AMC Privacy Notice

AMC Privacy Notice

Version: AMC-PRIVACY-NOTICE-v2. This notice explains how Andrew McDuff Coaching ("AMC", "we") collects and uses your personal data, your rights over that data, and how to contact us about privacy.

Data controller

Andrew McDuff Coaching is operated by Andrew McDuff as a sole trader and is the data controller for personal data processed for AMC coaching. For privacy requests, contact andrewmcduffcoaching@yahoo.com.

Data we collect

• Identity and contact data (name, email) used to create and administer your account.
• Coaching profile data (age, sex, height, weight, goals, training experience, preferences, lifestyle and activity information).
• Health and wellbeing information you voluntarily provide (injuries, limitations, relevant medical conditions, allergies, sleep, recovery, stress, energy, soreness, body measurements, progress photographs, training readiness). Some of this is special-category health data.
• Daily tracking data (workouts, nutrition logs, habits, check-ins, steps, mood, recovery scores).
• Messages and notes exchanged with your coach, including voice notes.
• Progress photographs stored privately with access gated by row-level security.
• Limited business and billing records where you are a paying client.
• Where you choose to connect a supported fitness or wearable service, data made available under the permissions you grant. Depending on the service and permissions, this may include activities and workouts, steps, heart rate, sleep, recovery and related fitness metrics.

Purposes and lawful basis

• Providing and personalising your coaching (UK GDPR Article 6(1)(b) — performance of a contract).
• Communicating with you about your coaching and operating the service (Article 6(1)(c) and 6(1)(f) — legal obligation and legitimate interests).
• Processing special-category health data for personalised coaching (Article 9(2)(a) — your explicit consent).
• Marketing and public sharing of your results, story or transformation (Article 6(1)(a) and, where relevant, Article 9(2)(a) — consent).

Special-category health data

We only process health and wellbeing information on the basis of your explicit, separate consent. Granting health-data consent is not a condition of using the AMC platform generally, but some personalised coaching features depend on it. You can withdraw consent at any time; withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Sharing and processors

We use service providers to host and operate the platform, process payments, support integrations and deliver communications. These include Base44 (app platform and hosting) and Stripe (card payments and subscriptions). Where enabled and used by a client, integrations may include Strava, WHOOP and Garmin Connect for fitness or wearable data, and Google Calendar for appointment scheduling. AMC also uses Twilio for WhatsApp notifications and ntfy.sh for push notifications where those notification features are enabled. Garmin Connect: if you choose to connect your Garmin account, AMC receives the workouts, daily steps, resting heart rate and sleep data you allow in Garmin Connect. It is used only to show your activity and recovery in your AMC training diary, so that you and your AMC coach can track your progress against your coaching plan. It is visible only to you and your coach, is stored on our hosting provider Base44, is never sold or shared with any other third party, and is never processed by AI systems or used to train AI models. You can stop sharing at any time by tapping Disconnect on the Integrations page or by removing AMC in your Garmin Connect account settings, and you can ask us to access, correct, export or delete your Garmin data using the contact details in this notice. Providers process data as needed to deliver their services under their own terms and privacy information. We do not sell your personal data. Transfers of your data to Notion for onboarding records are currently suspended pending processor-agreement and international-transfer confirmation; no AMC onboarding data is being sent to Notion while this suspension is in place.

International transfers

Where your data is processed outside the UK/EEA, we rely on appropriate safeguards or UK adequacy regulations. We monitor the international-transfer position for each processor and will not transfer special-category data to a processor without an appropriate safeguard in place.

Retention

AMC keeps personal data only for as long as reasonably necessary for the purposes for which it was collected, or where required by law.

As a general approach, client and coaching information is intended to be retained for the duration of the coaching relationship and normally for up to 12 months afterwards, unless a longer period is required or justified. Deletion and anonymisation are not currently automated across the platform; requests are reviewed and handled manually where technically and legally possible. Some records, backups or files may not be immediately removable through the app itself.

This general approach applies to client account information, onboarding information, health and wellbeing information, training and nutrition records, progress information, coaching communications and related coaching records.

Consent records and privacy/data-subject request records may be retained for as long as reasonably necessary to demonstrate compliance, record consent or withdrawal, deal with disputes, or meet legal obligations.

Financial and tax records are retained for the period required by applicable HMRC requirements.

Information used for marketing, testimonials or public client results is retained only while the relevant permission remains valid, subject to retaining the minimum necessary record of that permission or its withdrawal.

Where you ask AMC to delete information, we will review the request against legal obligations and the technical capabilities of the platform. We do not currently promise automatic or immediate deletion from every system, including underlying file storage or provider systems. We will take appropriate steps where technically and legally possible and explain any relevant limits.

Your rights

• Access, rectify, or delete your personal data.
• Restrict or object to certain processing.
• Receive your data in a portable format.
• Withdraw consent for consent-based processing, including health-data and marketing consent, without affecting the lawfulness of prior processing.

Marketing and public sharing

Marketing and public sharing (testimonials, photos, social media, your story) is separate from coaching. It requires a separate, explicit marketing consent. Granting health-data consent for coaching never authorises public marketing use of your data or photographs.

Complaints

You can complain to the UK Information Commissioner’s Office (ICO) if you are concerned about how we handle your personal data.

Connected fitness and wearable services

Connecting a third-party fitness or wearable account is optional. If you choose to connect one and authorise access, AMC may receive the categories of data permitted by the provider and the permissions you grant, and use relevant information to support coaching, activity tracking and progress reviews. The exact data available depends on the provider, the integration and your settings. Do not connect a service or share data you do not want used for coaching.

Disconnecting an integration

You can disconnect a linked service through the available controls or the provider’s account settings where supported. Disconnecting is intended to stop future access or syncing, subject to the provider and integration. Disconnecting does not automatically delete data already imported into AMC. To request deletion of imported records, contact andrewmcduffcoaching@yahoo.com; we will review and handle the request where technically and legally possible.

Contact and privacy requests

For questions about this notice or to request access, correction, deletion, restriction, portability or withdrawal of consent, email andrewmcduffcoaching@yahoo.com. We may need to verify your identity before responding.