Privacy, without ambiguity.

This pre-launch notice applies to the ORIGIN native app, the member web experience at app.originwithin.me and the public website at originwithin.me. The data controller identified in ORIGIN’s company documentation is ORIGIN ApS · CVR 46810708 · Svellestræde 33, 2640 Hedehusene, Denmark. For privacy questions or requests, contact mail@originwithin.me.

ORIGIN is a self-guided wellbeing and transformation product. It is not a medical record system, diagnostic service or emergency-care service. We design the product to collect only the information needed to provide the features a person chooses to use.

Before public launch, ORIGIN must confirm that ORIGIN ApS remains the correct controller in the real operating setup and complete the final Article 6/Article 9, retention, processor and international-transfer review.

For standalone book purchases, ORIGIN ApS is the seller and data controller. We process the selected book and format, order reference, payment status, amount, email address, terms acceptance and a protected download-access token to fulfil your contract and provide customer support. Stripe handles checkout, billing details, payment processing, tax calculation and emailed invoices; ORIGIN does not store full card details. Floot hosts the shop and order records, and its managed database and private file storage support delivery.

Book purchases do not require a member account. Writing or reflections entered into a downloaded PDF remain in your local file; the shop does not collect them. Order records are retained for access, support and applicable accounting obligations. Short-lived, hashed network identifiers help limit abusive checkout attempts. If paperback ordering is enabled, the necessary recipient details will be shared with Lulu for printing, shipping and tracking. The general privacy rights and contact details below also apply to book purchases.

ORIGIN v1 is currently for adults aged 18 and over. Before entering transformation flows, the product asks for a simple self-confirmation. ORIGIN does not collect a full date of birth for this eligibility check.

The confirmation is stored locally on the device as a minimal eligibility flag. Choosing the under-18 path does not create an account, age profile or wellbeing journey and instead directs the person toward human support.

Account and authentication

When you create or use an ORIGIN account, we process your email address, account identifier and authentication/session information. Passwords are submitted to our authentication provider for secure authentication and are not stored by the ORIGIN app in readable form.

Check-ins, guided returns and reflections

If you use ORIGIN check-ins or guided practices, we may process the choices you make about your current state, what you need, time available, whether movement fits, environmental constraints, the practice selected, practice timing and completion, your before/after shift and an optional short reflection word. When safety or urgent-support routing is active, ordinary guided-practice data is not saved to the account as a normal completed return.

Performance information

If you use PERFORMANCE features, we may process training programme/session progress and readiness inputs you choose to provide, such as sleep, energy, stress, soreness, a pain flag and an overall effort rating. These inputs are used to adapt the session experience, not to diagnose a condition.

NUTRITION information

If you use ORIGIN NUTRITION, we may process your nutrition goal, eating style, allergies, intolerances, food dislikes and favourites, household size, cooking time, cooking ability, capacity preference and saved meal-plan selections. ORIGIN uses these details to reduce irrelevant food choices and personalise planning.

Progress and membership access

We may process programme progress, completed sessions, timestamps and account entitlements. If you purchase through Apple, Apple processes the payment itself. ORIGIN receives the purchase or entitlement information needed to verify what your account can access; ORIGIN does not receive your full payment-card details from Apple.

Notifications

If you enable notifications, we process a device push token or subscription endpoint, platform information and your notification opt-in state so notifications can be delivered to the correct device. You can disable notifications in ORIGIN and in your device settings.

ORIGIN AI

If you use ORIGIN AI, the messages you submit are transmitted to the AI processing service used by ORIGIN to generate a response. The current implementation requests provider-side model storage to be disabled. A recent conversation thread is stored locally on your device so the conversation can continue. Technical processing and service logs may still be handled by infrastructure providers under their applicable terms.

Optional product analytics

Product analytics are currently disabled in the member experience while ORIGIN finalizes provider-side privacy controls. The current hardening build does not initialize PostHog product analytics. If optional analytics are enabled in a later release, ORIGIN will only do so after the user-facing consent and provider configuration have been re-verified against this Privacy Notice.

Public website analytics

The public website uses optional Google Analytics only after affirmative consent. When enabled, Google may set _ga and _ga_* analytics cookies for up to 90 days. Advertising storage, Google Signals and personalised advertising are disabled in the hardened source. Visitors can withdraw analytics consent at any time through the persistent Analytics settings control in the public-site footer.

Local device information

ORIGIN uses local device storage for things such as authentication-session state, preferences, local continuity/progress, check-in state, recent ORIGIN AI messages and notification state. Some locally held information can exist before it is synced to an account.

• to create and secure your ORIGIN account;
• to provide check-ins, practices, programmes, progress and cross-device continuity;
• to personalise training, nutrition and content choices when you ask ORIGIN to do so;
• to verify subscription or entitlement access;
• to deliver notifications you have enabled;
• to generate ORIGIN AI responses when you use that feature;
• to operate, protect, debug and improve the service; and
• to comply with legal, accounting, security and fraud-prevention obligations where applicable.

