Privacy policy

Last updated 30 October 2026

This policy explains what personal data AptCoach collects, why, who we share it with and the rights you have. It covers the AptCoach web workspace for coaches, the AptCoach app for clients, and the aptcoach.io website.

Who we are

AptCoach is run by Keelhouse Ltd, a company registered in England and Wales (company number 17307921), registered office Apartment 608, 18 Leftbank, Manchester, M3 3AJ. We are registered with the Information Commissioner's Office (ICO), the UK's data protection regulator, under registration number ZC282281. For anything about your data, email support@aptcoach.io.

Coaches, clients and who is responsible

AptCoach is used by personal trainers and other coaches (coaches) to work with the people they coach (clients).

For your AptCoach account, your plan and payments to us, how you use AptCoach, and for running and securing the service, we are the controller of your data.
For the coaching records a coach keeps about a client, such as programmes, check-ins, call notes, form answers and notes, the coach decides what is collected and why, and is the controller. We process that data on the coach's behalf. If you are a client, you can ask your coach or us about it, and we will help either way.

What we collect

Type	What it includes
Account details	Name, email address, phone number, profile photo, and your password, which our sign-in provider stores in scrambled (hashed) form so no one can read it. If you sign in with Google, your name, email address and Google account ID.
Coaching records	Programmes, workouts, the sets, reps and weights you log, habits, targets, check-ins, answers and signatures on forms, documents, notes and scheduled sessions.
Body and health information	Body weight, body measurements, progress photos, daily figures you log or allow your phone's Health Connect or Apple Health to share (see Health Connect and Apple Health), nutrition, and any health details you share with your coach, for example in a form or a message.
Messages	Messages between a coach and a client, including voice notes, photos, videos and GIFs.
Check-in calls	If a coach uses the notetaker on a video check-in: a recording of the call's sound, a written transcript and a summary for the coach. The coach decides whether it joins, and it shows in the call as AptCoach Notetaker.
Oracle, the coaches' assistant	What a coach asks Oracle and its answers, and the notes Oracle keeps for a coach and about their clients. Spoken questions are turned into text and the recording is not kept.
Payments	For coaches: your plan, and payment and billing details held by Stripe. For clients who pay a coach through AptCoach: what was paid and when. Card details go straight to Stripe and we never see them.
Calendar	If a coach connects Google Calendar: the events, times and guests in the calendars they choose, so their availability and sessions stay in step.
Linked nutrition data	If a client chooses to link their Mr Bite nutrition account, the nutrition information Mr Bite shares with their coach. The client can remove the link at any time.
How AptCoach is used	The pages opened and buttons pressed in the web workspace and on this website, with the device and browser type and country. See How we measure use.
Device information	A notification token so we can send you notifications, your device type and the app version.
Feedback and support	What you tell us when you send feedback or email us.

Body and health information is special category data under UK data protection law. We only process it because you choose to record it or share it with your coach for your coaching, and you can delete it at any time.

We do not use advertising or advertising trackers, and we never sell your data.

How we use it

To provide AptCoach: create your account, sign you in, and show coaches and clients the records they share.
To take payments for coaches' plans, and to let coaches take payments from their clients.
To send notifications you have allowed, such as a new message from your coach.
To see how AptCoach is used, so we can make it easier to use.
To keep the service secure and working, and to fix problems.
To answer you when you contact us.
To meet our legal obligations.

Health Connect

On Android, a client can let the AptCoach app read from Health Connect. We ask for five kinds of data, and the client chooses which to allow. Steps and sleep fill in the Steps and Sleep targets their coach has set. You see all five in the app, and they show your coach how you move and recover, on your Vitals and lifestyle page:

Steps: your daily step totals, shown against your Steps target on your Dashboard.
Sleep: your sleep sessions, added up into each night's sleep, shown against your Sleep target.
Heart rate: your heart rate across the day, kept as five-minute averages, and during each workout you log. You see each day's on the Health page (Coaching, then Health) and each workout's on that workout, and your coach sees how hard each workout was and anything unusual, such as a hard effort with no workout logged.
Resting heart rate: your daily resting heart rate, which you see on the Health page against your usual, and your coach follows to see your recovery over time.
Calories burnt: your daily totals, which you see on the Health page, and on your Dashboard against a Calories burnt goal if your coach sets one.

