Privacy Policy

1. Who we are

Trainerhood is software that gyms, personal training studios and coaches (we call them all "gyms") use to run their business: a coach portal, a member app in the gym's own branding, messaging, bookings, forms, phone calls, social media and enquiry handling.

Trainerhood is operated by RIPPD FIT PTY LTD (ABN 36 690 842 043, ACN 690 842 043), an Australian company, trading as Trainerhood. The same company also runs Rippd Fit, a training studio in Parramatta, which is one of the gyms that uses Trainerhood. In this policy, "Trainerhood", "we", "us" and "our" mean RIPPD FIT PTY LTD acting as Trainerhood.

We follow the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Because gyms on Trainerhood hold health information, we treat ourselves as covered by the Act whatever our turnover.

2. Our two roles

We handle personal information in two different ways. It helps to know which one applies to you.

On behalf of a gym. When a gym uses Trainerhood, the information about its members, clients, leads, callers, and the people who message or comment on its social media accounts, is held for that gym. The gym decides what to collect and why, and the gym is the business you are dealing with. We store and process that information to provide Trainerhood to the gym, under our agreement with the gym and this policy. We do not use it for our own marketing, we do not share it with other gyms, and we never sell it. Your gym has its own privacy policy, and you can ask your gym, or us, about your information.

For ourselves. For gym owners and staff who hold Trainerhood accounts, people who enquire about Trainerhood, and visitors to trainerhood.com, we decide what we collect and why.

3. What we collect and why

3.1 Gym owners and staff

What we collect: your name, email, mobile number, role and permissions; your business's name, legal name, ABN, address and time zone; billing details (card numbers are held by our payment provider, not by us); the settings you choose; and a record of important actions you take in the portal, such as approving an AI reply, moving an enquiry or changing a setting.

If you connect Facebook or Instagram, we receive the name and id of each Facebook Page and Instagram account you connect and the Instagram account's profile picture, and through one older connection screen we also receive your own Facebook name, profile picture and id. If you connect your gym's LinkedIn Page (once LinkedIn approves it), we receive the Page's name and id, and the name and LinkedIn id of the person who connected it. If you connect Google Business Profile or YouTube, we receive the business profile or channel name and id, and the channel's picture. If you use the phone features, we hold your call routing details, such as your extension and, if you choose, the mobile number calls forward to. If your gym creates a custom AI voice, the voice sample you record is sent through our servers to ElevenLabs, using your gym's own ElevenLabs account, and we keep only the voice's name and ElevenLabs id, not the recording.

Why: to create and run your account, keep Trainerhood secure, bill your gym, give you support, keep an audit trail your gym can rely on, and tell you about changes to the service.

3.2 Gym members and clients

What we collect, from you or your gym:

• Contact and profile: name, email, mobile number, date of birth, sex, location, and your membership and booking history.
• Health and fitness: pre-exercise health screening answers and any clearance letter; injuries and notes your coach records; training programs and workouts you log; body measurements; progress photos; nutrition, hydration, habits and goals; and check-in answers.
• From your phone, only if you allow it: steps, distance, active energy, heart rate, resting heart rate, blood pressure, sleep, weight and body fat from Apple Health or Health Connect (read only, the app never writes back); body composition readings from a supported smart scale, calculated on your phone; and body composition readings from Withings if you connect a Withings account.
• Content: messages with your coach, voice messages, photos, videos, documents, food photos and descriptions you submit for logging, posture photos and exercise videos your coach asks AI to review, form answers and signatures, and, if your gym holds video consultations through Google Meet, the meeting transcript and an AI summary of it.
• Device: device type, app version, push notification token and crash diagnostics.
• Payments: what you paid and when, through your gym's payment provider. We never store full card numbers.

If your gym moves to Trainerhood from another coaching app, we copy your gym's active client records from that app when your gym asks us to, using access your gym gives us, and we do not send your information back to that app.

Why: so your gym can coach you, build and adjust your training and nutrition plans, message you, take bookings and payments, and check you are ready to train safely. Some features use AI, for example estimating the food in a photo you take, or drafting a program your coach reviews.

