Privacy Policy — Private Performance

This Privacy Policy explains how your personal data is collected, used, and protected when you use the Private Performance platform. This includes both the Private Performance client app and the Private Performance Coach app (together, the "Apps"). Please read it carefully.

The Apps are operated by Tolunay Osman, a personal trainer operating as "Private Performance" ("we", "us", "our"). For the purposes of UK and EU data protection law, we are the data controller responsible for your personal data.

If you have any questions about this policy or your data, contact us at tolly-pt@hotmail.com.

---

1. Who this policy applies to

This policy applies to everyone who uses the Private Performance platform:

• Clients, who use the Private Performance client app to follow training programmes, log workouts and bodyweight, track nutrition and recovery, complete check-ins, and communicate with their coach.
• Coaches, who use the Private Performance Coach app to manage their client roster, build and assign programmes and nutrition plans, track sessions, review client progress, and communicate with the clients they coach.

Coaches access the data of the clients they coach solely to deliver coaching services to those clients. Clients can only see their own data.

2. What data we collect

We only collect data needed to provide coaching services through the Apps. This includes:

Account information

• Your name, email address, and phone number
• Login credentials (your password is stored securely and is never visible to us in readable form)
• For coaches, basic business information used to run your roster within the platform

Health and fitness data

• Bodyweight and body measurements you log
• Workout and training data (exercises, sets, reps, weights lifted, session history)
• Nutrition information entered (calories, macros, meals, food diary)
• Check-in responses (which may include subjective wellbeing, sleep quality, and similar)
• Progress photos uploaded as part of check-ins
• Recovery, sleep, heart rate, and heart-rate-variability data, where a wearable or health source is connected (see Section 4)

Communications

• Messages exchanged between clients and coaches through the Apps

Technical information

• Basic technical data necessary for the Apps to function (for example, device and session information used to keep you logged in)

We do not use your data for advertising, and we do not sell your data to anyone.

3. How we use your data

We use your data to:

• Provide and personalise coaching programmes, nutrition plans, and check-ins
• Show clients their own progress, history, and recovery insights
• Allow a coach to review the data of the clients they coach and give feedback
• Enable messaging between clients and coaches
• Maintain, secure, and improve the Apps

4. Third-party integrations

The Apps can connect to third-party services only when you choose to connect them:

• Whoop — if you connect your Whoop account, we receive recovery, sleep, and related metrics through Whoop's authorised connection. You can disconnect at any time.
• Apple Health (HealthKit) — if you grant permission, the App can read health data you have authorised (such as bodyweight, steps, sleep, heart rate, HRV, and nutrition data from apps that write to Apple Health). The App only accesses the categories you approve. Health data obtained through Apple Health is used solely to provide coaching and progress insights, and is never used for advertising or shared with third parties for their own purposes, in line with Apple's requirements.

You can revoke these permissions at any time through your device settings or by disconnecting the integration in the App.

5. Where your data is stored and who can access it

Your data is stored using Supabase, a third-party cloud database and authentication provider, which hosts the data securely on our behalf as a data processor.

The only people who can access your personal data are:

• You, through your own account
• Your coach, to deliver your coaching (clients only; a coach sees only the clients they coach)
• Our service providers (such as Supabase, Whoop, and Apple) strictly to the extent needed to operate the relevant feature

We require our service providers to protect your data and to use it only for the purposes of providing their service to us.

6. International data transfers

We are based in the United Kingdom. If you access the Apps from the EU or elsewhere, your data may be processed in the UK or in other countries where our service providers operate. Where data is transferred outside the UK or EU, we rely on appropriate safeguards (such as adequacy decisions or standard contractual clauses) to protect it.

7. Legal basis for processing (UK and EU users)

Where UK GDPR or EU GDPR applies, our legal bases for processing your data are:

• Contract — to provide the coaching services you have signed up for
• Consent — for connecting optional health integrations (Whoop, Apple Health) and for processing health data, which is a special category of personal data; you can withdraw consent at any time
• Legitimate interests — to secure, maintain, and improve the Apps

8. How long we keep your data

We keep your data for as long as you have an active account or coaching relationship with us. If you stop using the Apps or ask us to delete your data, we will delete it within a reasonable period, except where we are required to keep certain information by law.

9. Your rights

Depending on where you live, you have rights over your personal data. For UK and EU users these include the right to:

• Access the data we hold about you
• Correct inaccurate data
• Delete your data ("right to erasure")
• Restrict or object to certain processing
• Withdraw consent at any time
• Request a copy of your data in a portable format
• Lodge a complaint with a supervisory authority (in the UK, the Information Commissioner's Office, ico.org.uk)

To exercise any of these rights, email us at tolly-pt@hotmail.com. We will respond within the timeframe required by applicable law.

10. Data security

We take reasonable technical and organisational measures to protect your data, including secure authentication, encrypted connections, and access controls that limit who can see your information. No method of transmission or storage is completely secure, but we work to protect your data and to address any issues promptly.

11. Children

The Apps are not intended for use by children under 16, and we do not knowingly collect data from children under 16. If you believe a child has provided us with personal data, please contact us so we can remove it.

12. Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date at the top. Significant changes will be communicated to you where appropriate.

13. Contact

Tolunay Osman — Private Performance

Email: tolly-pt@hotmail.com

---

Support