Movetru Privacy Policy
Version 2.0 | Last updated: July 2026
1. Introduction
Movetru Ltd (“Movetru”, “we”, “us”, “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share and protect personal data when you use the Movetru VISION and Movetru PRO products, our mobile and web applications, our wearable sensors and our website at movetru.io (together, the “Services”). It also explains your rights and how to exercise them.
This Privacy Policy forms part of, and should be read with, our Terms of Service. Please read it carefully. We may provide additional privacy information at the point we collect data for a specific purpose.
Terms used in this Privacy Policy that are not defined here (including “Order Form” and “Data Processing Agreement”) have the meaning given in our Terms of Service and the applicable agreement with your organisation.
2. About us
Movetru Ltd is the data controller for the personal data described in this Privacy Policy, except where we act as a processor on behalf of a club or organisation (see section 3). For customers and users in the United States, the relevant controller (the “business”) is Movetru, Ltd., a Delaware corporation and our US affiliate (referred to in this Privacy Policy as “Movetru USA”) — a separate legal entity from Movetru Ltd, the Northern Ireland company; the US privacy notice in section 16 applies to them.
Company: Movetru Ltd, registered in Northern Ireland, company number NI670805.
Office address: Unit 14, Ormeau Business Park, 8 Cromac Avenue, BT7 2JA, Belfast, Northern Ireland.
ICO registration: ZB276692.
Data Protection Officer: Dylan McBurney — support@movetru.io.
General and data-rights contact: support@movetru.io.
3. Scope and our role
This Policy covers personal data we process as a controller: our direct relationship with individual athletes and users of the Movetru apps (including the self-record route), our website, our marketing, and account administration.
Where a club, team or other organisation deploys Movetru to capture and analyse data about its athletes, that organisation is the controller of that athlete data and its own privacy information applies; in that case Movetru acts as the organisation’s processor under a data processing agreement, and we process the data on that organisation’s documented instructions.
4. The personal data we collect
4.1 Account and identity data
Name, email address, username, password, role, organisation/team, and contact details.
4.2 Athlete profile data
Date of birth, gender, ethnicity, height, weight, limb lengths, and injury history. Some of this is special category (health) data — see section 5.
4.3 Movement data — Movetru PRO
Movetru PRO is a wearable device and accompanying application. It collects the device serial number and raw sensor data, and derives kinetic and kinematic movement metrics used to generate movement assessments and exercise recommendations.
4.4 Movement data — Movetru VISION
Movetru VISION is a camera-based application. Video analysis is performed locally on your device; the raw video is then uploaded to our cloud storage. VISION captures one athlete at a time.
4.5 Usage, device and technical data
Device and app information, identifiers, IP address, approximate location, log data and diagnostic data.
4.6 Cookies and website analytics
Our website uses cookies and similar technologies. We ask for your consent to non-essential cookies (such as analytics) through our cookie banner, and you can review or change your choices at any time using the “Cookie preferences” link in our website footer.
4.7 Communications and information about others
We collect records of your communications with us, and any information you provide about other people (for example a team contact). If you provide another person’s data to us, you must ensure you may lawfully do so.
4.8 Billing and payment data
Where you pay for the Services, we collect billing contact and transaction details (such as billing name, address and records of payments). Card payments are processed by our third-party payment provider on a PCI-DSS compliant basis; we do not store full card numbers.
4.9 Do you have to provide this data?
You must provide account, identity and movement data to create an account and use the Services, and billing and payment data to pay for them; without these we cannot provide the Services. Other data, such as marketing preferences, is optional and you can decline without affecting your use of the Services.
5. Special category (health-related) data
Some of the data we process — including date of birth, height, weight, limb lengths and injury history, and certain movement, asymmetry and physiological outputs from Movetru — is special category data concerning health under Article 9 of the UK GDPR and EU GDPR.
