Privacy Policy | HVPT — Harry Vine Personal Training

1. Data Controller

Harry Vine Personal Training (HVPT) is the data controller responsible for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Business name: Harry Vine Personal Training (HVPT)

Address: The Engine Shed, Station Yard, Station Road, Sharnbrook, MK44 1PD

Email: harry@harryvinept.co.uk

Phone: 07775 731 570

Website: harryvinept.co.uk

2. Data We Collect

When you sign up, book sessions, or use the HVPT member app, we may collect the following categories of personal data:

Account information

Full name
Email address
Phone number
Date of birth

Health data (special category data)

PAR-Q (Physical Activity Readiness Questionnaire) responses, including medical conditions, medications, and fitness level

This is classified as special category data under UK GDPR Article 9 and is processed only with your explicit consent.

Payment data

Payment transactions are processed securely by Stripe. HVPT does not store, access, or retain your card numbers or bank details.

Usage data

Class bookings and attendance records
Personal training session history

Progress data (voluntarily provided)

Weight logs
Body measurements
Fitness scores and personal bests

Emergency contact details

Emergency contact name and phone number

Communication records

Messages exchanged between you and your trainer through the HVPT app

3. Lawful Basis for Processing

We process your personal data under the following lawful bases as set out in UK GDPR Article 6 and, where applicable, Article 9:

Contract performance — Article 6(1)(b)

Processing your membership, bookings, and session management
Managing payments and subscriptions
Providing the services you have signed up for

Legitimate interests — Article 6(1)(f)

Improving our services and member experience
Operational communications (e.g. schedule changes, facility updates)
Maintaining safety standards and service quality

Consent — Article 6(1)(a)

Marketing communications (you can withdraw consent at any time)
Cookie preferences

Explicit consent — Article 9(2)(a)

Processing health and PAR-Q data (special category data). You provide explicit consent during registration and may withdraw it at any time by contacting us.

Vital interests — Article 6(1)(d)

Emergency contact information, used only in the event of a medical or safety emergency

4. Data Retention

We retain your data only for as long as necessary. Our retention periods are:

Active member data (name, email, phone, date of birth) — retained for the duration of your membership plus 6 months after cancellation
Health and PAR-Q data — retained for the duration of your membership and deleted within 30 days of cancellation
Payment records — retained for 7 years as required by HMRC for tax and accounting purposes
Communication logs — retained for 12 months
Class and attendance history — retained for 24 months after your last activity
Emergency contact details — deleted within 30 days of membership cancellation

When data reaches the end of its retention period, it is securely deleted or anonymised.

5. Third-Party Data Processors

We do not sell, rent, or trade your personal data. We share data only with the following third-party processors, strictly to operate our services:

Stripe — payment processing (PCI DSS Level 1 certified). Stripe Privacy Policy
Supabase — database hosting and authentication (EU data centres, encryption at rest and in transit). Supabase Privacy Policy
Netlify — website and app hosting. Netlify Privacy Policy
Google Fonts — font delivery. Google Fonts does not store personal data or set cookies when serving fonts.

Each third-party processor operates under their own privacy policy and is required to process data in accordance with UK data protection law.

6. Data Storage & Security

We take the security of your personal data seriously. Measures include:

All data transmitted between you and our website or app is encrypted via HTTPS/TLS
Database encryption at rest and in transit via Supabase
PCI DSS Level 1 certified payment processing via Stripe
Access to member data is restricted to Harry Vine only
Strong password policies and secure authentication via Supabase Auth

While we take all reasonable steps to protect your data, no system is completely secure. If you become aware of any security issue, please contact us immediately.

7. Your Rights Under UK GDPR

You have the following rights in relation to your personal data:

Right of access — you can request a copy of the personal data we hold about you (a Subject Access Request)
Right to rectification — you can ask us to correct any inaccurate or incomplete data
Right to erasure — you can ask us to delete your personal data (the “right to be forgotten”), subject to any legal obligations we must comply with
Right to restrict processing — you can ask us to limit how we use your data in certain circumstances
Right to data portability — you can request your data in a structured, commonly used, machine-readable format
Right to object — you can object to the processing of your data where we rely on legitimate interests
Rights related to automated decision-making — you have the right not to be subject to decisions based solely on automated processing. HVPT does not currently use automated decision-making.

8. How to Exercise Your Rights

To exercise any of the rights listed above, contact us at:

Email: harry@harryvinept.co.uk

We will respond to your request within 30 days. In exceptional circumstances, we may extend this by a further 60 days, in which case we will inform you of the reason for the delay.

If you are not satisfied with how we handle your request, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

Website: ico.org.uk
Phone: 0303 123 1113

9. Cookies

Our website and member app use a limited number of cookies to function correctly. We use essential cookies for session management and may use analytics cookies to understand how visitors use our site.

We do not use advertising cookies or third-party tracking cookies.

For full details on the cookies we use and how to manage your preferences, please see our Cookie Policy.

10. Children’s Data

HVPT Academy members may be aged 13–17. We take additional safeguards when processing the data of children and young people:

Parental or guardian consent is required before any data is collected for members under 18
We collect only the minimum data necessary to provide our services safely
Health and PAR-Q data for under-18s requires explicit parental consent
A parent or guardian may exercise data rights on behalf of a child at any time

We do not knowingly collect data from children under the age of 13.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we do, we will update the date below. If we make significant changes that affect how your data is processed, we will notify members directly.

Last updated: February 2026

12. Contact

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

Email: harry@harryvinept.co.uk

Phone: 07775 731 570

Address: The Engine Shed, Station Yard, Station Road, Sharnbrook, MK44 1PD