Privacy Policy
Kegio deals with some of the most private information there is. This policy explains exactly what we collect, why, and the control you have over it.
Kegio deals with some of the most private information there is — your bladder control, your erections, your ejaculation control, your pelvic health. We treat it that way. We ask for your explicit consent before we handle any health information about you, and you can withdraw that consent at any time. We never sell your data, we never share your health data with advertisers, and we never use it for advertising or marketing.
You can delete your account, and all of your training and health data, from inside the app at any time. Your training data is stored on your device and, if you have an account, in our secure database so it survives a lost phone. We use a small number of named service providers, every one of them listed below. The rest of this policy explains the detail — it is written to be read, not to be skimmed past.
Who we are
The data controller
KYNX LABS LTD is the “data controller” for the personal data described in this policy, which means we decide why and how it is used and we are legally responsible for it. We are registered in England and Wales under company number 17111265, at 3rd Floor, 86-90 Paul Street, London, England, United Kingdom, EC2A 4NE.
What this policy covers
This policy covers the Kegio mobile app, this website, and any support you receive from us. Privacy questions are handled at support@kegio-pro.com and answered by a named person, not a bot. We are not currently required to appoint a Data Protection Officer.
This is health data, and we treat it as such
What counts as special category data
Some of what Kegio records about you is special category data under UK and EU law — the most strictly protected category there is. Specifically, it is the information you enter about your own body: data concerning your health (your bladder-control scores, any urinary or pelvic symptoms you note) and data concerning your sex life (your erection-hardness and ejaculation-control scores, and anything you tell us about sexual function). Your training records on their own — which sessions you completed, how long they lasted, which level you are on — are exercise-completion data, not health data, and we do not treat them as special category.
We need your explicit consent
We can only process this data with your explicit consent under Article 9(2)(a) UK GDPR. Not implied consent, and not consent bundled into a terms checkbox — a separate, specific, clearly-worded opt-in that you give before we collect anything. You can withdraw it at any time, and when you do we stop processing and delete the data unless the law requires us to keep it.
Using Kegio without consenting
You can use the timer, the exercise library and every training track without giving that consent. If you decline, the self-assessment and progress-trend features simply stay switched off. Nothing else is affected, and we will not nag you about it. Because we rely on your consent — and not on our contract with you — for this data, withdrawing consent genuinely stops the processing. There is no fallback basis we switch to.
What we collect
Data you give us
Account data: your email address, your password (stored only as a cryptographic hash — we never see it), your sign-in provider if you use Apple or Google sign-in, and your account creation date. Profile and settings: age range, chosen difficulty mode and training tracks, reminder times, audio and haptic preferences, language. Health self-assessments (special category, optional, explicit consent required): your 1–10 scores for bladder control, erection hardness and ejaculation control, your self-assessment notes, and results of in-app self-check exercises such as maximum hold time. These are self-reported estimates for your own reference — they are not clinical measurements and have not been validated against any clinical standard. Support correspondence: your messages to us and our replies.
Data created by your use of Kegio
Training data: sessions started and completed, exercises performed, duration, reps, completion percentage, current level and phase, session counters, rest days, streaks, badges, skill-test results and difficulty mode changes. Challenge data: which lifestyle challenges you mark complete. Usage and diagnostic data: screens viewed, features used, session length, crash reports, error logs, app version and performance data. If you take the quiz on this website, we also record the answers you select so we can show you a result.
Data collected automatically
Device and technical data: device model, operating system version, language, region, time zone, screen size, app version and network type. Identifiers: a random app-instance identifier, a Firebase installation ID, and — if you allow it — a push notification token. We do not use the iOS Advertising Identifier and we do not ask for App Tracking Transparency permission, because we do not track you across other companies' apps or websites. Approximate location: country level only, inferred from your IP address, for language defaults and regional legal compliance. We do not collect GPS or precise location.
What we never collect
We do not collect your precise or GPS location; your contacts, calendar, photos, camera, microphone or call logs; Apple Health (HealthKit) or Google Health Connect data — Kegio does not integrate with either platform at all; biometric identifiers such as face or fingerprint data, since Face ID and fingerprint unlock are handled entirely by your device and we only receive a yes/no result; your payment card details; or data from children, as Kegio is strictly 18+.
