PRIVACY

Privacy notice

Version 2026-08-20-v1 · Effective 20 August 2026

Liam Robbert David Smit, sole trader, ABN 78 510 376 876, trading as The Built Mthd, provides online-only personal training to adults in Australia. There is no public business premises. Privacy and support requests can be sent to coach@thebltmthd.com.

Information we collect

• name, email, account, role, invitation and security information;
• training goals, programs, exercises, completed sets, repetitions, loads, estimated strength records, workout results, habits and schedules;
• check-in answers, progress and body measurements, Coach notes, and secure portal messages;
• limited health, injury or physical-limitation information you choose to provide when relevant to adapting coaching; and
• support, privacy-request, audit, rate-limit, backup and PDF-download records.

Do not provide full medical records, government identifiers or information that is not needed for coaching. The portal does not process payments and does not currently include progress photos, exercise-media uploads or accounts for minors.

Why we use it

We use information to verify access, provide and adapt online coaching, deliver programs and PDFs, record activity and progress, support secure Coach–Client conversations, respond to requests, secure and restore the service, investigate incidents and meet applicable obligations. Message bodies stay inside the protected portal and are not copied into email notification previews. We do not sell personal information or use client health information for advertising.

Consent and your choices

Health or injury information is collected only after the client completes the separate affirmative consent flow. Consent can be declined or withdrawn. If it is not active, personalised coaching and new sensitive-information collection pause, but support, access/export, correction and account-closure requests remain available.

Access and service providers

Admins may access workspace records. Coaches may access messages and other records only for assigned clients. Clients may access only their own portal records and conversation. The service uses Cloudflare for application hosting and its D1 database, Supabase for authentication, and Resend for transactional email and operational alerts. The Supabase project is configured in Sydney. Cloudflare D1 is configured with an Oceania location hint, which is not a guarantee of Australian-only storage. Resend sends from its Tokyo region and states that email metadata, logs, API records and account data are stored in the United States. These providers and their subprocessors may process limited information outside Australia. Information may also be disclosed when required or authorised by law, to address a serious safety risk where permitted, or with specific consent.

Security and incidents

The service uses authenticated access, server-side role and workspace controls, audit history, rate limits, private PDF responses, dependency checks, backups and an incident process. No online system is risk-free. Suspected privacy or security incidents are assessed promptly, contained where possible and notified when applicable law requires it.

Retention

Client coaching records, including secure messages, progress, membership and consent records are retained for 7 years after the coaching relationship ends; expired invitations and demo data for 30 days; support, privacy, audit, security and rate-limit records for 2 years; and backups for up to 30 days. Records are then deleted or irreversibly de-identified unless a legal, safety or incident hold applies.

Requests and complaints

You may request access, correction, export, consent withdrawal, account closure or deletion by emailing coach@thebltmthd.com. We verify identity, respond initially within 24 hours for privacy concerns, acknowledge closure within 2 business days and aim to complete closure within 30 calendar days where legally permitted. If a concern is unresolved, you may contact the Office of the Australian Information Commissioner where it has jurisdiction.

Changes

We version this notice. Material changes to sensitive-information purposes, disclosures or consent require notice and renewed consent where applicable.