Privacy Policy

1. About this policy

1.1 This policy explains how CPBC Pty Ltd (ABN 55 612 107 212) (we, us, our) handles personal information in this app (the App). It applies to clients, coaches and gym owners who use the App.

1.2 We comply with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs).

1.3 In this policy:

• personal information means information or an opinion about you that identifies you or could reasonably identify you;
• health information means personal information about your health, your body, any illness or injury, and your wishes about your health. It is a kind of sensitive information, and the Privacy Act gives it extra protection;
• Your Gym means the gym, studio or coaching business that enrolled you in the App;
• Your Coach means any coach at Your Gym who works with you; and
• Location Owner means the person who holds the owner account for Your Gym in the App.

1.4 Our contact details are in clause 20.

2. Who is responsible for your information

2.1 Your Gym is the business you deal with. It enrols you, coaches you and decides how your coaching runs.

2.2 We run the App. We provide it to Your Gym, host it and keep your information in it.

2.3 Both Your Gym and we handle your information, and both of us must look after it. You can make a privacy request or complaint to either of us. If it comes to us, we will work with Your Gym to answer it.

2.4 If you are a client of Cody Philp Coaching, we are also Your Gym.

2.5 This policy covers the App. Your Gym may hold other information about you outside the App, such as its own emails, paper forms or membership system. Its own privacy policy covers that.

3. Who the App is for

3.1 The App is for adults aged 18 and over. The onboarding form does not accept anyone under 18, whether you or Your Coach fills it in.

3.2 We do not knowingly collect information from anyone under 18. If you think we have, tell us and we will delete it.

4. What we collect

4.1 Your details. Your name, email address, phone number, age, biological sex and time zone, your job, and whether you mostly sit or stand at work.

4.2 Your goals and preferences. Your short and long term goals, why you are starting now, what has stopped you before, how you like to be coached, when and how long you can train, your equipment, and your experience with exercise and food tracking.

4.3 Health information. This is sensitive information. Depending on your answers, it includes:

• your body: height, weight, waist, hip, chest and thigh measurements, body fat, body scan results and progress photos;
• medical information: PCOS or endometriosis, diabetes, heart conditions, other medical conditions, medications, weight loss medication, and whether a doctor has advised you not to exercise;
• pregnancy and cycle: whether you are pregnant, breastfeeding or planning to be, and, if you opt in, your cycle length and period dates;
• injuries and pain: existing injuries, movements you cannot do, and pain you report;
• food: allergies, dietary pattern, foods you leave out of your plan, cravings, your relationship with food, and how your eating went; and
• lifestyle and wellbeing: sleep, steps, water, smoking, alcohol, stress, energy, hunger, digestion and recovery, including your daily entries and weekly check-in answers.

4.4 Your training. Your programs, the weights and reps you log, workout notes and ratings, and changes you make to a workout.

4.5 Your plan. Your calorie, macro and step targets, meal plans, meal swaps, shopping lists, supplement lists and the reasons for any change.

4.6 Messages and coaching records.Messages between you and Your Coach, Your Coach's notes and replies, and their check-in reviews.

4.7 Bookings. Any evaluation times you choose.

4.8 Consent records. What you agreed to, which version of this policy applied, and when.

4.9 Technical information.Your device's time zone, your display setting, your browser and device type, your IP address and your sign-in activity.

4.10 Coaches and gym owners. Your name, email address, phone number, role and location. For a gym owner, also the billing email and subscription status. Our payment provider handles card details and we do not hold them. Clients do not pay through the App.

5. How we collect it

5.1 From you. You enter most of this yourself: on the onboarding form, in daily entries and weekly check-ins, and when you log workouts or add photos.

5.2 From Your Coach. Your Coach may enter information about you by:

• filling in the onboarding form with you ("Fill out now, together"), which includes confirming that you agreed to the Terms and gave the consents recorded there;
• creating your invite with your name, email address and phone number;
• recording gym weigh-ins, measurements, body scans and check-in photos; and
• writing notes and reviews.

5.3 Automatically.The App reads your device's time zone so your days and reminders are right. Our hosting and sign-in providers record technical information such as your IP address and device type.

5.4 Worked out by the App. The App creates some information about you, such as your targets, your plan and alerts to Your Coach. See clause 9.

5.5 Drafts stay on your device. Onboarding answers, check-ins and workouts in progress are saved on your device until you submit them. If Your Coach fills in the form with you, the draft sits on their device until it is submitted or they clear it.

5.6 If you do not give us information. Some answers are required, such as your name, email address, age, sex, height, weight, activity level and goal, because we cannot set up your account or work out your targets without them. Most health and lifestyle questions are optional. If you leave out something important, such as an allergy or a medical condition, your plan may not be safe for you.

5.7 Using the App anonymously. You cannot use the App anonymously or under another name. Your Coach needs to know who you are to coach you safely, and we need to know whose health information we hold so we can protect it and let you see, correct or delete it.

