← Back

Privacy Policy

Last updated: 10 September 2026

1. Who we are

This Privacy Policy applies to BBL Coaching, the mobile app published on the Apple App Store by BBL Coaching (app ID com.bblcoaching.app), and to the BBL Coaching web app at app.getcoachvault.com/c/bbl.

BBL Coaching (“BBL Coaching”, “we”, “us”) is operated by Zachary Rigelsford-Lockwood, a coaching business in Australia. Zachary Rigelsford-Lockwoodis the developer named on the app's store listings and the legal entity responsible for the personal information described in this policy. You can reach us at info@bblcoaching.co.

BBL Coaching is built on the Coach Vault coaching platform, provided by Coach Vault Pty Ltd, which is why this policy is served from a Coach Vault web address. Coach Vault supplies the technology, hosting and support behind the app on our behalf and processes your information only on our instructions. It is listed as a service provider in section 4.

2. Information we collect

We collect the following types of information:

  • Account details: name, email address, date of birth, gender, height.
  • Health and fitness data: weight, body measurements, progress photos, training logs, nutrition logs, check-in responses, sleep, steps, blood pressure, blood test results (only if you choose to upload them).
  • Wearable and health app data: if you connect an Oura Ring, Apple Health, Health Connect on Android, or a similar service, we collect only the health metrics you authorise (for example steps, sleep, heart rate variability, readiness score). Data read through Apple Health or Health Connect is used solely to show you your own progress and to share it with your coach. We never use it for advertising, and we never sell it. You can withdraw access at any time from your device settings.
  • Cycle tracking (optional):if you turn on cycle tracking, we collect the period days, symptoms and notes you log, and, if you connect it, period days read from Apple Health or Health Connect. This is health information and it is only ever collected with your express consent. You choose whether your coach can see it, and what: nothing, period dates and the estimates built from them, or dates plus symptoms and notes. Sharing extends to the coaches on your coach's team who have been given access to cycle data. Whether you have set contraception, irregular or paused is never shared. Cycle data is never used for marketing, analytics, AI features or advertising. It lives only in the database that stores the rest of your account (hosted in Sydney, Australia), is never sent to any AI, analytics or marketing service, and is not read by platform support. You can stop sharing, clear a day, download your history or delete everything at any time from Settings.
  • Communication: messages you send your coach, comments on community posts, support requests.
  • Device and usage data: device type, operating system, crash logs, and basic analytics about which features you use.

3. How we use your information

We use your information to:

  • Provide personalised coaching, training programs, and nutrition plans.
  • Allow your coach to view your progress and give feedback.
  • Send you reminders, check-ins, and notifications you've opted into.
  • Improve the app and fix bugs.
  • Run and secure the platform: account administration, support, fraud and abuse prevention.
  • Comply with legal obligations.

AI features: some features, such as check-in summaries or draft responses, use an AI service to generate text. They run only when you or your coach use them, they send only the information needed for that feature, and the output is reviewed by your coach before it reaches you. Your information is not used to train AI models. Cycle data is never included.

We do not sell your personal information to third parties. Ever.

4. Who can see your data

  • Your coach: the coach you sign up with can see your profile, check-ins, progress photos, and messages. This is the core of the service.
  • Sub-coaches: your coach may delegate view or edit access to a team member. Access is controlled per-client.
  • Coach Vault: Coach Vault Pty Ltd provides the BBL Coaching app and the systems behind it to Zachary Rigelsford-Lockwood, and stores and processes your information on our instructions so that we can deliver the service.
  • Service providers: we use Supabase (database and file storage, Sydney, Australia), Vercel (web hosting, Sydney, with some requests routed through the United States), Resend (email delivery, United States), Apple Push Notifications and Firebase Cloud Messaging (notification delivery, United States; they receive the notification text and your device token), and Anthropic (AI features, United States; only when an AI feature is used). Each processes information only to provide its service to us.
  • Legal disclosures: we may disclose information if required by law.

5. Where your data is stored

Your data is stored on servers located in Sydney, Australia. The providers listed in section 4 that operate in the United States handle limited information for the purpose described there. When information leaves Australia we take the steps the Privacy Act requires, including contractual protections with each provider.

6. Your rights

You have the right to:

  • Access the personal information we hold about you.
  • Correct information that's inaccurate or out of date.
  • Request deletion of your account and associated data at any time, by sending a request from Settings (Help & Support) or by emailing us.
  • Export your data in a portable format on request.
  • Opt out of non-essential notifications.
  • Withdraw consent for wearable device syncing at any time.

We respond to access, correction and export requests within 30 days. We may need to verify your identity first.

7. How long we keep your data, and deletion

We keep your information while your account is active. When you or your coach delete your account, we remove your profile, logs, photos, messages and other personal data from our active systems within 30 days. Backups are kept for disaster recovery and expire on a rolling cycle of up to 30 days, so deleted data is gone from backups within 30 days of leaving the active system.

We keep a small set of records after deletion where the law or our contracts require it: payment and invoice records, signed agreements, and a minimal audit entry recording that the deletion happened. If any part of a deletion cannot be completed straight away, we tell the person who requested it and finish it, rather than reporting it complete.

8. Security

We use encryption in transit (HTTPS) and at rest, access controls in the database that keep each coaching business's data separate from every other, and we never store your password in plain text. No system is perfect, but we take security seriously, especially given the sensitivity of health data. If a data breach affects your information, we will tell you and any regulator the law requires, without undue delay.

9. Minors

BBL Coachingis for adults only. You must be 18 or older to create an account. We do not knowingly collect information from anyone under 18. If you believe we have, please contact us and we'll delete it.

10. Changes to this policy

We may update this policy from time to time. If we make significant changes, we'll notify you in-app or by email. The “Last updated” date at the top tells you when it last changed.

11. Contact us and complaints

Questions, concerns, or requests about your data? Email us at info@bblcoaching.co.

If you think we have mishandled your personal information, email the same address with “Privacy complaint” in the subject. We will acknowledge it within 5 business days, investigate, and give you a written response within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.