Two roles, and why it matters
PTToolBox is operated by James Swift, trading as PTToolBox, of Neston, Cheshire, United Kingdom. This policy uses “we” and “us” to mean the operator.
We handle two different kinds of data under two different legal roles, and the distinction runs through everything below.
- Your account. For your own details as a coach, we are the data controller: we decide what to collect and why, and this policy governs it.
- Your clients’ data. For everything you record about the people you coach, you are the controller and we are your data processor: we act on your instructions and hold that data on your behalf. The terms of that arrangement are in our Data Processing Addendum, which is the document that governs client data.
The data we hold as controller
This is the data about you, the coach.
- Account details. Your email address and password (stored hashed by our authentication provider), your display name, brand name and dashboard preferences.
- Billing identity. Handled by Stripe. We receive a customer reference, your plan and its status, never your card number.
- Usage and technical data. Request logs, IP address, browser type and timestamps, kept to run and secure the service.
Why we hold it (legal bases)
- Contract. To give you an account and provide the service you signed up for.
- Legitimate interests. To secure the service, prevent abuse, and understand how it is used, balanced against your rights.
- Legal obligation. To keep the records that tax and accounting law require.
- Consent. Where we ever ask for it explicitly; you can withdraw it at any time.
Client data and health information
The data you enter about your clients frequently includes health information: injuries, medical-screening answers, body measurements, training and nutrition records. Under UK data protection law this is a special category of personal data with extra protection.
You are the controller of that data. Before you put a client’s information into PTToolBox, you must have a lawful basis for processing it and, for health data, the client’s explicit consent. That responsibility is yours, and you confirm you have met it in our Acceptable Use Policy. We process this data only to provide the service to you, and never for our own purposes.
How AI is used
When you use an AI feature in PTToolBox, the relevant client context is sent to Anthropic’s Claude API and the result is returned to you. Anthropic does not use data sent through its API to train its models. Nothing is sent to Anthropic unless you use an AI feature.
Who else touches the data
We do not sell your data or share it for anyone else’s marketing. We use a small set of sub-processors to run the service, each bound to protect the data and to use it only as we instruct. This is the complete list.
- Google (Firebase) - Hosting and database. Stores your account, your clients, and everything you record about them — check-ins, workouts, nutrition, notes. Privacy terms.
- Anthropic (Claude API) - AI features. Receives the client context needed when you use an AI feature, and returns the result. Anthropic does not train its models on data sent through the API. Privacy terms.
- Stripe - Payments. Handles subscription payments. Card details go straight to Stripe and never reach PTToolBox. Stripe holds your billing identity, not your clients' data. Privacy terms.
- Vercel - Application hosting. Serves the application and processes request logs. Client data passes through Vercel in transit; it is stored in Firebase, not on Vercel. Privacy terms.
We may also disclose data where the law requires it, or to establish, exercise or defend legal claims.
Sending data outside the UK
Some sub-processors process data outside the United Kingdom, chiefly in the United States. Where they do, the transfer relies on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or an equivalent safeguard, so the data keeps a comparable level of protection. The location and basis for each is noted against it in our Data Processing Addendum.
How long we keep it
We keep your account data for as long as your account is open. Client data is kept until you delete it or close your account, after which it is deleted or returned as described in the Data Processing Addendum. We keep the billing and tax records the law requires us to, for as long as it requires.
Your rights
Over your own account data you have the right to:
- ask for a copy of it, and to have it corrected if it is wrong;
- ask us to delete it, or to restrict or object to how we use it;
- ask for it in a portable format;
- withdraw any consent you gave, without affecting what was done before.
To exercise any of these, email jswiftfitness@gmail.com. If a request concerns one of yourclients’ data, they should contact you, since you are its controller; we will help you answer them.
Cookies
We use only the cookies and local storage needed to keep you signed in and to run the app. We do not use advertising or third-party tracking cookies.
Age
PTToolBox is for professional coaches and is not intended for anyone under 18. The clients you coach must also be 18or over; the service is not built to hold children’s data.
Changes
If we change this policy we will update the effective date at the top, and tell you in the app or by email before a significant change takes effect.
Contact and complaints
Reach us at jswiftfitness@gmail.com, or by post at [registered business address]. We are registered with the Information Commissioner’s Office under [ICO registration number].
If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office, the UK regulator, though we would rather you told us first so we can put it right.