Privacy Notice

Version 1.0 · Last updated October 2026

This notice explains what personal information KeepItUp Fitness ("the Trainer") collects about you, why, what it is used for, who it is shared with, how long it is kept, and what rights you have over it. It sits alongside the Client Sign-Up Agreement, and applies to in-person 1-1 coaching clients, online subscription members (such as the Training Club and 1-1 online coaching), anyone who buys a pre-written programme, and anyone who visits the website or gets in touch through it — wherever in the world you are based. Sections 1 to 9 cover coaching; Section 10 covers the website and cookies specifically.

The short version: your information is used to coach you safely and to run the business behind that. It is never sold, and it is never passed to advertisers. Your health information is treated as the sensitive information it is: it is collected with your explicit consent, used to keep you safe and to keep an accurate record — never for marketing unless you separately choose to share results on the Photo & Video Consent Form — and that consent can be withdrawn at any time. Photographs and video are used in your coaching to check technique and track progress; they are only ever used to promote the business if you have separately said yes on the Photo & Video Consent Form, which is optional and which you can withdraw whenever you like.

1. Who is responsible for your information

KeepItUp Fitness is the trading name of George Warner, who trades as a sole trader. He is the data controller for the information described in this notice, which means he decides what is collected and why, and is responsible for looking after it.

Contact for any privacy question or request: hello@keepitupfitness.com

Address: KeepItUp Fitness, 124 City Road, London, EC1V 2NX

The Trainer is not required to have a Data Protection Officer, and does not have one. Privacy questions go directly to the Trainer.

2. What information is collected

Identity and contact details

  • Your name, date of birth, email address, and phone number.

  • The name, phone number, and relationship of the emergency contact you provide.

Health information

  • Your responses to the health screening in Section 15 of the Sign-Up Agreement, including any condition, injury, medication, pregnancy, or symptom you disclose.

  • Any health information you share afterwards — an injury, an illness, a change in medication — and any supporting information you provide when requesting a package extension.

  • Where relevant, correspondence about clearance or advice from a healthcare professional.

Training information

  • Your goals, training history, session records, programming, personal bests, progress notes, and check-in responses.

Photographs and video

  • Short videos and photographs taken during coaching to analyse your technique, compare movements over time, and track progress — including video you send in yourself if you train online.

  • If, and only if, you have separately agreed to it on the Photo & Video Consent Form, photographs, video, or a testimonial used to promote the coaching. This is optional, is never a condition of coaching, and is covered in Section 3 below.

Transaction information

  • What you bought, when, at what price, which version of the Agreement you accepted, and the date and time you accepted it — including the confirmations shown beside the Accept button when you accepted.

  • Payment records. Payments made through the app are handled by the payment provider, and your card details are never seen or stored by the Trainer. In-person coaching is paid to the Trainer directly, by bank transfer or cash, and the Trainer keeps a record of each payment — who paid, how much, and when.

Incident records

  • If there is an injury or incident during a session, what happened, any injury, the action taken, and the names and contact details of anyone who saw it are recorded on an incident report — including witnesses who are not clients.

Communications

  • Messages between you and the Trainer, whether by email, phone, text, a messaging app such as WhatsApp, or through the coaching app.

If you use the website

  • Anything you type into a form on the website — for example your name, email address, phone number, the kind of coaching you are interested in, and your message.

  • If you subscribe to the mailing list: your name and email address, and the date you subscribed.

  • Your marketing preferences: whether you have subscribed, and whether you have opted out of marketing emails.

  • Information collected automatically by cookies and analytics: the pages you visit, how long you spend, how you arrived at the site, your approximate location (from your IP address, not precise), and your device and browser type. Full detail is in Section 10.

3. Why it is used, and the legal basis for each purpose

Under UK GDPR, every use of your information needs a lawful basis. The list below sets out each purpose and the basis relied on.

