Privacy Notice

Last updated: 28 August 2026

1. Who I am

I am Robert Ede, trading as Ede Fitness. I am the data controller responsible for the personal information covered by this privacy notice.

Website: https://edefitness.com/
Email: [email protected]
Telephone: 07782 390729
Business location: Lightwater Leisure Centre, Lightwater Country Park, Lightwater, Surrey GU18 5RG

Ede Fitness is registered as a data controller with the Information Commissioner’s Office.

This notice explains how I collect and use personal information relating to website visitors, prospective clients, current and former clients, and other people who communicate with Ede Fitness. It applies throughout the relationship, from an initial enquiry and consultation through client onboarding, coaching, payment, support and the retention of relevant records after services end.

2. The information I collect

Information you provide

I may collect the following information when you book a consultation, make an enquiry, telephone me, send a message, use the website chat facility or subscribe to receive updates:

• Your name
• Your email address
• Your telephone number
• Your consultation date and time
• Information included in an enquiry or message
• How you heard about Ede Fitness
• Your communication and marketing preferences
• Records of my communications with you
• Call recordings, transcripts and AI-generated call summaries where you agree to continue with a recorded call handled by Alex, my AI assistant
• Billing, invoice, transaction and payment-status information if you become a client
• Your date of birth or age, address and emergency-contact information where required for client onboarding and service delivery
• Your answers to the Physical Activity Readiness Questionnaire (PAR-Q) and Informed Consent Form
• Information about your health, injuries, medical conditions, physical limitations and other factors relevant to exercise safety and coaching suitability
• Your goals, exercise history, training preferences, lifestyle information and information relevant to nutrition coaching
• Training programmes, session attendance, exercises performed, performance records, progress measurements, check-ins, app activity and coaching communications
• Information recorded or shared through Everfit, including onboarding and coaching forms, workout and programme data, nutrition information, progress photographs and measurements, habits, messages, booking information, session-credit records and data from connected health or fitness services where you choose to connect them
• Posts, comments, reactions, photographs and moderation information shared through the Everfit Community
• First-aid, accident and incident information, including what happened, any injury or symptoms, assistance provided, witnesses and relevant follow-up
• Your WhatsApp username or telephone number, profile information, messages and attachments when you contact me through WhatsApp Business
• Facebook-group membership answers, posts, comments, reactions and moderation records
• Photographs, videos, testimonials, progress stories and records of the consent you have provided for their use
• Reviews and feedback that you publish or provide to me

Health and coaching information

Information about your physical or mental health is special category personal data and receives additional protection under data-protection law. I only collect health information that is reasonably necessary to assess suitability, plan and adapt coaching, support safe participation, monitor progress and meet appropriate professional, safety, insurance or legal responsibilities.

Where health information is needed to provide coaching, my Article 6 lawful basis is taking steps at your request before entering into a contract or performing my contract with you. My Article 9 condition for processing health information is your explicit consent. This consent is requested separately and recorded during client onboarding using a dedicated health-information consent statement or form.

You may withdraw your consent to the processing of health information at any time. This will not affect processing that was lawful before withdrawal. If I cannot continue to process information that is necessary to assess your suitability or provide coaching safely, I may be unable to continue providing some or all of the service.

Not every use of health information relies on consent. If an accident, injury or emergency occurs, I may process relevant information to provide or arrange immediate assistance, complete an appropriate first-aid, accident or incident record, meet applicable reporting or insurance requirements, and establish, exercise or defend legal claims. The lawful bases and special-category conditions for those purposes are set out below.

Communications information

When you communicate with me by telephone, text message, email, WhatsApp or social media, I may also collect the account, username, telephone number or email address used, the date and time of the communication, delivery and engagement information, and the contents of the communication.

The public website forms are not intended for detailed medical or health information. Please do not submit sensitive health information through a general enquiry, chat message, WhatsApp message, social-media message or a call handled by Alex.

