Who we are
HomePTKit (“we”, “us”, “our”) is a multi-tenant platform that helps UK personal trainers sell challenges and memberships to their home clients. This policy explains what personal data we process, why, and your rights under UK GDPR and the Data Protection Act 2018.
The data controller / operator is Daryl Bleach, a sole trader trading as HomePTKit. Contact us by email at privacy@homeptkit.com (privacy) or support@homeptkit.com / hello@homeptkit.com (general).
Privacy requests: privacy@homeptkit.com
What we collect
Depending on whether you are a personal trainer (PT) or a client, we may process:
- Account details — name, email, password (hashed), profile basics, and branding you choose to show.
- Business / payout details (PTs) — information needed to connect payouts via our payment provider (for example Stripe Connect), such as identity and bank details collected by that provider.
- Client relationship data — which PT you follow or pay, challenge and membership enrolments, progress marks, community posts you choose to make.
- Payment metadata — amounts, dates, status, and fee application (HomePTKit takes 7.5% of client payments when money flows; £0 monthly fee to PTs). We do not store full card numbers; card data is handled by the payment provider.
- Content you upload — videos (or URLs), PDFs, meal-plan templates, session materials, and similar IP you publish.
- Technical & usage data — device/browser type, IP address, approximate location derived from IP, logs, cookies and similar technologies (see Cookie policy).
- Support messages — emails you send to support@homeptkit.com or privacy@homeptkit.com.
Why we use your data
We process personal data only where we have a lawful basis:
- Contract — to create and run your account, publish challenges and memberships, process payments, and deliver the client shell.
- Legitimate interests — to secure the platform, prevent fraud and abuse, improve product reliability, and understand aggregate usage (balanced against your rights).
- Legal obligation — where tax, accounting, or regulatory rules require retention of certain records.
- Consent — for non-essential cookies or optional marketing communications, where we ask and you can withdraw.
Who we share data with
We do not sell personal data. We use trusted processors who help us run the service, under contracts that require appropriate protection:
- Payment provider — Stripe (including Stripe Connect Express) to collect client payments, apply the platform fee, and pay out to PTs. Stripe processes card and identity data under its own terms and privacy notice.
- Hosting & infrastructure — cloud providers that store application data and backups in line with our configuration.
- Email & support tools — to send transactional messages (account, receipts, security) and handle support tickets.
- Analytics (if enabled) — privacy-respecting analytics tools, subject to cookie preferences where required.
- Legal / authorities — if required by law, court order, or to protect rights, safety, or the integrity of the platform.
PTs act as independent businesses. When a client joins a PT’s space, that PT may also process client data as a separate controller (or joint controller, depending on the arrangement). Contact your PT for how they use coaching data outside our platform tools.
International transfers
Some processors may process data outside the UK. Where that happens, we use appropriate safeguards (such as the UK International Data Transfer Agreement / Addendum, or an adequacy decision) as required by UK data protection law.
How long we keep data
We keep personal data only as long as needed for the purposes above:
- Active accounts — for the life of the account.
- After closure — we delete or anonymise personal data within a reasonable period, except where we must retain records for legal, tax, dispute, or security reasons.
- Payment & fee records — retained as required for accounting and compliance.
- Support correspondence — typically kept for a limited period to resolve follow-ups, then deleted or archived.
Your rights (UK)
Under UK GDPR and the Data Protection Act 2018, you may have the right to:
- Access your personal data
- Rectify inaccurate data
- Erase data in certain circumstances
- Restrict or object to certain processing
- Data portability, where applicable
- Withdraw consent where processing is based on consent
- Complain to the UK Information Commissioner’s Office (ICO) — ico.org.uk
To exercise these rights, email privacy@homeptkit.com. We may need to verify your identity before responding.
Children
HomePTKit is aimed at adults (personal trainers and their adult clients). We do not knowingly collect personal data from children under 16. If you believe a child has provided data, contact privacy@homeptkit.com and we will take appropriate steps.
Security
We use appropriate technical and organisational measures to protect personal data (access controls, encryption in transit where standard, hashed passwords, least-privilege practices). No method of transmission or storage is perfectly secure; please use a strong unique password and tell us promptly at support@homeptkit.com if you suspect unauthorised access.
Changes to this policy
We may update this policy from time to time. The “Last updated” date at the top will change. Material changes may also be notified in-product or by email where appropriate.
Contact
Privacy questions and requests: privacy@homeptkit.com
Operator: Daryl Bleach (sole trader trading as HomePTKit)
General support: support@homeptkit.com
Web: homeptkit.com (homeptkit.co.uk redirects here)