← forma.coach

Privacy Policy

Last updated: 20 March 2026

Who we are

Forma ("we", "us") is a fitness coaching service operated by Lokh Prakash Kopparni, trading as Forma, based in the United Kingdom. Our website is forma.coach and our app is at app.forma.coach.

What we collect

Account data: Your email address, used for authentication via magic link. We do not store passwords for Forma accounts.

Garmin biometric data: When you connect your Garmin account, we access your HRV status, Body Battery, sleep score, training load, and recovery time. This data is used solely to calculate your daily readiness score and generate personalised workouts.

Garmin credentials: Your Garmin email and password are used only during the authentication handshake. Your Garmin password is never stored on our servers. We store an encrypted session token to maintain the connection.

Workout history: We store records of workouts generated and pushed to your Garmin device to improve exercise rotation and avoid repetition.

Payment data: Payments are processed entirely by Stripe. We do not see, store, or handle your card number or banking details. We store only your Stripe customer ID to manage your subscription.

How we use your data

• Generate personalised, recovery-adapted workouts based on your daily biometrics
• Push structured workouts to your Garmin device
• Send you authentication emails (magic links)
• Manage your subscription and billing via Stripe
• Improve the workout generation algorithm over time

What we never do

• Sell, rent, or share your personal data with third parties for marketing
• Use your data for advertising
• Store your Garmin password
• Access Garmin data beyond what is needed for workout generation

Third-party services

We use the following services to operate Forma:

• Garmin Connect — biometric data access and workout delivery
• Stripe — payment processing and subscription management
• Resend — transactional email delivery (magic links)
• Railway — application hosting (EU region)
• Vercel — frontend hosting

Each service processes data under their own privacy policies. We select services that meet appropriate security and data protection standards.

Data storage and security

Your data is stored in a PostgreSQL database hosted on Railway in the EU. All connections use TLS encryption in transit. Session tokens are stored server-side with time-limited expiry.

Data retention

We retain your data for as long as your account is active. If you delete your account or request data deletion, we remove all personal data within 30 days. Anonymised, aggregated data may be retained for service improvement.

Your rights (GDPR)

Under the UK General Data Protection Regulation, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — ask us to delete your data
• Portability — receive your data in a machine-readable format
• Restriction — ask us to limit how we process your data
• Objection — object to our processing of your data

To exercise any of these rights, email us at privacy@forma.coach. We will respond within 30 days.

Cookies

Forma uses only essential cookies and local storage for authentication session management. We do not use analytics cookies, tracking pixels, or any third-party tracking.

Children

Forma is not intended for anyone under the age of 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. Material changes will be communicated via the email address associated with your account. The "last updated" date at the top of this page reflects the most recent revision.

---

Contact