Privacy policy

Train90 is operated by David Silver (ABN [ ]) of [ADDRESS], Queensland ("we", "us", "our"). This policy explains how we handle personal information, including health information, under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Version 1.0 (draft) · Effective [DATE]

Summary

• We collect your health and fitness answers only to screen for safety and build your program, and only with your consent.
• Your information is stored in Australia (Sydney).
• Our AI provider never receives your name, email or screening answers. It receives only de-identified details such as your goal, equipment and limitation codes.
• We don't sell your information or share it with advertisers.
• You can ask to see, correct or delete your information at any time.

What we collect

Contact and account details: first name, email address, time zone (state), and the private links we create for your program and calendar.

Health and fitness information: your answers to the pre-exercise safety screening questions, whether you have clearance from a health professional, your age range, goals, training experience, schedule, equipment, areas you've told us to work around (such as knees or lower back), and your weekly check-ins, including whether you had pain. This is "sensitive information" under the Privacy Act.

Your program: the program we build for you (including a free preview of week 1) and any changes to it.

Payment information: payments are processed by Stripe. We receive confirmation of payment, the amount and a customer reference. We never see or store your full card number.

Technical information: basic information needed to run the website securely, such as IP address, browser type and error logs, and where you found us (for example, a campaign code in the link you clicked).

Communications: emails and messages you send us.

Waitlist: if you join our waitlist, your email, optional first name and the goal you selected.

How we collect it

Almost everything comes directly from you, through our questionnaire, check-ins, emails and forms. We receive payment confirmations from Stripe. Some technical information is collected automatically when you use the website.

Why we collect, use and hold it

• To check it's reasonably safe for you to start exercising, using the Adult Pre-Exercise Screening System developed by Exercise & Sports Science Australia, AUSactive and Sports Medicine Australia.
• To build, deliver, adjust and support your program, including your calendar feed.
• To process payments and manage your plan.
• To contact you about your program, your account and any safety or service issues.
• To improve our programs and service, using de-identified or aggregated information wherever possible.
• To send you marketing, but only if you've agreed. You can unsubscribe at any time.
• To meet our legal obligations and handle complaints or claims.

We won't use your health information for any other purpose unless you consent or the law allows it.

Your health information and your consent

We only collect health information with your consent, which you give in the questionnaire. You don't have to provide it, but we can't safely build a program without it. If your screening answers suggest exercise may carry extra risk for you, we will ask you to confirm you have clearance from your GP or another health professional before we build a program. We don't use your health information for marketing.

Dealing with us without identifying yourself

You can use a nickname instead of your real first name. We need a working email address to deliver your program and a payment to supply it, so we can't provide the service anonymously.

Artificial intelligence and automated decisions

Parts of our service are automated. We think you should know exactly which parts.

Decisions made by our software, without a person involved at the time:

• Safety screening: if you answer "yes" to a screening question and haven't confirmed clearance from a health professional, or you tell us you're under 18 or pregnant or have given birth in the last six months, our software won't build a program. This uses your screening answers.
• Building your program: our software selects exercises, sets and schedule from our reviewed exercise library, using your goals, experience, schedule, equipment and the areas you've asked us to work around.
• Weekly adjustments (Adaptive plan): our software may make the next week lighter based on your check-in, including if you report pain.

How AI is used: after our rules have built your program, we send de-identified details (your goal, experience level, session length, days per week, age range, equipment codes and limitation codes) to an AI provider, OpenAI, which writes coaching notes and may suggest swapping an exercise for another one from our reviewed library. Every suggestion is checked by our software against safety rules before it's used. The AI provider does not receive your name, email, screening answers or check-in details.

Human review: if our automatic checks flag a program, a person reviews it before it's released. You can ask for a person to review any automated decision about you by emailing david@train90.com.au.

Who we share it with

We share personal information only with service providers who help us run Train90, and only what they need:

• Supabase: database hosting. Stored in Sydney, Australia.
• Vercel: website hosting. Our servers run in Sydney; website content may be delivered through a global network.
• Stripe: payment processing. Australia and the United States.
• OpenAI: AI-written coaching notes. De-identified program details only. United States.
• Resend: sending emails (your name, email and program links). United States.
• Qualified exercise professionals engaged by us, if your program needs human review or you choose a coach-reviewed plan.
• Professional advisers (such as lawyers, accountants and insurers) where necessary, and government or law enforcement bodies where the law requires it.

We don't sell personal information, and we don't share it with advertisers.

Overseas disclosure

Some of our service providers are located, or store information, outside Australia, mainly in the United States. Before disclosing information overseas we take reasonable steps to make sure the recipient handles it consistently with the APPs, including through contracts and by sending the minimum information needed. For our AI provider, we send only de-identified program details. We remain accountable for how these providers handle your information.

How we store and protect it

Your information is stored in a database in Sydney, encrypted in transit and at rest. Access is restricted to the people and systems that need it. Your program and calendar links are long, random and private; treat them like a password and don't share them.

We keep your information only as long as we need it:

• Account, program and screening information: while your account is active, then for 7 years after your last program ends, to deal with any questions or claims. After that it is deleted or de-identified.
• Payment and tax records: at least 5 years, as required by tax law.
• Free previews you don't buy: deleted, together with your screening and questionnaire answers, 30 days after you create them.
• Waitlist details: until you unsubscribe or ask us to delete them.

Marketing

We only send marketing emails, including a reminder about an unbought preview, if you've opted in. Every marketing email includes an unsubscribe link, and we action unsubscribes promptly. We'll still send essential service messages about your program, payments or safety, and short reminders during your program (such as the start of each block). You can turn those reminders off with the link in each one.

Cookies and analytics

We use only the cookies and local storage needed to run the website, such as remembering which link brought you to us for the current visit. We don't use advertising cookies or cross-site tracking.

Accessing and correcting your information

You can ask for a copy of the personal information we hold about you, or ask us to correct or delete it, by emailing david@train90.com.au. We'll respond within 30 days, and there's no charge. If we can't do what you ask, we'll explain why in writing.

Data breaches

If a data breach is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

Complaints

If you have a concern about how we've handled your information, email david@train90.com.au. We'll acknowledge it within 5 business days and aim to resolve it within 30 days. If you're not satisfied, you can complain to the OAIC at oaic.gov.au or on 1300 363 992.

Changes to this policy

We'll update this policy when our practices change, and post the new version here with its effective date. If a change significantly affects how we use your health information, we'll tell you by email first.

Contact us

Privacy Officer, David Silver trading as Train90 · david@train90.com.au · [ADDRESS]