← Back

Privacy Policy

Last updated: 13 September 2026

1. Who we are

This Privacy Policy applies to Whatdoin Coaching, the mobile app published on the Apple App Store by Whatdoin Coaching (app ID com.whatdoincoaching.app), and to the Whatdoin Coaching web app at app.getcoachvault.com/c/whatdoin.

Whatdoin Coaching (“Whatdoin”, “we”, “us”) is operated by Whatdoin Coaching, a coaching business in Australia. Whatdoin Coachingis the developer named on the app's store listings and the legal entity responsible for the personal information described in this policy. You can reach us at byran@whatdoincoaching.com.

Whatdoin Coaching is built on the Coach Vault coaching platform, provided by Coach Vault Pty Ltd, which is why this policy is served from a Coach Vault web address. Coach Vault supplies the technology, hosting and support behind the app on our behalf and processes your information only on our instructions. It is listed as a service provider in section 4.

2. Information we collect

We collect the following types of information:

  • Account details: name, email address, date of birth, gender, height.
  • Health and fitness data: weight, body measurements, progress photos, training logs, nutrition logs, check-in responses, sleep, steps, blood pressure, blood test results (only if you choose to upload them). This is health information. It is collected with your consent, which your coach asks for when you start, and you can withdraw at any time (section 6).
  • Wearable and health app data: if you connect an Oura Ring, Apple Health, Health Connect on Android, or a similar service, we collect only the health metrics you authorise (for example steps, sleep, heart rate variability, readiness score). Data read through Apple Health or Health Connect is used solely to show you your own progress and to share it with your coach. We never use it for advertising, and we never sell it. You can withdraw access at any time from your device settings.
  • Cycle tracking (optional):if you turn on cycle tracking, we collect the period days, symptoms and notes you log, and, if you connect it, period days read from Apple Health or Health Connect. This is health information and it is only ever collected with your express consent. You choose whether your coach can see it, and what: nothing, period dates and the estimates built from them, or dates plus symptoms and notes. Sharing extends to the coaches on your coach's team who have been given access to cycle data. Whether you have set contraception, irregular or paused is never shared. Cycle data is never used for marketing, analytics, AI features or advertising. It lives only in the database that stores the rest of your account (hosted in Sydney, Australia), is never sent to any AI, analytics or marketing service, and is not read by platform support. You can stop sharing, clear a day, download your history or delete everything at any time from Settings.
  • Communication: messages you send your coach, comments on community posts, support requests.
  • Device and usage data: device type, operating system, crash logs, and basic analytics about which features you use.

3. How we use your information

We use your information to:

  • Provide personalised coaching, training programs, and nutrition plans.
  • Allow your coach to view your progress and give feedback.
  • Send you reminders, check-ins, and notifications you've opted into.
  • Improve the app and fix bugs.
  • Run and secure the platform: account administration, support, fraud and abuse prevention.
  • Comply with legal obligations.

AI features: some features, such as check-in summaries or draft responses, use an AI service to generate text. They run only when you or your coach use them, they send only the information needed for that feature, and the output is reviewed by your coach before it reaches you. Your information is not used to train AI models. Cycle data is never included.

Google Calendar and Google user data: if you connect Google Calendar, we read your calendar events and free or busy times only to schedule and coordinate coaching sessions. Our access to, use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to develop, train or improve generalised or foundational artificial intelligence or machine learning models, and we never sell it.

We do not sell your personal information to third parties. Ever.

Our legal grounds (UK, EU and similar laws): we process your account and coaching data because it is necessary to deliver the coaching you signed up for (contract); your health information on your explicit consent, which your coach asks for when you start; security, support and improvement of the app on our legitimate interests, balanced against yours; and some records because the law requires it. Where we rely on consent you can withdraw it at any time, and that does not affect what was done before.

4. Who can see your data

  • Your coach: the coach you sign up with can see your profile, check-ins, progress photos, and messages. This is the core of the service.
  • Sub-coaches: your coach may delegate view or edit access to a team member. Access is controlled per-client.
  • Coach Vault: Coach Vault Pty Ltd provides the Whatdoin Coaching app and the systems behind it to Whatdoin Coaching, and stores and processes your information on our instructions so that we can deliver the service.
  • Service providers: we use Supabase (database and file storage, Sydney, Australia), Vercel (web hosting, Sydney, with some requests routed through the United States), Resend (email delivery, United States), Apple Push Notifications and Firebase Cloud Messaging (notification delivery, United States; they receive the notification text and your device token), and Anthropic (AI features, United States; only when an AI feature is used). Each processes information only to provide its service to us.
  • Legal disclosures: we may disclose information if required by law.

5. Where your data is stored

Your data is stored on servers located in Sydney, Australia. The providers listed in section 4 that operate in the United States handle limited information for the purpose described there. When information leaves Australia we take the steps the Privacy Act requires, including contractual protections with each provider.

