Data Processing Terms

1. Roles

1.1 These terms form part of the Coach Terms between Peak Performance Consultants Ltd, a company registered in England and Wales (number 13914529), registered office 31 Parkwood Gardens, Calverley, Pudsey, LS28 5PJ, England ("we", "us"), and the coach or coaching business that holds a Coach. account ("you").

1.2 "Controller", "processor", "personal data", "personal data breach", "processing" and "data subject" have the meanings given in the UK GDPR. "Data Protection Law" means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and, where it applies to you, the EU GDPR.

1.3 "Client Data" means personal data about your clients, and anyone else whose details you or your clients add to the platform, that we process on your behalf to provide the platform. Annex 1 describes it.

1.4 You are the controller of Client Data and we are your processor. We are a separate controller of your own account, billing and support details, and of the records we need to run and secure the platform. Our Privacy Policy covers that data.

1.5 If these terms conflict with the rest of the Coach Terms on the processing of Client Data, these terms apply.

2. Processing on your instructions

2.1 We process Client Data only on your documented instructions. Your instructions are these terms, the Coach Terms, and the actions you and your clients take using the platform's features and settings. We will only process Client Data otherwise if UK law requires it, and then we will tell you first unless the law forbids it.

2.2 We will tell you promptly if we think an instruction breaks Data Protection Law.

2.3 We do not sell Client Data, use it for advertising, share it with other coaches, or use it to train artificial intelligence models. We may create anonymous, aggregated statistics that identify no one, to run and improve the platform.

3. Your responsibilities

3.1 You are responsible for having a lawful basis, and where needed an Article 9 condition (usually your client's explicit consent), for the Client Data you collect through the platform; for giving your clients your own privacy information; and for responding to their requests to exercise their rights. The client app asks each new client to confirm their age and to consent to their health information being used for their coaching, and records the date and wording version.

3.2 You will only invite people you coach who are aged 18 or over, and will only collect the information you need to coach them. Do not upload clinical records or other people's data that you do not need.

4. Our people

4.1 Only people who need access to provide, support or secure the platform may access Client Data, and each is bound by a duty of confidentiality. At the date of these terms that is our director only.

4.2 We access Client Data only to provide the platform, to help you when you ask, to investigate a fault or a security concern, or where the law requires it. We do not read messages, view photos or watch videos between you and your clients except in those circumstances.

5. Security

5.1 We maintain the technical and organisational measures in Annex 2, which are appropriate to the risk as Article 32 requires. We may change them over time, but not in a way that reduces the overall protection of Client Data.

6. Sub-processors

6.1 You give us general authorisation to use the sub-processors on our published list.

6.2 We will give you at least 30 days' notice, by email and on that list, before we add or replace a sub-processor that will process Client Data.

6.3 You may object on reasonable data protection grounds within that notice period. We will discuss your concern in good faith. If we cannot resolve it, you may end your subscription before the change takes effect, and we will refund any fees you have paid for the period after it ends.

6.4 We put written terms in place with each sub-processor that protect Client Data at least as well as these terms. We remain responsible to you for each sub-processor's performance.

7. Where Client Data is held

7.1 Client Data is stored in Frankfurt, Germany, and training videos are converted in London. Some sub-processors may access Client Data from other countries, including the United States, to provide support or keep their services secure.

7.2 We only transfer Client Data outside the UK where the transfer is covered by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or by appropriate safeguards such as the International Data Transfer Addendum to the EU Standard Contractual Clauses.

8. Helping you meet your obligations

8.1 The platform lets you view, correct and delete your clients' records. On request we will provide an export of a client's records in a common electronic format within 30 days.

8.2 If we receive a request from one of your clients to exercise their rights, we will pass it to you within five working days and will not respond to it ourselves unless you ask us to.

8.3 Taking into account the nature of the processing and the information available to us, we will help you meet your obligations on security, personal data breaches, data protection impact assessments and prior consultation with the Information Commissioner. Our own impact assessment is available to you on request.

9. Personal data breaches

9.1 We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Client Data. We will give you the information described in Article 33(3) as it becomes available.

9.2 We will take reasonable steps to contain, investigate and put right the breach. We will not notify your clients or the Information Commissioner on your behalf unless you ask us to or the law requires it.