  • Providing the coaching, programming, or programme you have purchased, and communicating with you about it — Performance of a contract (Article 6(1)(b))

  • Taking payment, issuing confirmations and receipts, and keeping financial records — Performance of a contract (Article 6(1)(b)), and legal obligation for tax records (Article 6(1)(c))

  • Screening your health before and during coaching, adapting exercises, and keeping you safe — Explicit consent for the health information itself (Articles 6(1)(a) and 9(2)(a))

  • Keeping a record of health screening, incidents, and what was advised, in case of a later injury claim — Legitimate interests — establishing, exercising, or defending legal claims (Article 6(1)(f); Article 9(2)(f) for health information)

  • Responding to an emergency during a session, including contacting your emergency contact — Protecting vital interests (Articles 6(1)(d) and 9(2)(c))

  • Taking and reviewing photographs or video during coaching, to analyse technique, compare movements over time, and track progress — Performance of a contract (Article 6(1)(b)) — this is part of how the coaching is delivered

  • Using photographs, video, or a testimonial featuring you to promote the coaching — social media, website, advertising, print, or email — Consent, given separately on the Photo & Video Consent Form (Article 6(1)(a)) — and explicit consent (Article 9(2)(a)) for any health-related results you choose to share, such as weight. Entirely optional, never a condition of coaching, and withdrawable at any time

  • Handling a complaint, dispute, or insurance matter — Legitimate interests, and establishing or defending legal claims (Articles 6(1)(f) and 9(2)(f))

  • Keeping the business running — records, scheduling, and improving how coaching is delivered — Legitimate interests (Article 6(1)(f))

  • Replying to an enquiry you send through the website, by email, by message, or by phone — Steps taken at your request before entering a contract (Article 6(1)(b)), and legitimate interests in responding to people who contact the business (Article 6(1)(f))

  • Sending you marketing emails or a newsletter you have subscribed to — Consent (Article 6(1)(a)), which you give by subscribing and can withdraw at any time by unsubscribing

  • If you are a client, emailing you occasionally about new KeepItUp Fitness programmes, coaching and offers similar to what you have bought — Legitimate interests (Article 6(1)(f)) in keeping existing clients informed about the Trainer's own coaching, sent under the "soft opt-in" for existing customers in the Privacy and Electronic Communications Regulations 2003. You can opt out at any time, free of charge (Section 10)

  • Website analytics — understanding how people find and use the site — Consent (Article 6(1)(a)), given through the cookie banner. Nothing non-essential runs unless you accept it

Health information is "special category" data and gets extra protection. For coaching, it is collected with your explicit consent, which is set out as its own separately labelled statement beside the Accept button, apart from everything else you are agreeing to (you give it with the same tap). You can withdraw that consent at any time (see Section 8) — though if you do, the Trainer may not be able to continue coaching you safely, and may have to stop.

Where legitimate interests are relied on, the Trainer has considered whether this is fair to you. Keeping a record of what you disclosed and what was advised protects you as much as the Trainer, because it means there is an accurate account if something goes wrong.

Your information is only used for marketing emails as set out in Section 10, and you can opt out at any time. It is never sold or rented, never used to promote anyone else's products, and is not used for automated decision-making or profiling.

4. Whether you have to provide it

  • Identity, contact, and emergency contact details are needed to enter into and perform the coaching contract. Without them the Trainer may not be able to provide coaching.

  • Health screening information is not a legal requirement, but the Trainer cannot safely coach you or provide a programme without it, and will not do so. Declining to provide it, or withdrawing consent to its use, means coaching cannot start or continue.

  • Training and progress information is optional in the sense that you choose what to share, but the more the Trainer knows the better the coaching is.

5. Who your information is shared with

Your information is shared only where there is a reason to. Specifically:

  • The coaching app provider (currently FITR) hosts your profile, programming, health screening responses, and coaching records, and processes them on the Trainer's behalf. FITR is also responsible, under its own privacy policy, for the account details you give it directly when you create an account with it.

  • The payment provider (currently Stripe, through the app) processes payments made in the app. It handles your card details directly — the Trainer never sees or stores them — and acts as its own controller for the payment data it holds.

  • The Trainer's email provider (currently Google), which hosts the business email account through which enquiries and client emails are sent and received.

  • The website host (currently Squarespace), which runs the website and its forms on the Trainer's behalf. Form submissions may also be saved to the Trainer's own Google Drive account.

  • The Trainer's email automation provider (currently MailerLite), which holds clients' and subscribers' names and email addresses and sends emails on the Trainer's behalf — welcome and other practical emails to clients, and marketing emails to mailing list subscribers and to clients who have not opted out.

  • An automation service (currently Zapier), which passes your name, email address, and details of what you have bought — such as the programme, its start date and price — from the coaching app to the email automation provider, on the Trainer's behalf.

  • The Trainer's cloud storage and phone backup providers (for example Google Drive or Apple iCloud), which store files and coaching photos or video on his behalf.