We read the last 7 days (heart rate, the last 3 days and your recent workouts), when you open the app. We never write anything to Health Connect.
The daily totals are stored with your coaching records. Only you and your coach can see them.
If your coach uses Oracle, the coaches' AI assistant, it reads these totals along with your other records when your coach asks about you, so it can answer about your activity and recovery. To answer, they are sent to Anthropic, whose AI model Claude is behind Oracle (see Who we share it with). Anthropic does not use them to train its models.
We never sell this data or use it for advertising. Apart from Anthropic for Oracle, it goes to no other company except the providers that host AptCoach, who process it only on our instructions.
AptCoach's use of information received from Health Connect follows the Health Connect Permissions policy, including its Limited Use requirements.
To stop it, disconnect Health Connect in the app's Settings, or remove AptCoach's access in Health Connect. To delete the figures already stored, email support@aptcoach.io or delete your account.

Apple Health

On an iPhone, a client can send their health figures from Apple Health with the AptCoach Health shortcut, which they add to Apple's Shortcuts app from the AptCoach app's Settings. The shortcut runs on their iPhone, when they run it or at the time they choose, and sends four kinds of data, used the same way as Health Connect's above:

Steps: your daily step totals for the last 7 days.
Sleep: the stretches of sleep Apple Health holds for the last 3 nights, added up into each night's sleep.
Resting heart rate: your resting heart rate readings for the last 7 days.
Calories burnt: your daily active and resting energy for the last 7 days, added up into each day's calories burnt.

The shortcut only reads. Nothing is written to Apple Health.
The daily totals are stored and shared exactly as Health Connect's are: you and your coach see them, and Oracle reads them when your coach asks about you, through Anthropic. We never sell them or use them for advertising.
The shortcut sends them with a key of your own, which only adds these figures to your own records.
To stop it, disconnect Apple Health in the app's Settings, which stops your key working, and delete the shortcut. To delete the figures already stored, email support@aptcoach.io or delete your account.

Google Calendar

A coach can connect their Google account in Settings, Calendar, so their AptCoach calendar and Google Calendar stay in step. We ask Google for three permissions:

Calendar events: we read the events in the calendars the coach chooses, so their week shows in AptCoach and clients cannot book over them; and we add, change and remove the sessions the coach makes in AptCoach, with the client invited when the coach wants, and a Google Meet link for one held online.
The list of calendars: their names, so the coach can choose which ones AptCoach reads. Read only.
Tasks: the coach's Google Tasks, shown in their AptCoach calendar. Read only: we never change them.

Only the coach sees their Google events and tasks in AptCoach. A booking page leaves out the times they are busy, never showing what is in them.
If the coach uses Oracle, the coaches' AI assistant, it reads their events when they ask about their week or ask it to plan one. To answer, they are sent to Anthropic, whose AI model Claude is behind Oracle (see Who we share it with).
We never sell this data, use it for advertising, or use it to develop, improve or train AI models.
AptCoach's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
To stop it, disconnect Google in Settings, Calendar, which also deletes the Google events and tasks AptCoach copied, or remove AptCoach's access in your Google Account.

How we measure use

We use PostHog, in the EU, to see how coaches and visitors use the web workspace and this website, for example which pages people open, which buttons they press, and where they give up. This helps us find what is confusing and fix it.

We record pages opened, buttons pressed and where on the page, scrolling, and the device, browser and country. When a coach is signed in, this is linked to their account by an ID number, not their name or email.
When a coach signs up, their account keeps which of our links they came through, such as a partner's link or one of our social media posts, so we can see which links work.
We may record a replay of how a page was used. Every word, typed entry and picture is hidden in it, so it shows where someone clicked and scrolled but not what they read or wrote.
Nothing about a coach's clients is sent. Names, email addresses, phone numbers and longer text are removed in your browser before anything is sent.
Your IP address is not kept, and we do not use cookies for this. On this website (aptcoach.io), a random ID is kept in your browser's storage so that someone who comes back is counted once rather than every day. It is not linked to your name or email, and it is used only for our own statistics. In the web workspace, nothing is stored on your device for this.
To stop your visits to aptcoach.io being counted, open aptcoach.io/?count=off in that browser (aptcoach.io/?count=on counts them again). If your browser sends Global Privacy Control or Do Not Track, your visits are never counted.

