PRIVACY NOTICE

1.Who we are

HBL Fitness is run by Harrison Lewis, a fitness and nutrition coach based in Shrewsbury, UK.

Harrison is the data controller. That means he decides how your data is used, and he is responsible for it.

Contact: harrison@hbl.fitness

The site is built and looked after by Harrison's web developer. He also has admin access, so he can fix problems. Nobody else has admin access.

2.What we collect and why

Each part below says what we collect and why. It also gives the legal reason, which the law calls the lawful basis.

If you send an enquiry

• Your name, email address and message.
• How you heard about HBL Fitness, if you choose to say.

The contact form emails your enquiry to Harrison so he can reply. It isn't saved in our database. Your "how you heard" answer is added to an anonymous tally, with no link to you.

Lawful basis: our legitimate interest in replying to people who get in touch, and steps you've asked for before coaching starts.

If you're a client: your account

• Your name and email address.
• Your settings, such as kg or lb, and when your account was set up.
• Your password, stored only in scrambled (hashed) form. Nobody can read it, including Harrison.
• A count of wrong password attempts, to stop people guessing. It resets after 15 minutes, and is deleted when you next log in.
• How many sessions you've cancelled today, to limit misuse.

Lawful basis: to provide the coaching you've signed up for (a contract).

If you're a client: your tracker and coaching

• Food and drink you log, with amounts, calories and macros.
• Your saved meals and your macro targets.
• Body measurements: weight, waist, chest, hips, arms, thighs, body fat and any notes.
• Your training programme and workout logs: exercises, sets, reps and weights.
• Notes Harrison keeps about your progress, including private coaching notes, and content he writes for you.

This lets you track your progress, and lets Harrison coach you.

Lawful basis: a contract, plus your explicit consent for health data (see section 3).

If you book sessions

• The date and time of each session.
• Whether it was booked or cancelled, and by whom.
• Any message Harrison adds if he has to cancel.

When you book or cancel, we email a confirmation to you and to Harrison.

Lawful basis: a contract.

If you connect Claude (optional)

You can connect the Claude AI app to your tracker, to log food by chatting. This is entirely your choice.

• We store scrambled (hashed) copies of the keys that let Claude reach your tracker.
• When you ask it to, Claude reads and updates your food log, saved meals, targets, weight and body measurements.
• That data then goes to Anthropic, the company behind Claude, under your own account with them. Anthropic's privacy policy applies to it.
• Food photos you give Claude go to Anthropic, not to us. We only receive the food entries Claude logs.

To disconnect, remove the connector in Claude. Changing your password cancels its keys straight away.

Lawful basis: your consent, given when you connect.

Food search and barcode scanning

• Food searches and barcode lookups are made by our server. It uses our own food table and Open Food Facts. Open Food Facts never learns who you are.
• The barcode scanner uses your camera inside your browser. Camera images never leave your device. Only the barcode number is sent to our server.
• We keep a shared store of food results, so each food is only looked up once. It holds food information only, nothing about you.

Visiting the website

• Server logs. Like almost every website, our hosting records each visit: your IP address, browser type, the page and the time. Some entries also include your email address, for example when an email fails to send or you connect Claude. We use these only to keep the site working and secure.
• Visit counts. Our home page uses Cloudflare Web Analytics. It counts visits without cookies, and doesn't follow you to other sites. Harrison only sees totals, such as visits per day.

Lawful basis: our legitimate interest in running a secure website, and knowing roughly how many people visit.

3.Health data and your consent

Your weight, body measurements, food logs and workout logs say something about your health. UK law calls this special category data, and gives it extra protection.

We only use it with your explicit consent, and only to provide your coaching. You give that consent when you start coaching and choose to log this information. You never have to log anything you'd rather not.

You can withdraw your consent at any time by emailing harrison@hbl.fitness. We'll then delete your health data. The tracker can't work without it. Withdrawing doesn't affect anything we did before you asked.

4.Who else is involved

We never sell your data, or share it for marketing. These companies help run the site. They only use your data to provide their service to us.

