Privacy Notice
Last updated 26 September 2026 · Version 2026-09-26
Who we are
Prospect Group ([Registered office address], company number [Company registration number]) is the data controller for the personal data described here. That means we decide what data is collected and why.
For anything in this notice, including access or deletion requests, contact byheze@prspctgroup.com.
What we collect
Not everyone gives us all of this. What we hold depends on which parts of the platform you use.
| Data | When |
|---|---|
| Name, email, phone | When you apply for membership |
| Why you want to join | The free-text answer on the application form |
| Login details | When your account is created. Passwords are hashed and we never see them |
| Display name, profile photo | If you add them |
| Health and wellbeing data | If you use the wellness platform: weight, steps, calories, sleep, mood check-ins, workouts, runs, habits, goals and anything you write in your private journal |
| Financial activity | If you use the Terminal: your position journal, portfolios, holdings, watchlists and any broker account you connect |
| Posts and comments | Anything you share in the community feed, which other members can see |
| Strava activity | Only if you choose to connect Strava, and only until you disconnect it |
| Technical data | IP address, browser and device information, recorded automatically in server logs |
Health data needs your explicit consent
Data about your body and your mental health is a special category under Article 9 of the GDPR and is treated more carefully than ordinary personal data. We only process it where you have given explicit consent by choosing to use the wellness platform and entering that information.
Your journal entries are private to your account. Other members cannot read them. Staff do not read them in the normal course of running the platform.
You can withdraw that consent at any time by asking us to delete your wellness data, and we will.
Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Assessing your application | Legitimate interests: we cannot decide on an application without reading it |
| Running your membership and giving you access | Performance of a contract |
| The wellness platform, including health and journal data | Explicit consent, Article 9(2)(a) |
| Marketing emails and texts about events and sessions | Consent, which you give by ticking the box and can withdraw at any time |
| Service messages, such as password resets and session reminders | Legitimate interests, and necessary to run your account |
| Keeping the platform secure | Legitimate interests |
Ticking the marketing box is optional and your application is assessed the same either way. We record when you gave consent and which version of this notice was in force at the time.
Who else handles your data
We do not sell your data. We use these providers to run the platform, and each only receives what it needs:
| Provider | What it handles |
|---|---|
| Supabase | Database, logins and uploaded files |
| Vercel | Website hosting and server logs, and privacy-friendly visitor analytics. It counts page views and where visitors arrived from. It sets no cookies, does not track you across other websites, and does not build a profile of you |
| Resend | Transactional and marketing email |
| Twilio | Text messages |
| OpenAI | Generating workouts, weekly wellness summaries and market analysis. Wellness data is sent to OpenAI to produce your summary, and is not used to train their models |
| Strava | Only if you connect it |
| Vimeo | Hosting and playing session recordings |
| Fonts, which receive your IP address, and Meet for live sessions |
Some of these are based outside the European Economic Area. Where that is the case, transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision.
How long we keep it
| Data | Kept for |
|---|---|
| Unsuccessful applications | 12 months from the decision |
| Member accounts and their content | While you are a member, then 24 months |
| Health and wellness data | Deleted within 30 days of your account closing, or sooner on request |
| Record of marketing consent | While consent stands, then 24 months as evidence it was given |
| Server logs | Typically 30 days |
Your rights
Under the GDPR you can ask us to:
- give you a copy of the data we hold about you
- correct anything that is wrong
- delete your data
- stop or restrict how we use it
- send your data to you or another provider in a portable format
- object to processing we base on legitimate interests
- withdraw consent, including for marketing and for health data, at any time
Email byheze@prspctgroup.com and we will respond within one month. Withdrawing marketing consent is as simple as replying to any message or using the unsubscribe link.
If you think we have handled your data badly you can complain to the Data Protection Commission (Ireland). We would rather you told us first so we can put it right.
Cookies and similar technology
We do not use advertising or tracking cookies. We store a login token in your browser so you stay signed in, and some preferences locally on your device. These are necessary for the platform to work.
Embedded Vimeo players and Google Fonts may set their own cookies when a page loads them.
Changes
If we change how we use your data we will update this page and its version number. Where the change is significant we will tell members directly rather than relying on you to notice.