Information collected automatically

When you visit the website, certain technical information may be collected, including:

• Your IP address
• Browser and device information
• The pages you visit
• The date and time of your visit
• The website or link that referred you
• Website interactions and performance information
• Cookie identifiers and consent preferences

Non-essential analytics and advertising information is only collected where permitted by your CookieYes preferences.

3. How I use your information

I do not use information covered by this notice to make decisions that have legal or similarly significant effects through solely automated processing.

4. Consultation bookings and enquiries

Consultation bookings, enquiries and related communications are retained in my customer relationship management system, HighLevel, which may also be described as GoHighLevel or LeadConnector.

Booking a consultation does not enter you into a paid coaching contract. I use the information to arrange the consultation, communicate with you about it and respond to your enquiry.

You are not required to consent to marketing to book a consultation or receive a response.

5. Email marketing

I will only send general marketing emails where I have an appropriate legal basis to do so.

Where I rely on consent, the marketing choice will be separate from the consultation booking or enquiry. You can withdraw your consent at any time by using the unsubscribe link in an email or by contacting me at [email protected].

Withdrawing marketing consent will not affect consultation confirmations, appointment reminders or direct responses to an enquiry.

I may retain a minimal suppression record after you unsubscribe so that I can respect your preference and avoid adding you back to marketing communications accidentally.

I use Brevo to send bulk emails, including marketing communications and relevant communications with clients. Brevo may process names, email addresses, subscription preferences, delivery information and engagement information such as whether an email was delivered, opened or clicked.

6. Communications and AI-assisted tools

Telephone calls, text messages and Alex

Calls to my main business telephone number may be answered by Alex, my AI assistant. Alex can respond to general enquiries, take appropriate messages and help prospective clients arrange a consultation.

At the beginning of a call, Alex explains that the call will be recorded, transcribed and summarised and asks whether the caller is happy to continue. If the caller does not agree, Alex will not continue the call or collect further information.

Where the caller agrees to continue, the audio recording, transcript and an AI-generated summary of the conversation are created. These records and the associated call information are stored in my HighLevel customer relationship management system. Twilio provides the underlying telephone and SMS infrastructure.

The information processed may include your name, telephone number, the date and time of the call, the contents of the conversation, the recording, transcript and summary, and any consultation arrangements made during the call. I use this information to respond to your enquiry, arrange a consultation, maintain an accurate record of the communication and monitor the operation and quality of the service.

Please do not provide detailed medical or health information to Alex. Any injuries, medical considerations or other sensitive information relevant to coaching suitability can be discussed directly with me at the appropriate stage.

Other AI-assisted tools

Some of the business, communication and productivity services I use contain artificial-intelligence-assisted features. I may use these features for limited purposes such as helping me draft or summarise communications, organise information, conduct research and analyse business or marketing information.

Depending on the task, relevant information may be processed by services provided by organisations such as Microsoft, OpenAI and Anthropic. I take reasonable steps to limit the personal information provided, use available privacy and model-training controls, and avoid using identifiable client information where it is not necessary for the task.

AI-generated material is reviewed by me before it is relied upon or used in a communication. I do not use these tools to make solely automated decisions about individuals that produce legal or similarly significant effects.

7. WhatsApp, social media and published client content

WhatsApp Business

You may contact me through my WhatsApp Business account. WhatsApp is not connected to my HighLevel system. When you contact me through WhatsApp, I may process your WhatsApp username or telephone number, profile information, messages, attachments, timestamps and delivery information so that I can respond to and manage the communication.

WhatsApp provides end-to-end encryption for ordinary personal messages, but WhatsApp and other Meta companies process account, device, connection and usage information under their own terms and privacy policies. Please do not send detailed medical or health information through WhatsApp.

Private Facebook group

I administer an approval-based private Facebook group for clients, prospective clients and other people interested in local fitness and nutrition information. I may process membership answers, Facebook profile information, posts, comments, reactions and moderation information to decide membership requests and administer the group.