6. Your consent

6.1 We collect health information only with your consent and only when it is reasonably necessary to coach you. You give that consent on the onboarding form.

6.2 If Your Coach fills in the form with you, they confirm that you agreed. You can check what was recorded, and change it, in Privacy & consent in the App.

6.3 Photos have two separate choices, and both are optional:

• coaching: photos taken and stored to track your progress; and
• marketing: those photos used in testimonials or promotion.

6.4 You can withdraw a consent at any time in Privacy & consent:

• withdrawing photo consent stops further photos being taken or used for that purpose;
• withdrawing marketing consent changes nothing else; and
• withdrawing health consent alerts Your Coach, who will follow up with you about your information. It may limit the coaching we can safely give.

6.5 Withdrawing a consent does not delete what we already hold. To delete it, see clause 15.

7. How we use your information

7.1 We use your information to:

• set and adjust your targets, and build your meal plan, shopping list and training;
• let Your Coach track your progress, review your check-ins and support you safely;
• send you messages about your account and coaching, such as invites, password resets, reminders and target changes;
• run, secure, fix and support the App; and
• meet our legal obligations and handle complaints.

7.2 We use or disclose your information only for those purposes, for a related purpose you would reasonably expect (a directly related purpose for health information), with your consent, or where the law requires or allows it.

7.3 We do not sell your information, and we do not use it for advertising.

8. Direct marketing

8.1 The App does not send marketing emails. Its emails are about your account and your coaching. We will not use your health information for direct marketing without your consent.

8.2 The only marketing use is your progress photos, and only if you gave the separate marketing consent in clause 6.3.

8.3 To opt out, withdraw "Marketing use of photos" in Privacy & consent, or email us. We will stop using your photos in new marketing and take them down from channels we control. We cannot recall material that others have already copied.

9. Automated decisions

9.1 The App uses computer programs to make some decisions about you and to help Your Coach make others. These programs follow fixed rules and calculations. They do not use artificial intelligence or machine learning.

9.2 The information they use. Your age, sex, height, weight, body fat, activity level, goal and start date. Your health information, including allergies, dietary pattern, foods you leave out, medical answers and, if you opt in, your cycle. Also your daily entries, weigh-ins, check-in answers and time zone.

9.3 Decisions the App makes on its own.

• Your starting calorie, protein, fat and carbohydrate targets.
• Your meal plan: which meals you get and how much of each, rebuilding it when your food preferences or start date change, and replacing a meal that clashes with an allergy or diet change.
• Which meals are offered when you swap, and which are left out.
• Whether a protein shake is added to a day to reach your protein target.
• Your new target when you move to maintenance after week 8, worked out from your weigh-ins.
• Pausing your targets or plan until Your Coach has read your answers, if you report certain medical conditions or type an allergy note.
• Refusing onboarding for anyone under 18.
• Sending reminders and missed check-in notices.

9.4 Decisions the App helps Your Coach make. Your Coach decides these, and the App only suggests or alerts:

• weekly calorie, macro and step target suggestions after a check-in, which take your cycle into account if you opted in; and
• alerts such as a health answer to read, a medical review, weight climbing during maintenance, or missed check-ins.

9.5 A person can review these decisions. Your Coach can see your targets and plan, change them, swap meals, turn the protein shake off, and lift a pause once they have read your answers. A coach cannot change the under 18 rule. To ask about a decision, talk to Your Coach or contact us (clause 20).

10. Who can see your information

10.1 In the App. These people can see your information:

• you;
• Your Coach and the other coaches at your location;
• the Location Owner; and
• our staff who run and support the App.

10.2 Service providers. We use the outside services listed in clause 11 to run the App. They handle your information only to provide that service.

10.3 Where the law requires or allows it.We may disclose your information if the law requires or allows it, for example to a court or regulator, or to lessen a serious threat to someone's life, health or safety.

10.4 Links.Exercise videos open on YouTube and supplement links open on the shop's own website. We send them nothing about you, but their own privacy terms apply once you open them.

11. Where your information is held, and overseas disclosure

11.1 Your main record, including your health information and progress photos, is stored in Sydney, Australia.

11.2 We use these outside services:

• Supabase
  What it does: Database, sign-in, photo storage, database backups
  What it receives: Everything in the App
  Where: Sydney, Australia
• Amazon Web Services
  What it does: Nightly backup of progress photos
  What it receives: Progress photos
  Where: Sydney, Australia
• Vercel
  What it does: Runs the App
  What it receives: Information passing through the App while you use it, and technical information
  Where: App servers in Sydney. Your connection goes through Vercel's nearest network site, which may be overseas. Vercel's main processing facilities are in the United States
• Resend
  What it does: Sends emails
  What it receives: Your name, email address and the email's content, which can include your targets and a note from Your Coach
  Where: Sent from Japan. Records stored in the United States
• Stripe
  What it does: Gym subscription payments
  What it receives: A gym owner's email address and billing details. No client information
  Where: United States
• Software development tools
  What it does: Building and fixing the App
  What it receives: Limited information when we build or fix the App, which can include a client's name and plan details
  Where: United States

11.3 So we are likely to disclose personal information to recipients in the United States, Japan and Singapore. If you use the App while travelling, your connection may go through a Vercel site in the country you are in.

