject only to applicable legal exceptions, not a blanket research or platform exemption. Minimal agreement, consent, withdrawal, transaction and dispute evidence may remain where lawfully needed, including the detached United States receipts described above; this is not permission to keep all posture history or study observations. Backups and recipients must follow applicable deletion duties and deadlines. Your statutory rights and our responsibilities are not waived by this notice or a study agreement.

Your choices and rights

Settings lets you turn automatic check-ins off, export readable posture information, create an encrypted transfer backup, manage the Forma Research programme and any hosted research studies separately, remove supported onboarding responses, and delete your account. Depending on the circumstances, you may ask to access, correct, erase, restrict or receive your information, object to legitimate-interests processing, and withdraw consent. In particular, you may withdraw website early-access consent or object to linked product analytics without losing access to Forma. Withdrawal does not affect processing that was lawful beforehand.

Email eric@formapose.com or write to the service address above. Forma will acknowledge a data-protection complaint within 30 days, investigate it fairly, keep you appropriately informed and communicate the outcome without undue delay. You may also complain to the Information Commissioner’s Office.

Security, wellbeing boundary and changes

Controls include encryption, TLS, server-held credentials, schema allow-lists, rotating sessions, one-use security challenges, least access and fail-closed local storage. No system is completely secure; Forma maintains incident and rights procedures appropriate to its scale.

Forma is intended solely for general wellbeing and workday awareness. It is not intended for diagnosis, prognosis, treatment, clinical monitoring, emergency use or medical decision-making and is not a substitute for professional advice. Forma assesses a material change to purpose, data, recipient or consent before use. It records consent versions separately from ordinary notice corrections, brings material changes to affected users’ attention and seeks a new choice when required.

United States residents

This section applies only if you live in the United States. It describes what Forma does with personal information for a United States account and how to exercise your privacy rights. Where this section conflicts with the general notice above for a United States resident, this section applies. The Consumer Health Data Privacy Policy separately covers consumer health data.

What Forma receives, and what it does not

For United States residents, Forma processes posture information only on your own device and does not receive it. The app analyses camera frames on your computer, turns them into on-device posture measurements, scores, workday load and related insights, and keeps them in encrypted local Health Data. Forma’s servers do not receive camera images, video, audio, pose landmarks, coordinate arrays, posture measurements or scores. The exception for product data is research-study data that you explicitly agree to share under a study’s separate consent: if you join a hosted study and give its separate, unticked consents, Forma receives and stores only the derived data categories listed in that study on the research organisation’s behalf and shares them with that organisation, as set out in the Consumer Health Data Privacy Policy and the study’s own notice. You can withdraw that sharing at any time. Health-related information you deliberately send in a support or rights request is used to handle that request.

Cloud reports, the Forma Research programme (which Forma runs and which is unavailable to United States residents), onboarding-answer sync and check-in analytics are not available to United States residents. Hosted research studies are different: an organisation runs them, and when you join one and consent, Forma receives and stores the listed derived categories on that organisation’s behalf. Cloud report generation, Forma Research enrolment, onboarding-response sync, health milestones and check-in analytics events are turned off for your account, and your onboarding answers stay on your device.

Personal information Forma does receive

Forma receives and processes the account information needed to run a United States account: your email address and, when your identity provider supplies it, your name; authentication identifiers and credentials from Google, Apple or a Forma email account, including a salted password verifier and inbox confirmation, and never a Google or Apple password; agreement and consent receipts, including the version, statement and time of each choice; the operating system’s IANA time zone, used only for scheduling; security and abuse-prevention logs; billing and transaction records if you pay for a plan; and any support, feedback or complaint messages you send.

