Privacy at Mobius

Mobius Capacity Ltd ("Mobius", "we") provides the Mobius capacity management service. We are a company registered in England and Wales under company number 17490509, with our registered office at Unit 82A James Carter Road, Bury St. Edmunds, IP28 7DE, United Kingdom.

We are the data controller for the information described in this notice, except where we act as a processor for an organisation that has deployed Mobius to its people.

For any question about this notice, contact support@mobiuscapacity.com.

We aim to collect the minimum needed to run the service.

We use information to provide the service, generate your capacity view and action plan, maintain your account, keep the service secure and reliable, respond to support requests, and meet our legal obligations.

We collect limited information about how you interact with Mobius — such as whether you start or complete a check-in, view an insight, or select a context option. We use it to understand whether features are working and to improve the product.

We do not include journal notes, free-text reflections or your capacity scores in product analytics. Those stay with your record, and are used to give you your capacity view rather than to measure the product.

This information is held in our own systems. It is not sent to an advertising network or a third-party analytics provider.

We keep it for six months, and then delete it. If you close your account, it is deleted with the rest of your record rather than kept on in another form.

Where UK GDPR applies, we rely on: performance of our contract with you, to provide the service you have signed up for; our legitimate interests, to keep the service secure, reliable and improving; your consent, for optional features such as connected calendar or health sources; and legal obligation, where the law requires us to retain or disclose information.

Where we rely on consent, you can withdraw it at any time.

Mobius derives your capacity score automatically from the signals you record — load, energy, recovery and the context you tag a day with. Under UK GDPR that is profiling: a computer evaluating personal aspects of you from your own data.

We tell you this plainly because the score is the product. It is produced for you to read and act on, and it is not used to make a decision that has a legal or similarly significant effect on you. Mobius does not make automated decisions about anyone’s employment, insurance, credit or care, and organisation reporting is aggregated precisely so that it cannot be used that way.

The signals behind a reading are shown to you alongside it, so you can see what moved it. If a reading looks wrong to you, it probably is — tell us, and you can correct or delete the entries behind it.

Some of what you record in Mobius — sleep, energy, recovery — may be considered health-related. Where you connect a health source, or where the information you enter is health data, we process it on the basis of your explicit consent, and only to provide the capacity features you are using.

Mobius is not a medical or diagnostic service. It does not diagnose conditions and is not a substitute for professional medical advice.

If you connect a coach, you choose what they can see. Your coach receives a read-only view scoped to the visibility boundary you set — typically your current status, capacity history and the named signals behind it.

Your coach does not receive your raw check-in detail, your private notes or your account credentials. You can change or withdraw that permission at any time, and doing so stops future access immediately.

A coach keeps their own record of the work: when you met, what was agreed, and notes they write for themselves between sessions. Those notes are theirs rather than yours, and Mobius does not show them to you — a coach needs somewhere to think, and a notebook everyone can read is not one.

They are still information about you, and you still have rights over them. Ask your coach first, since it is their record; if that does not resolve it, contact us and we will help. If a coach invited you before you had an account, they will have entered your name and email to send the invitation, and you can ask us where that came from.

What a coach cannot do is see what you have not shared. The visibility boundary is yours, it is read-only to them, and withdrawing it takes effect immediately.

Where an organisation deploys Mobius, employees use Mobius as their own tool. The organisation receives aggregated, team-level patterns only, and only where the agreed privacy thresholds are met.

Organisations do not receive access to individual Mobius records, individual check-ins, individual capacity scores or personal notes. Mobius is not designed to support individual performance monitoring or automated employment decisions.

Mobius is hosted in the UK/EU. Access to production systems is limited to those who need it to operate the service, and personal capacity entries are separated from the aggregated reporting used by organisations.

We are still building out our formal security programme, including independent testing. We would rather state that plainly than overclaim. Organisations evaluating Mobius can request our current security position directly, and we will document it honestly at the point of any deployment.

We use a small number of providers to run the service — hosting, database, email delivery and payment processing. They act on our instructions, are bound by contract, and receive only what they need for their function.

We will maintain a current list of subprocessors and make it available to organisation customers on request.

Where information is transferred outside the UK or EEA, we put in place an approved safeguard — typically the UK International Data Transfer Addendum or Standard Contractual Clauses — and assess the transfer before it begins.

We keep your information while your account is active.

An email address and a password credential are needed to have an account at all; without them there is no way to sign you in or to keep your record yours.

Everything else is optional in the ordinary sense: a check-in you skip is a day without a reading, a connected calendar you decline is a little more typing, and a boundary you do not grant is a coach who sees nothing. None of it stops you using Mobius.

Where UK GDPR applies, you have the right to access your information, correct it, delete it, restrict or object to certain processing, receive a copy in a portable form, and withdraw consent where we rely on it.

To exercise any of these, contact support@mobiuscapacity.com. You also have the right to complain to the Information Commissioner’s Office.

You can delete your account and its associated data from within Mobius. Deletion removes your capacity history and, for coaches, ends client access to the records you hold — so we ask you to confirm before it proceeds.

Mobius is intended for adults. It is not designed for, or directed at, children, and we do not knowingly collect information from anyone under 18.

If we make a material change, we will update the date at the top of this page and, where the change affects how we use your information, tell you directly.

Mobius Capacity Ltd, Unit 82A James Carter Road, Bury St. Edmunds, IP28 7DE, United Kingdom. Company number 17490509, registered in England and Wales.

Email support@mobiuscapacity.com. You also have the right to complain to the Information Commissioner's Office (ico.org.uk), though we would rather you told us first so we can put it right.