Privacy Policy

1. Introduction

Welcome to ClearGym. We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our gym management platform.

ClearGym is a SaaS platform that enables gym owners to manage their facilities, members, payments, and communications. We process personal data on behalf of gym operators (our customers) and for members of those gyms.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, phone number, and password when you register
• Organisation Information: Gym name, address, contact details, and business information
• Payment Information: Payment details processed securely through Stripe (we do not store full card details)
• Member Health Data: PAR-Q responses and medical conditions, injuries, medications and allergies (encrypted using AES-256), and liability waiver signatures
• Communications: Messages, emails, and support requests you send to us

2.2 Automatically Collected Information

• Usage Data: Pages visited, features used, time spent, and interaction patterns
• Device Information: IP address, browser type, operating system, and device identifiers
• Cookies: Session cookies for authentication and functionality (see Section 7)

3. How We Use Your Information

We use collected information for:

• Service Delivery: Providing and maintaining the ClearGym platform
• Payment Processing: Processing platform subscriptions and member payments via Stripe
• Communications: Sending transactional emails, notifications, and support responses
• Security: Protecting against fraud, unauthorised access, and security threats
• Compliance: Meeting legal obligations including GDPR, data protection laws, and tax requirements
• Service Improvement: Analyzing usage patterns to improve features and user experience
• AI-Generated Training Plans: Where trainers use the AI training plan feature, the member's age range (for example, 60-69), experience level, the equipment available and the trainer's written instructions are sent to Google's Gemini AI service, through our own Cloudflare Worker, to generate a draft training plan. No health or medical information, PAR-Q answers or names are sent. This data is used solely to produce the plan.
• Marketing: Sending promotional emails (with your consent, which you can withdraw anytime)

3.1 Who Is Responsible for Member Data, and on What Basis

Each gym is the controller of its members' personal data, and ClearGym processes that data on the gym's behalf as its processor. Gyms collect member details to run memberships, bookings and payments under their contract with the member.

Health information (PAR-Q answers, medical conditions, injuries, medications and allergies) is special category data. Gyms collect it with the member's explicit consent (UK GDPR Article 9(2)(a)), which members give on the health screening form after reading how it is used. We record when consent was given and which version of the notice was shown. Members can withdraw consent at any time by telling their gym; we delete that member's health information on the gym's instruction.

4. Data Security

We implement industry-standard security measures to protect your data:

• Encryption: Members' PAR-Q answers and medical details are encrypted using AES-256 encryption with a separate key for each gym
• Secure Transmission: All data transmitted over HTTPS/TLS protocols
• Access Controls: Role-based access controls limit data access to authorised personnel only
• Database Security: PostgreSQL databases with encrypted connections and regular backups
• Password Checks: When you choose a password, only the first five characters of its SHA-1 hash are sent to Have I Been Pwned to check it has not appeared in a known data breach. Your password itself never leaves ClearGym
• Payment Security: PCI-DSS compliant payment processing via Stripe
• Infrastructure: Hosted on secure cloud infrastructure with regular security updates

ClearGym support staff can, to fix a fault or at your request, carry out a limited set of actions on your gym's records, such as retrying a failed refund or email, resending an invitation or re-checking a member's subscription with Stripe. Each action is recorded in an internal audit log with who did it and which gym it concerned.

5. Data Sharing and Disclosure

We do not sell your personal data. We share data only in the following circumstances:

• Service Providers: Stripe (payment processing), Cloudflare (infrastructure and security), Google (Gemini AI service for training plan generation), Amazon Web Services (email delivery and backups), Sentry (error monitoring, EU region), and HOSTKEY (server hosting in Iceland, where the ClearGym database runs)
• Legal Requirements: When required by law, court order, or regulatory authority
• Business Transfers: In the event of a merger, acquisition, or sale of assets (with notice to you)
• With Your Consent: When you explicitly authorise us to share your information

6. Your Data Rights (GDPR)

Under GDPR and UK data protection laws, you have the following rights:

• Right to Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restriction: Limit how we use your data
• Right to Data Portability: Receive your data in a machine-readable format
• Right to Object: Object to processing for direct marketing or legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time (where processing is based on consent)

To exercise these rights, please contact us at privacy@cleargym.uk. We will respond within 30 days.

7. Cookies and Tracking

We use cookies for:

• Essential Cookies: Required for authentication and platform functionality (cannot be disabled)
• Session Management: Maintaining your logged-in state securely
• CSRF Protection: Preventing cross-site request forgery attacks

You can control cookies through your browser settings, but disabling essential cookies may affect platform functionality.

8. Data Retention

We retain your data for as long as necessary to provide our services and comply with legal obligations:

• Account Data: Retained while your account is active
• Financial Records: Retained for 7 years for tax and accounting purposes
• Health Data: Deleted automatically 12 months after a member's membership ends and they stop booking classes or training with their gym, unless their gym has chosen a longer period (up to 7 years) because its insurer requires it. Signed liability waivers are kept as a record of the agreement.
• Backups: Deleted data may remain in backups for up to 90 days

When a gym stops using ClearGym, we offer it an export of its members' data and then delete its members' health data within 90 days, except where retention is required by law.

We keep a log of what gym staff do in ClearGym (for example cancelling a class or deactivating a member), including the member's name and the staff member who did it, for 24 months so gyms can answer questions and settle disputes, and then delete it.

9. Third-Party Services

We integrate with third-party services that have their own privacy policies:

• Stripe: Payment processing, subscription management, and Connect accounts for gym operators (Stripe Privacy Policy (opens in a new tab))
• Cloudflare: Infrastructure and security services (Cloudflare Privacy Policy (opens in a new tab))
• Google: When a trainer generates an AI training plan, the member's age range, experience level, the equipment available, the trainer's written instructions and your gym's exercise library are sent to Google's Gemini API, through our own Cloudflare Worker, to produce the plan. No health or medical information, PAR-Q answers or names are sent. Google handles that data under its own terms (Google Privacy Policy (opens in a new tab))
• Amazon Web Services: Transactional and marketing email delivery (Amazon SES) and storage of database backups (Amazon S3) (AWS Privacy Notice (opens in a new tab))
• Sentry: Error monitoring, processed in Sentry's EU region (Germany). When something goes wrong, Sentry receives technical details of the error, such as the page address and error message. It does not receive the contents of forms you submit, your cookies or your IP address (Sentry Privacy Policy (opens in a new tab))
• HOSTKEY: Server hosting. The servers that run ClearGym and store its database, including encrypted health data, are rented from HOSTKEY (hostkey.com) and located in its Iceland data centre

We encourage you to review the privacy policies of these third parties.

10. International Data Transfers

Your data may be transferred to and processed in countries outside the UK/EEA. When we transfer data internationally, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the EU Commission
• Processing within jurisdictions with adequate data protection laws
• Encryption and security measures during transfer and storage

11. Children's Privacy

ClearGym is not intended for children under 16. We do not knowingly collect data from children under 16. If you believe we have collected data from a child under 16, please contact us immediately.

For gym members under 18, parental consent must be obtained by the gym operator before processing personal data.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on this page with a new "Last updated" date
• Sending an email notification to registered users
• Displaying an in-app notification upon login

Continued use of ClearGym after changes indicates acceptance of the updated Privacy Policy.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us:

• Email: privacy@cleargym.uk
• Support: support@cleargym.uk
• Data Protection Officer: dpo@cleargym.uk

14. Supervisory Authority

If you are located in the UK/EEA and believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with your local data protection authority:

• UK: Information Commissioner's Office (ICO) - ico.org.uk (opens in a new tab)