11.4 We take reasonable steps to make sure these services handle your information in line with the APPs.

12. Security

12.1 We take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access, change or disclosure. These include encrypted connections, access controls so each gym sees only its own clients, and regular backups.

12.2 No system is completely secure. Keep your login private, and sign out on a shared device.

13. Cookies and storage on your device

13.1 We do not use advertising or tracking cookies, or analytics.

13.2 The App uses these cookies:

• sign-in cookies that keep you signed in;
• a cookie that remembers your gym on your device, so the sign-in page shows it;
• a one minute cookie used when you switch accounts; and
• a ten minute cookie that holds the list of what changed after a meal swap.

13.3 The App also saves your drafts on your device (clause 5.5), and small reminders such as a guide you have already seen.

14. How long we keep your information

14.1 We keep your information for these periods:

• challenge history: 2 years after your last challenge ends, so a future challenge can be compared with your earlier ones;
• progress photos: 2 years after your last challenge ends, sooner if you ask;
• consent and agreement records: 7 years, which may be longer than we keep the information they relate to; and
• the note of a deletion: 7 years.

14.2 When a period ends, or we no longer need information, we delete it or remove what identifies you, unless the law requires us to keep it.

15. Deleting your information

15.1 You can delete your information at any time. Use Delete my data in Privacy & consent in the App, or ask us. The Location Owner can also delete it for you. A coach cannot delete your information, but can make your account inactive.

15.2 You choose how much to delete:

• My progress photos. Your photos are removed from our records and from storage. Your weigh-ins, measurements and history stay.
• All my progress data. Photos, weigh-ins, measurements, daily entries, questionnaires and meal plans are removed. Your account stays open.
• Everything. Your login, your profile, your client record and everything in the App about you are removed. This includes your name, contact details and health answers. You will be signed out, you will not be able to sign in again, and any invite link stops working.

15.3 Deleting everything cannot be undone. If you come back later you will start with no history. If you only want to stop for a while, ask Your Gym to make your account inactive instead. That keeps everything.

15.4 What we keep. Whichever option you choose, we keep:

• the record that you consented, when, to what and under which version of this policy, including any withdrawal;
• the record of your photo choices; and
• a note of the deletion: what was deleted, when and who asked.

We keep these so we can show we were entitled to hold your information and that we carried out your request. After an Everything deletion they are no longer linked to you. They hold a random number and no name, contact details, health information or photos. Your Gym can no longer see them. Only we can.

15.5 Copies that take longer to clear. Some copies cannot be removed straight away:

• photo backup: a deleted photo leaves the backup on the next nightly run, stays as an old version for about 30 days, and is then removed. Amazon Web Services does not promise the exact day, so it can take a little longer;
• database backups:daily backups of the App's database are kept for 7 days and then replaced;
• email records: our email provider keeps its records of sent emails for about 30 days;
• hosting logs: our hosting providers keep technical logs for a short period; and
• delivered emails: emails already delivered to you or Your Coach stay in those inboxes until they are deleted there.

15.6 We use backups only to recover the App after a failure. If we ever restore one, we will delete your information again.

15.7 This clause covers the App. Ask Your Gym about anything it holds outside the App.

16. Seeing and correcting your information

16.1 You can see much of your information in the App, including your plan, targets, check-ins, progress, photos and consents. You can change your food preferences in Settings.

16.2 To see all the information we hold about you, or to correct something, ask Your Coach or email us. We will need to confirm who you are.

16.3 We will reply within 30 days. We do not charge for a request to see or correct your information.

16.4 If we refuse a request, we will tell you why in writing and how to complain. If we do not correct something, you can ask us to add a note saying you believe it is wrong.

17. Data breaches

17.1 If a data breach is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner (OAIC) as soon as we can, as the Notifiable Data Breaches scheme requires. We will tell you what happened, what information was involved and what you should do.

18. Complaints

18.1 If you think we have not handled your information properly, contact us (clause 20). Tell us what happened and what you would like us to do.

18.2 We will look into it and reply in writing within 30 days.

18.3 If you are not happy with our reply, or we have not replied within 30 days, you can complain to the OAIC. It usually asks you to complain to us first. Complaints to the OAIC must be in writing.

• Website: oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5288, Sydney NSW 2001

19. Changes to this policy

19.1 We may update this policy from time to time. The version and effective date are at the top.

19.2 If we make an important change, we will tell you in the App and, where needed, ask you to agree again.

20. Contact us

For any privacy question, request or complaint:

• CPBC Pty Ltd, ABN 55 612 107 212
• Email: coach@codyphilp.com
• Post: 47 Aquila Street, Redland Bay QLD 4165