Privacy Policy

App: R12 Training

Last updated: 20 October 2026

R12 Training lets you create a training profile, plan and record exercise, and review progress. A WHOOP connection is optional and is available only when the integration is enabled.

Information used

• Account details, including email, name, authentication and session identifiers.
• Training profile and preferences, goals, programmes, exercise selections, schedules, sets, repetitions, weights, cardio, feedback and progress history.
• Wellness or health-related details you enter or import, such as recovery, sleep, HRV, heart rate, strain, body measurements and activity.
• Privacy or account-deletion requests and technical/security records required to run the service.

What it is used for

• Create and secure your account and provide the training functions you request.
• Save workouts, prepare training suggestions and show your progress and history.
• Use recovery information to provide training context. The app is not medical advice or a medical device.
• Protect the service, respond to requests and meet applicable legal duties.

Who decides how information is used

The legal controller depends on who provides the service and decides why the relevant records are used. R12 Digital Ltd operates the R12 Training platform. This identifies the platform operator; it does not establish whether R12 Digital Ltd, a gym, a coach or another organisation is controller, processor or joint controller for each type of information. Those roles and any data-sharing terms still need confirmation. For gym membership, staff, attendance, induction and safety records, ask the gym or organisation that enrolled you or gave you access. For coaching records, ask the coach or organisation that arranged the coaching. For Glow Zone records, the verified website information identifies Madhouse Products and Services Limited as Glow Zone's legal operator; that fact alone does not determine its controller or processor role for each R12 activity. For Club and Glow Zone, the relevant controller and its contact details must be confirmed by the organisations providing those services.

For access, correction, erasure, objection, restriction, portability or other privacy requests, use the account-deletion route where appropriate and contact the organisation responsible for the relevant service using its published contact details. A verified general privacy contact for every R12 service still needs to be confirmed before publication.

Purposes and lawful bases

Potential Article 6 bases for this app, pending confirmation by the relevant controller: Contract for the account and requested training features; legitimate interests for proportionate account security and service support; legal obligation only where a specific record is required by law. The controller must confirm and document the basis for each purpose before collecting or using information. Code and product requirements do not establish that legal decision. Consent applies only to a genuinely optional purpose where it is freely given and can be withdrawn. Do not treat a software feature or payment setup as proof of a lawful basis.

Training and recovery records can be health data. In addition to an Article 6 basis, the controller must identify a valid UK GDPR Article 9 condition before processing that data. The repository does not establish that condition or show a confirmed explicit-consent flow for all health data. WHOOP's OAuth permission authorises the connection and data scopes; do not assume that alone satisfies every UK GDPR requirement.

WHOOP and health connections

R12 contains an optional WHOOP OAuth integration. When it is enabled and you connect it, R12 requests the recovery, sleep, cycle and workout scopes used by the app and may store returned recovery, sleep, strain, HRV, resting heart rate, workout and timestamp information. Disconnecting in R12 stops further syncing; you can also revoke access in WHOOP. Existing R12 records are not automatically erased when disconnected. The repository says Apple Health requires a future native bridge; the current app does not connect to Apple HealthKit. No other health provider is verified as active.

Service providers and sharing

The application code uses Supabase for authentication and database services and is configured for Vercel hosting. WHOOP receives an authorisation request only if you connect that integration. Stripe, GoCardless or PayPal receives transaction information only for the relevant configured flow. Authorised gym staff, coaches or organisation administrators can access records within their assigned roles. The repository does not include executed processor agreements, the deployed vendor configuration, data-location settings or international-transfer safeguards. The responsible controller must confirm its providers, their legal roles and any transfer safeguards before this notice is published.

Retention

Records are needed while an account, membership, coaching relationship or service is active. After it ends or a deletion request is made, the responsible controller should delete or de-identify records when they are no longer needed, except records retained for a specific legal duty, unresolved payment/refund, safety matter, dispute, fraud prevention or audit. Payment and accounting evidence should be kept only for the applicable statutory period. Training, WHOOP, coaching notes, staff audit trails, age-check evidence and session/minute histories should be reviewed against the purpose and deleted when that purpose ends, subject to a documented need to retain them. The repository contains no approved durations or retention schedule; the controller must set and publish record-specific periods or criteria before launch.

Account deletion and other rights

R12 provides an authenticated account-deletion request from Account settings and at the account-deletion page. Deleting the shared R12 account may affect access to every connected R12 application. If you have a linked gym membership, recurring payment agreement, coaching agreement or other service, account deletion does not automatically cancel it; cancellation is handled separately by the organisation or provider responsible for that service. Requests are reviewed before eligible personal data and the account identity are deleted or anonymised. Records required for a documented legal, financial, safety or audit purpose may be retained with restricted access.

Under UK data-protection law, rights may include access, rectification, erasure, restriction, portability, and objection to processing based on legitimate interests. You may withdraw consent where consent is the basis, without affecting earlier lawful processing. Rights depend on the purpose and legal basis. Ask the relevant controller using the contact on your service documents; the controller may verify your identity and must respond within the statutory period. You may complain to the Information Commissioner's Office.

Security

The code implements authenticated accounts, organisation-scoped access, role/capability checks, row-level security in the database schema and server-side handling of integration credentials. Access to operational records is permission-controlled and some staff actions are audited. This describes safeguards present in source; the repository does not verify production configuration, vendor contracts or that each migration has been applied. No online service can guarantee absolute security.

Privacy contact

The repository contains no verified public privacy email, postal address or support URL for this app's controller. Use the contact details provided by the organisation that gave you access. The R12 operator and the responsible privacy contact must be confirmed before this policy is published.

Children and wellbeing

Glow Zone sunbed services are restricted to people aged 18 or over and include age/eligibility checks. Gym and coaching age rules depend on the relevant organisation. R12 training and coaching features are not medical advice and are not medical devices.

R12 Training policy · R12 Club policy · R12 Coach policy · Glow Zone policy · Terms of Use