We do not use wellbeing, training, nutrition, reflection or AI conversation content for targeted advertising.

ORIGIN does not ask you to create a medical record or submit a diagnosis. Some information you choose to enter — for example allergies, intolerances, pain flags, sleep, stress, soreness or wellbeing check-in choices — may nevertheless be health-related under applicable law.

We use those inputs only to provide the ORIGIN feature you chose to use, maintain continuity and safety boundaries, and support the requested personalisation. We do not sell this information, use it for advertising or present it as a clinical assessment. Where applicable law requires additional consent for a new use of sensitive information, ORIGIN will request that consent before using the information for that purpose.

Where the EU/EEA GDPR applies, ORIGIN processes personal data under one or more of the following bases depending on the feature and purpose:

• Contract / requested service: to create your account, deliver the product, save progress and provide membership access you request.
• Consent: for optional product analytics, notification permissions and other processing where consent is required.
• Legitimate interests: to keep ORIGIN secure, prevent abuse, diagnose failures and operate the service reliably, balanced against your rights.
• Legal obligation: where information must be retained or processed to meet applicable legal, tax, accounting or regulatory requirements.

Some ORIGIN inputs may constitute special-category health data. An Article 6 basis alone is not sufficient for that processing; ORIGIN must also rely on an applicable Article 9 condition. The final Article 9 basis and any required explicit-consent flow remain a public-launch gate and are not bundled into general Terms acceptance.

ORIGIN uses specialised providers to operate the service. Depending on the feature you use, these currently include:

• Supabase for authentication, account data and server-side product data;
• Floot for application hosting/infrastructure and ORIGIN's integrated AI and push infrastructure;
• Google Analytics for optional public-website statistics, only after you allow analytics;
• PostHog EU is configured for product analytics, but the reviewed member-app source currently disables its runtime initialization;
• Apple for App Store distribution, StoreKit purchases and Apple push delivery on supported Apple devices; and
• Google/Firebase services where Firebase Cloud Messaging is used for push delivery on a supported native build.

Providers receive only the information reasonably necessary for the service they perform. We may also disclose information if required by law, to protect users or the service, or as part of a legitimate corporate transaction subject to appropriate safeguards.

ORIGIN does not sell personal data. ORIGIN does not use third-party advertising trackers or cross-app advertising profiles.

ORIGIN is operated from Denmark and uses services that may process information in the EU/EEA and, depending on the provider and service, in other countries. Where personal data is transferred outside the EU/EEA, ORIGIN relies on applicable transfer mechanisms and safeguards required by data-protection law, such as adequacy decisions or contractual safeguards where relevant.

We keep personal data only for as long as needed for the purpose for which it was collected, to provide an active account, or to meet legitimate security, legal, tax or accounting requirements.

• Account and synced product data are generally kept while your ORIGIN account is active and are removed through the account-deletion process, subject to any information we must lawfully retain.
• Local device data remains on the device until ORIGIN clears it through an available control, you clear the app/site storage, or the app is removed, depending on the data type.
• Push subscriptions are removed from ORIGIN's account state when notifications are disabled or during sign-out where the current subscription can be identified.
• The recent ORIGIN AI thread can be cleared with the in-product “Start fresh” control and is otherwise stored locally on the device.
• Public-website analytics cookies are configured to expire after 90 days without automatic renewal on each visit. This cookie lifetime is separate from the retention of information on Google Analytics servers. The actual Google Analytics property retention setting remains to be verified before this notice can be finalized.

ORIGIN provides in-product controls for local-data export, connected-account data export, clearing local return history, analytics consent, notifications and permanent account deletion.

If GDPR applies to you, you may also have rights to access, correct, erase, restrict or receive a portable copy of personal data, object to certain processing, and withdraw consent where processing is based on consent. Withdrawing consent does not affect processing that was lawful before withdrawal.

To make a privacy request, email mail@originwithin.me. We may need to verify your identity before acting on an account-specific request.

You also have the right to complain to your local data-protection authority. In Denmark, the supervisory authority is Datatilsynet.

ORIGIN uses access controls, authenticated account boundaries, protected server-side entitlements and service-provider security controls intended to protect personal information. No online service can guarantee absolute security. If we become aware of a personal-data breach, we will assess and handle notification obligations under applicable law.

We may update this policy when ORIGIN's product, providers or legal obligations change. The effective date at the top of this page will be updated when a revised policy is published. Material changes will be communicated through an appropriate ORIGIN surface when required.

Email mail@originwithin.me.

ORIGIN ApS · CVR 46810708 · Svellestræde 33, 2640 Hedehusene, Denmark · www.originwithin.me