Categories of personal information collected in the last 12 months

For United States residents, in the 12 months before the effective date above, Forma collected these categories: identifiers such as your email address, name, account and provider identifiers, and network-address data in security logs; customer and commercial information such as plan, entitlement and quota state and payment or transaction records where you pay; and internet or network activity limited to the security, abuse-prevention and delivery logs created when you use the service. Forma does not collect biometric identifiers or face-geometry templates, precise geolocation, or the contents of your camera. Forma collects health-related product data about a United States resident to its servers only where you join a hosted research study and give that study’s separate consents; health-related information you voluntarily send in a support or rights request is handled only for that request, and the categories are listed in the Consumer Health Data Privacy Policy. Outside study sharing and information you deliberately provide to support or exercise a right, Forma does not receive the health-related content of a United States account.

How Forma uses personal information

Forma uses this information to create and secure your account; provide the on-device posture features and any local reports; send service, security and support messages; enforce agreements and quotas; process payments; prevent abuse and fraud; meet legal, tax and accounting obligations; and respond to your requests and rights. Forma does not use it to build advertising or marketing profiles.

No sale, no advertising “sharing” and Global Privacy Control

Forma does not sell personal information, and it does not “share” personal information for cross-context behavioural advertising. Forma does not run targeted advertising or allow third-party advertising trackers on the service. Forma honours the Global Privacy Control (GPC) signal as a valid opt-out of sale and sharing; because Forma does not sell or share personal information for advertising, there is nothing further to opt out of, and Forma will not treat you differently for sending the signal.

Retention

Forma keeps account, agreement, security and, where applicable, billing records only as long as needed to operate the account and to meet legal, dispute and record-keeping duties, including up to six years after account closure where reasonably necessary for legal obligations or claims. Security and abuse-prevention logs are kept for the shorter periods in the general retention list above. Ordinary posture and notification history stays on your device until local deletion, so there is no server-side copy to retain unless you have joined a hosted study and separately consented to its sharing. That study copy follows its stated retention and deletion rules. United States consent and arbitration receipts are the one exception: Forma keeps the statement version, a hash of the exact statement shown, a keyed hash of your normalised email address and the related study and time, detached from your account, for six years after you delete it, so a later claim or arbitration opt-out can be matched.

Your state privacy rights

Depending on where you live, you may have the right to know and access the personal information Forma holds about you and how it is used; to delete it; to correct inaccurate information; to obtain a portable copy; to opt out of sale, sharing, targeted advertising or profiling, none of which Forma does; and to appeal a decision about a request. To exercise a right, email eric@formapose.com or use Settings where available. Forma will compare the request with your account and may ask you to confirm control of the account email before acting. You may use an authorised agent; Forma may require written permission and may still verify the request directly. Forma will not discriminate against you for exercising a privacy right and will handle an appeal through the same contact. A United States resident may also complain to their state attorney general.

Children

Forma is not intended for anyone under 18, and Forma does not knowingly collect personal information from anyone under 18. If you believe a child has used Forma, contact Forma so the account can be removed.

Biometric information

Forma does not collect, store or use biometric identifiers or face-geometry templates. Pose estimation runs on your device and produces posture measurements; Forma does not send images, video or body coordinates to its servers. Forma does not create or keep a faceprint, retina or iris scan, fingerprint, voiceprint or other biometric identifier, and does not use your face or body to identify you. Research-study sharing, when you separately agree to it, is limited to the derived categories listed in the study and excludes images, video and coordinates.

Illinois, Texas and Washington notices

Forma uses body and face position points transiently on your own device to estimate posture and does not use them to identify you or create an identity template. Illinois residents receive a separate on-device processing notice and consent at sign-up. Local processing and the absence of an identity template do not waive any biometric privacy rights that apply. Before a change to biometric processing, Forma will assess the applicable state requirements and provide the notice, consent and retention controls required before that processing begins.

Breach notification

If a security breach affects your personal information, Forma will investigate promptly and notify you and any required regulator or authority as applicable law requires, including the Federal Trade Commission Health Breach Notification Rule where it applies to a research-study share and applicable state breach-notification laws.

Contact

Questions or requests about this section: eric@formapose.com, or Forma Pose Ltd, 10 York Road, London SE1 7ND, United Kingdom.