• Google Cloud hosts the website and its database. Your account and tracker data are stored in London, UK.
• Google also provides the inbox that emails to harrison@hbl.fitness arrive in, including enquiries.
• Resend sends our emails: enquiries to Harrison, welcome and password-reset links, and booking confirmations. It sees the email address and the message.
• Cloudflare runs our domain name and forwards email sent to @hbl.fitness addresses. It also provides the cookie-free visit counts.
• Open Food Facts answers food lookups made by our server. No personal data is sent.
• MuscleWiki provides exercise demo videos. No personal data is sent. See section 5.

Files your browser loads. Our pages load fonts from Google Fonts. The home page and the barcode scanner also load code files from cdnjs (run by Cloudflare) and unpkg. As with any download, these services see your IP address and browser type. We send them nothing else.

Outside the UK. Our database is in the UK. Google, Cloudflare and Resend are US companies, and may handle some data outside the UK, for example when sending an email. When they do, they use safeguards recognised by UK law, such as the UK–US data bridge or standard contract terms.

We would only share your data with police or regulators if the law required it.

5.Exercise demo videos

Some exercises in a training programme come with a short demo video.

• Demos are fetched by our server, so your device never contacts MuscleWiki and no personal data is sent to them.
• Your browser remembers which demonstrator you picked, so you don't have to choose every time. That choice is kept on your device, not in your account.
• To stay within our usage limits, we count how many demos are played. These counters use a scrambled (hashed) code instead of your name or email. They're deleted after 45 days.

Exercise data and videos provided by MuscleWiki.com

Visit musclewiki.com for their full exercise library.

6.Cookies and device storage

We don't use advertising or tracking cookies. That's why you won't see a cookie banner.

• One login cookie, called hbl_admin. It keeps you logged in, and protects our forms from forgery. It's only set when you use the login pages. It lasts up to 8 hours after you last use the site, or until you log out. The site can't work without it, so the law lets us use it without asking.
• Intro animation. The home page remembers that you've seen its intro animation, so it only plays once. This uses your browser's session storage, and clears when you close the tab.
• Page animations. Some animations carry on from one page to the next, for example after you log in. Your browser's session storage passes a short note between the two pages: which animation to play, and a few numbers such as where you tapped. It is used for 30 seconds at most, the next page deletes it when it reads it, and it clears when you close the tab. It never leaves your device.
• Calorie ring. The calorie ring remembers the totals it last showed you for each day, so it only fills again when they change. This uses your browser's session storage. It is only used while you stay logged in: logging out deletes it, and it clears when you close the tab. It never leaves your device.
• Page layouts. When you move between portal pages, placeholder cards fly to where the next page's cards will be. To know where that is, your browser remembers the size and position of each page's cards from your last visit: numbers only, never what the page says. This uses your browser's local storage, which stays after you close the tab. It is never used after 30 days, logging out deletes it, and it never leaves your device.
• Demo videos. Your choice of demonstrator is remembered on your device (see section 5).

7.How long we keep it

8.Your rights

Under UK data protection law, you have the right to:

• Access: get a copy of the data we hold about you.
• Rectification: have wrong data corrected. You can also edit or delete most of your logs yourself in the portal.
• Erasure: have your data deleted.
• Restriction: ask us to pause using your data while a problem is sorted out.
• Portability: get your data in a common file format, such as a spreadsheet.
• Objection: object to us using your data for our legitimate interests.
• Withdraw consent: at any time, for your health data or the Claude connection.

To use any of these rights, email harrison@hbl.fitness. It's free. We'll reply within one month. We may ask you to confirm who you are first.

Complaints. If you're unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office (ICO), the UK regulator, at ico.org.uk or on 0303 123 1113.

9.Keeping it safe

• Everything is sent over an encrypted connection (HTTPS).
• Passwords are only ever stored in scrambled (hashed) form.
• An account locks for 15 minutes after 5 wrong passwords.
• Each client can only ever see their own data.
• Only Harrison and his web developer have admin access.
• We don't make automated decisions about you, or profile you for marketing.

10.Changes to this notice

If we change this notice, we'll update the date at the top. If a change affects how we use your data, we'll email clients before it happens.