← Back

Privacy Policy

Last updated: 27 October 2026

1. Who we are

Coach Vault (“Coach Vault”, “we”, “us”) is a fitness and health coaching platform operated by Coach Vault Pty Ltd. This Privacy Policy explains how we collect, use, store, and share your personal information when you use our mobile app, website, and coaching services.

2. Information we collect

We collect the following types of information:

  • Account details: name, email address, date of birth, gender, height.
  • Health and fitness data: weight, body measurements, progress photos, training logs, nutrition logs, check-in responses, sleep, steps, blood pressure, blood test results (only if you choose to upload them). This is health information. It is collected with your consent, which your coach asks for when you start, and you can withdraw at any time (section 6).
  • Wearable and health app data: if you connect an Oura Ring, Apple Health, Health Connect on Android, or a similar service, we collect only the health metrics you authorise (for example steps, sleep, heart rate variability, readiness score). Data read through Apple Health or Health Connect is used solely to show you your own progress and to share it with your coach. We never use it for advertising, and we never sell it. You can withdraw access at any time from your device settings.
  • Cycle tracking (optional): if you turn on cycle tracking, we collect the period days, symptoms and notes you log, and, if you connect it, period days read from Apple Health or Health Connect. This is health information and it is only ever collected with your express consent. You choose whether your coach can see it, and what: nothing, period dates and the estimates built from them, or dates plus symptoms and notes. Sharing extends to the coaches on your coach's team who have been given access to cycle data. Whether you have set contraception, irregular or paused is never shared. Cycle data is never used for marketing, analytics, AI features or advertising. It lives only in the database that stores the rest of your account (hosted in Sydney, Australia), is never sent to any AI, analytics or marketing service, and is not read by platform support. You can stop sharing, clear a day, download your history or delete everything at any time from Settings.
  • Communication: messages you send your coach, comments on community posts, support requests.
  • Device and usage data: device type, operating system, crash logs, and basic analytics about which features you use.

3. How we use your information

We use your information to:

  • Provide personalised coaching, training programs, and nutrition plans.
  • Allow your coach to view your progress and give feedback.
  • Send you reminders, check-ins, and notifications you've opted into.
  • Improve the app and fix bugs.
  • Run and secure the platform: account administration, support, fraud and abuse prevention.
  • Comply with legal obligations.

AI features: some features, such as check-in summaries or draft responses, use an AI service to generate text. They run only when you or your coach use them, they send only the information needed for that feature, and the output is reviewed by your coach before it reaches you. Your information is not used to train AI models. Cycle data is never included.

Google Calendar and Google user data: if you connect Google Calendar, we read your calendar events and free or busy times only to schedule and coordinate coaching sessions. Our access to, use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to develop, train or improve generalised or foundational artificial intelligence or machine learning models, and we never sell it.

We do not sell your personal information to third parties. Ever.

Our legal grounds (UK, EU and similar laws): we process your account and coaching data because it is necessary to deliver the coaching you signed up for (contract); your health information on your explicit consent, which your coach asks for when you start; security, support and improvement of the app on our legitimate interests, balanced against yours; and some records because the law requires it. Where we rely on consent you can withdraw it at any time, and that does not affect what was done before.

4. Who can see your data

  • Your coach: the coach you sign up with can see your profile, check-ins, progress photos, and messages. This is the core of the service.
  • Sub-coaches: your coach may delegate view or edit access to a team member. Access is controlled per-client.
  • Service providers: we use Supabase (database, sign-in and file storage, Sydney, Australia), Vercel (web hosting, Sydney, with requests entering through its global network), Resend (email delivery, United States), Apple Push Notifications and Firebase Cloud Messaging (notification delivery, United States; they receive the notification text and your device token), Mux (video hosting for video messages, check-in and diary videos, United States), Anthropic (powers the AI features, United States; only when an AI feature is used), Groq (transcribes voice messages when you or your coach ask for a transcript, United States), Sentry (error monitoring, United States; it receives error details and request paths, never your name, health information, photos or videos), Cloudflare (bot protection on the sign-in and sign-up pages, United States; your IP address and browser signals), Stripe (payments, only when you pay through the app, United States) and Google Workspace (support email and documents, United States; whatever is included when you or your coach email support about your account). Each processes information only to provide its service to us.
  • Legal disclosures: we may disclose information if required by law.

5. Where your data is stored

Your data is stored on servers located in Sydney, Australia. The providers listed in section 4 that operate in the United States handle limited information for the purpose described there. When information leaves Australia we take the steps the Privacy Act requires, including contractual protections with each provider.

If you are outside Australia, your information leaves your country to be stored here. For the United Kingdom and Europe, that transfer is covered by the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, which form part of the Data Processing Addendum between Coach Vault Pty Ltd and Coach Vault Pty Ltd, published at app.getcoachvault.com/customer-terms/dpa. For other countries, the same addendum binds Coach Vault to protections comparable to your local law.

6. Your rights

You have the right to:

  • Access the personal information we hold about you.
  • Correct information that's inaccurate or out of date.
  • Request deletion of your account and associated data at any time, by sending a request from Settings (Help & Support) or by emailing us.
  • Export your data in a portable format on request.
  • Opt out of non-essential notifications.
  • Withdraw consent for wearable device syncing at any time.
  • Withdraw your consent to the use of your health information at any time, by deleting your account from Settings or by emailing us. Withdrawing does not affect what was done before, and it means the app can no longer deliver your coaching.
  • If you are in the UK, Europe or another place with these rights: restrict or object to processing, receive your data in a machine-readable format, and not be subject to a decision based solely on automated processing. We make no such decisions about you.
  • Complain to a privacy regulator (section 12 lists them by country).

We respond to access, correction and export requests within 30 days. We may need to verify your identity first.

