Privacy Policy

Last updated 14 August 2026

This policy explains what personal information Marshall Coaching collects about you, why we collect it, who we share it with and what you can ask us to do with it. It is written to be read, not to be got past.

1. Who we are

Marshall Coaching is a personal coaching service operated by Joseph Marshall. For the purposes of the UK General Data Protection Regulation and the Data Protection Act 2018, Joseph Marshall is the data controller for the information described here. That means we decide what is collected and why, and we are accountable for it.

You can reach us about anything on this page at joe.marshall18@gmail.com.

This policy covers the Marshall Coaching website at marshallcoaching.co.uk and the coaching application at marshallcoaching.co.uk/app.

2. What we collect

Information you give us

• Your name, email address and date of birth, when you create an account.
• Body measurements, including bodyweight and, where you record them, girth measurements.
• Training logs: the sessions you complete, the loads you lift, the repetitions you perform and any notes you add.
• Daily check-in data: calories, steps, cardio, sleep hours and duration, how you rated your sleep, recovery, appetite and training quality, supplements taken, and anything you write in the notes.
• Progress photographs, if you choose to upload them.
• Messages and check-in text you send to your coach through the app.

Information we collect automatically

• Basic technical information needed to serve the site and keep it secure, including your IP address and browser type, held in our hosting and database provider's logs.
• If you turn on reminders, a push notification subscription for your device. This identifies the browser on that device, not you personally.

Information from other services

Only if you connect them yourself. See section 5.

What we do not collect

We do not collect your payment card details. Payments are handled by Stripe, and your card number is given to them and never reaches us. We do not use analytics, advertising or social media tracking of any kind, so we do not collect a record of what you look at.

3. Why we use it, and our lawful basis

UK data protection law requires us to have a specific legal reason for every use. Ours are these.

• To deliver the coaching you have paid for. Writing your programme, setting your targets, reviewing your adherence and replying to you. Lawful basis: performance of our contract with you.
• To run your account and take payment. Signing you in, managing your subscription, sending receipts. Lawful basis: performance of our contract with you.
• To send you the service emails and reminders you have asked for. Lawful basis: performance of our contract, and your consent for optional reminders, which you can switch off at any time.
• To handle your health information and progress photographs. Lawful basis: your explicit consent. See section 4.
• To keep the service secure and working. Diagnosing faults, preventing abuse. Lawful basis: our legitimate interests in operating a service that works and is not misused.
• To meet our legal obligations. Keeping financial records for the period tax law requires. Lawful basis: legal obligation.

We do not sell your information, and we do not use it to train anyone's advertising, profiling or machine learning systems.

4. Health information and photographs

Bodyweight, sleep, recovery, injury notes and progress photographs are information about your physical health. UK law treats this as a special category of personal data and holds it to a higher standard than an email address.

Progress photographs are stored in a private area of our file storage that is not publicly reachable and cannot be found by a search engine. They are visible to you and to your assigned coach and to nobody else. They are never used in marketing, on social media, in testimonials or anywhere public without your separate, specific, written permission, and you are free to refuse without it affecting your coaching. You can delete a photograph from the app yourself, and you can ask us to delete all of them at once.

Withdrawing consent for health information means we can no longer coach you, because there is no version of this service that works without knowing what you weigh and how you are training. If you withdraw it we will tell you plainly what that means for your subscription before anything is deleted.

5. Connected apps and devices

The app can connect to three outside services so that data you already record elsewhere appears in your check-in without being typed in twice. All three are optional, all three are off unless you switch them on, and each one is connected separately.

• Withings. Reads your bodyweight, and your steps and sleep if you have a Withings device that records them.
• Oura. Reads your daily step total and how long you slept. We request only the permission needed for those two figures. We do not ask for, and cannot see, your Oura email address, age, height or self-reported weight.
• FatSecret. Reads the daily calorie total from your food diary. We do not receive the individual foods.

Connecting one of these sends you to that company's own sign-in page. Your password for that service is entered there and is never seen by us. What we store is an access token, which is a key that lets our server ask for the specific data listed above and nothing else. Those tokens are held in our database and are readable only by our server, not by the app running in your browser.

You can disconnect any of them from Settings at any time. Disconnecting stops all further syncing immediately. Figures already written into your log stay there, because they are part of your coaching history, and you can ask us to remove them.

