Privacy policy

Data controller

MatchMyTrainer Limited (company number 16996627) is the data controller for personal data processed through the Service. We are registered in England and Wales. You can contact us at team@matchmytrainer.uk.

What we collect

• account details (email and name)
• profile information you provide (e.g. trainer bio, services, venues, photo)
• booking and subscription details (trainer, service, location, date/time, notes, billing period)
• reviews you leave after completed bookings
• qualification documents uploaded by trainers (e.g. certification PDFs, insurance documents, DBS check certificates): these are stored in a private storage bucket and are only accessible to the trainer who uploaded them and our admin team for document review purposes
• technical data needed to operate the Service (e.g. logs and error reports)
• email addresses and names submitted through our free guide download pages: these are stored separately from platform accounts and used to deliver the requested content and occasional marketing emails (see "Marketing emails" below)

Health information

You can add injuries, health conditions, training goals and notes to your health profile. Information that reveals your physical or mental health is special category data under UK GDPR. Share only what is relevant to your training. Emergency contact details are stored separately; let that person know you have provided their details.

Purpose and consent: Optional health information helps trainers prepare and adapt sessions. Our basis for this processing is consent under Article 6(1)(a), together with explicit consent under Article 9(2)(a). This requires a clear, informed choice about the information and who can access it, separate from accepting our general terms. You can choose not to complete the health profile.

Who can access it: Your shared health profile is available to trainers you have booked with, including previous trainers. It is not a separate profile for each trainer and is not public. Authorised platform staff may access relevant information where needed for support or to investigate a safety concern. Trainers may also keep notes about your sessions and are responsible for their own use of client information in their training business.

Your choices: You can edit or clear the fields on your health profile page. To withdraw consent or request deletion of health information and related records, contact us at team@matchmytrainer.uk. Withdrawing consent does not affect the lawfulness of earlier processing based on valid consent. We will explain any records that must be retained on another lawful basis; see the retention and your rights sections below. Clearing a profile does not erase copies already held in other records or by a trainer.

What we use it for

• to provide core features (accounts, booking, reviews)
• to review uploaded qualification documents against what trainers have told us
• to send transactional emails (confirmations and notifications)
• to prevent abuse and keep the platform secure
• to improve product quality and user experience
• to deliver free guides and resources you request, and to send occasional marketing emails about MatchMyTrainer (you can unsubscribe at any time)

Legal basis (GDPR)

Under the UK General Data Protection Regulation (UK GDPR), we process your personal data based on the following legal grounds:

• Contract performance: to provide the Service, process bookings, and fulfil our obligations to you
• Legitimate interests: to operate and improve the Service, prevent fraud, and ensure security (where these interests are not overridden by your rights)
• Consent: for optional analytics and advertising, marketing email choices, and optional health information as explained above. Requesting a guide or uploading a document does not, by itself, establish consent for other uses.
• Legal obligations: to comply with applicable laws, such as tax and accounting requirements

Public information

Trainer profiles are public so clients can browse trainers and book sessions. This may include a trainer's name, photo, bio, services, venues, pricing, reviews, and document entry details labelled ‘Document seen’ (qualification name, type, and issuing body: but not the uploaded document itself, which remains private).

Reviews are shown on trainer profiles. Reviewer display names are limited (for example, first name and last initial) to reduce unnecessary exposure of client data.

Sharing

We only share data with service providers needed to run the Service. We do not sell personal data.

• Supabase (database, authentication, and file storage)
• Vercel (website hosting, plus optional usage and performance measurement when you allow analytics)
• Stripe (payment processing for bookings, packages, and subscriptions: Stripe securely tokenises your payment method for recurring charges; we never store card details)
• Resend (account, booking and requested-guide emails, plus marketing mailing lists and delivery)
• Sentry (error monitoring and performance tracking: may collect IP addresses, browser information, and technical error context to help us identify and fix issues; Sentry processes this data as our data processor)
• PostHog (analytics and session recordings, hosted in the EU)
• Meta (advertising measurement when you allow advertising). Browser events and server-side guide-request events help measure ad visits and conversions. These may include browser identifiers, an IP address, browser information and a hashed email address. A hashed email address can still be matched to you; it is not anonymous.
• Location lookup providers (only when you search by location): OpenStreetMap Nominatim and postcodes.io

Cookies and analytics

We use PostHog to understand how people use our Service and to improve the user experience. This includes:

• page views and interactions (clicks, form submissions)
• session recordings that show how users navigate the site
• performance metrics (page load times)

Optional analytics and advertising are off until you choose to allow them. You can choose each separately. With analytics enabled, PostHog can record your visits and interactions and link them to your account ID, email and role when you sign in. With advertising enabled, we use Meta to measure ad visits and conversions. Declining these options does not affect account access, bookings or payment processing.

Change your choices using the cookie preference controls. Your choice applies to this browser and expires after 180 days. Withdrawing stops new optional tracking; it does not erase data already sent. Payment webhooks do not send optional PostHog or Meta events because they do not carry your current browser choice.

Necessary operational records, payment processing and error monitoring are separate from optional usage analytics. We still use these to provide the service and investigate problems. PostHog analytics is hosted in the European Union.

Marketing emails

We use the name and email address you provide to deliver a guide you request. Marketing emails are a separate choice: tips, resources and product updates should only be sent with the permission required for that purpose. Downloading a guide, creating an account or accepting advertising cookies is not a substitute for email marketing consent.

You can withdraw marketing consent at any time using the unsubscribe link in an email or by contacting team@matchmytrainer.uk. This does not stop essential account, booking or payment messages. We retain a limited record of your opt-out so we can respect it. A later guide request should not restart marketing without a fresh choice from you.

Resend processes contact details to deliver our emails and manage our mailing lists. We do not sell your email address or provide it to other organisations for their own email marketing. Advertising measurement, including consented use of a hashed email address, is explained separately above.

International transfers

Some of our service providers are US-based companies. However, we use EU-hosted regions wherever possible. Where personal data is processed outside the UK, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the UK Information Commissioner's Office (ICO).

Retention

We keep personal data only as long as needed to operate the Service and for legitimate business purposes such as security, support, and resolving disputes. You can request deletion of your account and associated data (see "Your rights").

To request account deletion, email team@matchmytrainer.uk. We review each request and explain what will be deleted, what we need to retain, and why. We may ask for information to confirm that the account belongs to you.

Deletion requests cover your profile and associated personal data, including uploaded documents. Where you have bookings, payments or subscriptions, we also need to account for any outstanding obligations. Hiding a profile or disabling sign-in is not the same as completing deletion.

Some records may need to be kept for tax and accounting requirements, disputes, or other legal obligations. These can include information that identifies you. We explain any exceptions that apply to your request, including how retained copies and backups are handled.

Your rights (GDPR)

Under the UK GDPR, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (in certain circumstances)
• Object to processing based on legitimate interests
• Request restriction of processing
• Data portability (receive your data in a structured format)
• Withdraw consent at any time where we rely on consent as the legal basis for processing (this does not affect the lawfulness of processing carried out before you withdraw consent)

To exercise these rights, contact team@matchmytrainer.uk. We’ll handle your request without undue delay and normally within one calendar month. If a permitted extension is needed, we’ll explain why within that first month.

If you are not satisfied with how we handle your request, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

Automated decision-making

We do not use automated decision-making or profiling as defined under GDPR Article 22.

Changes to this policy

We may update this policy from time to time. We’ll update the “Last updated” date above when we do.