Privacy Policy

Luke Coaching is a personal coaching practice run by Luke and based in the United Kingdom. We coach through this website (lw.coach), our web app (app.lw.coach) and our iPhone and Android apps (together, “the app”).

For UK data protection law (the UK GDPR and the Data Protection Act 2018), Luke Coaching is the controller of the personal information described in this policy. You can reach us as described in Contact us.

Everyone whose information we handle: visitors to lw.coach, people who send an enquiry or take the Blueprint quiz, clients who use the app, and coaches who work with Luke. It explains what we collect, why, on what legal basis, who can see it, where it is stored, how long we keep it and what your rights are.

When you enquire through the consultation form or the Blueprint quiz:

• your name, email address and, if you give it, your phone number;
• what you are hoping to change and how you would like us to contact you (consultation form);
• your quiz answers, your score and stage, and the package the quiz suggests (Blueprint quiz).

When you coach with us and use the app:

• Account: your name, email address, time zone and units, and whether your email address is verified. Your password is held only as a secure hash by our sign-in provider; we never see it.
• Onboarding: your goals and reasons, height and weight, sex (optional), work pattern, sleep, training experience, available days and equipment, nutrition approach, dietary requirements, allergies and intolerances, injuries or pain, and a health screening questionnaire (heart conditions or high blood pressure, chest pain, dizziness or fainting, long-term conditions, prescribed medication, bone or joint problems, and pregnancy or recent birth).
• Your coaching record: your goals and plan, workouts and workout logs (sets, reps, loads, effort and notes), habits and tasks you complete, check-ins and your answers, and the measurements you log, such as body weight and measurements, steps, sleep, stress, energy, hunger, digestion and nutrition.
• Progress photos, only if you choose to add them. The app removes location data from photos before they are uploaded.
• Messages between you and your coach.
• Documents your coach sends you, such as PDF plans and guides. Only you and your coach can see them.
• Coach notes about your coaching, and a history of changes to your plan.
• Your package: its name, start and renewal dates and whether it is paid. The app does not take payments and holds no card details.
• Your choices: the consents you give (what, which version and when), privacy requests you make, and app settings such as reminders, appearance and app lock. App lock uses Face ID, Touch ID or your device passcode, handled entirely by your phone; we never receive biometric data.

If you coach with us: your name, email address, role, sign-in security settings and a log of the actions you take on client records.

Technical information: when you use the website or the app, our hosting and database provider processes technical information such as your IP address, device and browser type and the time of each request, to deliver the service and protect it from abuse.

We do not use analytics, advertising or tracking tools, and we do not collect your location. The app has “Product analytics” and “Crash reports” settings that ask for your permission; we do not currently collect either. If that changes, we will update this policy first and collect only from people who have switched them on. If your phone is set to share crash reports with app developers, Apple or Google may pass us anonymous crash information under their own terms.

We do not buy information about you from anyone else.

Information about your physical or mental health, such as your health screening answers, injuries, measurements, sleep, nutrition and progress photos, is “special category” data under UK GDPR, and we treat it with extra care.

• We use it only to coach you safely and effectively, and only with your explicit consent, which the app asks for before you share any health information.
• You can withdraw that consent at any time in the app (Profile → Privacy). Luke cannot coach you safely without it, so withdrawing it pauses your coaching and lets Luke know. It does not affect anything we did before you withdrew.
• Progress photos are optional. Only you and your coach can see them, and you can delete them at any time.
• If you include health information in an enquiry, we use it only to reply to you, with the consent you give when you send the form.

• Replying to your enquiry and arranging a consultation if you want one: steps you ask us to take before entering into a contract. Any health information you include: your explicit consent.
• Scoring the Blueprint quiz and showing your result: steps you ask us to take. The quiz only suggests a package; it makes no decision about you, and Luke reads every enquiry personally.
• Coaching you and running your account (plans, check-ins, feedback, messages and reminders): performing our contract with you. Your health information: your explicit consent.
• Keeping the service secure and working (access controls, logs of staff actions, backups and preventing abuse): our legitimate interest in protecting you, our clients and the service.
• Business and tax records (invoices and payments): our legal obligations.
• Legal claims and lawful requests from authorities: our legal obligations or legitimate interests, and for health information, where it is needed to establish, exercise or defend legal claims.

