Privacy policy

Last updated: 29/10/2026

This policy explains what personal data Gethin Ellis Coaching collects through this app, why, who it is shared with, how long it is kept and what your rights are under the UK GDPR and the Data Protection Act 2018.

1. Who is responsible for your data

Gethin Ellis, trading as Gethin Ellis Coaching (a sole trader based in the United Kingdom), is the controller of your personal data. Contact: gethin@gethinelliscoaching.co.uk.

2. What we collect

Account details: name, email address, password (stored hashed by our authentication provider), sign-in events.
Training data: planned and logged sessions, exercises, effort ratings, race and event details, test results.
Nutrition and body data: food logs, nutrition targets, body weight, body measurements, daily readiness scores (sleep, energy and similar).
Body stats you enter: height, year of birth, sex and activity level, which your coach uses with your weight and goal to calculate your daily calorie and macro targets.
Check-ins and messages: weekly check-ins and answers, messages and voice notes between you and your coach, and any PAR-Q health questionnaire answers.
Progress photos and check-in videos you choose to upload.
Wearable data (such as steps, active energy, resting heart rate, HRV, sleep and body weight) if you connect Apple Health in the iPhone app, connect a device or send data to your personal ingest link. We only read the data types you allow in the Apple Health permission sheet, we never write to Apple Health, and we do not use it for advertising or share it with data brokers.
Optional location (for weather-aware training suggestions) if you set one.
Push notification details for each device where you turn notifications on (a device token or subscription).
Strava activity data (activity name, type, date, distance, time, elevation and heart rate) if you choose to connect your Strava account. You can disconnect at any time in Settings.
Garmin Connect data, if you choose to connect your Garmin account: your completed activities (type, date, distance, duration, pace and heart rate) so your coach can compare them with your plan. We also send your planned workouts to your Garmin Connect account so they sync to your watch. We only receive data from the time you connect. Before connecting we show you a notice and ask for your explicit consent. You can withdraw that consent at any time by choosing Disconnect Garmin in Settings (or in your Garmin Connect account settings), which stops all further data, deletes the Garmin activities we hold and the stored connection, and asks Garmin to delete the registration.
Photos of food or nutrition labels that you choose to submit for a calorie or nutrition estimate.
Meal descriptions you type or dictate, which are sent to our AI provider to be turned into a list of foods for you to confirm. Dictation uses your phone’s own keyboard; we do not receive audio.
Messages you send in coach-created group chats, which other members of that group can see, and any reports or blocks you make about them.
Barcodes you scan, and any product details you enter from a nutrition label (shared with other clients as a food entry, without your name).
Payment information: payments are handled by Stripe. We receive subscription status and customer references, not your full card number.
If you use a public enquiry form: your name, email, optional phone number and message.

Much of this is health-related, which UK GDPR treats as special category data (see section 3).

3. Why we use it and our lawful basis

Contract: to provide your coaching, programme, tracking, messaging and billing.
Explicit consent: for health-related data (for example readiness scores, body measurements, body stats such as height and year of birth, wearable data, PAR-Q answers). We record your agreement, with the date, when you first set up your account and for progress photos and videos. You can withdraw consent at any time by deleting the data or your account; this does not affect earlier lawful use.
Legitimate interests: keeping the service secure, preventing abuse and fixing faults (for example sign-in records and error logs).
Consent or legitimate interests: for coaching emails and enquiry replies. Every coaching email has an unsubscribe link.
Legal obligation: keeping basic financial records where the law requires it.

4. Who we share it with

We do not sell your data. Your coach sees the data you log. We use these service providers (processors) to run the app:

Supabase: database, authentication and file storage.
Vercel: hosting.
Stripe: payments and subscriptions.
Resend: sending emails.
Sentry: error monitoring (may include technical details such as device and page).
Anthropic: analyses a food or nutrition-label photo you submit to estimate calories and nutrition. Only the photo you submit is sent, and only when you use that feature.
Strava: only if you connect your account. We receive your activities and do not post anything to Strava.
Garmin: only if you connect your account. We receive your activities and send your planned workouts to your Garmin Connect account. Garmin is a separate controller and handles your data under the Garmin Connect privacy notice. We do not sell Garmin data and do not share it with any third party other than the providers listed above that host the app (Supabase and Vercel). Garmin data is not shared with advertisers or data brokers, is not sent to analytics services, is not processed by any AI system, and is never used to train, evaluate or improve AI models.
Open Food Facts and the US Department of Agriculture FoodData Central: a scanned barcode or food search term is sent to look up nutrition information.
Apple and Google push notification services: deliver notifications to your device.

Some providers may process data outside the UK. Where they do, it is protected by appropriate safeguards such as the UK International Data Transfer Addendum or an adequacy decision.

5. How long we keep it

Your coaching data is kept while you are a client.
When you delete your account (Settings, then Delete my account) it is erased immediately: your account, logs, messages, photos, videos and voice notes are deleted from the live service, and any subscription is cancelled. You can also ask by email. Copies in provider backups are overwritten within a limited period set by our database provider (up to 30 days).
Payment and tax records are kept by us and Stripe for as long as the law requires (normally up to 6 years).
Enquiry form submissions are kept for 12 months unless you become a client.

6. Your rights

You have the right to:

access your data and receive a copy;
have inaccurate data corrected;
have your data erased;
restrict or object to some uses of your data;
data portability (a machine-readable copy);
withdraw consent at any time.

In Settings you can disconnect Garmin and Strava, download a copy of your data (including links to your photos, videos and voice notes) and delete your account immediately. For anything else, email gethin@gethinelliscoaching.co.uk. We aim to reply within one month.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113. We would appreciate the chance to put things right first.

7. Cookies and similar storage

We use only essential cookies and browser storage: to keep you signed in, remember your light or dark theme and store logs on your device until they sync. We do not use advertising or analytics cookies, so there is no cookie banner. The app also uses a service worker so it can be installed to your home screen.

8. Security

Data is encrypted in transit, access is limited by account and role, and files are stored privately and shared only through time-limited links. No system is perfectly secure; if a breach puts your rights at risk we will tell you and the ICO as the law requires.

9. Children

This service is for adults aged 18 and over.

10. Changes

We will update this page if our practices change and show the date at the top.