10. Records, information and audits

10.1 We keep a record of our processing for you as Article 30(2) requires.

10.2 We will make available the information you reasonably need to show that these terms and Article 28 are being met.

10.3 If that information does not reasonably answer your questions, or a regulator requires it, you or an independent auditor you appoint may audit our compliance once a year, on at least 30 days' notice, during business hours, at your cost and under a duty of confidentiality.

11. Keeping, returning and deleting Client Data

11.1 While your subscription continues, Client Data is kept until you or your client delete it, apart from the automatic deletion described in Annex 1 (training videos, for example).

11.2 When you delete a client from the platform, their records and files are deleted from the live database and file storage straight away.

11.3 When your account ends, you may ask for an export of your clients' records within 30 days. We will then delete or anonymise Client Data within a further 60 days. Copies in backups are overwritten within 7 days. We keep only what the law requires us to keep.

12. Liability and changes

12.1 Each party's liability under these terms is subject to section 9 of the Coach Terms.

12.2 We may update these terms as described in section 10 of the Coach Terms. We will give you at least 30 days' notice of material changes.

Annex 1. Description of the processing

Subject matter and duration: providing the Coach. platform to you, for the term of the Coach Terms plus the export and deletion period in clause 11.

Nature: collecting, storing, organising, displaying, sending (including notifications and messages), converting (training videos), exporting and deleting.

Purpose: to let you plan and deliver coaching: training programmes, nutrition plans, check-ins, education, messaging, progress tracking and video feedback on technique.

Data subjects: your clients, current, paused and archived, and anyone else you or a client add.

Categories of personal data:

• Identity and contact: name, email address, profile picture, coach assigned.
• Account and device: sign-in identifiers, time zone, app version, device model and system version, notification tokens.
• Training: programmes, workout logs, sets, loads, repetitions, effort ratings, notes, personal records.
• Nutrition: meal plans, food logs, custom foods and recipes, meal photos, supplement plans, water intake.
• Check-ins and forms: answers to your questions, which may include health, lifestyle and wellbeing information.
• Messages: text, photos, videos and voice notes between you and your client.
• Training videos: clips of the client exercising (which may show their face and surroundings) and your recorded reviews.
• Progress photos: photos of the client's body from the front, side and back.
• Goals and tasks: roadmap goals, needle movers, tasks and their completion.
• Special category data (health): body mass, body fat, measurements, steps, energy expenditure, heart rate, heart rate variability, blood pressure, breathing rate, oxygen saturation, VO2 max, sleep, injuries, medical conditions or medication a client mentions, and progress photos. Readings from Apple Health or Health Connect arrive only with the client's permission on their phone.
• How long data is kept: coaching records, forms, nutrition, goals, messages and progress photos until you or the client delete them, or your account ends (clause 11). Client training videos 30 days after the client sends them, or 7 days after you publish your review if that is later. Your raw review recording 1 day after publishing; the finished review 30 days after publishing. Notification tokens until the client signs out or the token stops working. Backups 7 days.

Annex 2. Security measures

• Every table holding Client Data enforces row-level security in the database: a coach can only read clients assigned to them, and a client only their own records. Signed-out visitors can read none of it.
• Database functions that act with wider rights check the signed-in person's role and coach link before acting.
• Every database change is tested on a private copy, then a separate demonstration database, before the live database, and each change has a written reverse step.
• Message attachments, training videos and progress photos are kept in private storage. The app and website receive time-limited links; training video links last no more than five minutes.
• Video conversion runs on a private Google Cloud service. Working copies are deleted at the end of each job.
• All traffic to and from the platform is encrypted in transit (TLS). The database and file storage are encrypted at rest by the hosting provider (AES-256).
• Passwords are stored only as salted hashes by the sign-in service. We never see them.
• Server keys are held in the hosting providers' secret stores, never in the apps or source code. The payment key is restricted to the permissions billing needs. Card details are handled by Stripe and never reach our systems.
• Only our director has access to the live systems. Testing uses his own accounts or a separate demonstration database.

Annex 3. Sub-processors

The companies that process Client Data for us are listed on our sub-processor page. Questions: will@theperformanceconsultant.net.