1. Introduction

PT Suite ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

We are the data controller for the personal data we process. For data processed on behalf of our Business Users (fitness trainers), we act as a data processor.

2. Information We Collect

Information You Provide

Account Information: Name, email address, password, business name
Profile Information: Phone number, address, profile photo
Payment Information: Billing address, payment card details (processed by Stripe)
Content: Videos, images, and text you upload to the platform
Communications: Messages and correspondence with us or through the platform

Information Collected Automatically

Device Information: IP address, browser type, operating system
Usage Information: Pages visited, features used, time spent
Cookies: Session and preference cookies (see Section 7)

3. How We Use Your Information

We use your information to:

Provide, maintain, and improve our services
Process transactions and send related information
Send administrative messages (account, security, updates)
Respond to your inquiries and provide customer support
Send marketing communications (with your consent)
Monitor and analyze usage patterns to improve the platform
Detect, prevent, and address fraud and security issues
Comply with legal obligations

4. Legal Basis for Processing (GDPR)

We process your data based on:

Contract: To provide services you've requested
Consent: For marketing communications and cookies
Legitimate Interests: To improve our services and prevent fraud
Legal Obligation: To comply with applicable laws

5. Information Sharing

We may share your information with:

Service Providers: Third parties who perform services on our behalf (hosting, payment processing, email delivery)
Business Users: Trainers can see information from clients who book through their site
Legal Requirements: When required by law or to protect our rights
Business Transfers: In connection with a merger, acquisition, or sale of assets

We do not sell your personal information to third parties.

6. Data Retention

We retain your personal data for as long as necessary to provide our services and fulfill the purposes described in this policy. Specifically:

Account Data: Retained while your account is active and for 30 days after deletion
Transaction Data: Retained for 7 years for legal and accounting purposes
Usage Data: Aggregated data may be retained indefinitely
Marketing Preferences: Until you withdraw consent

7. Cookies and Tracking

We use cookies and similar technologies to:

Essential Cookies: Required for the platform to function (authentication, security)
Preference Cookies: Remember your settings and preferences
Analytics Cookies: Understand how you use our platform

You can control cookies through your browser settings. Disabling essential cookies may affect platform functionality.

8. Your Rights (GDPR)

Under GDPR, you have the following rights regarding your personal data:

Access: Request a copy of your personal data
Rectification: Request correction of inaccurate data
Erasure: Request deletion of your data ("right to be forgotten")
Restriction: Request limited processing of your data
Portability: Receive your data in a structured, machine-readable format
Objection: Object to processing based on legitimate interests
Withdraw Consent: Withdraw consent at any time for consent-based processing

If you use the PT Suite mobile app, you can delete your account from within the app (Profile → Delete account), or request deletion on our account deletion page. See Section 14 for details.

To exercise these rights, contact us at [email protected] or use the data export feature in your account settings.

9. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

Encryption of data in transit (TLS) and at rest
Regular security assessments and audits
Access controls and authentication
Employee training on data protection

While we strive to protect your data, no method of transmission or storage is 100% secure.

10. International Transfers

Your data may be transferred to and processed in countries outside your country of residence. We ensure appropriate safeguards are in place, such as Standard Contractual Clauses, when transferring data internationally.

11. Children's Privacy

Our services are not directed to individuals under 16. We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us immediately.

12. Third-Party Links

Our platform may contain links to third-party websites. We are not responsible for the privacy practices of these sites. We encourage you to read their privacy policies.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the platform. Your continued use after changes constitutes acceptance of the updated policy.

14. Mobile App

This section applies to the PT Suite mobile app for iOS and Android (the "App"), used by clients of personal trainers and studios ("Studios") that use PT Suite. For client data, your trainer or Studio is the data controller and PT Suite acts as their data processor, as described in Section 1. Your trainer or Studio may have its own privacy notice that also applies to you.

Data the App collects and why

Account data (name, email address, phone number): to create and secure your account and connect you to your trainer. Legal basis: contract.
PAR-Q health questionnaire: your answers about heart conditions, chest pain, dizziness, chronic conditions, medications, musculoskeletal issues and medical supervision, any free-text follow-up or custom questions your trainer adds, and your drawn signature and typed name. This is used so your trainer can assess whether exercise is safe for you. See "Health data" below.
Wellbeing check-ins (mood, energy, soreness and notes): to let you and your trainer track how you are feeling and adjust training. Legal basis: contract, and explicit consent for health information.
Workout logs, nutrition logs, habits and goals: to track your training and progress with your trainer. Legal basis: contract, and explicit consent where the information reveals health details.
Profile photos: so you and your trainer can recognise each other in the App. Optional. Legal basis: contract.
Chat messages with your trainer: to deliver messaging between you and your trainer. Legal basis: contract.
Booking and purchase history: to manage sessions and packages. Payments are processed by Stripe; your card details are never received or stored by PT Suite. Legal basis: contract and legal obligation (accounting records).
Device identifier and push notification token: to deliver notifications you have allowed (see below). Legal basis: contract; you can switch these off at any time.
Crash and performance diagnostics: to find and fix faults and keep the App secure and reliable. Legal basis: legitimate interests.

Health data (special category data)

Information about your health, including PAR-Q answers and wellbeing check-ins, is special category data under Article 9 of the UK GDPR. We process it on the basis of your explicit consent, which you give when you complete the PAR-Q, so that your trainer can assess whether exercise is safe for you. Health data is shared only with your own trainer or Studio and the service providers needed to operate the App. We do not use it for advertising or sell it. You can withdraw your consent at any time by contacting your trainer or us, or by deleting your account; withdrawal does not affect processing carried out before it. If you withdraw consent, your trainer may be unable to safely provide some services.

Push notifications

If you allow notifications, we store a push token for your device and send notifications through Expo and Apple (APNs) or Google (Firebase Cloud Messaging). You can turn notifications off at any time in your device settings (for example Settings → Notifications → PT Suite) without affecting the rest of the App.

Camera and photos

The App uses your camera only to scan food barcodes for nutrition logging. Camera images are not stored; only the scanned barcode number is sent to look up the product. If you choose to set a profile photo, the image you select is uploaded and stored. You can revoke camera or photo access in your device settings.

Diagnostics

We use Sentry to collect crash reports and performance data. These are linked to a pseudonymous user identifier and do not include your email address.

No advertising or tracking

The App contains no advertising and does not track you across other companies' apps or websites. We do not sell your personal data.

Service providers (sub-processors)

Stripe: payment processing
Neon: database hosting
Cloudflare: file storage (R2) and video streaming (Stream)
Railway and Vercel: application hosting
Sentry: crash and performance diagnostics
Expo, Apple (APNs) and Google (FCM): push notification delivery
Resend and SMTP2GO: transactional email
Upstash: rate limiting and scheduled jobs
Open Food Facts: food product lookups from barcodes, made through our servers

Some of these providers are located outside the UK; see Section 10 on international transfers.

Retention and deletion

Mobile app data is retained while your account is active. When you delete your account (in the App under Profile → Delete account, or by following our account deletion page), we delete your account, PAR-Q responses, check-ins, logs, messages, photos and push tokens within 30 days. Payment and booking records may be kept in anonymised form for the statutory accounting period (see Section 6). Your trainer or Studio may keep its own records as controller in line with its own obligations.

Children

The App is not directed to anyone under 16 and we do not knowingly collect data from children (see Section 11).

15. Contact Us

For privacy-related questions or to exercise your rights, contact us:

Email: [email protected]
Data Protection Officer: [email protected]

You also have the right to lodge a complaint with a supervisory authority, such as the UK Information Commissioner's Office (ICO).