Why we use it, and our lawful basis
On the basis of our contract with you
We create and run your account and authenticate you; deliver the training programme, showing your level, running timers, counting sessions and unlocking levels; sync your training records between your devices; unlock Premium features and handle billing queries; and answer your support messages. Without this processing we cannot provide the service you asked for.
On the basis of your consent
We store and display your self-assessment scores and progress trends, and sync that data between your devices so you do not lose it — both with your explicit consent under Article 9. We send reminders and streak notifications if you turn them on, and we collect usage analytics if you opt in. Withdrawing any of these consents stops the processing immediately.
On the basis of our legitimate interests
We fix crashes, diagnose bugs and keep Kegio working and secure, and we protect against fraud and abuse. We have considered whether these interests are overridden by your rights and concluded they are not, because the processing is limited to what is necessary, involves no health data, and you can object at any time. We also process data where the law obliges us to, for example for tax and accounting.
Analytics, advertising and automated decisions
Analytics are off until you turn them on. On this website that choice is the cookie banner; in the app we ask on first launch. If you say no, or ignore the prompt, no analytics events leave your device. Our analytics are aggregated and event-based — we look at how many users completed a session this week, or where people drop out of onboarding. We never send self-assessment scores or any health data to Google Analytics or any other analytics tool. We do not use your data for advertising or marketing profiling, we do not share it with ad networks or data brokers, and we do not sell or rent it. We also make no decision about you by automated means that produces a legal or similarly significant effect — level progression is a fixed, published rule set you can override yourself at any time.
Where your data lives, and for how long
On your device and in our database
Your current level, session history, settings and progress are stored locally on your device so the app works offline, protected by your device's own encryption and passcode. If you use Kegio without an account, your data stays on your device only — deleting the app deletes it, and we cannot recover it for you. If you create an account, your data is also stored in our secure database hosted by Supabase encrypted in transit and at rest, with row-level security rules so your records can only be read by your own authenticated account. We exclude your health data from iCloud and Google device backups.
How long we keep it
Account and profile data, health self-assessments and training history: while your account is active, then deleted within 30 days of account deletion or of you withdrawing consent. On-device data: until you delete the app or clear its data. Support correspondence: 2 years from the last message. Crash and diagnostic logs: 90 days. Event-level analytics linked to a random app-instance identifier: 14 months, matching our Google Analytics retention setting. Aggregated counts containing no identifier: indefinitely, as this is no longer personal data. Purchase and transaction records: 7 years, because UK tax and accounting law requires it — after you delete your account we keep only the store transaction identifier, product and amount, with your email address and all health data removed.
Inactive accounts
If you do not use Kegio for 24 months we will email you. If you do not respond within 30 days, we will delete your health data and self-assessment history. If you hold a lifetime unlock or an active subscription we will not delete the record of what you bought — you keep the access you paid for, and you can start again from a clean slate whenever you come back.
Who we share it with
Providers that process data on our behalf
These act only on our written instructions, and their contracts require them to protect your data to the same standard as this policy and forbid them from using it for their own purposes. Supabase Inc., with its hosting provider Amazon Web Services, provides our database, authentication and file storage, holding account data, training history and self-assessment scores ; Supabase is US-headquartered and its support staff may access data to resolve a fault. Google Firebase provides crash reporting, opt-in usage analytics and push notification delivery, receiving device and technical data, an app-instance identifier, usage events, crash logs and push tokens — no health data and no self-assessment scores. Resend sends our account and service emails, receiving your email address and the message content. We confirm that every one of these providers is contractually required to give your data protection equal to that described in this policy.
Independent organisations we deal with
Apple and Google are not our processors. They decide their own purposes and are governed by their own privacy policies, so we send them as little as possible. They handle App Store and Google Play distribution, payment and subscription management, and — if you use Sign in with Apple or Google Sign-In — they know you have an account with us. Neither receives your health data or your self-assessment scores from us.
Other disclosures
We may also disclose data to professional advisers under a duty of confidentiality; to a buyer or successor if our business is sold or reorganised, though we will ask for your fresh explicit consent before transferring any health data to a new owner and will delete it rather than transfer it if you do not consent; where the law requires it, to a court, regulator or law enforcement body under a valid legal request, resisting requests that are overbroad or unlawful and telling you unless legally prohibited; and to protect people, where we reasonably believe disclosure is necessary to prevent serious harm. We do not sell your personal data. We never have and we will not.
