Privacy Policy

Last updated: 22 October 2026

This policy explains what personal data FLOWBIO collects when you use our sensor, apps, Garmin data field, website and shop, how we use it, and the choices and rights you have.

At a glance

• What we collect: your account and body profile (name, email, height, weight, sex, date of birth), the sweat readings from your sensor, and the workouts you sync or connect.
• Why: to calculate your fluid and sodium loss and give you recovery advice. We process your health data only with your explicit consent.
• Who sees it: service providers that run our apps and services for us, and services you choose to connect. We never sell your data, and we never use your health data for advertising.
• Analytics and marketing: only if you agree, and you can change your mind at any time.
• Your control: delete your account in the app, or email privacy@flowbio.com to access, correct or export your data.

The rest of this policy gives the details.

Who we are

We are FLOWBIO Ltd, a company registered in England and Wales (company number 12590933), of FLOWBIO Office (K402), 100 Drummond Road, London, SE16 4DG, United Kingdom. In this policy, "FLOWBIO", "we", "us" and "our" mean FLOWBIO Ltd.

We make the FLOWBIO S1 sweat sensor and the software that goes with it. This policy explains how we handle personal data when you use any of these:

• The FLOWBIO S1 sensor, which you wear during exercise to estimate fluid and sodium loss.
• The FLOWBIO phone apps for iPhone and Android.
• The FLOWBIO APIs and backend services that store your account and workouts and connect to services such as Garmin, Wahoo, Zwift and COROS.
• The FLOWBIO Garmin Connect IQ data field.
• Our website and online shop at flowbio.com, which runs on Shopify.

FLOWBIO Ltd is the controller of the personal data described here: we decide why and how it is processed. Where you connect a third-party service, such as Garmin Connect or Apple Health, that service is a separate controller of the data it holds under its own privacy policy.

What we collect

Most of what we collect is health data: readings from your sweat sensor and the fluid and sodium estimates we calculate from them. Under UK and EU data protection law this is special category data, and we only process it with your explicit consent (see How we use your data).

Your FLOWBIO account (phone apps and backend)

Sensor and workout data

Location. The FLOWBIO apps do not track your device's GPS location. Android asks for location permission on Android 11 and older only because Android needs it to scan for Bluetooth devices; the app does not read your location. When you plan a workout, the place you type is looked up with Apple Maps (iPhone) or Google Places (Android), and the resulting coordinates are stored with your plan.

Device and app data

Apple Health

The FLOWBIO apps do not read from or write to Apple Health, Health Connect or Google Fit. If we add this, we will update this policy and ask for your permission first.

What the S1 sensor stores

The sensor stores up to 128 workout sessions in its own memory: the raw readings, session details and calorie, heart rate and power inputs listed above. It does not store your name, email, weight, age or sex. Sessions stay on the sensor until the app has uploaded them and deletes them.

Website and shop

Where your data comes from. You give us most of it directly: when you sign up, complete your profile, log drinks, plan workouts, buy from us or contact us. The rest comes from your sensor and our apps, from cookies on our website, from services you choose to connect, and from service providers acting for us, such as Shopify for orders and Terra for connected workouts.

The FLOWBIO Garmin Connect IQ data field

The FLOWBIO data field runs on your Garmin watch or bike computer. It talks only to your FLOWBIO sensor over Bluetooth, never connects to the internet, and has no account, analytics or advertising.

• Reads from your Garmin device: the activity's calorie total, its sport type (for example indoor or outdoor cycling) and whether the timer is running. It does not read your location, heart rate or Garmin profile.
• Sends to your sensor: your calorie total and workout type, and commands to start, pause and stop the session. The sensor uses them to estimate your fluid and sodium loss, and the FLOWBIO app later syncs the session to your account.
• Shows and records: your fluid and sodium loss on screen, and the final totals in your Garmin activity. When the activity syncs to Garmin Connect, Garmin handles it under Garmin's privacy policy.
• Keeps on your device: the sensor you paired and the current session, until you remove the sensor or uninstall the data field.

The calorie total and workout type are health-related data. We process them on the basis of our contract with you and the explicit consent you give in the FLOWBIO app.

How we use your data and our legal bases

We use your health data to give you fluid and sodium estimates and recovery advice, and only with your explicit consent. UK GDPR and EU GDPR require a legal basis for each use, plus an extra condition for health data. The table sets them out.

Your consent choices. When you create an account, we ask for your explicit consent to process your health data. Without it we cannot calculate your estimates, so the app's core features will not work. We ask separately for consent to product analytics, and you can say no without losing any features. You can withdraw either consent at any time in the app's settings or by contacting us. Withdrawing does not affect processing we did before.

What we do not do. We do not sell your personal data. We do not use your health data for advertising. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Our fluid and sodium estimates are guidance for training and are not medical advice.

Who we share your data with

We share personal data only with service providers that process it for us under contract (processors), with services you choose to connect, and where the law requires it. We do not sell personal data and we do not share your sweat or sodium data with any training platform.

Service providers that process data for us

Shopify. Our shop runs on Shopify. For some features, such as Shop Pay and fraud checks across stores, Shopify uses your data as a separate controller under the Shopify Consumer Privacy Policy. You can exercise your rights over that data at privacy.shopify.com.

