Forma Research and hosted research studies

Controller and eligibility

Forma Pose Ltd, company number 17392462, is incorporated in England and Wales and is the controller for its own Forma Research programme and platform accountability. The organisation named in a hosted study is that study’s controller, with Forma acting as its processor. Forma’s registered office is 23 Albert Embankment, London, United Kingdom, SE1 7GG. The service contact remains 10 York Road, London SE1 7ND, United Kingdom. Participants must be United Kingdom or United States residents aged 18 or older, or the age of majority in their state, and must meet the eligibility rules shown in the study. Contact eric@formapose.com.

Hosted research studies

A research organisation can invite you to a specific study inside Forma. The organisation is the controller: before you join, Forma shows its privacy notice, study information, selected categories, retention, recipients and participation choices. Forma acts as its processor under a written agreement. Joining is optional and specific to that study. It does not authorise access to every local record, category or future purpose, or enrol you in another study.

Check-in timing is required. Depending on the study and your choices, additional derived categories can include sampled desk, away or uncertain presence and camera quality; posture score and bounded measurements; workday load; reminder interactions, including prompts held back; and monitoring-status events such as pausing, camera problems, sleep, lock or account access. Category opt-outs apply where offered. Forma does not treat missing or poor-quality capture as proof of good posture, absence or a break. Selected observations are collected during the consented enrollment; automated capture never sends camera images, video, audio or pose coordinates.

Invitation and survey emails have separate delivery records. The organisation may send survey invitations through Forma while you are enrolled, using its contact address; a one-click link stops survey emails for that study without withdrawing participation. If the study requests paperwork, you may separately upload PDF, PNG or JPEG files. These can contain personal or health information and are held in private encrypted storage for authorised organisation reviewers. Uploading paperwork is distinct from sharing camera recordings.

A study may disclose check-in timing or reminder settings that apply while you participate. Identified studies show the permitted team your name and email alongside study data. Studies configured to hide identity use a participant code in researcher views; that code is pseudonymous and does not by itself make the data anonymous. Consent does not authorise unrelated AI inference, model training or new recipients.

United States participants

For a United States participant, Forma processes posture information on your device and does not receive it unless you join a hosted study and give its separate, explicit consents — one to Forma collecting the study’s categories on the organisation’s behalf and one to sharing them — together with the study’s own consent. That share consent covers only the derived data categories listed for the study and is described in the Consumer Health Data Privacy Policy, and you can withdraw it at any time in Forma settings. Once you share data, the research organisation named in the study is the controller of the data it receives and its own privacy notice governs how it uses it. Any ethics or institutional review — such as review under the Common Rule by an Institutional Review Board — is that organisation’s responsibility, not Forma’s. Forma deletes the study observations it holds for you when you withdraw or when the study’s retention period ends.

Your separate choices in the Forma Research programme

This separately governed programme is currently closed to new participation. If offered under its approved notice, you may choose to share pseudonymous derived posture measurements, quality signals and check-in context created after enabling the choice. Derived-data sharing contains no camera media, name or email, although Forma retains a protected account link to administer your choices and deletion.

A separate choice permits silent clips made only from frames Forma analyses, paired with those frames’ derived posture and quality evidence. Clips may contain your face, background or another person in view. Clips cannot be enabled without the paired derived-data choice. This programme does not enrol you in a hosted study. Historical consent-authorised report-improvement copies retain their existing deletion rules; current report generation runs locally without an AI provider.

Purpose, basis and access

Research copies are used only for the purpose described in the approved programme or study, never for advertising, employment decisions, insurance, facial recognition, diagnosis or sale. Forma’s own programme relies on Article 6(1)(a) consent and Article 9(2)(a) explicit consent for health-related derived information. A hosted study’s controller explains its own lawful basis in the organisation’s notice; Forma follows its lawful, study-limited instructions and the participant’s recorded choices.

Access is limited to authorised operators, study personnel and contracted processors for the permitted purpose and under confidentiality, security and deletion obligations. The study organisation’s role controls what its team can review or export. A new purpose, recipient, labelling or model-training use requires its own assessment, approval and participant information and choice where required.

Storage and retention

Ordinary product Health Data remains encrypted on your device. Selected hosted-study observations waiting for upload are held in a separate encrypted account-specific queue. They can remain pending while the service is unavailable or refuses an upload; they are cleared after delivery or through the applicable withdrawal/deletion flow. Optional programme media has a seven-day local retention deadline, including quarantined clips. Cleanup runs when Forma next processes the queue; a closed app or failed deletion can delay physical removal, and expired clips are not uploaded.

Forma uses Cloudflare for the hosted research service. Study observations and platform records are stored in its access-controlled database; paperwork and optional programme copies use private object storage. Data is encrypted in transit and at rest. Authorised Forma operators and study personnel can read information for the permitted purpose; encryption does not make these shared copies private from every authorised recipient.

Hosted-study observations have the rolling period shown before joining, between 30 and 365 days, with a default of 365 days. Confirmed withdrawal deletes Forma-held study observations and survey delivery records. Paperwork expires no later than the study’s rolling period from upload and follows an earlier disclosed post-withdrawal period, normally 30 days or a study-selected period capped by its retention. Closing a study also starts a final cleanup period under its stated retention; it does not extend an observation’s rolling period. You may request earlier erasure, and applicable rights take precedence over a protocol or grace period.

Optional Forma Research copies have a 30-day retention deadline from capture, separate from hosted-study retention; retries do not restart that clock. Expired or withdrawn copies are removed through scheduled deletion. If deletion fails, the affected encrypted records or files and the custody information needed to retry may remain pending cleanup. They are not treated as erased or authorised for continued research use. Minimal consent, withdrawal and access-audit evidence is separate from observations and may remain only as lawfully needed. United States consent and arbitration receipts are detached on account deletion and retained for six years as described in the Consumer Health Data Privacy Policy; that exception does not permit keeping all study observations.

Withdrawal, outcomes and rights

Use the withdrawal control for the relevant programme or study in Forma Settings. Once confirmed, the corresponding sharing stops without changing Free or Pro access, and Forma removes the research copies it controls under the disclosed deletion rules. A failed, offline or pending request is not confirmation that withdrawal or erasure has completed: retry or contact Forma. Turning ordinary check-ins off alone does not withdraw a study or erase earlier copies. Local product history, other-device copies and files you exported remain under their separate controls.

To ask for deletion without closing the account, earlier paperwork removal, a copy or correction of your data, or help with pending deletion, email eric@formapose.com and identify the account and study. Do not send passwords or camera recordings. Forma uses proportionate verification, coordinates with the organisation and its processors, and explains any lawful retained information and applicable deadline. The organisation must address copies it already downloaded; Forma cannot directly erase its independent systems and remains responsible for its own processing and required rights assistance.

Withdrawal cannot reverse genuinely anonymised findings that can no longer relate to an identifiable person; a participant code alone does not meet that standard. A study agreement does not waive mandatory privacy rights. Forma owns the service, methods and improvements it develops; participation creates no ownership or payment right unless a study expressly provides one. You may withdraw consent, exercise applicable access, correction, erasure, restriction and portability rights, or complain to Forma or the Information Commissioner’s Office. United States rights are also described in the Consumer Health Data Privacy Policy.