Privacy notice

Short version: Rachel collects what she needs to coach you safely, run bookings and take payments. Health answers are treated as sensitive data, stored encrypted, and never shared for marketing. You can see, download or delete your data from your account.

Who is responsible for your data

Rachel Mutters, trading as PT With Rachel, is the data controller. Rachel is registered with the Information Commissioner's Office (ICO). Contact details are in your account and on the website.

What we collect and why

What	Why	Legal basis
Name, email, phone, date of birth, emergency contact	To set up your account, contact you and keep you safe during sessions	Contract
Health questionnaire (PAR-Q), injuries, medication, pregnancy, GP letters, pre-session health checks, session notes about your health	To plan safe, suitable training and meet insurance requirements	Your explicit consent (special category health data)
Payments, invoices and session balance	To take payment and keep tax records	Contract and legal obligation
Bookings, attendance and cancellations	To run the diary and apply the cancellation policy	Contract
Programme, workout logs, progress measurements and photos you choose to add	To coach you and show your progress	Contract (photos: consent)
Messages and check-ins	To coach and support you	Contract
Marketing email	Only if you tick the box; you can untick it any time	Consent
Website enquiry (name, contact, goal)	To reply to you	Legitimate interest

Who sees it

• Rachel, as your coach.
• Stripe processes card and Direct Debit payments. Rachel never sees your full card number. Stripe's privacy policy applies to the payment itself.
• byashley.social (Ashley Pantry, a UK sole trader) hosts and maintains the system for Rachel under a written data-processing agreement, on a UK server provided by IONOS. Health data is encrypted on that server, and byashley.social looks at it only where strictly necessary to fix a fault; every such access is logged.
• Backups. An encrypted copy of the system is taken every night. It is encrypted before it leaves the server and stored in two places: a private storage device held by byashley.social and a Google Drive account protected by two-step login. Google and anyone else outside the system only ever hold scrambled files they cannot read.
• The email provider carries emails such as booking confirmations.
• YouTube (Google), only if you press play on a technique video in your programme. Nothing is sent to YouTube until you do; the video then plays through YouTube's privacy-enhanced player, and YouTube's own cookies and privacy policy apply to that video. Exercise videos and photos that Rachel has uploaded herself are served from this system, not from YouTube, and are shown to every logged-in client; they are not personal data, so they are not encrypted.
• Your GP, only if you ask Rachel to contact them.
• Insurers, solicitors or a court, only if there is an injury claim.

Your data is never sold or used for advertising.

How long we keep it

• Health questionnaires, consent, signed agreements, session notes and incident records: 6 years after your last session, because this is how long an injury or contract claim can be brought. They are then deleted automatically.
• Payment records: 6 years after the tax year they relate to, as required by HMRC. These are kept in anonymised form if you delete your account.
• Messages, programmes, progress photos and logs: deleted when you delete your account, or at the 6-year point if sooner.
• Website enquiries that do not become clients: 12 months.
• Backup copies rotate on a roughly 30-day cycle, so data you delete also disappears from backups within about a month.

Your rights

You can ask to see your data, correct it, download it, delete it, or object to how it is used. The quickest way is the Download my data and Delete my account buttons in your account. Otherwise email Rachel; she will respond within one month.

You can withdraw consent for health data or marketing at any time. Withdrawing consent for health data means Rachel can no longer train you, because she cannot do so safely without it.

If you are unhappy with how your data is handled, you can complain to the ICO at ico.org.uk or on 0303 123 1113.

Security

Logins are protected by passwords (and two-factor authentication for Rachel's own login). Health data, notes and uploaded documents are encrypted at rest. Nightly backups are encrypted on the server before they leave it. Every access to your health data — by the coach or by the hosting provider — is logged.

Cookies

The system uses one essential cookie to keep you logged in. There are no advertising or analytics cookies. If you press play on a YouTube technique video, YouTube may set its own cookies from that point; see "Who sees it" above.