Services you choose to connect

You can connect your FLOWBIO account to Garmin Connect, Wahoo, Suunto, COROS and Zwift. Garmin, Wahoo and Suunto connect to us directly; COROS and Zwift connect through Terra, our integration provider. When you connect a service, it sends us your workouts: for example time, sport, duration, distance, heart rate, power, cadence, speed, calories, temperature and GPS route. We use them to match your sensor sessions to your workouts and improve your estimates. We only receive data from these services: we do not send them your sweat or sodium data. Each service is a separate controller of your data under its own privacy policy. Disconnecting a service in the app revokes our access and deletes the stored access tokens.

The Garmin Connect IQ data field writes your fluid and sodium totals into your Garmin activity file on your own device; Garmin then holds them under Garmin's privacy policy (see The FLOWBIO Garmin Connect IQ data field).

Other disclosures

We may disclose personal data if the law requires it, to protect the rights, safety or property of FLOWBIO or others, or to a buyer or successor if our business is sold or reorganised. In a sale, this policy will continue to apply to your data.

International transfers

We are based in the UK. Some of the service providers listed above store or access personal data outside the UK and the European Economic Area, for example in the United States.

When we transfer personal data from the UK or the European Economic Area to a country without an adequacy decision, we protect it with:

• the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and the EU Standard Contractual Clauses, in our contracts with each provider; or
• the UK Extension to the EU–US Data Privacy Framework, or the EU–US Data Privacy Framework, where the US provider is certified.

We also assess the risks of each transfer and use encryption in transit and at rest. You can ask us for a copy of the safeguards for a particular transfer (see Contact us).

How long we keep your data

We keep your account and health data while your account is open, and delete or anonymise it when you delete your account. Some copies take longer to clear, as set out below.

How we keep your data secure

We use technical and organisational measures that fit the sensitivity of health data. They include:

• encrypted connections (HTTPS) between the apps and our servers;
• encryption at rest for our databases, backups and file storage;
• databases in private networks that are not reachable from the internet;
• login through a dedicated identity provider, so we never store your password;
• separate cloud accounts for production, staging and development, and restricted staff access to production data;
• names and emails removed from the data we use for analysis.

No system is completely secure. If a breach affects your personal data and is likely to put your rights at high risk, we will tell you and the regulator as the law requires.

Your sensor. The S1 sensor talks to your phone and your Garmin device over Bluetooth Low Energy. It does not store your name or contact details, and it deletes each session once the app has uploaded it. Keep your phone and Garmin device locked with a passcode, because the FLOWBIO app and data field store data on them.

Your rights

You have rights over your personal data, and exercising them is free. Under UK GDPR and EU GDPR you can ask us to:

• Access your data: get a copy of the personal data we hold about you.
• Correct it: you can edit your profile in the app, or ask us to fix anything else.
• Delete it: delete your account in the app's settings, or ask us.
• Port it: get the data you gave us, and the sensor data you generated, in a machine-readable format.
• Restrict or object to processing, including processing based on our legitimate interests.
• Withdraw consent at any time, for health data, product analytics, cookies or the newsletter.

To exercise a right, email privacy@flowbio.com. We may need to confirm your identity. We will reply within one month, or tell you within that month if we need up to two more months for a complex request.

We will not treat you differently for using your rights. You can ask someone else to make a request for you; we will ask for proof that you authorised them.

Marketing emails. You can unsubscribe at any time with the link in any of our emails. We will still send you emails about your account and orders.

Browser privacy signals. Our shop treats a Global Privacy Control signal from your browser as a request to opt out of the sale or sharing of your data for targeted advertising. We do not respond to other "Do Not Track" signals.

Deleting your data in other places.

• Your sensor: sessions are deleted from the sensor once the app has uploaded them.
• Your phone: signing out of the app deletes the data stored on your phone.
• Your Garmin device: remove the sensor from the Sensors menu or uninstall the data field.
• Garmin Connect, Wahoo and other connected services: data they hold, including the fluid and sodium totals the Garmin data field writes to your activities, is deleted through those services.

Complaints. If you are unhappy with how we handle your data, please contact us first. You can also complain to our supervisory authority, the UK Information Commissioner's Office (ico.org.uk, 0303 123 1113). If you live in the EU or EEA, you can complain to the data protection authority where you live or work.

If you live outside the UK and EU. We sell to customers internationally. Wherever you live, you can use the rights above by emailing privacy@flowbio.com. If the law where you live gives you further rights, we will honour them.

Links to other websites

Our apps, website and emails link to sites and services we do not control, such as training platforms and social networks. Their own privacy policies apply when you use them. Anything you share publicly on social media can be seen by others.

Children

FLOWBIO products are for adults. You must be 18 or over to create a FLOWBIO account, and the app checks your date of birth when you complete your profile. We do not knowingly collect personal data from anyone under 18. If you think a child has given us personal data, contact us (see Contact us) and we will delete it.

Changes to this policy

We will update this policy when our products or the way we use data change. The current version is always on this page, and the "Last updated" date at the top shows when it last changed. If a change materially affects how we use your personal data, we will tell you in the app or by email before it takes effect. Where a change needs your consent, for example a new use of your health data, we will ask for it first.

Effective date: 22 October 2026.

Contact us

For any question about this policy or your personal data, contact:

• FLOWBIO Ltd, FLOWBIO Office (K402), 100 Drummond Road, London, SE16 4DG, United Kingdom
• Email: privacy@flowbio.com

For help with the app or your sensor, email support@flowbio.com.