Who we are
HomePTKit (“we”, “us”, “our”) is a multi-tenant platform that helps UK personal trainers run their coaching businesses and sell memberships, challenges and sessions to their clients. This policy explains what personal data we process, why, who decides that processing, and your rights under UK GDPR and the Data Protection Act 2018.
HomePTKit is operated by Daryl Bleach, a sole trader trading as HomePTKit. Contact us by email at privacy@homeptkit.com (privacy) or support@homeptkit.com / hello@homeptkit.com (general).
Privacy requests: privacy@homeptkit.com
Who is the controller?
HomePTKit has two roles. Which one applies depends on whose data it is and who decided to collect it.
Your coach is the controller for client data they manage on HomePTKit. That is the coaching record: who trains with them, programmes and workouts, check-ins, progress photos, messages, bookings, meal preferences, allergies and intolerances, and enquiries sent to that coach through the public form. The coach decides why that data is collected and how it is used for coaching. HomePTKit (Daryl Bleach, a sole trader trading as HomePTKit) is their processor. We store it and run the studio and portal tools on the coach’s documented instructions, which are the PT terms and the data processing agreement. If you are a client, ask your coach first about that coaching data. You can also email privacy@homeptkit.com and we will help.
HomePTKit is the controller only for data we decide on ourselves:
- PT account data: the trainer’s name, email, hashed password, studio profile, branding, and invite slug.
- Platform billing: application-fee amounts, the monthly fee cap, and related Stripe Connect settlement records we need to run the platform.
- Security logs: sign-in events, abuse-prevention and rate-limit counters (stored as a one-way hash, not a raw IP), and similar integrity records.
- Marketing site analytics: aggregated use of public pages, only where you have allowed analytics cookies (see the Cookie policy).
A client’s login email and hashed password sit with HomePTKit as controller because we run the account system. The same email also appears on the coach’s client list, where the coach is controller and we are processor.
What we collect
Depending on whether you are a personal trainer (PT) or a client, we may process:
- Account details: name, email, password (hashed), profile basics, and branding you choose to show.
- Business / payout details (PTs): information needed to connect payouts via our payment provider (for example Stripe Connect), such as identity and bank details collected by that provider.
- Client relationship data: which PT you follow or pay, challenge and membership enrolments, progress marks, community posts you choose to make.
- Coaching records the PT manages: programmes, check-ins (weight, measurements, notes, progress photos), allergies, intolerances, meal preferences, messages and bookings. The PT is the controller of this data. HomePTKit is the processor. Check-ins, photos, allergies and similar are health data.
- Payment metadata: amounts, dates, status, and fee application (standard HomePTKit platform fee is 7.5% of memberships and challenges when money flows; PTs who join in the first 3 months after launch get 0% for 6 months, then 5% for 12 months, then the standard 7.5%; paid 1:1 sessions stay at 0%; £0 monthly fee to PTs). We do not store full card numbers; card data is handled by the payment provider.
- Content you upload: videos (or URLs), PDFs, meal-plan templates, session materials, and similar IP you publish.
- Technical & usage data: device/browser type, IP address, approximate location derived from IP, logs, cookies and similar technologies (see Cookie policy).
- Enquiries to a trainer: if you use a PT’s “ask about training” form without an account: your name, email address, optional phone number, what you wrote about your goal, and when you ticked the box agreeing to be contacted (see below).
- Support messages: emails you send to support@homeptkit.com or privacy@homeptkit.com.
Enquiries you send to a trainer
A PT’s page may let you ask about training without creating an account. When you send that form, the PT you chose receives your name, email address, optional phone number and your message so they can reply to you about training. We do not use these details for our own marketing, and we do not sell them.
- The PT is the controller of your enquiry. It is stored in that PT’s studio on HomePTKit, visible only to them. They decide how to follow up. HomePTKit is their processor: we store it on their behalf and send the optional acknowledgement and alert messages they have switched on.
- You can ask for it to be deleted. Ask the PT and they can delete your enquiry from their studio. If you cannot reach them, email privacy@homeptkit.com and we will act on it. You can also use the other rights listed below.
- Automatic deletion after 12 months. HomePTKit deletes an enquiry that was never turned into a client account once it is more than 12 months since you last submitted the form (an enquiry marked “new” or “contacted”). If you submit the form again, the 12 months start again. An enquiry that became a client account is not deleted this way; it stays as part of that client relationship and is covered by the retention rules below.
- Spam protection. To stop automated abuse we use a hidden form field, a limit on how often one connection can submit (stored as a one-way hash, not your raw IP address, and deleted within days) and, where switched on, Cloudflare Turnstile. Turnstile runs a short check in your browser and shares technical signals with Cloudflare to decide whether you are a person; see Cloudflare’s privacy notice.
Why we use your data
We process personal data only where we have a lawful basis:
- Contract: to create and run your account, publish challenges and memberships, process payments, and deliver the client shell.
- Legitimate interests: to secure the platform, prevent fraud and abuse, improve product reliability, and understand aggregate usage (balanced against your rights).
- Legal obligation: where tax, accounting, or regulatory rules require retention of certain records.
- Consent: for non-essential cookies or optional marketing communications, where we ask and you can withdraw, and for contacting you about an enquiry you send to a PT (the box you tick on the form; you can withdraw it by asking the PT, or us, to delete your enquiry).
Who we share data with
We do not sell personal data. We use these processors to run the service, under contracts that require appropriate protection:
- Stripe (including Stripe Connect Express): client payments, the platform fee, and payouts to PTs. Stripe processes card and identity data under its own terms.
- Cloudflare: hosting on Workers, delivery and security, R2 media storage, and Turnstile bot checks where switched on.
- Neon: Postgres database (HomePTKit’s project is in AWS eu-west-2).