We never sell your information, never use it for advertising, and never send you marketing without your consent.

• You, in the app.
• Luke, and any coach Luke asks to work with you. Coaches see only the clients assigned to them.
• Google (Firebase and Google Cloud), which provides our sign-in, database, website and app hosting, and the emails that verify your address or reset your password. Google processes this information only on our instructions, under its data processing terms.
• Apple and Google as app store operators, when you download or update the app, under their own privacy policies.
• A test provider, only if you choose an add-on that involves a third-party test (such as a nutritional blood-spot test). The provider handles your sample and results under its own privacy policy; we see only the results you choose to share with us.
• An AI service, through OpenRouter, if your coach uses the AI plan assistant to draft a training plan. It receives your training details (such as your goal, experience, available days and equipment) under a coded reference, never your name or contact details, and only gets health details if your coach chooses to include them. It may process them outside the UK. Your coach checks every plan before you see it.
• A video-call service we agree with you, if we meet by video.
• Professional advisers such as our accountant, lawyer or insurer, where needed and under confidentiality.
• The police, courts or regulators, where the law requires it.

If Luke Coaching is ever transferred to a new owner, your information would move with it under this policy, and we would tell you first.

• The app’s database is in Google Cloud’s London region.
• Sign-in is provided by Google’s Firebase Authentication, and the website and app are delivered through Google’s global network. So some information, such as your email address, IP address and sign-in records, can be processed outside the UK, including in the United States. Google protects these transfers with the UK International Data Transfer Addendum to the EU Standard Contractual Clauses and its certification under the UK Extension to the EU–U.S. Data Privacy Framework.
• On your phone or browser, the app keeps an offline copy of your coaching data so it works without a signal. It is removed when you sign out.

• Every connection is encrypted (HTTPS), and Google encrypts the data it stores.
• Database rules allow each person to see only what their role needs: a client sees only their own record, and a coach sees only their own clients.
• No coaching information can be seen until the account’s email address is verified.
• Staff actions on client records are logged.
• Backups are encrypted, with the key kept offline.
• You can turn on app lock on your phone.

If a breach puts your information at risk, we will tell you and the Information Commissioner’s Office (ICO) as the law requires.

• Enquiries that don’t lead to coaching: up to 12 months after our last contact, then deleted.
• Client records: while you coach with us. When coaching ends, you can still sign in, view and export your records for 90 days. The record is then archived and deleted 12 months later, or sooner if you ask.
• When you delete your account: your login is deleted straight away, and your coaching records, messages and photos are erased within 30 days. See how to delete your account.
• Backups: kept for up to 90 days, then deleted. If we ever have to restore a backup, we re-apply every deletion made since it was taken.
• Invoices and payment records: six years, as UK tax law requires. These are kept outside the app.
• Records of consents and privacy requests (what was asked or agreed, and when; no health information): up to six years, so we can show we handled them properly.

You have the right to:

• get a copy of the information we hold about you. Clients can download everything in their account at any time (Profile → Your data → Export my data);
• have anything inaccurate corrected (Profile → Your data → Correct information);
• have your information deleted (Profile → Delete account, or see how to delete your account);
• restrict or object to how we use your information;
• receive your information in a portable format;
• withdraw your consent at any time (Profile → Privacy);
• not be subject to decisions made solely by automated means that have legal or similarly significant effects. We make no such decisions.

Exercising your rights is free. We will reply within one month; if a request is complex we may need up to two more months, and we will tell you if so. We may ask you to confirm your identity first.

You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.

Our coaching and the app are for adults. You must be 18 or over to create an account, and we do not knowingly collect information from anyone under 18.

We use only the storage the website and app need to work, plus your own display preferences. There are no analytics, advertising or tracking cookies. Our Cookies Policy lists exactly what is stored.

• Clients: message Luke in the app, or use Profile → Privacy and Profile → Your data.
• Anyone: use the form on our contact page and start your message with “Privacy”.

When this policy changes, we update this page, its version and its date. If a change affects how we use your health information or your rights, the app asks you to review and accept the new version before you continue.