Who we are

Naturally Fit is a personal training and exercise coaching business providing one-to-one personal training, strength and mobility sessions, return-to-exercise support, group exercise and related wellbeing services.

Data controller: Nathanielle Jones trading as Naturally Fit

Website: https://www.feelnaturallyfit.com/

Email: feelnaturallyfit@gmail.com

Correspondence address: 25 Pembroke Road, Norwich, NR2 3HD

Naturally Fit is the data controller for the personal information described in this notice.

What information we collect

Depending on the service you use, we may collect:

• identity and contact information, including your name, date of birth, email address, telephone number and, where relevant, home address;

• emergency-contact details;

• booking, attendance and communication records;

• information about your goals, exercise history, preferences, occupation, lifestyle and training availability;

• assessment and progress information, including measurements, exercise performance and programme records where relevant;

• payment and transaction information relating to bank-transfer payments;

• health information relevant to safe exercise participation, such as injuries, symptoms, medical conditions, medication, healthcare advice, exercise restrictions and physical-activity screening outcomes;

• correspondence and feedback you send to us;

• technical information collected through the website, such as cookies or analytics information, where applicable.

Why we use your information

We use personal information to:

• respond to enquiries and arrange consultations;

• provide and manage personal training, classes and related services;

• assess exercise suitability and identify appropriate adaptations;

• design, deliver and review exercise programmes;

• maintain client and attendance records;

• communicate about appointments, programmes and service administration;

• receive and reconcile bank-transfer payments and maintain accounting records;

• manage complaints, incidents, insurance matters and legal obligations;

• improve our services and business administration;

• send marketing communications where permitted by law and where any required consent has been obtained.

Lawful bases for ordinary personal data

Depending on the activity, Naturally Fit may rely on one or more of the following UK GDPR lawful bases:

• Contract — where processing is necessary to take steps at your request before entering into a service agreement or to provide services you have purchased.

• Legal obligation — where information must be retained or processed to comply with applicable legal, tax or regulatory obligations.

• Legitimate interests — where processing is reasonably necessary for business administration, service improvement, record keeping, security, or the establishment, exercise or defence of legal claims, provided your rights and interests do not override those interests.

• Consent — where you have freely chosen to give consent for a particular activity, for example certain marketing communications.

Health information and other special-category data

Health information is special-category personal data under UK data-protection law. Naturally Fit only asks for health information that is reasonably necessary to assess exercise suitability, adapt exercise appropriately and provide the service safely.

Where Naturally Fit relies on explicit consent as the Article 9 condition for processing health information, you will be asked to provide that consent separately and clearly. You may withdraw consent at any time. Withdrawal does not affect processing that was lawful before withdrawal. If health information is necessary to provide a service safely, withdrawal may mean that Naturally Fit cannot continue to provide that service.

For more detail, see the Health Data Processing Notice below.

Where information comes from

Most information is provided directly by you through enquiries, registration forms, consultation forms, PAR-Q+ documentation, assessments, emails, messages, booking systems or conversations during sessions.

Where you choose to provide information from a healthcare professional, such as a physiotherapy recommendation or medical exercise restriction, we will use only the information relevant to providing your exercise service.

Who we may share information with

We do not sell your personal information.

Information may be shared where necessary with service providers that help us operate the business, such as:

• Squarespace, which hosts and operates the Naturally Fit website;

• Google Workspace, used for business email, cloud storage and office-administration tools;

• Acuity Scheduling, used to arrange and manage appointments;

• the banking provider through which client bank-transfer payments are received; and

• accounting service providers, where these are used;

• insurers, professional advisers or legal advisers where necessary;

• healthcare professionals where you have asked us to communicate with them or where another lawful basis applies;

• public authorities, regulators, emergency services or law-enforcement bodies where disclosure is required or permitted by law.

Service providers should receive only the information required for the relevant purpose and must process it under appropriate contractual and data-protection arrangements.

International transfers

Some technology providers may process information outside the United Kingdom. Where this occurs, Naturally Fit will use providers that offer appropriate safeguards for international transfers, such as an applicable UK adequacy arrangement, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism.

How we keep information secure

Naturally Fit takes reasonable organisational and technical measures to protect personal information. These may include password-protected accounts, multi-factor authentication, restricted access to confidential health information, device security, secure cloud storage, controlled file sharing and keeping health records separate from general business administration where practical.

How long we keep information

We keep personal information only for as long as it is reasonably needed for the purpose for which it was collected, including legal, insurance, safeguarding, tax and dispute-resolution requirements.

Our retention schedule may include:

• enquiry records that do not lead to a client relationship: normally retained for up to 12 months after the last meaningful contact, unless longer retention is needed for a complaint or dispute;

• active client records: retained while services are being provided;

• adult client registration, health screening, consent, programme, assessment, session and relevant incident records: normally retained for 7 years after the client relationship ends or the last service is provided;

• financial and tax records: retained for at least the period required by HMRC; for a self-employed business this is generally at least 5 years after the 31 January Self Assessment submission deadline for the relevant tax year;

• marketing records: retained until you unsubscribe or withdraw consent, with periodic review so that information is not kept longer than necessary.

Records may be kept longer where a specific incident, complaint, insurance claim, legal requirement or regulatory obligation makes this necessary. At the end of the applicable retention period, records will be reviewed and securely deleted or anonymised unless there is a clear reason to keep them for longer.

Your data-protection rights

Depending on the circumstances, you may have the right to:

• be informed about how your information is used;

• request access to your personal information;

• ask for inaccurate or incomplete information to be corrected;

• ask for information to be erased in certain circumstances;

• ask us to restrict processing in certain circumstances;

• object to certain processing based on legitimate interests;

• receive certain information in a portable format;

• withdraw consent where processing is based on consent;

• complain to the Information Commissioner’s Office.