Although the group is private, it is not confidential. Anything a member posts can be seen by other approved members and is also processed by Meta under its own terms and privacy policies. Members are asked not to post detailed medical information or copy, screenshot or share another member’s content outside the group without permission.

I may remove content that breaches the group rules or creates an inappropriate privacy, safety or legal risk. If you disclose health information in the group, you should understand that it will be visible to the approved membership. The group is not an appropriate place to obtain medical advice or discuss detailed medical information.

Everfit Community

I may provide clients with access to a private community area within Everfit. Information you choose to post there, including your profile information, posts, comments, reactions, photographs and other shared content, may be visible to other members who have access to that community.

The Everfit Community is intended for general coaching support, encouragement and discussion. It is not a confidential channel for health information. Please do not post detailed medical information or other sensitive personal information that you would not want other community members to see. I may moderate or remove content where reasonably necessary to protect privacy, safety or the appropriate operation of the community.

Photographs, testimonials and progress stories

I only publish identifiable client photographs, videos, testimonials or progress stories for promotional purposes where the client has provided separate consent. The consent request identifies the material and intended uses or publication channels. Consent is voluntary and is not a condition of receiving coaching.

You may withdraw this consent by contacting me. Withdrawal will not affect use that was lawful before it was withdrawn. I will stop future use and remove the material from channels I control where reasonably practicable, although copies already shared, indexed or republished by other people or platforms may remain outside my control.

Reviews and public feedback

Reviews that you publish on Google Business Profile or another public platform may be quoted or shared to present genuine customer feedback. I will reproduce reviews accurately and will not add health or other sensitive details. Where a review contains health information, or where I wish to use additional identifiable content, I will obtain appropriate consent or anonymise the material before republishing it.

You may object to my use of a public review by contacting me. Where reasonably practicable, I will stop future use and remove copies from channels I control. Removing a review from the original platform is subject to that platform’s own procedures and privacy terms.

8. Everfit client coaching platform

I use Everfit Technologies, Inc (Everfit) as a client coaching platform. Everfit may be used for client onboarding, training-programme delivery, workout logging, progress tracking, nutrition coaching, habits, forms and check-ins, progress photographs, messaging, community features, booking and session-credit management. Where you choose to connect a compatible health or fitness service, relevant data from that service may also be made available through Everfit.

For personal information that I collect or upload to Everfit in connection with providing Ede Fitness services, I remain the data controller and Everfit generally processes that information on my behalf under its data-processing terms. Everfit may separately act as an independent data controller for certain information that it collects directly from you for its own account, platform, security and service administration purposes.

When you create an Everfit account, you are also asked to agree separately to Everfit's own Privacy Policy and Terms of Service. Those terms govern your direct relationship with Everfit where it acts in its own right. They do not replace this Ede Fitness Privacy Notice, my client terms, or any separate consent I request for the processing of health information or use of client content.

Everfit may use subprocessors and may process personal information outside the United Kingdom. Restricted international transfers of information for which I am controller are subject to the contractual and legal safeguards set out in Everfit's data-processing terms and the requirements described in section 13 below.

Further information is available in the Everfit Privacy Policy, Everfit Terms of Service and Everfit Data Processing Agreement.

9. Payments and accounting

If you become a client, payments may be made using Stripe or GoCardless. This may include payments made through a secure payment page, Direct Debit or a supported tap-to-pay facility.

You provide your card or bank-account details directly to the relevant payment provider. I do not receive or store your full card number or full bank-account details. I may receive limited information needed to identify, administer and reconcile the payment, such as your name, contact details, billing information, the amount paid, a transaction reference, payment status and limited payment- method information.

Stripe processes card and tap-to-pay transactions and may use transaction and technical information for purposes including payment processing, authentication, fraud prevention and compliance with its legal obligations. Further information is available in the Stripe Privacy Policy.

I use GoCardless to process Direct Debit payments. More information about how GoCardless processes personal information and about your data-protection rights, including your right to object, is available in the GoCardless Privacy Notice.

