Privacy Policy

1. Who we are and contact details

Shane Williams, a sole trader trading as NO SHANE NO GAIN ("we", "us"), is the data controller for the personal information described in this notice. Our website is https://www.noshanenogain.co.uk. We provide personal training, small group training, corporate wellbeing programmes, workshops, fitness assessments, motivational speaking and related nutrition and wellbeing services.

For privacy questions, requests or withdrawal of consent, email info@noshanenogain.co.uk.

Administrator placeholder: Business correspondence address: [To be supplied by the owner before publication].

2. Personal information we collect

• Identity and contact details: names, email addresses, telephone numbers, company details and information you include in enquiries. For youth bookings this can include the child’s name and parent or guardian contact details.
• Account and service records: profile details, account authentication records, purchased sessions, assigned trainer, bookings, attendance, cancellations, programme prescriptions, workout results and communications.
• Payment records: purchase amount, payment status, payment references and billing details returned by our payment provider. Card payments are processed by Stripe; our checkout does not collect full card numbers. Bank-transfer arrangements include payment references and confirmation.
• Health and fitness information: PAR-Q and health-questionnaire answers, injuries, medical conditions, medication, allergies, pregnancy or postnatal considerations, health disclaimers, consent and signature records, fitness goals, assessments, InBody measurements and optional progress photos. Assessments may include blood pressure, heart-screening, lung function, sleep and fitness measurements where that service is selected.
• Technical and usage information: browser/device details, network information used to operate and protect the website, sign-in/session storage, and advertising/conversion data associated with Google Ads tags. Some waiver flows request a public IP address for signature evidence.

3. Where information comes from

We receive information from you when you contact us, create an account, complete a questionnaire, book or pay, upload results or log a workout. Trainers record assessments, programme prescriptions, attendance and relevant training notes. A parent or guardian may provide information for a young participant.

For corporate bookings an employer or organiser may provide event, attendee or contact details. Payment and scheduling providers return payment confirmations and scheduling information. We use these sources only for the relevant service and explain any materially different use.

Administrator placeholder: Confirm what employers receive after workplace assessments, including whether results are individual or anonymous aggregate reports, and provide the relevant event-specific notice before collecting participant health information.

4. Purposes and Article 6 lawful bases

• Enquiries and quotations: taking steps at your request before a contract (Article 6(1)(b)); for business contacts and organiser communications, our legitimate interest in answering enquiries and arranging services (Article 6(1)(f)).
• Account management, paid bookings, training, small group packages, nutrition plans and agreed services: performance of a contract or steps before a contract (Article 6(1)(b)).
• Corporate wellbeing, workshops and speaking arrangements: performing our contract with the customer; where attendees or company contacts are not parties to that contract, legitimate interests in organising and delivering the event, subject to their rights (Article 6(1)(f)). Health information requires a separate Article 9 condition as explained below.
• Receipts, accounting and legally required records: compliance with applicable legal obligations (Article 6(1)(c)).
• Security, misuse prevention, service administration and handling complaints: legitimate interests in protecting customers and operating our business (Article 6(1)(f)). We consider necessity, proportionality and the impact on individuals. Legal claims involving health information require a separately applicable Article 9 condition.
• Optional marketing and any advertising/device access requiring permission: consent (Article 6(1)(a)) where relied upon. Service confirmations are distinct from optional promotional messages.

Administrator placeholder: Document and approve the purpose-by-purpose basis, legitimate-interest assessment and any applicable Article 9 condition before publication. Do not use "contract" as a substitute for a health-data condition.

5. Health information and explicit consent

Health and fitness information that reveals your health is special-category data under UK GDPR. In addition to an Article 6 basis, we must have an applicable Article 9 condition. Where we rely on explicit consent under Article 9(2)(a), we ask for a specific affirmative statement explaining the health-data processing; agreement to general Terms of Service is not that consent.

The fitness questionnaire has a separate explicit health-data consent control and records submitted answers and signature evidence. The paid InBody journey has a separate consent control for using results and answers to prepare and review the selected plan. Optional photo/video marketing permission is separate. These controls do not establish that every assessment or booking flow has equivalent consent.