3.3 Leads: people who enquire with a gym

When you contact a gym that uses Trainerhood, whether through its website form, website chat, booking page, a promotion link or QR code, a Facebook, Instagram, LinkedIn or Google ad form, a text, a phone call, a visit, or a social media message, we record for that gym: your name and the contact details you gave, what you asked about, where the enquiry came from, the messages and calls between you and the gym, notes staff add, and where your enquiry is up to.

Consent records. We also record what you agreed to (for example "call and text me about this enquiry", or "send me offers and news"), the exact words you were shown, when and how you agreed, and any time you asked the gym to stop. We keep these so the gym contacts you only in the way you agreed, and can show that it did.

Where did you get my details? You can ask the gym, or us, and we will tell you where your details came from.

Ad forms. Meta and LinkedIn only let apps download a lead for a limited time after the form is filled in (reported as about 90 days). So when a gym connects its ad account, we copy each lead into the gym's records as it arrives.

3.4 People who message or comment on a gym's social media

You might never be a customer of the gym. If a gym has connected its Facebook Page, Instagram professional account, LinkedIn Page or Google Business Profile to Trainerhood, and you send it a message, comment on its posts, mention it in a story or leave it a review, we receive and store for that gym:

• your name or username, and your profile picture, as the platform shares them, plus the platform's id for you;
• the text of your message, comment or review, any photo or video you sent, the star rating (for reviews), and the time;
• the gym's replies to you.

We use this only so the gym can read and answer you from one inbox, see your conversation history, and, if the gym chooses, have AI draft or send a reply (section 5). We do not use it to advertise to you, and we do not combine it with information held for other gyms.

To ask for this information to be deleted, see section 13 and trainerhood.com/data-deletion.

3.5 Callers

When you call a gym's Trainerhood phone number, or a gym calls you from it, we record the phone numbers, the time and length of the call, who answered, any voicemail you leave, and, where the call is recorded, the recording and a written transcript. Section 6 explains how recording works.

3.6 Visitors to trainerhood.com and people enquiring about Trainerhood

We collect the pages you visit, basic device and browser details, and anything you send us, such as your name and email if you email us to ask for a demo. Section 10 explains cookies and analytics.

4. Social media connections

A gym can connect its own social media accounts to Trainerhood. This section explains what we receive from each service and what we do with it. We only ask for the permissions a feature needs, and a gym can disconnect at any time.

Facebook and Instagram (Meta). When a gym admin connects through Facebook Login, we receive the Facebook Pages and Instagram professional accounts the admin chooses to connect; through one older connection screen, the admin's name, profile picture and Facebook id; and permission to publish the gym's posts, read and reply to messages sent to those accounts, read, reply to, hide and like comments on them, and, where the gym runs lead ads, receive the answers people give in its lead forms. We use this to publish the gym's posts, show messages and comments in the gym's inbox, send the gym's replies, and put ad enquiries on the gym's lead board.

LinkedIn. Once LinkedIn approves the features, a gym can connect its LinkedIn Page to publish posts, read and reply to comments on those posts (which show the commenter's name and profile picture), and receive answers to its LinkedIn Lead Gen Forms. LinkedIn limits how long apps may keep this information, and we keep it only within those limits. If LinkedIn tells us a member has deleted a lead, we delete our copy. We never use LinkedIn data we receive through a LinkedIn connection for advertising or profiling.

Google Business Profile. When a gym owner connects through Google sign-in, we receive the gym's business profile details and its reviews (the reviewer's name and photo as Google shows them, the rating, the review text and the time), along with the gym's replies and posts. We use this to show reviews in the gym's inbox and to publish the gym's replies and posts. Google lets us keep review content for no more than 30 days, so after 30 days we delete the reviewer's name, photo and review text and keep only the rating, the dates and the gym's own reply. Trainerhood's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

YouTube. If a gym connects a YouTube channel to publish videos, Trainerhood uses YouTube API Services, and the YouTube Terms of Service and the Google Privacy Policy apply. We receive the channel's name, id and picture, and permission to upload videos to it and manage its comments, and use them only to publish the videos, and the first comment on each, that the gym chooses. We do not share YouTube data with anyone else. You can turn off Trainerhood's access at any time in Trainerhood, and remove it completely on Google's security settings page at myaccount.google.com/permissions.