I use Xero for invoicing, bookkeeping and accounting. Xero may process names, contact details, invoice information, payment information and transaction records. Further information is available in the Xero Privacy Notice.

10. Calculators and website tools

The website may contain calculators or interactive tools that provide general estimates, such as estimated protein requirements.

These tools operate within your browser. The information you enter and the result produced are not submitted to me, added to my CRM or retained by Ede Fitness.

I may record that a calculator was used, but I do not record the values entered or the result produced.

11. Cookies and similar technologies

I use CookieYes to provide information about cookies and manage visitor preferences.

Cookies that are strictly necessary for the website to operate may be used without consent. Non-essential analytics, advertising and similar technologies are controlled through the choices presented by CookieYes.

Depending on your choices, these technologies may be provided by organisations such as Google, Meta, X and Microsoft.

You can reject non-essential cookies and change or withdraw your preferences at any time through the cookie settings available on the website.

Further information about the individual technologies, providers, purposes and durations is provided in my Cookie Policy.

12. Who receives your information

I may use trusted service providers to operate the website and support my communications and business administration. These may include:

• HighLevel, GoHighLevel or LeadConnector for forms, consultation booking, CRM, AI-assisted call handling, call recordings, transcripts, summaries and communications
• Everfit Technologies, Inc for client onboarding, training-programme delivery, workout logging, coaching forms and check-ins, nutrition coaching, progress tracking, progress photographs, messaging, community features, booking and session-credit management, and connected health or fitness data where enabled by the client
• PT Distinction for client onboarding, delivery of training programmes, coaching communications, progress tracking and access to coaching resources during the transition to Everfit
• Brevo for bulk email delivery, marketing and client communications
• Twilio for telephone and SMS infrastructure, call routing and message delivery
• Microsoft 365, including AI-assisted productivity features, for email, documents and business administration
• OpenAI and Anthropic for limited AI-assisted writing, summarising, research and business analysis
• Stripe for card payments, tap-to-pay transactions, fraud prevention and related payment services
• GoCardless for Direct Debit payment processing
• Xero for invoicing, bookkeeping and accounting
• WhatsApp and Meta for WhatsApp Business communications
• Meta for the administration of my private Facebook group and for content published through Facebook or Instagram
• Google for Google Business Profile, public reviews and content published through Google services
• LinkedIn, X and other social-media platforms where I maintain a business presence or publish content
• Emergency services, relevant healthcare providers, Lifestyle Fitness or Lightwater Leisure Centre, insurers and legal advisers where reasonably necessary following an accident, injury or incident
• CookieYes for cookie preference management
• Website hosting, security and technical-support providers
• Google, where Google Analytics or related measurement services are enabled with permission
• Microsoft, where Microsoft Clarity or related services are enabled with permission
• Meta and X, where advertising measurement technology is enabled with permission
• Professional advisers, regulators, courts, law-enforcement bodies or public authorities where disclosure is necessary or required by law

These providers handle information under their applicable terms, contracts, privacy policies and legal safeguards. I use available settings and controls intended to limit unnecessary use of personal information.

I do not sell personal information.

13. International processing

Some of the technology providers I use may process information outside the United Kingdom.

Where a restricted international transfer takes place, I require an appropriate transfer mechanism. Depending on the destination and provider, this may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses or another legally recognised safeguard.

You may contact me if you would like more information about the safeguards applicable to a particular provider.

14. How long I retain information

I retain personal information only for as long as reasonably necessary for the purpose for which it was collected.