Sending data outside the UK
Some providers process data outside the United Kingdom. When that happens we protect it to the UK standard using either UK adequacy regulations, or the UK International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum, together with a transfer risk assessment and extra technical measures such as encryption where needed. You can ask us for a copy of the safeguards that apply to a specific transfer by emailing support@kegio-pro.com.
Your rights
What you can ask for
You can get a copy of everything we hold about you and an explanation of how we use it; receive your data in a structured, machine-readable file or have us send it to another provider; correct anything inaccurate or incomplete; have your data deleted, which for health data given with consent is close to absolute; withdraw your consent at any time; ask us to pause processing while a dispute or accuracy question is resolved; and object to anything we do on the basis of legitimate interests. All of these are free, and we will respond within one month, extendable by two months for complex requests, in which case we will tell you why.
How to exercise them
You can delete your account and all of your training and health data, including the copy on your device, from You → Account → Delete account in the app. For everything else — a copy of your data, correcting something, withdrawing your consent, or making a complaint — email support@kegio-pro.com and we will do it for you, free. You never have to find a screen in the app to exercise a right. Where the app also offers a screen for one of these, under You → Privacy, you can use whichever route you prefer. We may ask you to verify your identity before we act, because we will not hand your health data to someone claiming to be you.
Complaining
You can raise a data protection complaint directly with us at support@kegio-pro.com. We will acknowledge it within 5 working days, and always within the 30 days required by the Data (Use and Access) Act 2025, respond without undue delay and keep you updated. You can also complain to the Information Commissioner's Office at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, on 0303 123 1113, or at ico.org.uk/make-a-complaint. We would appreciate the chance to put things right first, but you do not have to come to us before going to the ICO. If you are in the EU, you can complain to your national data protection authority instead.
Security and age
How we protect your data
We use encryption in transit (TLS 1.2 or higher) and at rest; row-level security in the database so a query can only ever return your own rows; passwords stored as salted hashes that we cannot see or recover; access controls limiting access to the small number of people who need it, and only for a specific reason; redaction of health fields from crash and diagnostic reports, which we do not intentionally log; and regular dependency and security updates, with a privacy review of new features before release.
If something goes wrong
No system is perfectly secure and we cannot guarantee absolute security. If a breach happens that is likely to result in a high risk to your rights, we will tell you without undue delay, and we will report it to the ICO within 72 hours where the law requires it. You can help by using a strong, unique password, locking your device, and not using Kegio on a shared or jailbroken device.
Age restriction
Kegio is for adults aged 18 and over. It is not directed at children and we do not knowingly collect data from anyone under 18. If you believe someone under 18 has given us personal data, email support@kegio-pro.com and we will delete the account and the data promptly.
Store labels, changes and contact
App store privacy labels
The App Store “Privacy Nutrition Label” and the Google Play “Data safety” section give a short summary of our data practices. This policy gives the full detail. We check both against this policy whenever either changes, and we keep them consistent.
Changes to this policy
We will update this policy when our practices change or the law does, and the date at the top always tells you which version you are reading. If a change materially affects your rights — a new purpose, a new category of data, or a new recipient of health data — we will tell you in advance by in-app notice or email at least 14 days before it takes effect, and where the change requires it we will ask for fresh consent rather than assume it. We keep previous versions and will send you one on request.
Contact us
For privacy questions, requests and complaints, email support@kegio-pro.com, or write to KYNX LABS LTD, 3rd Floor, 86-90 Paul Street, London, England, United Kingdom, EC2A 4NE. We aim to answer every privacy email within 5 working days, and always within the one-month legal deadline.
Cookie Policy
We use cookies and similar tracking technologies to improve your experience, analyze usage patterns, and deliver personalized content. Cookies are small data files stored on your device.
Essential Cookies
Required for basic functionality like authentication and security.
Analytics Cookies
Help us understand how users interact with our services.
Preference Cookies
Remember your settings and preferences for a better experience.
You can change or withdraw your cookie choice at any time using the cookie settings on this site. Analytics cookies are off until you accept them — declining does not limit any feature of Kegio.