Privacy policy

1. Who I am

I'm Neil Leonard Smith, a personal trainer operating as a sole trader under the name Neil Leo Smith Personal Training (ABN 50 970 898 315). I coach clients in person in Bangkok, Thailand, and online worldwide. In this policy, "I", "me" and "my" mean my business, and "you" means anyone who visits my website, contacts me, or trains with me.

I'm responsible for your personal information. Because I run the business myself, I'm also the person you contact about anything in this policy.

2. Privacy laws that apply

I handle your information in line with:

• the Australian Privacy Act 1988 and the Australian Privacy Principles, because my business is registered in Australia and I hold health information while providing a fitness service
• Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA"), because I provide services to people in Thailand and carry out much of my work there
• any other privacy law that applies to you where you live, if it gives you stronger protection

3. What I collect

When you enquire

Your name, email address or WhatsApp number, your training goal, where you're based, how you want to train, and anything else you choose to tell me in the form, by WhatsApp, email or Instagram.

When you become a client

• Contact and account details: name, email, phone number, login details for the client app
• Health and fitness information: height, weight, body measurements, sleep, energy levels, injuries, medical conditions or medications you tell me about, and your answers to weekly check-ins
• Progress photos and training videos you upload
• Training records: your workout plan, sessions you complete, and your progress over time
• Messages between us in the app or by WhatsApp
• Booking and payment records: packages bought, dates paid and amounts. I don't store your full card details; payments are handled by the payment provider.

I only collect what I need to coach you well. You don't have to give me everything, but if you leave out important health information, such as an injury, I may not be able to train you safely.

4. Why I use it

• To reply to your enquiry and arrange a trial session or call. I rely on your request and your consent.
• To coach you: designing your program, running sessions, reviewing check-ins, and tracking progress. This is needed to deliver the service you've signed up for.
• To keep you safe, for example adapting exercises around an injury.
• To run the business: bookings, invoices, payments and tax records, which I'm legally required to keep.
• To improve my service, using general, non-identifying patterns such as how often clients complete check-ins.

I don't sell your information, I don't use it for advertising, and I won't send you marketing messages unless you've agreed to receive them. You can opt out at any time.

5. Health information and photos

Health information and photos of your body are sensitive. I only collect them with your explicit consent, which I'll ask for when you set up your client account. You can withdraw that consent at any time by telling me. If you do, I'll stop collecting it and delete what I hold, though I may no longer be able to provide some parts of the service, such as progress reviews.

Your progress photos, videos and results are private to you and me. I will never use your photos, name, results or testimonial on my website or social media without your separate written permission, and you can withdraw that permission later.

I'm not a medical professional. If something you share suggests you should see a doctor, I'll tell you. I'll only share your health information with a doctor, physiotherapist or other health professional if you ask me to, or in an emergency where your safety is at serious risk.

6. Who I share it with

I use a small number of trusted service providers to run my website, client app and communication. They only handle your information to provide their service to me:

• Website hosting (Netlify): serves the website
• Client app database and storage (Supabase): stores your account, check-ins, photos and messages
• Enquiry form (Formspree): delivers website enquiries to my email
• Messaging (WhatsApp, owned by Meta): if you choose to contact me that way
• Email and payment providers: to communicate with you and take payments
• My accountant, for business and tax records only

I may also disclose information if the law requires it, for example to a court or government authority.

7. Storage outside your country

Some of my service providers store data outside Australia and Thailand, including in the United States and other countries. Before using a provider, I take reasonable steps to make sure they protect personal information to a standard similar to Australian and Thai law, such as through their data protection terms and security certifications. By using my services you understand your information may be stored overseas in this way.

8. Keeping it secure

The website and client app use encrypted connections (HTTPS). Your client data sits behind a login, and access rules mean each client can only see their own information. Only I can see all client records. I use strong passwords and two-factor authentication on my accounts, and keep client information off shared or public devices.

No system is completely secure, but I take reasonable steps to protect your information from misuse, loss and unauthorised access.

9. How long I keep it

• Enquiries that don't lead to training: deleted after 12 months
• Client records, including health information, photos and messages: kept while you're a client, then deleted within 2 years of your last session, or sooner if you ask
• Payment and tax records: kept for 5 years, as Australian tax law requires

10. Your rights

You can ask me to:

• see the personal information I hold about you, and get a copy
• correct anything that's wrong or out of date
• delete your information, where I'm not legally required to keep it
• withdraw your consent, including for health information and photos
• stop or limit how I use your information, or object to a particular use
• send your information to you or another provider in a commonly used format

Email me at [email protected] to make a request. I'll confirm who you are, then respond within 30 days. There's no charge in most cases. If I can't do what you ask, for example because the law requires me to keep a record, I'll explain why.

11. Cookies and website data

This website doesn't use advertising or tracking cookies. My hosting provider automatically records basic technical information, such as IP addresses and pages visited, to keep the site running and secure. The client app uses essential cookies or similar storage only to keep you logged in. If I add analytics in future, I'll update this policy and ask for consent where required.

12. Under 18s

My services are designed for adults. I only train anyone under 18 with the consent and involvement of a parent or guardian, who can exercise the rights in this policy on their behalf.

13. If something goes wrong

If there's a data breach likely to cause you serious harm, I'll tell you as soon as possible and explain what happened and what you can do. I'll also notify the relevant regulator where required: the Office of the Australian Information Commissioner, and Thailand's Personal Data Protection Committee within 72 hours of becoming aware of the breach.

14. Questions and complaints

If you have a question or concern, please contact me first at [email protected]. I'll respond within 30 days and try to resolve it.

If you're not satisfied, you can complain to:

• Australia: Office of the Australian Information Commissioner (OAIC), oaic.gov.au, phone 1300 363 992
• Thailand: Personal Data Protection Committee (PDPC), pdpc.or.th
• the privacy regulator where you live, if you're elsewhere

15. Changes to this policy

I may update this policy as my services change, for example when new features are added to the client app. The "last updated" date at the top shows when it last changed. If a change significantly affects how I use your information, I'll let current clients know directly.