AMC Privacy Notice

AMC Privacy Notice

Version: AMC-PRIVACY-NOTICE-v1. This notice explains how Andrew McDuff Coaching ("AMC", "we") collects and uses your personal data, your rights over that data, and how to withdraw consent.

Data controller

Andrew McDuff Coaching is the data controller for the personal data you provide through the AMC coaching platform.

Data we collect

• Identity and contact data (name, email) used to create and administer your account.
• Coaching profile data (age, sex, height, weight, goals, training experience, preferences, lifestyle and activity information).
• Health and wellbeing information you voluntarily provide (injuries, limitations, relevant medical conditions, allergies, sleep, recovery, stress, energy, soreness, body measurements, progress photographs, training readiness). Some of this is special-category health data.
• Daily tracking data (workouts, nutrition logs, habits, check-ins, steps, mood, recovery scores).
• Messages and notes exchanged with your coach, including voice notes.
• Progress photographs stored privately with access gated by row-level security.
• Limited business and billing records where you are a paying client.

Purposes and lawful basis

• Providing and personalising your coaching (UK GDPR Article 6(1)(b) — performance of a contract).
• Communicating with you about your coaching and operating the service (Article 6(1)(c) and 6(1)(f) — legal obligation and legitimate interests).
• Processing special-category health data for personalised coaching (Article 9(2)(a) — your explicit consent).
• Marketing and public sharing of your results, story or transformation (Article 6(1)(a) and, where relevant, Article 9(2)(a) — consent).

Special-category health data

We only process health and wellbeing information on the basis of your explicit, separate consent. Granting health-data consent is not a condition of using the AMC platform generally, but some personalised coaching features depend on it. You can withdraw consent at any time; withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Sharing and processors

We use trusted processors to deliver the service, including cloud infrastructure, file storage, email, calendar, and payment providers. We do not sell your personal data. Transfers of your data to Notion for onboarding records are currently suspended pending processor-agreement and international-transfer confirmation; no AMC onboarding data is being sent to Notion while this suspension is in place.

International transfers

Where your data is processed outside the UK/EEA, we rely on appropriate safeguards or UK adequacy regulations. We monitor the international-transfer position for each processor and will not transfer special-category data to a processor without an appropriate safeguard in place.

Retention

AMC keeps personal data only for as long as reasonably necessary for the purposes for which it was collected, or where required by law.

As a general rule, client and coaching information is retained for the duration of the coaching relationship and normally for up to 12 months afterwards. At the end of this period, information will be securely deleted or anonymised where appropriate, unless there is a legitimate or legal reason to retain it for longer.

This general approach applies to client account information, onboarding information, health and wellbeing information, training and nutrition records, progress information, coaching communications and related coaching records.

Consent records and privacy/data-subject request records may be retained for as long as reasonably necessary to demonstrate compliance, record consent or withdrawal, deal with disputes, or meet legal obligations.

Financial and tax records are retained for the period required by applicable HMRC requirements.

Information used for marketing, testimonials or public client results is retained only while the relevant permission remains valid, subject to retaining the minimum necessary record of that permission or its withdrawal.

Where you ask AMC to delete information, the request will be reviewed against any legal or regulatory requirements and the technical capabilities of the platform. Information that must be retained will be retained only for as long as necessary.

Your rights

• Access, rectify, or delete your personal data.
• Restrict or object to certain processing.
• Receive your data in a portable format.
• Withdraw consent for consent-based processing, including health-data and marketing consent, without affecting the lawfulness of prior processing.

Marketing and public sharing

Marketing and public sharing (testimonials, photos, social media, your story) is separate from coaching. It requires a separate, explicit marketing consent. Granting health-data consent for coaching never authorises public marketing use of your data or photographs.

Complaints

You can complain to the UK Information Commissioner’s Office (ICO) if you are concerned about how we handle your personal data.