  • Google, which provides website analytics, only where you have accepted analytics cookies.

  • If you choose to message the Trainer through WhatsApp or a similar messaging app, that app's provider handles those messages under its own privacy policy.

  • Emergency services and your named emergency contact, if there is a medical emergency during a session.

  • The Trainer's insurers, and if needed his legal or professional advisers, in connection with a claim, complaint, or incident.

  • HMRC and the Trainer's accountant, for financial records only — no health information.

  • Anyone else where you have asked the Trainer to share it, or where the law requires it.

The gyms and venues where sessions take place are separate businesses. The Trainer does not share your coaching or health records with them, unless you ask him to, or unless there is an incident on their premises that has to be reported.

6. Where your information is held, and transfers outside the UK

The Trainer is based in England.

  • The coaching app provider (currently FITR) states that it stores personal data within the European Economic Area, which UK data protection law recognises as giving adequate protection.

  • Other providers — including the payment provider, the website host, the email provider, cloud storage and backup providers, the analytics provider, the email automation provider, and the automation service — may process information outside the UK, including in the United States. Where they do, it is protected by an appropriate safeguard recognised under UK data protection law — normally UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework), or the International Data Transfer Agreement or Addendum with Standard Contractual Clauses.

  • You can ask the Trainer which providers are currently used and what safeguard applies, and for a copy or details of that safeguard.

If you are based outside the UK, your information will be transferred to and handled in the UK, under UK data protection law, in order to coach you.

7. How long it is kept

  • Health screening records, session records, incident notes, and coaching correspondence — 6 years after your last session or programme access (and, for incident notes, at least 6 years after the incident), in line with the limitation period for a personal injury or contract claim and typical insurer requirements

  • Financial records — what you bought, the price, and payments — 6 years after the end of the relevant tax year, as required for tax purposes

  • Proof of what you accepted and when, and any request to start early — 6 years after your last session or programme access

  • Coaching photographs and video (technique and progress) — Deleted when no longer needed for your coaching, and in any event within 12 months of your last session unless you ask for them to be kept longer

  • Photographs, video, or testimonials used for promotion, where you have consented — Until you withdraw consent, or until the material is no longer used, whichever is sooner. Withdrawal is actioned as soon as reasonably practicable, though already-printed or already-shared material may not be recallable. Your consent form and any withdrawal are kept for 6 years after that, as a record of what you agreed

  • Contact and emergency contact details — For as long as you are an active client, then with the coaching records above

  • Website enquiries that do not lead to coaching — 12 months from your last contact, then deleted

  • Mailing list subscription and marketing preferences — Until you unsubscribe, plus a minimal record of the unsubscribe so you are not re-added by mistake. Clients who have not opted out stop receiving marketing emails 2 years after their last purchase, unless they have subscribed to the mailing list

  • Google Analytics data — No longer than 14 months

  • The website host's own analytics — Shown to the Trainer only as combined reports, not as information about individual visitors, and held by the website host under its own retention settings

At the end of these periods information is securely deleted, or anonymised so it can no longer identify you. If you ask for erasure sooner, see Section 8 — the Trainer may need to keep a limited record for the periods above where the law requires it, or to defend a potential claim, but will keep no more than necessary.

8. Your rights

You have the following rights over your personal information. Exercising any of them is free, and the Trainer will respond within one month.

  • Access — ask for a copy of the information held about you.

  • Rectification — have inaccurate information corrected, or incomplete information completed.

  • Erasure — ask for information to be deleted, where there is no continuing reason to keep it.

  • Restriction — ask for use of your information to be paused, for example while you contest its accuracy.

  • Portability — receive information you provided in a commonly used electronic format, or have it sent to another provider.

  • Objection — object to use of your information based on legitimate interests, or to direct marketing at any time.

  • Withdraw consent — withdraw your consent to the processing of your health information, to marketing emails, or to analytics cookies, at any time. This does not affect anything done before you withdrew it. Withdrawing consent to the use of your health information will normally mean coaching cannot safely continue.

  • Complain — if you are unhappy with how your information has been handled, please tell the Trainer first, as most things are resolved quickly. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ico.org.uk), or, if you are based outside the UK, to the regulator where you live.

To exercise any of these, contact hello@keepitupfitness.com. The Trainer may need to confirm your identity first.

9. How your information is kept secure

  • Health and training records are held in the coaching app, in an account that is protected by a password and accessed only by the Trainer.