7. How long we keep your data, and deletion

We keep your information while your account is active. When you or your coach delete your account, we remove your profile, logs, photos, messages and other personal data from our active systems within 30 days. Backups are kept for disaster recovery and expire on a rolling cycle of up to 30 days, so deleted data is gone from backups within 30 days of leaving the active system.

We keep a small set of records after deletion where the law or our contracts require it: payment and invoice records, signed agreements, and a minimal audit entry recording that the deletion happened. If any part of a deletion cannot be completed straight away, we tell the person who requested it and finish it, rather than reporting it complete.

8. Security

We use encryption in transit (HTTPS) and at rest, access controls in the database that keep each coaching business's data separate from every other, and we never store your password in plain text. No system is perfect, but we take security seriously, especially given the sensitivity of health data. If a data breach affects your information, we will tell you and any regulator the law requires, without undue delay.

9. Minors

Coach Vault is for adults only. You must be 18 or older to create an account. We do not knowingly collect information from anyone under 18. If you believe we have, please contact us and we'll delete it.

10. Changes to this policy

We may update this policy from time to time. If we make significant changes, we'll notify you in-app or by email. The “Last updated” date at the top tells you when it last changed.

11. Contact us and complaints

Questions, concerns, or requests about your data? Email us at admin@getcoachvault.com.

If you think we have mishandled your personal information, email the same address with “Privacy complaint” in the subject. We will acknowledge it within 5 business days, investigate, and give you a written response within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

12. If you are outside Australia

Coach Vault Pty Ltd is responsible for your information under the law where you live, and Coach Vault Pty Ltd processes it on their behalf under the Data Processing Addendum linked in section 5. Whatever country you are in, you can use the contact in section 11, and the following also applies.

  • United Kingdom: the UK GDPR and the Data Protection Act 2018 apply. Your health information is special category data, processed on your explicit consent. You can complain to the Information Commissioner's Office at ico.org.uk.
  • European Economic Area and Switzerland: the GDPR (or the Swiss Federal Act on Data Protection) applies, with the same rights and grounds as above. You can complain to the data protection authority in your country.
  • United States: we do not sell or share your personal information, and we do not use it for targeted advertising. If you are a California resident, you have the right to know what we collect (sections 2 and 3), to delete it, to correct it, and not to be treated differently for exercising those rights. Your health information is consumer health data under laws such as Washington's My Health My Data Act: it is collected only with your consent, shared only with your coach and the providers in section 4, never sold, and you can withdraw consent and ask for deletion at any time. Requests are handled through the contact in section 11, and we verify identity before acting.
  • Canada: the Personal Information Protection and Electronic Documents Act and provincial privacy laws apply. Your information is stored outside Canada, in Australia, and may be accessed by the providers in section 4 under their local law. You can complain to the Office of the Privacy Commissioner of Canada.
  • South Africa: the Protection of Personal Information Act applies. Your health information is special personal information, processed on your consent. You can complain to the Information Regulator.
  • United Arab Emirates: Federal Decree-Law No. 45 of 2021 on personal data protection applies. Your information is transferred to Australia on the basis of the contractual protections in the Data Processing Addendum and your consent.
  • Indonesia: Law No. 27 of 2022 on Personal Data Protection applies. Your health information is specific personal data, processed on your explicit consent, and transferred to Australia under the protections in the Data Processing Addendum.
  • New Zealand and Singapore: the Privacy Act 2020 and the Personal Data Protection Act 2012 apply respectively; the Data Processing Addendum provides the comparable safeguards those laws require for information held overseas.

13. If you're a coach, a partner, or thinking of joining Coach Vault

This section is about Coach Vault Pty Ltd's own customers and contacts: coaching businesses that subscribe, our partners, and people who ask about joining. It is not about the clients a coach trains, who are covered by sections 1 to 12.

What we collect:

  • Coaches who subscribe: your name, business name, email, phone, ABN, plan, payment history, support messages and how you use Coach Vault. Card details are held by Stripe, never by us.
  • People thinking of joining: what you tell us in forms, messages and calls, such as your business details, the platform you use now, how many clients you have and what you want help with. Sales calls may be recorded and transcribed; we tell you at the start of the call.
  • Partners: your business details, your ABN or country, the coaches you refer and what we owe you. Bank details for payouts in Australia are held by Stripe, not by us. If we pay you by PayPal, we keep your PayPal email.

How we use it: to provide, bill and support your subscription; to answer your questions and help you decide whether to join; to onboard you and move your data if you ask us to; to work out and pay partner commission; to send you messages about your account; and to send you news and offers, which you can unsubscribe from at any time. If another coach or partner referred you, they can see your business name, the month you joined, your plan and whether you are paying, and nothing else. Some replies to Instagram messages are written with AI. We tell you that at the start of the conversation, and a person can jump in at any time.

Who can see it: our team, including our sales and booking staff, some of whom work outside Australia (for example in the Philippines and South Africa). They see only what they need to talk to you and book your call. And our service providers: Stripe (payments and partner payouts; Australia and the United States), PayPal (payouts to partners outside Australia; United States), GoHighLevel (bookings, texts and contact records; United States), Google Workspace (email and documents; United States), Fathom (call recording and notes; United States), Resend (email delivery; United States), Anthropic (powers the AI features; United States) and Meta (Instagram messages; United States), plus the providers in section 4 when you use the app (including Mux, Groq, Sentry and Cloudflare). We take the steps the Privacy Act requires before information leaves Australia.

How long we keep it: while you are a customer or partner, then as long as the law requires for tax and business records (usually 7 years). If you ask about joining and don't, we delete or de-identify your details when we no longer need them, and we check at least once a year.

Your rights: the rights in section 6 apply to you too. Use the contact and complaints process in section 11.