WhatsApp. If a gym uses WhatsApp through Trainerhood, messages are carried by Twilio and Meta.

What we do not do with social media data: sell it, use it for advertising, or share it between gyms. When a gym turns off or removes an account, we stop receiving new messages and comments from it. What we already stored stays in the gym's records unless you ask us to delete it, except a Google reviewer's name, photo and review text, which we keep for no more than 30 days.

5. AI that drafts or sends replies for a gym

Trainerhood includes an AI assistant that a gym can use to help with messages, comments, reviews, texts, emails and phone calls. For each channel, and for each member if it wishes, the gym chooses one of three settings: off, where the AI does nothing; drafts, where the AI writes a suggested reply and a person at the gym reads it, can change it and decides whether to send it; or automatic, where the AI replies by itself and says that it is the gym's AI assistant. A gym can limit automatic replies to certain hours, for example outside its opening hours.

How it works. The AI reads your message, the recent conversation, and the gym's own information (such as its prices, timetable and answers to common questions) and writes a reply. It is not allowed to give medical advice. Messages about pain, injury, a medical condition or medication, feeling unwell or distressed, billing or contracts, or anything it is not confident about go to a person at the gym instead of being answered automatically.

How you are told when AI is involved:

• Phone calls. When a gym switches on its AI Lead caller, the gym's AI assistant can phone people who ticked a box agreeing to calls about their enquiry, and can answer calls to the gym's marketing number. Every such call starts by saying it is the gym's AI assistant, and the AI says it is not a human if you ask. Where the law lets us simply announce it, the call also says it is recorded. Where we cannot tell, or the law needs your consent, the AI asks you first and records only after a clear yes. When the AI phones you, that notice or question also says a coach may listen in, and a coach can listen in only if you heard it and, where you were asked, said yes.
• Replies the AI sends automatically. On Facebook and Instagram direct messages, texts, WhatsApp and email, the AI's first automatic message in a conversation says it is the gym's AI assistant. Each automatic reply to a comment or a Google review says so too. In the gym's app, every automatic reply is marked as written by your coach's AI assistant. Automatic replies are never sent to a 1, 2 or 3 star Google review.
• Replies a person sends. When a gym uses drafts, a person at the gym reads each reply before it is sent and is responsible for it, so these replies are sent in the name of the gym or your coach and are not labelled. If you would rather deal only with a person, ask your gym and it can switch the AI off for you.
• A gym's website chat. The chat window says you are talking with the gym's AI assistant, and every AI message is labelled. It answers only from the gym's own information, and questions about health, injuries, payments or anything it is not sure about go to a person at the gym. The gym keeps your messages for 30 days if you leave no contact details, or up to 12 months if you do, unless you or the gym ask for them to be deleted sooner.

AI providers. AI features are processed by Anthropic (Claude) and Google (Gemini). On AI phone calls, Twilio turns speech into text and the AI's replies back into speech, and Anthropic (Claude) writes the replies. Custom voices are processed by ElevenLabs when a gym connects it. These providers process each request to give us the result and, under their business terms, do not use it to train their models. We keep copies of some AI drafts that coaches approve or change, such as message replies, check-in feedback and training programs, with client ids replaced by codes, and use them to develop Trainerhood's own AI models.

Automated decisions

Some decisions are made, or partly made, by software. This section says which.

Decisions made by software alone:

• Pausing first bookings after a health screening answer. If a new member answers yes to a health screening question, software pauses their first session and trial bookings and any program until someone at the gym who is allowed to see health information reviews it. Signing up still completes, and only a person can lift the pause.
• Moving an enquiry along the board. Software moves an enquiry when something happens: to "Trial booked" when a booking is made, to "Came in" when attendance is marked, to "Joined" when a paid plan starts, back to "Talking" when you reply or miss a session, and to "Not now" when the last follow-up gets no reply, and each move records a reason the gym can see.
• Moving an enquiry to "Not now". If a gym has chosen to let the AI act alone, the AI may move an enquiry to "Not now" or to the spam list. It never moves anyone forward and never marks anyone as having joined. It always records a one-line reason, which the gym can see and undo for 24 hours. If you reply STOP, your enquiry moves to "Not now" automatically.