- Resend: transactional email (account, receipts, security, invites, booking notices). Inbound support is ordinary email to support@homeptkit.com or privacy@homeptkit.com, not a separate support product.
- OpenAI: AI week meal plans, check-in summaries, and workout drafts. For meal plans we send allergies, intolerances, meal preferences and a calorie target if one is set. For check-in summaries we send check-in answers (including notes and custom answers), workout names and custom check-in question labels as the PT wrote them, apart from the same contact-pattern redaction, weight and measurement trends, recent workout adherence, short message excerpts including the PT’s own message text in the thread, and a few of the PT’s own messages as style examples. We do not send names or contact details from our records. Free text that clients and PTs write is sent as written, apart from emails, links, social handles and UK phone numbers, which are removed. Names, addresses and postcodes someone types themselves are not removed automatically. Workout names and custom check-in question labels are sent as the PT wrote them, apart from the same contact-pattern redaction. For workout drafts we send the PT’s brief (after the same contact-pattern redaction) and the exercise catalogue. We do not send progress photos. Summaries and drafted replies are stored in our database (latest 5 per check-in) until the check-in, the client user, or the studio is deleted. Workout drafts are not stored until the PT saves the workout. Check-in summaries and the workout builder stay off until
AI_COACH_ENABLEDis turned on. - Apple, Google (FCM) and Mozilla (Autopush): push delivery when a user enables notifications.
- Legal / authorities: if required by law, court order, or to protect rights, safety, or the integrity of the platform.
For client coaching data the PT is the controller and the providers above (except legal / authorities) are HomePTKit’s sub-processors. The same list, with the same detail, is in the data processing agreement. Coaches remain independent businesses for the coaching itself. Contact your PT for how they use coaching data outside HomePTKit.
If a PT embeds a YouTube URL on a challenge, the video loads from YouTube in the client’s browser (we use youtube-nocookie.com). YouTube is not our sub-processor; it is the PT’s choice of host. Open Food Facts receives only the search term or barcode, not a client’s identity, so it is not a processor of client identity.
International transfers
Transfers outside the UK happen only as described in the data processing agreement when we act as processor, and on the same basis when we act as controller. Cloudflare, Stripe, Resend, OpenAI and the push providers are US companies. Neon stores the database in AWS eu-west-2 (London). Where a provider processes data in the US we rely on the UK-US data bridge (UK adequacy regulations) where that provider is certified, and otherwise on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. OpenAI is in the US and receives health data when those AI features run: allergies, intolerances and meal preferences for meal plans; and, when a PT asks for a check-in summary with the feature enabled, answers, notes, custom answers, workout names and custom check-in question labels as the PT wrote them, apart from the same contact-pattern redaction, weight and measurements, workout adherence and short message excerpts (including the PT’s own message text in the thread). We do not send names or contact details from our records. Free text that clients and PTs write is sent as written, apart from emails, links, social handles and UK phone numbers, which are removed. Names, addresses and postcodes someone types themselves are not removed automatically. Workout names and custom check-in question labels are sent as the PT wrote them, apart from the same contact-pattern redaction. Workout drafts send the PT’s brief (after the same contact-pattern redaction) and the exercise catalogue, not a client record. OpenAI’s default API retention is described at https://platform.openai.com/docs/guides/your-data.
How long we keep data
We keep personal data only as long as needed for the purposes above:
- Active accounts: for the life of the account.
- Coaching records we process for a PT: for as long as that PT’s studio stays open, then deleted or returned as the data processing agreement requires, except where we must keep a copy as controller (for example platform fee records).
- After closure: we delete or anonymise live personal data promptly, except where we must retain records for legal, tax, dispute, or security reasons. Copies in encrypted database backups are overwritten within 24 hours as our hosting provider’s restore window expires. We do not keep longer-term archives.
- Enquiries to a trainer: until you or the PT delete them, or automatically 12 months after you last submitted the form if they never became a client account. Spam-protection counters are deleted within a few days.
- Pending imported invites: name, email, optional phone, and any allergies, intolerances or meal preferences the coach included, until the person accepts or declines, or for 90 days if they do not. Health fields from an import are not added to a client record until that person ticks to agree.
- Payment & fee records: retained as required for accounting and compliance.
- Support correspondence: typically kept for a limited period to resolve follow-ups, then deleted or archived.
Your rights (UK)
Under UK GDPR and the Data Protection Act 2018, you may have the right to:
- Access your personal data
- Rectify inaccurate data
- Erase data in certain circumstances
- Restrict or object to certain processing
- Data portability, where applicable
- Withdraw consent where processing is based on consent
- Complain to the UK Information Commissioner’s Office (ICO): ico.org.uk
To exercise these rights for data HomePTKit controls (PT accounts, platform billing, security logs, marketing analytics), email privacy@homeptkit.com. For coaching data your PT controls, contact your PT; if you cannot reach them, email us and we will help them respond. We may need to verify your identity before responding.
Children
HomePTKit is aimed at adults (personal trainers and their adult clients). We do not knowingly collect personal data from children under 16. If you believe a child has provided data, contact privacy@homeptkit.com and we will take appropriate steps.
Security
We use appropriate technical and organisational measures to protect personal data (access controls, encryption in transit where standard, hashed passwords, least-privilege practices). No method of transmission or storage is perfectly secure; please use a strong unique password and tell us promptly at support@homeptkit.com if you suspect unauthorised access.
Changes to this policy
We may update this policy from time to time. The “Last updated” date at the top will change. Material changes may also be notified in-product or by email where appropriate.
Contact
Privacy questions and requests: privacy@homeptkit.com
Operator: Daryl Bleach (sole trader trading as HomePTKit)
General support: support@homeptkit.com
Web: homeptkit.com (homeptkit.co.uk redirects here)