Where we process such data as controller, we rely on your explicit consent (Article 9(2)(a)), or, for athletes aged under 18, the explicit consent of a parent or guardian. You can withdraw this consent at any time, which will not affect processing carried out before withdrawal. Our products are not medical devices and do not diagnose, treat or prevent any injury or condition.
6. Lawful bases for processing (provisions of the UK GDPR and EU GDPR for UK and EU users)
Performance of a contract (Article 6(1)(b)) — to provide the Services and your account.
Legitimate interests (Article 6(1)(f)), including the recognised legitimate interests introduced by the Data (Use and Access) Act 2025 where applicable — to secure, support, improve and develop the Services. We balance these against your interests and rights.
Legal obligation (Article 6(1)(c)) — to comply with our legal and regulatory duties.
Consent (Article 6(1)(a)) — for marketing and non-essential cookies.
Explicit consent (Article 9(2)(a)) — for special category (health) data.
7. How we use your information
To register you as a new user of the Services.
To provide, operate and personalise the Services and your account.
To generate movement assessments and exercise recommendations using automated processing, including our patent pending Performance Framework™ and machine-learning models (see section 8).
To train and improve the Movetru algorithms, and to develop our Services, using de-identified movement data only — we do not use raw athlete video for training (see section 8).
To communicate with you, provide support, and (with your consent or where lawful) send marketing about our products. You can opt out of marketing at any time using the unsubscribe link in our emails or by contacting support@movetru.io.
To take and process payments and manage billing — on the basis of our contract with you, and to keep tax and accounting records as required by law.
For operational, security, legal and compliance purposes, including fraud prevention and enforcing our terms.
8. Automated processing, and training our algorithms
The Services use automated processing, including our Performance Framework™ and machine-learning models, to analyse movement and generate assessments and exercise recommendations. These outputs are decision-support tools; they inform, but do not replace, the judgement of you and your qualified staff. Where any processing produces a decision with legal or similarly significant effects based solely on automated means, you have the rights described in section 14, including to request human involvement and to object.
Training our algorithms. We train and improve the Movetru algorithms using de-identified movement data only — with identifying metadata separated and removed so that the training data does not identify any individual. We do not use raw athlete video, or any data that identifies an individual, to train our algorithms. Training runs on our own infrastructure in the United Kingdom (Amazon Web Services, London region), and we do not send or share this data with any third party for training. Because the training data is de-identified, it is not personal data. If we ever propose to use identifiable data, including raw video or health-related data, to train our algorithms, we will obtain your explicit consent first.
Your choices. Business customers may require the exclusion of their data from this training in their Order Form, and individual app users may ask us to exclude their data at any time by contacting support@movetru.io. If we ever propose to use identifiable data, including raw video or health-related data, to train our algorithms, we will obtain your explicit consent first.
9. How we share your information
9.1 Within a team account
Where you use the Services through a club or organisation, your data and movement outputs may be visible to that organisation’s authorised staff.
9.2 Service providers (processors)
We use trusted service providers that process personal data on our behalf under written terms, in the following categories: cloud hosting and infrastructure; email and communications; website hosting and analytics; and payment processing. We require each provider to protect personal data and to process it only on our instructions. A current list of our sub-processors, naming each provider, is available on request and is provided to business customers under our Data Processing Agreement.
9.3 Other disclosures
We may disclose personal data where required by law, to protect our rights, safety or property, or in connection with a sale or reorganisation of our business.
9.4 No sale; no cross-context behavioural advertising
We do not sell your personal data, and we do not share it for cross-context behavioural advertising.
10. International data transfers
We host personal data in the United Kingdom (AWS, London region).
EEA to UK: transfers of EEA personal data to the UK rely on the European Commission’s adequacy decision for the UK. No further safeguard is required while the adequacy decision is in force; if it lapses or is invalidated, we will implement the EU Standard Contractual Clauses for the EEA-to-UK transfer.
