← Back to Training Hub

Privacy Policy

This page explains what personal data Training Hub ("we", "us") collects from personal trainers who sign up to our platform and the clients they coach, how we use it, and your rights under UK GDPR and the Data Protection Act 2018.

Who controls your data

Training Hub is the data controller for personal trainer accounts. When a trainer coaches a client through our platform, the trainer is the data controller for that client's personal data (name, email, photos, measurements, goals) and Training Hub processes it on their behalf. Your trainer's own privacy policy governs how they use your data.

What we collect

Personal trainers:

• Name, email, business name
• Billing details via Stripe (we never see your card number)
• Training and meal plan content you create
• Login timestamps, IP address at sign-up for fraud prevention
• Usage data (features used, AI generation counts) for product improvement

Clients:

• Name + email given by your trainer
• Training logs (weights, reps, notes) you enter
• Body weight, measurements, and onboarding metrics you optionally provide
• Progress photos — stored on your device only, never uploaded to our servers

Why we use it

• To provide the service you signed up for (contract basis)
• To process payments and prevent fraud (legitimate interest)
• To send you transactional emails — trial warnings, payment receipts, password resets (contract basis)
• To improve the product and fix bugs (legitimate interest)

We do not sell your data, share it with data brokers, or use it for advertising.

Where your data lives

All data is stored on servers hosted in the UK/EU via Railway (railway.app). Encrypted backups run automatically. Payment processing runs through Stripe (certified PCI-DSS Level 1) — their privacy policy applies to card data.

How long we keep it

• Active PT accounts: indefinitely while subscription is active
• Cancelled PT accounts: 90 days after cancellation, then deleted
• Client records: controlled by the trainer — they can delete any client any time
• Billing records: 7 years (HMRC requirement)
• Failed-login / security logs: 30 days

Third parties we use

• Stripe — payment processing
• Resend — transactional email delivery
• Anthropic — AI plan generation (content sent at your request; your inputs aren't used to train their models)
• Railway — server hosting

Each signs a data-processing agreement with us and processes data only on our documented instructions.

Your rights

Under UK GDPR you have the right to:

• Access — request a copy of the data we hold about you
• Rectify — correct anything inaccurate
• Erase — request deletion (subject to legal retention periods)
• Port — export your data in JSON format
• Object — stop us using your data for legitimate-interest purposes
• Withdraw consent — where processing relies on consent

Email privacy@traininghub.pro for any of the above. We respond within 30 days.

Cookies

We use no tracking or advertising cookies. A single session cookie keeps you logged in. That's it.

Children

Training Hub is for adult personal trainers and their adult clients. We do not knowingly collect data from anyone under 16. Trainers must verify their clients are 16+ before onboarding.

Security

Passwords are salted and hashed with bcrypt. Data in transit is encrypted with TLS. Access to production infrastructure is limited to the Training Hub team and logged. If we discover a breach affecting your personal data we'll notify you and the ICO within 72 hours as required by UK GDPR.

Complaints

If you're unhappy with how we've handled your data, contact us first so we can try to resolve it. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk.

Changes

We may update this policy as the service evolves. Material changes will be announced by email to active PT accounts.