Privacy Policy
Last updated: July 2026
1. Who We Are
BM Fitness is operated by Ben Morris, an online fitness coach based in Scotland. When this policy refers to "I", "me", "my", or "BM Fitness", it means Ben Morris. When it refers to "you" or "your", it means you — the person using this website or enrolling in coaching.
Data Controller: Ben Morris, BM Fitness
Contact: coach.bmfitness@gmail.com
Website: www.bmfitness.co.uk
This policy explains what personal data I collect, why I collect it, how it is used, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. What Data I Collect and Why
Contact & Enquiry Data
When you submit an application, book a call via Calendly, or contact me directly, I collect your name and email address. This is used to communicate with you about your enquiry or coaching arrangement.
Lawful basis: Legitimate interests / pre-contractual steps.
Coaching & Health Data (Special Category)
When you begin coaching, I collect health and fitness information including your Physical Activity Readiness Questionnaire (PAR-Q), which covers cardiovascular health, blood pressure, injuries, medications, and other relevant health conditions. I also collect ongoing data including workout logs, body metrics, progress notes, and progress photos if you choose to share them.
This data is essential to providing safe and effective coaching.
Lawful basis: Contract (necessary to deliver the service) and Explicit Consent (required for special category health data, which you will be asked to provide separately before coaching begins).
Website & Analytics Data
I may collect basic anonymised data about how visitors use this website (such as pages visited and time spent) to improve the site experience. No personally identifiable information is collected through standard site analytics.
Lawful basis: Legitimate interests.
Email Marketing
If you sign up via the calorie calculator or any email capture on this site, your email address will be added to my mailing list on MailerLite. You will only ever receive fitness and coaching content. You can unsubscribe at any time via the link in any email.
Lawful basis: Consent.
I do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.
3. How Long I Keep Your Data
| Data Type | Retention Period |
|---|---|
| Active clients — all coaching data | Duration of coaching engagement |
| Past clients — PAR-Q and training records | 7 years after coaching ends (UK fitness industry standard for insurance and legal compliance) |
| Enquiries/calls that did not proceed to coaching | 6 months, unless you opted into my mailing list |
| Email subscribers | Until you unsubscribe |
4. Third-Party Services
I do not sell your data. However, to run BM Fitness professionally, your data is processed by the following trusted third-party services, each with their own privacy policies:
- Calendly — appointment scheduling and booking management (calendly.com)
- MailerLite — email marketing and list management (mailerlite.com)
- ABC Trainerize — coaching platform where your fitness plan, progress, and health data are stored (trainerize.com)
- Google Meet / Google Calendar — for coaching calls and scheduling (google.com)
- Spaceship — website hosting (spaceship.com)
- Stripe / PayPal — payment processing where applicable. I never see or store your full card details.
- WhatsApp / Instagram / Facebook (Meta) — if you choose to contact me through these channels, your messages are also processed by Meta under its own privacy policy.
Each of these providers processes your data under its own privacy policy and appropriate data-processing terms. I only share data with these services where necessary to deliver coaching or operate the business, and I do not sell your data to anyone.
International Transfers
Some of the providers listed above process data outside the UK (for example, in the United States or Canada). Where this happens, the transfer is protected by safeguards recognised under UK GDPR — such as UK adequacy regulations covering the destination country, or the International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses implemented by the provider.
5. Cookies
This website uses only essential cookies that are strictly necessary for the site to function correctly (such as form and booking functionality). Under the Privacy and Electronic Communications Regulations (PECR), strictly necessary cookies do not require your consent. No advertising, analytics, or tracking cookies are set by this site. If that ever changes, this policy will be updated and you will be asked for consent first.
6. Your Rights Under UK GDPR
You have the following rights regarding your personal data:
- Right of Access — request a copy of the data I hold about you
- Right to Rectification — ask for inaccurate data to be corrected
- Right to Erasure — ask for your data to be deleted ("right to be forgotten"), subject to legal retention obligations
- Right to Restrict Processing — ask me to limit how I use your data
- Right to Data Portability — receive your data in a portable format
- Right to Withdraw Consent — withdraw consent for health data processing at any time (note: this will mean I can no longer safely provide coaching)
- Right to Object — object to processing based on legitimate interests
To exercise any of these rights, contact me at coach.bmfitness@gmail.com. I will respond within one month, as required by UK GDPR. For particularly complex requests this can be extended by up to two further months — if that applies, I will tell you within the first month and explain why.
If you are unhappy with how your data is handled, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
7. Data Security
I take reasonable technical and organisational measures to protect your personal data from unauthorised access, loss, or disclosure. All third-party platforms used are reputable, industry-standard services with their own security frameworks. No method of internet transmission is 100% secure; however, I am committed to protecting your data using best practices.
8. Children
This website and my coaching services are designed for adults and are not directed at anyone under 18. I do not knowingly collect personal data from children. If you believe a child has provided me with personal data, please contact me and I will delete it.
9. Changes to This Policy
This privacy policy may be updated from time to time. The date at the top of this page will always reflect the most recent version. Continued use of this website after any changes constitutes acceptance of the updated policy.