UK to United States: where our providers (such as our payment, email and website analytics providers) process data in the United States, we put in place the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses (and rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified), together with any supplementary measures identified by a transfer risk assessment.
11. Children and young athletes
The Services are intended for users aged 13 and over. We do not knowingly collect data from children under 13; if we learn we have, we will delete it.
For athletes aged 13 to 17, we require the consent of a parent or guardian (captured directly or, for club deployments, obtained and warranted by the club), and we apply additional protections in line with the UK Children’s Code and the children’s higher protection matters under the Data (Use and Access) Act 2025. In the Republic of Ireland the digital age of consent is 16; we apply the higher local age where it applies. Where data forms part of US school or college records, we rely on the institution’s authorisation (FERPA).
12. Data retention and deletion
We keep personal data only as long as necessary.
You can ask us to delete your personal data at any time by making a deletion request to support@movetru.io. On a valid deletion request (or account closure), we will delete or irreversibly anonymise your personal data within 30 days, after which residual copies are removed from backups on our normal backup cycle. We may retain genuinely anonymised data and data we must keep by law.
13. Security
We use appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, role-based access controls and multi-factor authentication, UK-region hosting, logging and monitoring, and vendor due diligence. Where a personal data breach is likely to result in a risk to individuals, we notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware, and we notify affected individuals where there is a high risk.
14. Your rights (UK and EU users)
Access, rectification, erasure, restriction, portability and objection.
To withdraw consent at any time, and to object to direct marketing.
Rights in relation to solely automated decisions that produce legal or similarly significant effects, including to request human involvement.
The right to complain to us directly: we will acknowledge your complaint within 30 days and respond without undue delay (Data (Use and Access) Act 2025).
To complain to a supervisory authority — the UK Information Commissioner’s Office (ico.org.uk) or, in the Republic of Ireland, the Data Protection Commission. We would welcome the chance to address your concern first.
To exercise your rights, contact support@movetru.io. You can also access, correct or delete much of your information directly in the Movetru app settings.
15. EU and UK representatives
Movetru is established in the UK (Northern Ireland). Where we offer the Services to, or monitor, individuals in the EEA, we are required to appoint an EU representative under Article 27 EU GDPR.
16. United States privacy notice
For US customers and users, the “business” responsible for personal information is Movetru, Ltd., a Delaware corporation (“Movetru USA”), our US affiliate and a separate legal entity from Movetru Ltd (Northern Ireland). This section applies to residents of US states with applicable privacy laws (including California’s CCPA/CPRA, and the comprehensive laws of Virginia, Colorado, Connecticut, Utah and others). It supplements the rest of this Privacy Policy.
Categories collected: identifiers, customer records, commercial/financial and payment information, internet/usage activity, approximate geolocation, and sensitive personal information (health-related movement data and, for some users, precise data or financial account information).
Sources and purposes: as described in sections 4 and 7.
No sale or sharing: we do not sell personal information or share it for cross-context behavioural advertising.
Sensitive personal information: we use it only to provide the Services and for permitted purposes, and you may limit its use as provided by law.
Your rights: to know, access, correct, delete, and to opt out of sale/sharing and limit sensitive-data use; we will not discriminate against you for exercising them.
To exercise US rights, contact support@movetru.io. California residents may also make a Shine the Light request.
17. Changes to this Privacy Policy, and your duty to inform us of changes
We may update this Privacy Policy from time to time. We will post the updated version here and, where changes are significant, notify you. The “last updated” date shows the latest revision.
It is important that the personal data we hold about you is accurate and current. Please keep us informed at support@movetru.io if your personal data changes during your relationship with us — for example a new address or email address.
18. Contact us
Movetru Ltd, Unit 14, Ormeau Business Park, 8 Cromac Avenue, BT7 2JA, Belfast, Northern Ireland. Data Protection Officer: Dylan McBurney, support@movetru.io. General and data-rights contact: support@movetru.io.