Each of those companies has its own privacy policy governing the data they hold about you, and this policy does not cover it.

6. Who we share it with

We do not sell, rent or trade your information. We do use a small number of specialist companies to run the service. They process your information on our written instructions, for us and for nobody else. They are:

• Supabase. Our database, sign-in system and file storage. This is where your account, your logs and your photographs are held.
• Netlify. Hosts the website and the app itself.
• Stripe. Takes payment and manages your subscription. Stripe holds your card details; we do not.
• Resend. Sends our service emails, such as reminders and account messages.
• Apple and Google. If you turn on push notifications, the notification is delivered through the push service built into your device's browser. The message content passes through them.
• YouTube, operated by Google. Exercise demonstration videos are hosted there and embedded in the app in privacy-enhanced mode, which means YouTube does not set tracking cookies unless you play the video.
• The USDA FoodData Central and Open Food Facts databases. When you search for a food, the words you typed are sent to look it up. Nothing identifying you is sent with the search.
• Withings, Oura and FatSecret. Only if you connect them, and only as described in section 5.

We will also disclose information if the law requires it, for example in response to a valid court order, or to establish or defend a legal claim.

If the coaching business is ever sold or transferred, your information may transfer with it. You would be told before that happened and it would not change what this policy allows.

7. Where it is stored

Your information is held on servers operated by the providers named in section 6. Several of them are companies based in the United States, so some of your information is transferred outside the United Kingdom.

Where that happens, the transfer is covered by the safeguards UK law requires, which for these providers means the UK International Data Transfer Addendum to the European Commission's standard contractual clauses. In plain terms, they are contractually bound to protect your information to the standard UK law demands, wherever the servers sit.

8. How long we keep it

• While you are a client, and for twelve months after your last subscription ends. Your account, logs, measurements and coaching history. Twelve months exists because clients commonly come back, and starting again from nothing loses the context that makes the coaching work. Tell us to delete it sooner and we will.
• Progress photographs. Deleted when you delete them, when you delete your account, or on request. Otherwise they follow the twelve month rule above.
• Financial and transaction records. Six years from the end of the tax year they relate to, because UK tax law requires it. This is the one category we cannot delete on request.
• Connection tokens for Withings, Oura and FatSecret. Deleted immediately when you disconnect the service or delete your account.
• Technical and security logs. Kept for a short period by our hosting and database providers under their own retention schedules.

When we delete an account we delete the underlying records, not just your access to them.

9. Your rights

Under UK data protection law you have the following rights, free of charge, and we will respond within one month.

• Access. Ask for a copy of everything we hold about you.
• Rectification. Have anything inaccurate corrected. Most of it you can correct yourself in the app.
• Erasure. Ask us to delete what we hold, subject to the financial records above.
• Restriction. Ask us to stop using it while a dispute about it is resolved.
• Portability. Ask for your information in a common machine-readable format, or ask us to send it to another service.
• Objection. Object to any use we have justified on the basis of our legitimate interests.
• Withdrawal of consent. Withdraw consent for anything we do on that basis, including health information, photographs and connected devices.

To use any of these, email joe.marshall18@gmail.com. We may need to check you are who you say you are before we act, which protects you rather than us.

10. Cookies and tracking

The public website sets no cookies at all and loads nothing from any third party. There is no analytics script, no advertising pixel, no social media tag and no font loaded from someone else's server.

The app stores a sign-in token in your browser's local storage so you are not made to sign in on every visit, and it installs a service worker so it can behave like an app on your phone. Neither is used to track you, and neither leaves your device except to talk to our own database. Clearing your browser data removes both and signs you out.

11. Age

Marshall Coaching is for adults. The service is not offered to anyone under 18 and we do not knowingly collect information about children. If you believe a child has given us information, tell us and we will delete it.

12. Changes to this policy

If we change this policy we will change the date at the top. Where a change materially affects how your information is used, we will tell current clients by email rather than leaving it to be discovered.

13. Contact and complaints

Any question about this policy, or any request under section 9, goes to joe.marshall18@gmail.com. Ask first, please, because most things are resolved in a message.

If you are not satisfied with how we have handled it, you have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. Complaining to them does not cost anything and does not require you to have spoken to us first.