To be left out, email support@aptcoach.io.

Our legal bases

Contract: to provide the service you signed up for and to take payments for it.
Explicit consent: for body and health information you choose to record or share, and for push notifications. You can withdraw consent at any time by deleting that information or turning notifications off.
Legitimate interests: to keep the service secure and reliable, and to understand how AptCoach is used so we can improve it. You can object to this at any time.
Legal obligation: where the law requires us to keep or share information, such as payment records.

Your coach or client sees the records you share with each other. Apart from that, we use service providers who process data only on our instructions:

Supabase, for our database, sign-in and file storage, held in the EU (Ireland).
Netlify, for hosting the web workspace and this website.
Stripe, for payments. When a client pays a coach, the payment goes through the coach's own Stripe account.
PostHog, for measuring how AptCoach is used.
Google, for signing in with Google, Google Calendar sync, the video links for check-in calls, and delivering notifications to Android phones (Firebase Cloud Messaging).
Expo, for sending app notifications.
Resend, for sending AptCoach's emails: booking confirmations, updates you have not seen in the app, and password resets. It receives the email address and what the email says.
Anthropic, whose AI model Claude is behind Oracle and check-in call summaries. It receives what a coach asks Oracle, the records Oracle needs to answer (which can include a client's steps and sleep from Health Connect or Apple Health), and call transcripts to summarise. Anthropic does not use any of it to train its models.
MeetStream, for the notetaker that joins check-in calls. It keeps the recording for up to 72 hours.
Groq, for turning a coach's spoken questions to Oracle into text in browsers that cannot do it themselves. Nothing is kept.
Tavily, the web search Oracle uses when a coach's question needs something from the web, such as UK guidance or research. It receives only the words searched for and the addresses of public pages to read. AptCoach blocks any search that contains a client's full name, email address or phone number.
Giphy, for searching GIFs in messages. It receives the words you search for.
YouTube, which plays exercise demonstration videos, in its privacy-enhanced mode.
Mr Bite, only if a client chooses to link it.

We may also share information if the law requires it, or to protect someone's safety.

International transfers

Some of our providers process data outside the UK, including in the United States (among them Stripe, Google, Netlify, Expo, Resend, MeetStream, Groq, Tavily, Giphy and Anthropic). Where a country is not covered by UK adequacy regulations, we rely on approved safeguards such as the UK International Data Transfer Agreement or Addendum.

How long we keep it

We keep your data while your account is open.
If a client stops working with a coach, the coach keeps the records made while they worked together, unless the client asks for them to be deleted.
Check-in call recordings are deleted by MeetStream within 72 hours. The transcript and summary stay with the check-in until the coach deletes it.
Page replays are kept for 30 days, and records of pages and clicks for up to 12 months.
When you delete your account, we delete your data within 30 days. Copies in our backups are removed within a further 30 days.
We keep anything the law requires us to keep, such as payment records, for as long as it requires.

To delete your account, see Delete your account.

Your rights

You have the right to access your data, correct it, delete it, restrict or object to how we use it, receive a copy in a portable format, and withdraw consent. To use any of these rights, email support@aptcoach.io. We reply within one month.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to put it right first.

Cookies and storage

We do not use advertising or analytics cookies. The app keeps what it needs to work in your browser or on your phone, such as keeping you signed in, your settings and the screens you opened last, so they open quickly. This website keeps one random visitor ID in your browser's storage to count returning visitors, as described in How we measure use, and you can turn it off there.

Security

Your data is held in the EU (Ireland) by Supabase, whose security is independently audited to SOC 2 Type 2 and certified to ISO 27001.
It is encrypted in transit and at rest.
Access rules in our database mean coaches and clients can only see the records that belong to them.
Payments are handled by Stripe, so card details never reach us.
The AI provider behind Oracle and call summaries does not use what it receives to train its models.

Children

AptCoach is not intended for anyone under 16.

Changes to this policy

If we change this policy, we will update the date at the top, and tell you in the app if the change is significant.