You can withdraw consent by emailing info@noshanenogain.co.uk. Withdrawal does not make earlier lawful processing unlawful. If the relevant health information is necessary for safe, tailored participation, we may need to discuss an alternative or be unable to continue that part of the service. We will explain the consequences without removing statutory rights.

Administrator placeholder: Review the existing draft fitness waiver and every health-data entry point, including scan upload before processing, workshop/youth health notes and assessment consent. Confirm that consent is informed, specific, recorded and withdrawable, or identify and document another applicable condition. Do not launch a new health-data flow on this notice alone.

6. Training, assessments and corporate services

We use booking information to organise personal training, small group sessions, workshops and speaking engagements; confirm times and locations; manage attendance, purchased credits and cancellations; and communicate about the service. Corporate quotations may include participant numbers, venue and equipment requirements.

Relevant authorised staff use health and fitness information to review safe participation, tailor programmes and assess progress. The customer portal includes prescribed workouts, recorded performance, confirmed measurements, optional private progress photos and trainer notes. Access depends on the customer’s own account and authorised staff responsibilities.

Providing relevant information may be necessary to book, pay for or safely participate in a service. Optional information is identified in the relevant form; if information required for a service is not provided, we may be unable to supply that service. We do not sell your personal information or use your health answers for advertising.

7. InBody scanning and AI-assisted plans

An uploaded InBody sheet is sent to an AI-assisted extraction service to read the measurements. You are asked to check and confirm or correct the results, with manual entry available if scanning fails. The free scan flow does not save the sheet or individual results in our application database; results remain in the browser unless you start a paid order. Anonymous usage counters are recorded separately. Processing by the AI provider is still a disclosure to that provider.

Starting paid checkout saves the information needed for your order, including confirmed results, questionnaire answers and any original upload, in private order storage. AI services are used to draft personalised nutrition and training materials; staff review and approval is required before the new paid magazine is delivered.

We do not use solely automated decisions that produce legal or similarly significant effects in this service. Automated extraction and safety flags support, rather than replace, confirmation and staff review.

Administrator placeholder: Confirm the AI provider(s), processing regions, contractual terms and provider-side retention/logging for each deployed extraction and generation service. Do not claim that third-party AI never stores data without evidence.

8. Google Calendar and Google account information

Trainer scheduling uses the existing NSNG OS calendar connection. The website requests busy time intervals to determine available appointment times. Customers see available slots, not a trainer’s private calendar event titles or descriptions.

For a confirmed appointment the scheduling system can send Google the event title, description, location, start/end times and attendee email address. The website retains the related booking and Google event reference so the event can be managed or cancelled. A trainer’s own calendar is used; customers do not have to share their calendars to book.

The website uses a signed server-to-server calendar bridge to NSNG OS. Calendar authorisation and any Google access credentials are managed through that existing connection, not a separate connection introduced by this notice.

The inspected website sign-in screen uses email/password and does not currently offer a Google sign-in button. If Google authentication is enabled in a future or separate flow, its account data and permissions must be described here before use; calendar permission must not be implied by ordinary account sign-in.

Administrator placeholder: Confirm the exact Google OAuth permissions, calendar identifier and Google profile data read, credential storage/retention in NSNG OS, recipients and disconnect/deletion procedure. No access to Gmail, Drive or unrelated Google data is claimed. Confirm Google consent-screen links only after the final pages are published.

9. Service providers and other recipients

• Lovable Cloud and the website’s hosting, database, authentication and private file-storage services provide the application infrastructure.
• Stripe processes card payments and payment confirmations under its own applicable privacy notice as well as relevant service arrangements.
• Google provides calendar scheduling through NSNG OS; Google Ads receives website advertising/conversion information. Google Cloud also serves securely signed exercise media.
• Resend delivers transactional communications such as booking confirmations, invitations and plan delivery emails.
• AI providers used through the existing application’s AI services receive information needed for InBody extraction and personalised plan drafting.
• Authorised trainers/administrators access service records according to their responsibilities. Corporate organisers receive relevant event administration information; health-result sharing must follow the applicable participant notice and lawful basis.
• We may disclose necessary records to professional advisers, insurers, regulators or law-enforcement bodies where legally required or justified; any health-data disclosure needs a valid Article 9 condition.