Unless a longer period is needed because of a legal dispute or other legal obligation:

• Consultation bookings, enquiries and related communications are retained for as long as reasonably necessary to manage the enquiry, provide appropriate follow-up and maintain relevant business records. Records that are no longer required are deleted or anonymised when they are reviewed, unless there is another lawful reason to retain them.
• Call recordings, transcripts and AI-generated summaries are retained only for as long as reasonably necessary to manage the enquiry, maintain appropriate business records and resolve any query or dispute.
• Marketing contact information is retained until you unsubscribe or I stop the relevant marketing activity.
• A minimal suppression record may be retained after an unsubscribe request.
• Invoices, payment records and other accounting records are retained for the period required by tax, accounting and other applicable laws. As a sole trader, this will generally be at least five years after the relevant 31 January Self Assessment submission deadline, and may be longer where legally required.
• PAR-Q responses, informed-consent records, coaching programmes, session records, progress information and related client communications are normally retained for the duration of the coaching relationship and for up to six years after it ends where reasonably necessary for professional, contractual, insurance or legal purposes.
• Health information that is no longer necessary for those purposes is deleted or anonymised earlier where reasonably practicable.
• First-aid, accident and incident records are normally retained for at least three years and may be retained longer where reasonably necessary because of an insurance requirement, statutory reporting obligation, complaint or actual or potential legal claim.
• WhatsApp and social-media communications are retained for as long as reasonably necessary to manage the communication, relationship or enquiry, subject to the controls and retention practices of the relevant platform.
• Facebook-group membership answers, posts, comments and moderation records remain available for as long as necessary to administer the group or until they are removed by the member, by me or by Meta, subject to Meta’s own retention practices.
• Everfit coaching records that I control are retained in accordance with the applicable client and coaching retention periods above. Community content may remain available while the community and client access remain active or until it is removed, subject to Everfit’s own retention obligations for information it processes as an independent controller.
• Client-content consent records are retained for as long as the relevant material is used and for as long as reasonably necessary afterwards to demonstrate the consent given or withdrawn.
• Published photographs, videos, testimonials and progress stories are retained until consent is withdrawn, the agreed use ends or the material is no longer required, subject to the limits described above.
• Copies of public reviews used by me are retained while they remain relevant to the stated purpose or until a justified objection is upheld.
• Cookie-consent records are retained for the period reasonably necessary to demonstrate and respect the choice made.
• Technical and security records are retained according to the relevant system’s security and retention settings.
• Analytics information is retained according to the settings applied to the relevant analytics service.

15. How I protect your information

I use appropriate technical and organisational measures intended to protect personal information from unauthorised access, loss, misuse, alteration or disclosure.

These measures include controlled access to business systems, appropriate account security and the use of established service providers.

No internet-based service can be guaranteed to be completely secure. If you believe that information you have provided has been compromised, please contact me promptly.

16. Your data-protection rights

Depending on the circumstances, you may have the right to:

• Ask for a copy of your personal information
• Ask me to correct inaccurate or incomplete information
• Ask me to delete your information
• Ask me to restrict how your information is used
• Object to processing based on legitimate interests
• Withdraw consent where processing is based on consent
• Receive certain information in a portable format
• Complain about how your information has been handled

These rights are not absolute and may depend on the reason the information is being processed.

To exercise a right, contact me at [email protected]. I may need to ask for information to confirm your identity before responding.

17. Complaints

If you have a concern about how I have handled your personal information, please contact me first so that I can investigate it.

You also have the right to complain to the Information Commissioner’s Office:

• Website: https://ico.org.uk/make-a-complaint/
• Telephone: 0303 123 1113

18. Other websites and embedded content

The website may contain links to, or content supplied by, other websites and services. Those organisations are responsible for their own privacy practices when you interact directly with them.

Where embedded content uses non-essential cookies or similar technology, it will be controlled through the available cookie preferences where required.

19. Children

Ede Fitness services and this website are directed towards adults. I do not knowingly use the website to collect personal information from anyone under 18.

If you believe that a person under 18 has provided personal information through the website, please contact me so that I can review and, where appropriate, delete it.

20. Changes to this notice

I may update this privacy notice when my website, service providers or legal obligations change.

The latest version will be published on this website with the date it was last updated.

21. Contact

For questions about this privacy notice or how I handle personal information, contact:

Robert Ede trading as Ede Fitness
Email: [email protected]
Telephone: 07782 390729