  • The phone and other devices used to access client information, including the app, are locked with a passcode or biometric lock, and kept up to date. Other accounts used for client information (such as email) are protected by a strong password.

  • Health information is not shared in group chats, on social media, or with other clients, at any time or in any form.

  • Paper records, where any exist, are kept securely and destroyed when no longer needed.

  • If there is ever a breach affecting your information that poses a risk to you, the Trainer will tell you, and will report it to the regulator where the law requires — normally within 72 hours.

10. The website and cookies

This section covers what happens when you visit the website, and applies whether or not you ever become a client. It covers the website as a whole, so it applies to every page and form on it, including any added later.

Making an enquiry

  • If you use a form on the website, what you send is emailed to the Trainer and stored in the website's form records, and may also be saved to the Trainer's Google Drive. It is used to reply to you and, if you go on to train with him, to set you up as a client.

  • If your enquiry does not lead to coaching, it is deleted within 12 months of your last contact. You can ask for it to be deleted sooner at any time.

  • Please do not send detailed health information through a website form. If something about your health matters to whether you can train, the Trainer will ask you about it properly once you are in touch.

Marketing emails

  • Website visitors and people who make an enquiry only receive marketing emails if they actively subscribe to the mailing list. Subscribing is never required. If an enquiry form offers a box to join the mailing list, it is optional, never ticked in advance, and separate from sending your enquiry.

  • If you are a client — you have bought a programme, a subscription, or coaching from KeepItUp Fitness — the Trainer may occasionally email you about new KeepItUp Fitness programmes, coaching and offers similar to what you have bought. Your details are never used to promote anyone else's products or services. You can opt out at any time, free of charge, by clicking unsubscribe in any of these emails or by telling the Trainer.

  • Every marketing email includes an unsubscribe link, and you can also unsubscribe by simply replying and asking.

  • Unsubscribing has no effect on your coaching, and you will still receive the practical emails you need about sessions or purchases — those are not marketing.

Cookies

Cookies are small files stored by your browser. Some are needed for the site to work at all; the rest only run if you accept them on the cookie banner. You can change your mind at any time through the cookie preferences link at the bottom of every page, or by clearing cookies in your browser settings.

The main cookies currently used are listed below. The website host occasionally adds or renames its cookies; its current full list is published on its own help pages, and the cookie banner always reflects the categories in use.

Essential cookies — these run without consent, because the site cannot work without them:

  • crumb — Security — prevents a form on the site being misused by another site. Ends when you close your browser.

  • RecentRedirect — Stops the site getting stuck in a redirect loop. 30 minutes.

  • _ssid — Recognises devices for fraud prevention. Up to 4 years.

  • _dd_s — Records browser errors so faults can be fixed. 4 hours.

  • Test, _dd_cookie_test, _dd_site_test — Check whether your browser accepts cookies at all. Momentary or session-length.

  • ss_performancecookiesAllowed, ss_marketingcookiesAllowed — Remember the choice you made on the cookie banner, so you are not asked repeatedly. 30 days.

Analytics cookies — these only run if you accept them:

  • ss_cid, ss_cpvisit, ss_cvr — Website host analytics — recognise returning visitors and group page views into visits. 2 years.

  • ss_cvisit, ss_cvt — Website host analytics — track the current visit. 30 minutes.

  • _ga, _ga_<id> (Google Analytics) — Google Analytics — how people find the site, which pages are read, and how long for. Up to 2 years.

None of this is used to identify you personally, to build a profile about you, or for advertising. It is used to understand which pages are useful and which are not.

Embedded content

  • Where a page includes content hosted elsewhere — for example a video from YouTube or Vimeo, or a map — that provider may set its own cookies when the content loads, under its own privacy policy rather than this one. Videos are embedded in privacy-enhanced mode where the provider offers it.

Links to other sites

The website links to other places — for example the Trainer's coaching app storefront, social media, or a gym. Once you follow a link you are on someone else's site, governed by their privacy policy, not this one. Purchases made in the coaching app are covered by this notice as described in Sections 1 to 9.

11. Changes to this notice

This notice is updated when what is collected, why, or who it is shared with changes — for example if a new kind of service provider is used, or the coaching offered changes. Ordinary changes to the website's pages and content do not change it. The current version is always available on the website and alongside the Sign-Up Agreement, and where a change materially affects how your information is used, you will be told directly.