Administrator placeholder: Complete and approve the processor/recipient list, including any IP-address lookup service used by waiver signing, subprocessors, provider notices and contracts. Confirm corporate result-sharing arrangements; this draft does not authorise new sharing.

10. Security and international transfers

The application uses authenticated access and server-side access checks for protected records, private storage for relevant customer uploads, signed temporary media links and encrypted HTTPS connections. Nutrition order administration is restricted to authorised administrators. We do not promise that any online system is completely secure.

Some providers and their support teams may process information outside the UK. Where UK restricted-transfer rules apply, an appropriate transfer mechanism must be established, such as UK adequacy regulations or approved contractual safeguards, together with any required assessment. You may contact us for information about applicable safeguards.

Administrator placeholder: Confirm actual hosting/processing countries, overseas support access, provider agreements and transfer safeguards; do not claim a particular adequacy decision, IDTA or UK Addendum exists until checked. Confirm incident handling and backup access/retention.

11. Retention and deletion

We keep information only for a justified service, legal or recordkeeping purpose. Different record types need different periods. Existing historical health records and customer programmes are not deleted simply because this notice is revised. Requests for erasure are considered against applicable legal duties and exemptions.

The existing legacy nutrition cleanup code is configured to remove original uploads after 30 days, delete unpaid orders older than 24 hours, erase health information approximately two years after completion/payment, and remove the remaining financial record approximately six years after payment. These are code-level settings, not a verified guarantee that every scheduler, backup, production magazine, email attachment or downloaded copy is covered.

Administrator placeholder: Approve a complete retention schedule for accounts, enquiries, PT/group/corporate bookings, PAR-Q and signed waivers, assessments, programmes/results, photos, notes, recruitment and financial records. Verify the cleanup job actually runs and define retention/deletion for new production magazine orders, backups, sent email copies and provider logs. Confirm sole-trader tax recordkeeping periods before promising deletion.

12. Cookies, website usage and marketing

The website uses browser storage for authentication/session information and preferences such as the selected small-group location. The InBody paid journey also uses temporary browser session storage to support return from payment.

The website currently loads a Google Ads tag and records conversions after contact submissions. The inspected implementation does not include a verified cookie consent manager or consent-gating for this advertising tag. We therefore do not claim that advertising only runs after consent.

Corporate enquiry screens include an optional updates checkbox. This is separate from requesting a quotation, booking a service, agreeing to terms or health-data consent. Contact us at info@noshanenogain.co.uk to stop promotional communications; any unsubscribe method included in a message may also be used. Booking and service communications may still be necessary.

Browser settings can manage cookies and stored information, but disabling necessary storage may affect sign-in and bookings. Browser settings are not a replacement for any consent mechanism the law requires us to provide.

Administrator placeholder: Audit cookies/device access, purposes, providers and lifetimes. Resolve Google Ads/other non-essential tracking consent before publication, and verify optional marketing choices are actually recorded and honoured. The notice itself does not implement a cookie manager or newsletter system.

13. Your data protection rights

Depending on the circumstances, you can request access to your information, correction of inaccurate data, erasure, restriction of processing and data portability; object to processing based on legitimate interests; and withdraw consent where we rely on it. You can object to direct marketing at any time. These rights are not absolute and applicable exceptions will be explained.

Email info@noshanenogain.co.uk to exercise your rights. We may ask for proportionate proof of identity to protect your information. We normally respond within one month, subject to lawful extensions and rules applicable to the request. If an extension is needed we will explain the reason.

You can complain to the Information Commissioner’s Office at https://ico.org.uk or telephone 0303 123 1113. You do not have to contact us first, although we welcome the opportunity to resolve a concern.

14. Changes to this notice

The latest approved notice will be available at https://www.noshanenogain.co.uk/privacy-policy with its update date. Where a material change affects how we use your information, we will provide appropriate notice, for example through the relevant service or email. Where new consent is legally necessary, a notice update alone will not replace obtaining it.