HomePTKit
Menu
Start free

Legal

Data processing agreement

The UK GDPR Article 28 terms that apply when a personal trainer uses HomePTKit to process their clients’ data.

Last updated: 5 November 2026

This data processing agreement (the “DPA”) is part of the PT terms. It applies when you (the personal trainer, the controller) use HomePTKit to process personal data about your clients. HomePTKit is operated by Daryl Bleach, a sole trader trading as HomePTKit (the processor). Contact: privacy@homeptkit.com or hello@homeptkit.com.

HomePTKit is the controller only for data it decides on itself (your PT account, platform billing, security logs, and marketing site analytics). That data is covered by the Privacy policy, not this DPA.

1. Subject matter and duration

Subject matter: we host and operate the HomePTKit studio and client portal so you can coach, take payments, message clients, and keep their training records.

Duration: from when you start using the studio until your account is closed, and then until we have deleted or returned the personal data as section 10 requires, except where UK law requires us to keep a copy.

2. Nature and purpose

Nature: storage, retrieval, display, transmission, backup, and deletion of personal data inside the product (including sending transactional email and push notifications you switch on, and generating an AI week meal plan when a client or you ask for one).

Purpose: to provide those tools to you, on your instructions, so you can deliver coaching to the people who join your studio.

3. Types of personal data

Depending on which tools you use, this includes:

We do not need, and you should not upload, data we have nowhere to store (for example a date of birth or a previous platform’s package name).

4. Categories of data subjects

Your adult clients, people who enquire about training with you through your HomePTKit join page or lead form, and people you have invited from a spreadsheet who have not yet joined.

5. Documented instructions (Article 28(3)(a))

We process this personal data only on your documented instructions: this DPA, the PT terms, and how you (and your clients, acting for you) use the product. We will not process it for our own marketing. If UK law requires us to process it in another way, we will tell you first unless the law forbids that.

Transfers of this personal data to a third country or international organisation happen only on those same instructions (this DPA). The sub-processors in section 8 include US companies (Cloudflare, Stripe, Resend, OpenAI, and device push providers). Neon stores the database in AWS eu-west-2 (London). Where a provider processes data in the US we rely on the UK-US data bridge (UK adequacy regulations) where that provider is certified, and otherwise on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. OpenAI is in the US and receives allergies, intolerances, meal preferences and a calorie target when a meal plan is generated, and, when a PT asks for a check-in summary with the feature enabled, check-in answers (including notes and custom answers), workout names and custom check-in question labels as the PT wrote them, apart from the same contact-pattern redaction, weight and measurement trends, workout adherence, short message excerpts including the PT’s own message text in the thread, and PT style-example messages. We do not send names or contact details from our records. Free text that clients and PTs write is sent as written, apart from emails, links, social handles and UK phone numbers, which are removed. Names, addresses and postcodes someone types themselves are not removed automatically. Workout names and custom check-in question labels are sent as the PT wrote them, apart from the same contact-pattern redaction. Workout drafts send the PT’s brief (after the same contact-pattern redaction) and the exercise catalogue. Progress photos are not sent. Summaries and drafted replies are stored (latest 5 per check-in) until the check-in, the client user, or the studio is deleted.

If we believe an instruction from you infringes UK GDPR or other UK data protection law, we will tell you immediately.

6. Confidentiality (Article 28(3)(b))

Daryl Bleach is a sole trader. Anyone authorised to process the data (including sub-processor staff) is under a confidentiality duty. We will not publish your clients’ data.

7. Security (Article 28(3)(c) and Article 32)

We take these measures, among others:

No method of transmission or storage is perfectly secure. Tell us promptly at privacy@homeptkit.com if you suspect unauthorised access.

8. Sub-processors (Article 28(3)(d))

You give general written authorisation for us to use the sub-processors below. We impose the same data protection obligations as in this DPA on each sub-processor by contract. We remain fully liable to you for a sub-processor’s performance of those obligations.

We will tell you of a change to this list by email to the address on your PT account, at least 14 days before a new sub-processor starts processing, unless we have to change sooner for security or because a provider has failed. You may object by emailing privacy@homeptkit.com. If we cannot accommodate the objection, you may stop using the affected feature or close your studio.

9. Data subject rights and assistance (Article 28(3)(e) and (f))

You are responsible for answering your clients’ UK GDPR requests (access, rectification, erasure, restriction, objection, portability, and withdrawal of consent). We will help, using the tools in the studio where they exist, and otherwise if you email privacy@homeptkit.com. We will also help with security, personal-data-breach notification to the ICO and to affected clients, data protection impact assessments, and prior consultation, to the extent the information is available to us as processor.

Breach notice. If we become aware of a personal data breach affecting data we process for you, we will email the address on your PT account without undue delay and in any case within 48 hours of becoming aware, with the facts we then know so you can meet your controller duties (including Article 33 to the ICO and Article 34 to affected clients).

10. Deletion or return (Article 28(3)(g))

When you close your studio, or this DPA ends, we will delete the personal data we process for you, or return it to you in a structured machine-readable form if you ask in writing before closure, unless UK law requires us to keep a copy (for example tax records of platform fees, which we hold as controller). Copies in encrypted database backups are overwritten within 24 hours as our hosting provider’s restore window expires. We do not keep longer-term archives.

11. Information and audit (Article 28(3)(h))

We will make available the information you need to show that this DPA is being followed. You may audit our processing on reasonable written notice, no more than once per year unless a competent authority or a personal data breach requires it, during UK business hours, in a way that does not compromise other customers’ security. We may satisfy an audit with up-to-date third-party reports or written answers where that gives you what Article 28 requires.

12. Your duties as controller

You confirm you have a lawful basis (and, for health data, an Article 9 condition) for the processing you instruct us to do. You will not instruct us to process children’s data. HomePTKit is aimed at adults.

13. Governing law

This DPA is governed by the laws of England and Wales. Courts of England and Wales. It does not reduce any right or duty that UK GDPR already gives either of us.

Operator: Daryl Bleach (sole trader trading as HomePTKit)
Privacy: privacy@homeptkit.com

← Back to HomePTKit