Decisions a person makes with help from software:

• The AI suggests stage moves and drafts replies for staff to approve.
• The AI decides whether a message can be answered automatically or must go to a person, for example a message about pain or a medical condition.
• The AI reads a new member's health screening answers and gives the coach a risk level and whether medical clearance may be needed.

What the software uses: your health screening answers; your enquiry, where it came from, and the messages, calls, bookings, attendance and payments between you and the gym; whether you agreed to be contacted or asked to stop; and the gym's own settings.

No automated process refuses you a membership. If you want a person to review something that happened automatically, ask your gym or email us.

6. Calls, recordings and transcripts

Gyms make and receive phone calls through Trainerhood using Twilio.

• Recording is announced first. If a gym records calls, you hear that at the start of the call, before your conversation is recorded. When you call a gym, you can say "don't record me" and you are still put through, without recording. When a gym's AI assistant calls you, it tells you at the start that it is an AI. It then says the call is recorded and that a coach may listen in, or, where it needs your yes, asks first, and you can ask it to stop and end the call at any time. For callers in the ACT, and where we cannot tell which state you are calling from and the gym has chosen the stricter setting, we ask for your yes first and do not record, or let a coach listen in, without it.
• If you say no, the recording is deleted. If any recording was made before your answer registered, we delete it from Twilio as soon as it is ready and never keep a playable copy.
• Transcripts. Where a call is recorded with consent, it may be turned into a written transcript, and later a short summary, so the gym can follow up. We never transcribe a call you asked us not to record. When an AI assistant is talking with you, it has to turn what you say into text to answer you, and a short summary of that conversation may be kept for the gym even when the call is not recorded.
• Voicemail. A voicemail you leave is recorded and kept for the gym. Your choice about recording the call and your voicemail are kept separately.
• Who can listen. Staff at that gym who have access to calls. Recordings are played through Trainerhood and stored with Twilio in the United States. On a live AI call, a coach at the gym may listen in only if you were told first or said yes when asked. If you said no, or were not told, nobody can listen to your call live.
• Calls from an AI assistant. A gym's AI assistant only phones people who ticked a box agreeing to calls about their enquiry. It calls only during permitted calling hours for where you are, says at the start who it is and which gym it is calling for. Where the law lets it simply announce this, it says the call is recorded and that a coach may listen in. Where it cannot tell, or the law needs your consent, it asks first, and records and lets a coach listen in only after a clear yes. It ends the call as soon as you ask. If it reaches your voicemail, it leaves a short message naming the gym and a number to call back. If you ask, it tells you how the gym got your number. If you ask it to stop, it ends the call and the gym's AI does not call or text you again.

7. Texts, emails and how to opt out

Gyms send texts (through Twilio) and emails (through Resend) from Trainerhood. Some messages are about something you asked for, such as a booking confirmation or a reminder. Others are follow-ups or offers, which a gym may send only if you agreed to them. Every message says which gym it is from.

• Texts: reply STOP to any text sent from a phone number and that gym's texts stop.
• Emails: use the unsubscribe link in any marketing email. You do not need to sign in or give any other details.
• Calls: tell the caller you do not want to be called again.
• Any time: ask your gym, or email privacy@trainerhood.com.

We act on every unsubscribe and STOP straight away, and always within 5 business days, and unsubscribe links keep working for at least 30 days after a message is sent.

Opting out of marketing does not stop messages you still need, such as a booking confirmation, unless you ask us to stop those too.

8. Health information

Health information is sensitive information under the Privacy Act, and we treat it that way.

• A gym asks for health screening answers only with your agreement, and only to decide whether you are ready to train and what to look out for.
• Who can see it. Your screening answers and any clearance details are for the gym owner and the coach responsible for you. Other staff see only that a booking is paused, not why.
• Health details are never used for marketing, never put in push notification text, and never sold. Coaching features such as program and nutrition planning use the health and training information needed to build your plan.
• Apple Health, Health Connect and smart scale readings are read only with your permission and used only for the features you see. Body composition readings are bioimpedance estimates for fitness guidance, not a medical measurement.
• In the Trainerhood store apps, analytics click capture and screen recording are switched off, so health readings are not sent to analytics providers.

