Your information and The Collective

Who is responsible for your information

Data controller: Anna Potticary trading as The Collective.

The Collective is the data controller for personal information handled through the app. Authorised coaches may access client information only where needed to provide coaching services through The Collective. Privacy questions can be sent to Anna@aphf.co.uk.

Information we collect

• Account information, such as your name and email address.
• Coaching and fitness information entered by you or your authorised coach.
• Programmes, workout results, attendance and traffic-light check-ins.
• Achievements, points and House membership.
• Wellbeing, injury, rehabilitation or similar health-related information that you or your authorised coach voluntarily enter.
• Authentication and account-security information needed to sign you in, maintain your session and help protect your account.

Why we use information

We use personal information to:

• create, authenticate and secure accounts;
• provide coaching programmes and support coach-client sessions;
• record attendance, results, check-ins and progress;
• calculate and display achievements, points and House membership;
• respond to support, privacy and account-deletion requests; and
• maintain, troubleshoot and protect the app.

Under UK data-protection law, these uses rely on performing our service, legitimate interests in providing and securing the app, and legal obligations where applicable.

Health and wellbeing information

You or your authorised coach may voluntarily enter wellbeing, injury, rehabilitation or similar health-related information. We use this information only to deliver and adapt coaching services.

Where this information constitutes special-category personal data, processing is based on your explicit consent. Consent is optional, and you can use the app without supplying health or wellbeing information.

You can withdraw consent in Account settings or by emailing Anna@aphf.co.uk. Withdrawal prevents future health-data processing but does not affect processing already carried out lawfully. You may separately request deletion of existing information through Support.

Service providers and sharing

Supabase provides database and authentication infrastructure. Vercel provides hosting infrastructure. These providers process information on our behalf. Authorised coaches may access client information only to provide coaching services through The Collective. Information may also be disclosed where required by law.

We do not sell personal information.

Supabase and Vercel may process information outside the UK. Where required, appropriate contractual and legal safeguards are used.

Data retention

Account and coaching information is retained while your account is active and while reasonably required to provide coaching services. Some information may be retained afterwards where reasonably necessary for legal obligations, security, fraud prevention, record keeping or dispute resolution.

Information is deleted or anonymised when it is no longer reasonably required. You can request deletion by emailing Anna@aphf.co.uk. Deletion from backups may not be immediate, but deleted information will not be restored for normal app use.

Account deletion

You can permanently delete your account from My Account in the app. This removes the Supabase Auth identity and personal account details. Check-ins, goals and coaching notes are deleted. Shared coaching, House and season history is retained only in anonymised form so it no longer identifies the deleted account holder.

Some records may be retained where legally required or where necessary to establish, exercise or defend legal claims.

Data security

We use reasonable technical and organisational measures intended to protect personal information, including authenticated access and restricted administrative access. Supabase and Vercel also provide security controls for the services they operate. No online service can guarantee absolute security, so users should keep passwords private and contact support if they suspect unauthorised access.

Your UK GDPR rights

Depending on the circumstances, you may have the right to:

• access a copy of your personal information;
• correct inaccurate or incomplete information;
• request deletion or restriction of processing;
• object to certain processing;
• receive eligible information in a portable format; and
• withdraw consent where processing relies on consent.

To request access, correction or deletion, email Anna@aphf.co.uk. We may ask for information needed to verify your identity. You can also raise a concern with the UK Information Commissioner's Office at ico.org.uk.

Minimum age

The app is intended only for users aged 18 or over. The Collective does not knowingly provide app accounts to children. If you believe a child's information has been entered into the app, contact Anna@aphf.co.uk.

Changes to this policy

We may update this policy when the app or legal requirements change. The effective date above will be updated when a revised policy is published.