Privacy policy

How we collect, use, and protect your personal data — in full compliance with the UK GDPR.

1. Data controller

Harry Vine Personal Training (HVPT) is the data controller responsible for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

• Business name: Harry Vine Personal Training (HVPT)
• Address: The Engine Shed, Station Yard, Station Road, Sharnbrook, MK44 1PU
• Email: harry@harryvinept.co.uk
• Phone: 07775 731 570
• Website: harryvinept.co.uk

2. Data we collect

When you sign up, book sessions, or use the HVPT member app, we may collect the following categories of personal data.

• Account information: full name, email address, phone number, date of birth.
• Health data (special category data): PAR-Q responses, including medical conditions, medications, and fitness level. This is classified as special category data under UK GDPR Article 9 and is processed only with your explicit consent.
• Payment data: payment transactions are processed securely by Stripe. HVPT does not store, access, or retain your card numbers or bank details.
• Usage data: class bookings and attendance records, personal training session history.
• Progress data (voluntarily provided): weight logs, body measurements, fitness scores and personal bests.
• Emergency contact details: emergency contact name and phone number.
• Communication records: messages exchanged between you and your trainer through the HVPT app.

3. Lawful basis for processing

We process your personal data under the following lawful bases as set out in UK GDPR Article 6 and, where applicable, Article 9.

• Contract performance — Article 6(1)(b): processing your membership, bookings and session management; managing payments and subscriptions; providing the services you have signed up for.
• Legitimate interests — Article 6(1)(f): improving our services and member experience; operational communications such as schedule changes and facility updates; maintaining safety standards and service quality.
• Consent — Article 6(1)(a): marketing communications, which you can withdraw at any time, and cookie preferences.
• Explicit consent — Article 9(2)(a): processing health and PAR-Q data. You provide explicit consent during registration and may withdraw it at any time by contacting us.
• Vital interests — Article 6(1)(d): emergency contact information, used only in the event of a medical or safety emergency.

4. Data retention

We retain your data only for as long as necessary. Our retention periods are as follows.

• Active member data (name, email, phone, date of birth) — retained for the duration of your membership plus 6 months after cancellation.
• Health and PAR-Q data — retained for the duration of your membership and deleted within 30 days of cancellation.
• Payment records — retained for 7 years as required by HMRC for tax and accounting purposes.
• Communication logs — retained for 12 months.
• Class and attendance history — retained for 24 months after your last activity.
• Emergency contact details — deleted within 30 days of membership cancellation.
• When data reaches the end of its retention period, it is securely deleted or anonymised.

5. Third-party data processors

We do not sell, rent, or trade your personal data. We share data only with the following third-party processors, strictly to operate our services.

• Stripe — payment processing (PCI DSS Level 1 certified).
• Supabase — database hosting and authentication (EU data centres, encryption at rest and in transit).
• Netlify — website and app hosting.
• Resend — sending account and booking emails.
• Meta Platforms — measures how well our advertising works, and only if you accept cookies: the Meta Pixel in your browser reports page views, a free-class booking, and starting and paying for the four-week trial. Your name, email address and phone number are not sent to Meta. We do not currently send events from our own servers; if we start (Meta’s Conversions API, which would include your email address and phone number in hashed form for a free-class booking), we will update this policy first.
• Google Fonts — font delivery. Google Fonts does not store personal data or set cookies when serving fonts.
• Anthropic — AI assistant Harry sometimes uses for coaching questions (see “AI-assisted coaching” below).
• Each third-party processor operates under their own privacy policy and is required to process data in accordance with UK data protection law.

6. Data transfers outside the UK

Most of your data is stored in the EU. Our member database (Supabase) is hosted in Paris, and the UK recognises the EU as protecting personal data to UK standards.

Some of the services we use are based in, or may process data in, the United States:

• Netlify, which hosts our website and app
• Stripe, which processes payments
• Resend, which sends our emails to you
• Meta, which measures advertising, and only if you accept cookies
• Anthropic, the AI assistant Harry sometimes uses

Whenever your data leaves the UK, we make sure it stays protected to UK standards. Either the provider is certified under the UK–US Data Bridge, or our agreement with them includes the UK’s approved contract terms for international transfers. You can ask us for details of these safeguards at any time.

7. AI-assisted coaching

There are times when Harry uses an AI assistant to help his thinking on a training question, for example how best to adapt a session around an injury, or to draft a progress summary. When he does, the assistant sees only the training details it needs: your first name, gender, age, fitness level, goals, your training history with us (including any body measurements you’ve logged), and any injuries or health notes you’ve shared with us. We never send it your surname or contact details. The coaching decisions are always Harry’s. Our AI provider processes this information on our behalf and does not use it to train its models.

8. Data storage and security

We take the security of your personal data seriously. Measures include the following.

• All data transmitted between you and our website or app is encrypted via HTTPS/TLS.
• Database encryption at rest and in transit via Supabase.
• PCI DSS Level 1 certified payment processing via Stripe.
• Access to member data is restricted to Harry Vine only.
• Strong password policies and secure authentication via Supabase Auth.
• While we take all reasonable steps to protect your data, no system is completely secure. If you become aware of any security issue, please contact us immediately.

9. Your rights under UK GDPR

You have the following rights in relation to your personal data.

• Right of access — you can request a copy of the personal data we hold about you (a Subject Access Request).
• Right to rectification — you can ask us to correct any inaccurate or incomplete data.
• Right to erasure — you can ask us to delete your personal data (the right to be forgotten), subject to any legal obligations we must comply with.
• Right to restrict processing — you can ask us to limit how we use your data in certain circumstances.
• Right to data portability — you can request your data in a structured, commonly used, machine-readable format.
• Right to object — you can object to the processing of your data where we rely on legitimate interests.
• Rights related to automated decision-making — you have the right not to be subject to decisions based solely on automated processing. HVPT does not currently use automated decision-making.

10. How to exercise your rights

To exercise any of the rights listed above, contact us at harry@harryvinept.co.uk.

We will respond to your request within 30 days. In exceptional circumstances, we may extend this by a further 60 days, in which case we will inform you of the reason for the delay.

If you are not satisfied with how we handle your request, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO): ico.org.uk, 0303 123 1113.

11. Cookies

Our website and member app use a limited number of cookies to function correctly. We use essential cookies for session management and may use analytics cookies to understand how visitors use our site.

We use the Meta (Facebook) Pixel to measure which of our ads lead to a booking. It runs only after you accept cookies via the consent banner. We do not use advertising cookies beyond this.

For full details on the cookies we use and how to manage your preferences, please see our Cookie Policy.

12. Children’s data

HVPT Academy members may be aged 13–17. We take additional safeguards when processing the data of children and young people.

• Parental or guardian consent is required before any data is collected for members under 18.
• We collect only the minimum data necessary to provide our services safely.
• Health and PAR-Q data for under-18s requires explicit parental consent.
• A parent or guardian may exercise data rights on behalf of a child at any time.
• We do not knowingly collect data from children under the age of 13.

Group PT sessions are for ages 13 and over. When you book a Group PT session for other people, we ask you to confirm that each person is 13 or over. We don’t ask for or keep their date of birth; about their age, we record only that you confirmed it, and when. We ask for your own date of birth once, if we don’t already have it, and keep it on your account; you can change it in Settings.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we do, we will update the date below. If we make significant changes that affect how your data is processed, we will notify members directly.

14. Contact

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us.

• Email: harry@harryvinept.co.uk
• Phone: 07775 731 570
• Address: The Engine Shed, Station Yard, Station Road, Sharnbrook, MK44 1PU