9. Children

Trainerhood is built for adults. A gym may set up a member account for someone under 18 only with a parent or guardian's permission, and a parent or guardian answers their health screening questions.

If you think a child's information is in Trainerhood without that permission, email privacy@trainerhood.com and we will look into it straight away.

10. Cookies, analytics and error reports

Trainerhood itself does not use advertising cookies, tracking pixels or advertising identifiers, and we do not sell data to advertisers.

• Needed for Trainerhood to work: your sign-in is kept in your browser's storage. On sign-in and password pages, and in a gym's website chat, in a web browser, a Cloudflare Turnstile bot check loads.
• Content from other services: our pages load fonts from Google Fonts and some photos from Unsplash, and exercise videos may play from YouTube or Vimeo. Those services receive your IP address and browser details when they load, under their own privacy policies.
• Product analytics (PostHog): records which pages and features are used so we can improve Trainerhood. It sets a first-party cookie and uses browser storage to recognise a returning browser. On the website and the web portal it also records which buttons and links are clicked, but not the words on them or anything you type. It does not record or replay sessions. PostHog receives your IP address when your browser connects to it, and is set not to keep it. Signed-in people are identified by an internal id, not by name or email. Click capture is switched off in the store apps, and on sign-in, password, account setup, form, booking, member check-in, agreement, unsubscribe, shopping list and website chat pages. It also runs on the public website and campaign pages Trainerhood hosts for gyms, including on a gym's own web address.
• Error reports (Sentry): when something breaks, a technical report is sent to Sentry. On the web it may include a replay of the moments before the error, and about 1 in 10 web sessions is replayed even without an error, always with all text and images hidden. Reports are linked to an internal id, not your email.
• A gym's own ad tracking on its website: a gym can choose to add its own Meta (Facebook and Instagram) Pixel or Google tag to the public website pages Trainerhood hosts for it, and only on the gym's own web address. It is off unless the gym's owner switches it on, it starts only after a visitor chooses Allow on that website, and it never runs on forms, booking pages, campaign pages, health questions, the member app, the coach portal or the store apps. When it runs, your browser sends Meta or Google the address of the page you viewed, your browser details and your IP address, for the gym's advertising, under the gym's own Meta or Google account and their privacy policies. Trainerhood does not receive what is sent. The gym decides whether to use it and explains it in its own privacy policy. You can change your choice at any time with the Ad tracking choices link at the bottom of the gym's website.

You can block cookies in your browser settings, but parts of Trainerhood, such as signing in, will not work without browser storage.

11. Service providers and overseas disclosure

We use service providers to run Trainerhood. They may use personal information only to provide their service to us. Our main database is in Sydney, Australia, but some providers are overseas. Before personal information goes to an overseas provider, we take reasonable steps, such as contract terms, to make sure it is handled consistently with the APPs.

We may also disclose personal information where the law requires or authorises it, to lessen a serious threat to someone's life, health or safety, or if our business is sold or restructured, in which case this policy continues to apply to it.

12. How long we keep information

We keep personal information only as long as we need it for the purposes in this policy, or as long as the law requires.

• Member accounts, profiles, training, nutrition, check-ins, messages, photos and health data: for as long as the gym uses Trainerhood, including after an account is deactivated. When you ask us to delete your account or specific information, we remove it from our active systems within 30 days of the request.
• Health screening and clearance records: for the period the gym sets.
• Leads and enquiries: while the gym is working on the enquiry, and until the gym deletes it or you ask us to.
• Facebook and Instagram messages and comments: while the gym uses Trainerhood, including after it disconnects the account, unless you ask us to delete them.
• Google reviews: the reviewer's name, photo and review text for no more than 30 days; the rating, the dates and the gym's own reply while the gym uses Trainerhood.
• LinkedIn: we do not receive LinkedIn comments or lead form answers yet.
• YouTube: the channel's name, id and picture, until the gym removes the connection.
• Call recordings and transcripts: until you or the gym ask us to delete them. Recordings of callers who said no are deleted straight away. Calls with a gym's AI assistant: recordings are deleted after 30 days and transcripts after 12 months; a two-sentence summary stays with the enquiry.
• Text and email content: while the gym uses Trainerhood, unless you ask us to delete it.
• Consent and opt-out records: for as long as we need them to respect your choices and to show what you agreed to. If you ask us to delete your information, we keep the record of what you agreed to and when you asked us to stop, so you are not contacted again by mistake.
• Raw data received from other services (webhooks): 14 days after we have processed it, except payment events, which are kept with billing records.
• Push notification delivery records: 90 days.
• Gym accounts that close: we delete the gym's data when the gym asks us to.
• Payment and billing records: 7 years, as Australian tax and corporations law requires.
• Encrypted backups: copies of deleted data in encrypted backups are never restored to active systems, and are removed automatically as the backups expire on their fixed rolling schedule.
• Error reports and analytics: kept by Sentry and PostHog for their standard limited periods, and looked at only as needed to fix problems and improve the service.
• Support emails: while we handle your request, and for a reasonable time afterwards as a business record.

