Policy · v1

Privacy & GDPR Notice

This notice explains what personal data M.M.X Coaching collects, why we collect it, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR).

1. Who we are

M.M.X Coaching provides online 1:1 fitness coaching. We are the data controller for the personal data described in this notice. All data protection requests and questions are handled directly by the coach over WhatsApp — we do not operate a support email address.

2. What we collect

Account data: name, email address, and account creation date.
Onboarding data: age, occupation, country/timezone, preferred contact method, phone number.
Health and fitness data: weight, height, body measurements, body-fat estimates, injuries, allergies, medical conditions, doctor clearance, energy levels, digestion, alcohol and caffeine intake, training history, workout logs and personal records. Some of this is special-category health data.
Progress photos, where you choose to upload them.
Coaching content: training and nutrition plans, macro logs, check-ins, notes and messages between you and your coach.
Consent records: which statements you agreed to, the policy version, and the timestamp.
Payment records: due dates, amounts and payment confirmations. Card details are never entered on or stored by this site.
Testimonials: the name and quote you submit, if you choose to submit one.
Cookies: essential cookies to keep you signed in, plus optional Meta Pixel analytics/advertising cookies if you consent.

3. Why we use it, and our legal basis

Contract: to create and deliver your coaching, training and nutrition plans, and to manage your account and payments.
Explicit consent: to process your health data, progress photos, publish a testimonial, and to run analytics/advertising cookies. You can withdraw consent at any time.
Legitimate interests: to keep the service secure, prevent abuse, and improve our coaching.
Legal obligation: to keep records we are required to retain, such as consent and transaction records.

4. Automated tools and AI

We use an AI service to help draft nutrition plans and summarise your coaching data for your coach. Coaching decisions are always reviewed by a human coach — no decision about you is made solely by automated means. Data sent to the AI service is limited to the coaching information needed to produce the plan or summary.

5. Who we share it with

We do not sell your personal data. We share it only with service providers who process it on our behalf: our cloud hosting and database provider (which stores your account, coaching data and photos), our AI plan-generation provider, and — only if you consent to analytics cookies — Meta, for advertising measurement. Providers may process data outside the EEA under appropriate safeguards such as EU Standard Contractual Clauses.

6. How long we keep it

We keep your coaching account and its data for as long as you are a client and for up to 2 years afterwards, so we can answer questions about past plans. Consent and payment records are kept for 6 years where required for legal and accounting purposes. Progress photos are deleted when you ask us to delete them, or with your account. You can ask us to delete your data sooner at any time (see Section 8).

7. How we protect it

Your data is stored in an access-controlled database with row-level security, so clients can only see their own records. Progress photos are stored in a private (non-public) storage area. Access to client data is limited to your coach. No online service can be guaranteed 100% secure, so please only share what you are comfortable sharing.

8. Your GDPR rights

Access: get a copy of the data we hold about you.
Rectification: correct data that is wrong or incomplete.
Erasure: ask us to delete your data ("right to be forgotten").
Restriction and objection: ask us to pause or stop certain processing.
Portability: receive your data in a machine-readable format.
Withdraw consent: at any time, without affecting the coaching already provided.
Complain: to your local data protection authority — in Ireland, the Data Protection Commission.

Logged-in clients can download a copy of their data and submit a correction or deletion request instantly from Account Settings inside the dashboard. Otherwise, message us on WhatsApp. We respond to requests within one month.

9. Cookies and your choice

Essential cookies are always active because the site cannot function without them. Analytics and advertising cookies (Meta Pixel) only load if you turn them on. You can change your choice at any time.

10. Children

This service is intended for adults. We do not knowingly collect data from anyone under 18. If you believe a minor has given us data, message us and we will delete it.

11. Changes to this notice

If we change how we use your data we will update this notice and, where the change is significant, ask you to confirm your consent again the next time you sign in.