Privacy Policy

1.0 Who We Are

This Privacy Notice explains how ALM Performance Ltd (“ALM”, “we”, “our”, “us”) handles personal data collected through our Health & Wellbeing Application (“the App”).

• Company number: 14291906
• Registered office: 4 Stadium Close, Stotfold, Bedfordshire, SG5 4TJ, United Kingdom
• ICO registration: ZB562401
• Contact: privacy@almperformance.uk

ALM Performance Ltd is the Data Controller for personal data processed through the App. The App operates independently of police force systems and is used voluntarily on personal devices. No police force has access to personal data within the App and does not act as a Data Controller or Data Processor.

2.0 Purpose of Processing

The App provides access to employee health and wellbeing content, resources, and interactive features designed to support nutrition, sleep, stress, resilience, and similar topics.

We process limited personal data to:

• enable user registration and secure access;
• deliver app content and notifications;
• integrate with optional third-party wellness platforms (e.g. Apple Fit / Google Fit);
• support anonymised usage analytics and technical maintenance;
• manage user data and deletion requests in accordance with user instructions and applicable data protection legislation.

3.0 Personal Data We Process

No health or special category data is processed unless an optional future feature is activated by you with explicit consent.

4.0 Lawful Bases for Processing

Processing is carried out under:

• UK GDPR Art. 6(1)(b) – performance of a contract (to provide the App service);
• UK GDPR Art. 6(1)(f) – legitimate interest (security, analytics, support);
• UK GDPR Art. 6(1)(a) / Art. 9(2)(a) – explicit consent (for optional integrations).

Controllers (Police Forces) may also rely on Art. 6(1)(e) (public task) when the App is provided as part of their employee welfare programme.

5.0 Data Retention

Personal data is retained for the duration of the organisational contract under which the App is provided. The App operates independently of employer systems and ALM does not have visibility of individual employment status; therefore data cannot be automatically deleted based on employment changes. Users may delete their account and data at any time via the App or by contacting ALM. Where a valid deletion request is received, data will be securely erased without undue delay. Limited data may remain in secure backups temporarily before automatic overwrite.

6.0 Data Storage and Security

All data are stored and processed on Amazon Web Services (AWS) cloud servers located in the UK.

Technical and organisational measures include:

• AES-256 encryption at rest and in transit;
• pseudonymisation and restricted access controls;
• MFA authentication and security auditing;
• ISO 27001-aligned controls.

7.0 Data Sharing and Third-Party Processors

ALM does not sell or disclose personal data for marketing.

Limited data may be shared with:

Where transfers occur outside the UK/EEA, we use UK International Data Transfer Agreements (IDTA) or Addendum clauses (DUAA 2025 ss. 42–45) to ensure equivalent protection.

8.0 Your Rights

Under UK GDPR, DPA 2018, and DUAA 2025, you have the right to:

• access your data (Art. 15);
• rectify inaccuracies (Art. 16);
• erase data (Art. 17);
• restrict processing (Art. 18);
• object to processing (Art. 21);
• data portability (Art. 20);
• withdraw consent at any time (Art. 7(3));
• not be subject to automated decisions (Art. 22).

Requests can be made directly to ALM at privacy@almperformance.uk. ALM will manage and respond in accordance with applicable data protection legislation.

9.0 Children’s Data

The App is not intended for individuals under 16. No data are knowingly collected from minors.

10.0 Cookies and Analytics

Where the App uses cookies or analytics SDKs, we comply with PECR 2003 reg. 6 and DUAA 2025 Part 5 Digital Communications, using consent banners or in-app prompts where required.

11.0 Future Developments

As ALM expands App functionality (e.g. optional lifestyle tracking, feedback surveys, or biometric inputs), further data types may be introduced. This Notice will be updated in line with:

• Data Use and Access Act 2025 (Sections 28–32) – automated decision transparency;
• DUAA 2026 Part III Regulatory Alignment Provisions – new obligations on data brokers and third-party integrations.

Users will be notified of material changes and prompted to re-consent if required.

12.0 Complaints

If you are unhappy with how your data are processed:

• Raise your concern with your Police Force DPO;
• If unresolved, contact the Information Commissioner’s Office (ICO).

ICO website: https://ico.org.uk/make-a-complaint/
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

13.0 Contact Us

For any queries about this Notice or the App’s data processing, please email: privacy@almperformance.uk

14.0 Version Control

Note on Responsibility

This app is provided by ALM Performance Ltd, which acts as the Data Controller for all personal data processed within the app.

The app operates independently of police force systems, and no police force has access to personal data within the app.

If you have a query, concern, or wish to exercise your data rights, please contact ALM directly at privacy@almperformance.uk.