13. Your rights: access, correction and deletion

You can ask to see the personal information Trainerhood holds about you (APP 12), to have it corrected (APP 13), or to have it deleted. You do not have to give a reason, and there is no charge.

How to ask: ask your gym, or email privacy@trainerhood.com. Tell us which gym it relates to, and the email address, phone number or social media account your information is linked to.

What happens next: we check it is really you, usually with a code sent to the email or mobile number we hold, or a message from the same social media account. We respond within 30 days. If we cannot do all of what you ask, for example because the law requires us to keep a record, we tell you why in writing and how to complain. If we do not agree to correct something, you can ask us to keep a note with it saying you believe it is wrong.

If your information is held for a gym, we usually work with that gym on your request and tell you when we have done so.

Requesting account deletion

Your member account is set up and managed by your gym, so deleting it is something we do together rather than a button in the app. You can request deletion of your account and personal data at any time: ask your coach, or email privacy@trainerhood.com from the email address on your account. We action deletion requests within 30 days.

Deletion removes your profile details, messages, photos, logged workouts and health readings from our active systems; records your coach wrote about you, such as screening forms, notes, attachments, plans and AI reports, are kept unless you ask us to delete those too. You can also ask us to delete specific information without closing your account, such as one photo, message or health reading. Limited records may be kept where the law requires it, such as payment records, and records your gym must keep for its own business remain the gym's responsibility.

If you use Facebook or Instagram

If you messaged or commented on a gym's Facebook Page or Instagram account, or connected Facebook or Instagram to Trainerhood, you can ask us to delete the information we received from Meta. Step-by-step instructions are at trainerhood.com/data-deletion.

14. Security

We protect personal information with:

• encryption in transit (HTTPS) everywhere, and storage with a provider that encrypts data at rest;
• database rules that keep every gym's data separate, so one gym cannot see another's;
• staff permissions that control what each person can do in the portal;
• regular security reviews, and fixing problems as we find them.

No system is perfectly secure. If a data breach is likely to cause serious harm, we will tell the people affected and the Office of the Australian Information Commissioner (OAIC), as the Notifiable Data Breaches scheme requires.

15. Complaints

If you are unhappy with how we have handled your personal information, email privacy@trainerhood.com and tell us what happened. We confirm we have your complaint within 5 business days, look into it, and give you our answer in writing within 30 days. If your complaint is about something a gym did, we tell you, and with your agreement we work on it with that gym.

If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner: oaic.gov.au, phone 1300 363 992.

16. Health disclaimer

Trainerhood is a software tool for gyms, coaches and their members. It does not provide medical advice, diagnosis or treatment, and it is not a substitute for professional medical care. Always talk to a qualified health professional before starting any exercise or nutrition program. Gyms and coaches are responsible for the advice they give their members.

17. Changes to this policy

We will update this policy as Trainerhood changes. The date at the top shows the latest version. If we make a significant change, we will tell gyms and members in the app or by email before it takes effect.

18. Contact us

• Privacy questions and requests: our Privacy Officer, privacy@trainerhood.com
• Legal notices: legal@trainerhood.com
• RIPPD FIT PTY LTD, trading as Trainerhood. ABN 36 690 842 043.