Privacy Policy

App: R12 Coach

Last updated: 20 October 2026

R12 Coach provides authorised coaches with client relationship, programme, session and progress tools.

Information used

• Coach/client account identifiers and contact details, invitations, permissions and relationship status.
• Programmes, exercise choices, session structures and attendance, workout records, goals, feedback, progress and coach notes.
• Nutrition or accountability entries when those features are used; some notes may reveal health information.
• Privacy/support requests and technical or audit records needed to operate and protect the service.

What it is used for

• Connect a client with an authorised coach and enforce access permissions.
• Create and deliver programmes, record sessions and review progress.
• Provide nutrition or accountability functions when selected.
• Secure accounts, resolve service issues and meet applicable legal duties.

Who decides how information is used

The legal controller depends on who provides the service and decides why the relevant records are used. R12 Digital Ltd operates the R12 Coach platform. This identifies the platform operator; it does not establish whether R12 Digital Ltd, a gym, a coach or another organisation is controller, processor or joint controller for each type of information. Those roles and any data-sharing terms still need confirmation. For gym membership, staff, attendance, induction and safety records, ask the gym or organisation that enrolled you or gave you access. For coaching records, ask the coach or organisation that arranged the coaching. For Glow Zone records, the verified website information identifies Madhouse Products and Services Limited as Glow Zone's legal operator; that fact alone does not determine its controller or processor role for each R12 activity. For Club and Glow Zone, the relevant controller and its contact details must be confirmed by the organisations providing those services.

For access, correction, erasure, objection, restriction, portability or other privacy requests, use the account-deletion route where appropriate and contact the organisation responsible for the relevant service using its published contact details. A verified general privacy contact for every R12 service still needs to be confirmed before publication.

Purposes and lawful bases

Potential Article 6 bases for this app, pending confirmation by the relevant controller: Contract where the controller is a party to the coaching service; otherwise the coach/organisation must assess legitimate interests or another basis for arranging and administering the coaching relationship. Legitimate interests may also support proportionate security and support; legal obligation applies only where a specific law requires a record. The controller must confirm and document the basis for each purpose before collecting or using information. Code and product requirements do not establish that legal decision. Consent applies only to a genuinely optional purpose where it is freely given and can be withdrawn. Do not treat a software feature or payment setup as proof of a lawful basis.

Nutrition, injury, recovery and some coaching notes can be health data. The controller must identify both an Article 6 basis and an Article 9 condition before collecting or using it. The repository does not establish a single Article 9 condition for all coach/client relationships.

Coaching access

Client information is available only through an authorised coach relationship and the app's role and organisation permissions. A coach or organisation should explain its own coaching notes, retention rules and sharing practices to clients.

Service providers and sharing

The application code uses Supabase for authentication and database services and is configured for Vercel hosting. WHOOP receives an authorisation request only if you connect that integration. Stripe, GoCardless or PayPal receives transaction information only for the relevant configured flow. Authorised gym staff, coaches or organisation administrators can access records within their assigned roles. The repository does not include executed processor agreements, the deployed vendor configuration, data-location settings or international-transfer safeguards. The responsible controller must confirm its providers, their legal roles and any transfer safeguards before this notice is published.

Retention

Records are needed while an account, membership, coaching relationship or service is active. After it ends or a deletion request is made, the responsible controller should delete or de-identify records when they are no longer needed, except records retained for a specific legal duty, unresolved payment/refund, safety matter, dispute, fraud prevention or audit. Payment and accounting evidence should be kept only for the applicable statutory period. Training, WHOOP, coaching notes, staff audit trails, age-check evidence and session/minute histories should be reviewed against the purpose and deleted when that purpose ends, subject to a documented need to retain them. The repository contains no approved durations or retention schedule; the controller must set and publish record-specific periods or criteria before launch.

Account deletion and other rights

R12 provides an authenticated account-deletion request from Account settings and at the account-deletion page. Deleting the shared R12 account may affect access to every connected R12 application. If you have a linked gym membership, recurring payment agreement, coaching agreement or other service, account deletion does not automatically cancel it; cancellation is handled separately by the organisation or provider responsible for that service. Requests are reviewed before eligible personal data and the account identity are deleted or anonymised. Records required for a documented legal, financial, safety or audit purpose may be retained with restricted access.

Under UK data-protection law, rights may include access, rectification, erasure, restriction, portability, and objection to processing based on legitimate interests. You may withdraw consent where consent is the basis, without affecting earlier lawful processing. Rights depend on the purpose and legal basis. Ask the relevant controller using the contact on your service documents; the controller may verify your identity and must respond within the statutory period. You may complain to the Information Commissioner's Office.

Security

The code implements authenticated accounts, organisation-scoped access, role/capability checks, row-level security in the database schema and server-side handling of integration credentials. Access to operational records is permission-controlled and some staff actions are audited. This describes safeguards present in source; the repository does not verify production configuration, vendor contracts or that each migration has been applied. No online service can guarantee absolute security.

Privacy contact

The repository contains no verified public privacy email, postal address or support URL for this app's controller. Use the contact details provided by the organisation that gave you access. The R12 operator and the responsible privacy contact must be confirmed before this policy is published.

Children and wellbeing

Glow Zone sunbed services are restricted to people aged 18 or over and include age/eligibility checks. Gym and coaching age rules depend on the relevant organisation. R12 training and coaching features are not medical advice and are not medical devices.

R12 Training policy · R12 Club policy · R12 Coach policy · Glow Zone policy · Terms of Use