Privacy Notice

Depending on how you use the service, we may collect:

• name, contact details, date of birth and emergency-contact details;
• consultation answers, goals, training history and availability;
• health, injury, medication and exercise-capacity information you choose to provide;
• training plans, workout results, routes, equipment, session feedback, focus blocks, reviews, calls, messages and files;
• food, nutrition, hydration and energy entries, including optional meal photographs;
• account, authentication and security information;
• signed agreements and records of acceptance; and
• billing status and Stripe identifiers. Full card and bank details are handled by Stripe and are not stored in the Shea Kerry app.

• Steps before and performance of a contract: consultations, onboarding, personalised coaching, communication, call booking and billing administration.
• Legal obligations: tax, accounting, consumer-law and record-keeping requirements.
• Legitimate interests: running and improving the service, keeping the portal secure, resolving complaints and establishing or defending legal claims.
• Consent: where we ask for an optional choice or permission that can be withdrawn.

Health information is special-category personal data. We use it only where it is relevant to providing safer, appropriately adapted coaching.

Our Article 6 basis is normally that the processing is necessary to provide the coaching service you requested. Our Article 9 condition is your explicit consent. You can withdraw that consent by emailing us. Withdrawal does not affect earlier lawful use, but it may mean we cannot safely provide some or all coaching services.

We share only what is reasonably necessary with service providers that help deliver the service, including:

• Supabase for the application database and authentication;
• Vercel for application hosting;
• Resend for transactional email;
• Stripe for payment-method setup, subscriptions and payment records;
• FatSecret when you choose to search its food database;
• Wger when Shea chooses to add an exercise from its library; and
• Strava only when you connect your account and explicitly choose an activity to import.

We may also disclose information to professional advisers, insurers, regulators or law-enforcement bodies where reasonably necessary or legally required, or in an emergency involving a serious risk of harm.

Some suppliers may process information outside the UK. Where this happens, we rely on the supplier's recognised transfer mechanism and contractual safeguards, such as UK adequacy regulations or the UK International Data Transfer Agreement/addendum, as applicable.

GPX and FIT activity files and optional meal photographs are stored privately. They are available only to the applicable client and their assigned coach through time-limited protected links.

If you connect Strava, access and refresh tokens are encrypted in restricted server-side storage. Activities are never matched or attached automatically: you choose each activity. Strava-derived activity data is visible only to you in the portal and is deleted within seven days. Disconnecting removes stored credentials, cached activities and Strava attachments. Portal results you entered yourself remain.

Food and exercise searches send only the search terms needed to the configured provider. The portal stores the selected item, its source and the snapshot needed for your diary or programme rather than copying an entire provider database.

• Unsuccessful consultation enquiries are normally kept for up to 12 months after the last contact.
• Active coaching records are kept while coaching is provided and are normally retained for up to six years afterwards where needed for contractual, safeguarding or legal-claims purposes.
• Signed agreements and relevant financial records are normally retained for six years after the applicable relationship or accounting period.
• Health and training information is reviewed and deleted or anonymised sooner where it is no longer reasonably required.
• Disconnected Strava credentials and Strava-derived activity data are deleted. Transient Strava activity data is otherwise deleted within seven days. Private GPX/FIT files and meal photographs are removed when their associated records are deleted, subject to backups and legal retention requirements.

Depending on the circumstances, you may have rights to access, correct, erase or restrict your information; object to certain uses; receive portable information; and withdraw consent.

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.