Privacy Policy

Last updated: 2026. This policy explains how personal data is handled under the UK GDPR and the Data Protection Act 2018.

1. Who we are

NeuroFitz ("we", "us") is a sole-trader personal training practice operating in the United Kingdom and is the data controller for the personal data described here.

2. What data we collect

  • Identity and contact data: name, email address, telephone number.
  • Enquiry data: training goals, previous experience, training preferences, availability and any free-text notes you choose to provide.
  • Health and neurodivergence information you volunteer (for example autism, ADHD, injuries, sensory needs). This is special category data under Article 9 UK GDPR.
  • Scheduling data: session dates, times, attendance and session notes.
  • Technical data: limited server logs required to operate and secure the website.

3. Why we use it and our lawful basis

  • Contract: to respond to your enquiry, arrange consultations, deliver and schedule training sessions.
  • Legitimate interests: to run and improve the coaching service, keep records and prevent misuse of the website.
  • Legal obligation: tax, accounting and insurance record-keeping.
  • Explicit consent (Article 9(2)(a)): for health, disability and neurodivergence information, which you provide voluntarily so training can be delivered safely and appropriately. You may withdraw consent at any time.

4. How data is stored and secured

Submissions are stored in an access-controlled database hosted within the UK/EEA. Records are protected by row-level security so they can only be read by the trainer's authenticated account. Access is limited to the trainer; no enquiry data is publicly readable.

5. Sharing

We do not sell personal data. Data may be processed by our website and database hosting providers acting as processors under written terms, and disclosed where required by law or to insurers/medical professionals in an emergency.

6. Retention

Enquiries that do not become clients are deleted within 12 months. Client training and health records are kept for the duration of coaching and for up to 6 years afterwards to meet insurance and tax obligations, then securely deleted.

7. Your rights

You have the right to access, rectify, erase, restrict or object to processing of your data, the right to data portability, and the right to withdraw consent at any time. Requests are answered within one calendar month at the contact address above.

If you are unhappy with how your data has been handled you may complain to the Information Commissioner's Office (ico.org.uk, helpline 0303 123 1113).

8. International transfers

Where a processor stores data outside the UK, transfers are protected by UK adequacy regulations or the International Data Transfer Addendum to the EU Standard Contractual Clauses.

9. Cookies

This site uses only strictly necessary cookies and local storage required for the trainer login session. No advertising or third-party tracking cookies are set.

10. Children

Coaching is offered to adults aged 18 and over. Where a client is under 18, a parent or guardian must provide consent and countersign all records.