Privacy
policy.

1. Who we are

This privacy policy explains how BODYHACKER LTD, trading as The Body Hacker and Body Hacker Academy (“we”, “us”, “our”), collects, uses and protects your personal information when you use our website, contact us, or train with us.

We are the data controller for your personal information. BODYHACKER LTD is registered in England and Wales, company number [COMPANY NUMBER], registered office [REGISTERED OFFICE ADDRESS]. We are registered with the Information Commissioner’s Office (ICO), registration number [ICO REGISTRATION NUMBER].

If you have any questions about this policy or your information, contact us at sweat@thebodyhacker.co.uk, call 07588 963005, or write to us at 9 Shottery Brook, Stratford-upon-Avon CV37 9NR.

2. The information we collect

Depending on how you use our services, we may collect:

1. Contact details: your name, email address, phone number and postal address.
2. Health and lifestyle information: your answers to our health and lifestyle questionnaire, including medical conditions, injuries, medication, pregnancy and any information from your GP or physio that you choose to share.
3. Assessment and progress information: your age, body measurements, weight, movement and posture assessments, training records and, only if you agree, progress photos.
4. Booking and payment information: the services you buy, session attendance, cancellations, and payment records. We do not store your full card details. Card payments are handled securely by our payment provider.
5. Communications: messages you send us by email, phone, text, WhatsApp, social media or our website contact form.
6. Marketing preferences: whether you want to hear from us about news and offers.
7. Website information: technical information such as your IP address, browser and device type, and how you use our website, collected through cookies. See section 14.

3. How we collect it

1. Most information comes directly from you, when you fill in our contact form or health questionnaire, book a consultation, train with us or get in touch.
2. Some information is created by us while we work with you, such as assessment results, training programmes and attendance records.
3. Some technical information is collected automatically when you use our website. See section 14.

4. How and why we use it

The law requires us to have a lawful basis for using your personal information. We use it:

1. To provide our services: to arrange consultations, deliver training and coaching, design your programme, track your progress and manage bookings and payments. Lawful basis: performance of our contract with you, or steps you ask us to take before entering into one.
2. To keep you safe: to check you can exercise safely and adapt your training to your health. Lawful basis: your explicit consent (see section 5).
3. To reply to enquiries: when you contact us before becoming a client. Lawful basis: our legitimate interests in responding to people who contact us.
4. To run our business: to keep accounts, handle complaints and protect our legal rights. Lawful basis: legal obligation (for example, tax records) and our legitimate interests.
5. To send you news and offers: only where you have agreed, or where you are an existing client and we are telling you about similar services. Lawful basis: consent, or our legitimate interests. You can opt out at any time.
6. To improve our website: to understand how visitors use it. Lawful basis: our legitimate interests (see section 14).

We do not use your information for automated decision-making or profiling that has legal or similarly significant effects on you.

5. Your health information

1. Health information is a special category of personal data and is given extra protection by law. We only collect and use it with your explicit consent, which you give when you complete our health and lifestyle questionnaire.
2. We use it only to make sure your training is safe and suitable for you. Only your trainer can see it, and we never use it for marketing.
3. You can withdraw your consent at any time. If you do, we may not be able to continue training you safely, and we will explain the options.
4. In an emergency, we may share relevant health information with emergency services to protect your life or health.

6. Photos, videos and testimonials

1. We will only take progress photos or videos of you with your permission. They are stored securely and used only to track your progress, unless you also agree to them being used publicly.
2. We will only use your name, photos, videos, measurements, results or testimonial on our website, social media or other marketing with your separate, clear consent.
3. You can withdraw your consent at any time by contacting us. We will then remove the content from our website and social media accounts as soon as reasonably possible, but we cannot recall material that has already been printed or shared by others.

7. Marketing

1. We will only send you marketing emails or messages if you have agreed to receive them, or if you are a client and the messages are about similar services.
2. You can unsubscribe at any time using the link in our emails, by replying “STOP” to a message, or by contacting us.
3. We never sell or rent your personal information to anyone.

8. Who we share it with

We only share your information where necessary, and never for other organisations’ own marketing. We may share it with:

1. Service providers who help us run our business, such as our website host, email provider, booking and payment providers, messaging services (such as WhatsApp) and cloud storage. They act on our instructions and must keep your information secure.
2. Our accountant and professional advisers, where needed for accounting, insurance or legal purposes.
3. Your GP, physio or other health professional, only if you ask us to or agree to it.
4. Emergency services, where necessary to protect your life or health.
5. Authorities or courts, where we are required to by law.

9. International transfers

1. Some of our service providers (for example, email, messaging or cloud services) may store or process information outside the UK.
2. Where this happens, we make sure your information is protected, either because the country is approved by the UK government as having adequate data protection, or because the provider has agreed to approved safeguards such as the UK International Data Transfer Agreement or Addendum.

10. How long we keep it

1. Client records, including your health questionnaire, assessments and training records: 6 years after your last session, so we can meet our legal and insurance obligations and respond to any claims.
2. Payment and accounting records: 6 years from the end of the financial year they relate to, as required for tax purposes.
3. Enquiries from people who do not become clients: 12 months after our last contact.
4. Progress photos: until the end of your training with us, unless you ask us to delete them sooner.
5. Marketing consent and testimonials: until you withdraw your consent.

After these periods, we securely delete or anonymise your information.

11. Keeping it secure

1. We use appropriate technical and organisational measures to protect your information, including password-protected devices and accounts, two-step verification where available, and secure storage of paper records.
2. Access to your information is limited to those who need it to provide our services.
3. If a data breach is likely to put your rights at risk, we will tell you and the ICO where the law requires us to.

12. Your rights

Under UK data protection law, you have the right to:

1. Access the personal information we hold about you and receive a copy.
2. Correct information that is wrong or incomplete.
3. Delete your information, where we no longer have a lawful reason to keep it.
4. Restrict how we use your information in certain circumstances.
5. Object to us using your information on the basis of legitimate interests, and to direct marketing at any time.
6. Data portability: receive information you gave us in a commonly used format, or ask us to send it to someone else.
7. Withdraw consent at any time, where we rely on your consent. This does not affect anything we did before you withdrew it.

To use any of these rights, contact us at sweat@thebodyhacker.co.uk. There is usually no charge. We will reply within one month, and may need to confirm your identity first.

13. How to complain

1. If you are unhappy with how we have handled your personal information, please tell us first, in any way that suits you, including by email, phone, letter or social media. We will acknowledge your complaint within 30 days, look into it without undue delay, keep you updated, and tell you the outcome.
2. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

14. Cookies

1. Cookies are small files stored on your device when you visit a website.
2. Essential cookies are needed for our website to work and to keep it secure. They do not need your consent.
3. Analytics cookies help us understand how visitors use our website so we can improve it. Where these are used only for that purpose, the law allows us to set them without asking first, as long as we tell you and give you a simple way to opt out. You can opt out at any time using the cookie settings on our website.
4. Third-party content, such as embedded Google Maps, may set its own cookies when you use it. Any cookies that are not essential or analytics-only, including advertising cookies, are only set if you agree.
5. You can also block or delete cookies in your browser settings. Blocking some cookies may affect how the website works.

15. Children

1. Our services are for adults aged 18 and over. Clients aged 16 or 17 may train only with written consent from a parent or guardian, who will also be asked to complete the health questionnaire with them.
2. We do not knowingly collect information from children under 16 through our website.

16. Changes to this policy

1. We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated. If we make significant changes that affect you, we will let you know.