Privacy Statement

We are committed to protecting your privacy and ensuring that your personal and health information is handled safely, transparently, and in accordance with the New Zealand Privacy Act 2020.

This Privacy Policy explains how we collect, use, store, and disclose your personal information when you visit our website, apply for our coaching, or use our strength & conditioning (S&C) and performance nutrition services.

We only collect personal information that is necessary to deliver safe, effective, and tailored coaching services. Depending on how you interact with us, we may collect:

• Contact Information: Name and email address. A phone number if you choose to give one on our enquiry form. We do not collect or hold a physical address.

• Athletic & Health Metrics: Date of birth, sex, sport(s) played, current playing level, training history, body weight, height, test results, wellness check-ins, injury reports, and dietary/nutrition preferences & needs.

• Parent/Guardian Information: Name and email address for athletes under 18 years of age.

• Content You Upload: Messages you send us in the app, and any photo, video or voice note you attach to them.

• Technical Data: Our website sets a session cookie so that you stay signed in. It is required for the site to work and is not used for tracking. We do not use analytics, advertising or marketing cookies, and we do not build a profile of how you use the site. Our hosting and database providers keep their own short-term server logs, which include IP addresses, as any web host does.

• Payment Information: If you pay us by subscription, our payment provider collects and holds your card details. We never see or store your card number. What we hold is a reference to your customer record with them, and whether your subscription is active.

We collect personal information directly from you (or your parent/guardian if under 18) when you:

• Fill out an application form or enquiry form on our website.

• Onboard into our coaching software.

• Communicate with us via email, phone, or messaging platforms.

• Subscribe to newsletters, updates, or downloadable guides.

We collect and use your personal information strictly for the following purposes:

• Service Delivery: To design customised S&C programs, track athletic progress, calculate nutritional/macro targets, and communicate with you.

• Safety & Duty of Care: To ensure training protocols and dietary targets are safe, appropriate, and aligned with your physical readiness and health history.

• Administration: To manage client accounts, process payments, and issue invoices.

• Service Improvement & Communication: To send program updates, service announcements, and promotional communications (you may opt out at any time).

Our services run on third-party platforms, and your information is stored on their servers rather than on a computer in our office. Because those platforms operate internationally, your information is held outside New Zealand. The New Zealand Privacy Act 2020 (Information Privacy Principle 12) permits this where the receiving country or provider offers comparable privacy safeguards, and we rely on each provider's published privacy terms for that.

The providers we use, and where each holds your information:

• Supabase — our database and file storage. This holds the substantial majority of what we have about you: your profile, test results, wellness check-ins, injury reports, nutrition information, messages and uploaded files. Servers are in SINGAPORE (region ap-southeast-1).

• Vercel — our website and app hosting. Handles the requests your browser makes and keeps short-term server logs. Servers are outside New Zealand.

• Stripe — payment processing, if you are on a paid subscription. Holds your card details; we never see them. Operates internationally, including in the United States.

• Resend — sending our automated emails, such as invitations and confirmations. Receives your name and email address. Operates internationally, including in the United States.

• GitHub — where our encrypted database backups are held. The backup is encrypted before it leaves our systems and cannot be read without a key we hold separately. Servers are in the United States.

We never sell, rent, or trade your personal information to third parties. Beyond the providers listed above, which simply operate our systems on our behalf, we do not share your information with anyone without your consent, unless the law requires it.

We take reasonable technical and administrative precautions to protect your personal information from unauthorised access, loss, misuse, or alteration. Data collected digitally is stored in secure, password-protected databases and encrypted cloud services accessible only by authorised coaching staff.

We keep your information for as long as you are a client. If you stop training with us, we keep it afterwards rather than deleting it automatically, so that your training history is still there if you come back. You can ask us to delete it at any point — see section 7 below and clause 3.4 of our Terms & Conditions, which describe exactly what is deleted and what we keep.

Some records we are required by law to keep, such as invoices and payment records held for tax purposes.

We work extensively with developing high school and junior athletes. If an athlete is under 18 years of age, personal information and health disclosures must be provided with the knowledge and authorisation of a parent or legal guardian.

Under the New Zealand Privacy Act 2020, you have the right to:

1. Access: Request a copy of the personal information we hold about you.

2. Correction: Request that we correct or update any inaccurate, incomplete, or out-of-date information.

3. Deletion: Ask us to delete your personal information. This is a service we choose to offer rather than a requirement of the Privacy Act 2020, and it is described in full — including the seven (7) day cooling-off period, what is deleted, and what we retain in de-identified form — in clause 3.4 of our Terms & Conditions. You can start or withdraw a deletion request yourself from the You tab in the App.

To exercise these rights, email us at hello.theperformanceco@gmail.com. We will respond to your request within 20 working days.

Our website sets one kind of cookie: a session cookie that keeps you signed in as you move between pages. It is required for the site to function and it does not track you.

We do not use analytics, advertising or marketing cookies. We do not use Google Analytics or any similar service, we do not run advertising pixels, and we do not build a profile of how you use the site.

You can block cookies in your browser settings, but you will not be able to sign in if you do.

If you have any questions, concerns, or requests regarding this Privacy Policy or how your data is handled, email us at hello.theperformanceco@gmail.com. We are a small business and that address reaches the people who hold your information directly; we have not appointed a separate Privacy Officer.

If you are not satisfied with our response, you have the right to lodge a complaint with the New Zealand Office of the Privacy Commissioner at www.privacy.org.nz.