If you are outside Australia, your information leaves your country to be stored here. For the United Kingdom and Europe, that transfer is covered by the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, which form part of the Data Processing Addendum between Whatdoin Coaching and Coach Vault Pty Ltd, published at app.getcoachvault.com/customer-terms/dpa. For other countries, the same addendum binds Coach Vault to protections comparable to your local law.

6. Your rights

You have the right to:

  • Access the personal information we hold about you.
  • Correct information that's inaccurate or out of date.
  • Request deletion of your account and associated data at any time, by sending a request from Settings (Help & Support) or by emailing us.
  • Export your data in a portable format on request.
  • Opt out of non-essential notifications.
  • Withdraw consent for wearable device syncing at any time.
  • Withdraw your consent to the use of your health information at any time, by deleting your account from Settings or by emailing us. Withdrawing does not affect what was done before, and it means the app can no longer deliver your coaching.
  • If you are in the UK, Europe or another place with these rights: restrict or object to processing, receive your data in a machine-readable format, and not be subject to a decision based solely on automated processing. We make no such decisions about you.
  • Complain to a privacy regulator (section 12 lists them by country).

We respond to access, correction and export requests within 30 days. We may need to verify your identity first.

7. How long we keep your data, and deletion

We keep your information while your account is active. When you or your coach delete your account, we remove your profile, logs, photos, messages and other personal data from our active systems within 30 days. Backups are kept for disaster recovery and expire on a rolling cycle of up to 30 days, so deleted data is gone from backups within 30 days of leaving the active system.

We keep a small set of records after deletion where the law or our contracts require it: payment and invoice records, signed agreements, and a minimal audit entry recording that the deletion happened. If any part of a deletion cannot be completed straight away, we tell the person who requested it and finish it, rather than reporting it complete.

8. Security

We use encryption in transit (HTTPS) and at rest, access controls in the database that keep each coaching business's data separate from every other, and we never store your password in plain text. No system is perfect, but we take security seriously, especially given the sensitivity of health data. If a data breach affects your information, we will tell you and any regulator the law requires, without undue delay.

9. Minors

Whatdoinis for adults only. You must be 18 or older to create an account. We do not knowingly collect information from anyone under 18. If you believe we have, please contact us and we'll delete it.

10. Changes to this policy

We may update this policy from time to time. If we make significant changes, we'll notify you in-app or by email. The “Last updated” date at the top tells you when it last changed.

11. Contact us and complaints

Questions, concerns, or requests about your data? Email us at byran@whatdoincoaching.com.

If you think we have mishandled your personal information, email the same address with “Privacy complaint” in the subject. We will acknowledge it within 5 business days, investigate, and give you a written response within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

12. If you are outside Australia

Whatdoin Coaching is responsible for your information under the law where you live, and Coach Vault Pty Ltd processes it on their behalf under the Data Processing Addendum linked in section 5. Whatever country you are in, you can use the contact in section 11, and the following also applies.

  • United Kingdom:the UK GDPR and the Data Protection Act 2018 apply. Your health information is special category data, processed on your explicit consent. You can complain to the Information Commissioner's Office at ico.org.uk.
  • European Economic Area and Switzerland: the GDPR (or the Swiss Federal Act on Data Protection) applies, with the same rights and grounds as above. You can complain to the data protection authority in your country.
  • United States:we do not sell or share your personal information, and we do not use it for targeted advertising. If you are a California resident, you have the right to know what we collect (sections 2 and 3), to delete it, to correct it, and not to be treated differently for exercising those rights. Your health information is consumer health data under laws such as Washington's My Health My Data Act: it is collected only with your consent, shared only with your coach and the providers in section 4, never sold, and you can withdraw consent and ask for deletion at any time. Requests are handled through the contact in section 11, and we verify identity before acting.
  • Canada: the Personal Information Protection and Electronic Documents Act and provincial privacy laws apply. Your information is stored outside Canada, in Australia, and may be accessed by the providers in section 4 under their local law. You can complain to the Office of the Privacy Commissioner of Canada.
  • South Africa: the Protection of Personal Information Act applies. Your health information is special personal information, processed on your consent. You can complain to the Information Regulator.
  • United Arab Emirates: Federal Decree-Law No. 45 of 2021 on personal data protection applies. Your information is transferred to Australia on the basis of the contractual protections in the Data Processing Addendum and your consent.
  • Indonesia: Law No. 27 of 2022 on Personal Data Protection applies. Your health information is specific personal data, processed on your explicit consent, and transferred to Australia under the protections in the Data Processing Addendum.
  • New Zealand and Singapore: the Privacy Act 2020 and the Personal Data Protection Act 2012 apply respectively; the Data Processing Addendum provides the comparable safeguards those laws require for information held overseas.