Some rights are not absolute and may not apply where information must be retained for legal, regulatory, insurance or legal-claim purposes.

To exercise your rights, contact: feelnaturallyfit@gmail.com

Complaints

If you have concerns about how Naturally Fit handles your personal information, please contact us first so that we can investigate.

You also have the right to complain to the UK Information Commissioner’s Office (ICO). Current contact details and complaint procedures are available at https://ico.org.uk/.

Marketing

We will not treat agreement to health screening, service terms or data processing as agreement to receive marketing.

Where marketing consent is required, it will be requested separately. You can unsubscribe from marketing at any time by using the unsubscribe method provided or by contacting us.

Cookies and website analytics

The Naturally Fit website is hosted by Squarespace. Necessary cookies may be used so the website and booking functions work correctly. Non-essential cookies are currently restricted until a visitor makes a choice through the Squarespace cookie banner. Visitors can Accept all, Decline all or Manage cookies, and can reopen Cookie Preferences to change their choice. Squarespace Analytics activity-log data is enabled and may include page visited, date and time, approximate location, referrer, browser/operating-system information and IP address.

Please use the Cookie Preferences control on the website for further information or to change your choices. If additional third-party analytics, advertising or tracking tools are introduced, this notice and the website consent controls will be reviewed.

Changes to this Privacy Notice

We may update this notice when our services, systems or legal obligations change. The current version should always be available on the Naturally Fit website and will show the date it was last updated.

HEALTH DATA PROCESSING NOTICE

Why we collect health information

Naturally Fit provides exercise services and therefore needs enough relevant health information to make reasonable decisions about exercise suitability, appropriate modifications and safe programme design.

We do not collect health information for diagnosis or medical treatment and we do not attempt to replace the role of your GP, physiotherapist, registered dietitian or other healthcare professional.

Health information we may collect

Depending on your circumstances, this may include:

• PAR-Q+ completion status and outcome;

• injuries, pain, symptoms or mobility limitations;

• diagnosed medical conditions that may affect exercise;

• medication relevant to exercise safety or tolerance;

• previous surgery or rehabilitation relevant to activity;

• exercise restrictions or advice provided by a healthcare professional;

• information about dizziness, loss of consciousness, chest symptoms or other exercise-related warning symptoms where relevant to screening;

• pregnancy-related exercise considerations where voluntarily disclosed and relevant;

• relevant assessment and progress information.

We aim to collect only information that is relevant to the exercise service you are asking us to provide.

How we use health information

We may use this information to:

• decide whether further screening or professional advice is appropriate before exercise;

• adapt exercise selection, intensity, range of movement or session format;

• identify movements or activities that should be avoided or progressed cautiously;

• plan return-to-exercise or rehabilitation-support programmes within our professional scope;

• record relevant changes to health status over time;

• respond appropriately to an incident or emergency during a session;

• establish, exercise or defend legal claims where necessary.

Our legal basis for health information

Health information is special-category data. Naturally Fit must have both a lawful basis under Article 6 of the UK GDPR and a separate condition under Article 9 before processing it.

For routine client health information used for exercise screening and programme adaptation, Naturally Fit intends to rely on:

• an appropriate Article 6 lawful basis for providing and administering the requested service; and

• explicit consent under Article 9(2)(a), where that is the selected and appropriate special-category condition.

Where health information later needs to be retained or used for the establishment, exercise or defence of a legal claim, Naturally Fit may rely on the applicable legal-claims condition under data-protection law rather than consent, where appropriate.

Explicit consent statement for forms

Where explicit consent is used, the client-facing form can state:

“I explicitly consent to Naturally Fit processing the health information I provide, including relevant information about medical conditions, injuries, symptoms, medication and professional healthcare advice, for the purposes of assessing exercise suitability, adapting my exercise programme and safely providing the exercise service I have requested. I understand that I may withdraw this consent at any time. I understand that if this information is necessary for Naturally Fit to provide the service safely, withdrawal may mean that the service cannot continue.”

This consent should be collected as a separate required affirmative action. It should not be bundled with marketing consent or hidden within general terms and conditions.

PAR-Q+ information

Naturally Fit may ask you to complete the current official PAR-Q+ or another appropriate physical-activity readiness process. Where practical, Naturally Fit records the outcome or participation recommendation rather than unnecessarily duplicating the full screening questionnaire.

If further screening is indicated, you may be asked to complete the official follow-up pathway or seek appropriate professional advice before certain exercise activities are undertaken.

Who can see your health information

Access to health information is restricted to Naturally Fit personnel who reasonably need it to provide or administer your service and to approved service providers where necessary for secure storage or administration.

Health information will not be shared with another trainer, healthcare professional, venue or other third party simply because they ask for it. We will normally obtain your permission unless another lawful basis permits or requires disclosure.

Emergency situations

If a serious health or safety incident occurs, relevant information may be shared with emergency services or other appropriate persons where necessary to protect life, health or safety and where the law permits the disclosure.

Accuracy and updates

You are asked to provide health information accurately to the best of your knowledge and to tell Naturally Fit about relevant changes that may affect exercise, including new symptoms, injuries, medication changes or professional advice.

Naturally Fit may periodically ask you to confirm whether your health status has changed rather than requiring you to complete a full intake questionnaire again.

Retention and deletion

Health information will be retained only for as long as reasonably necessary for safe service delivery and legitimate record-keeping requirements, including any applicable insurance or legal-claim periods. When it is no longer required, it will be securely deleted or anonymised where appropriate.

For adult clients, relevant health screening, consent, programme, assessment and session records are normally retained for 7 years after the client relationship ends or the last service is provided. A longer period may apply where a complaint, incident, insurance claim or legal matter is ongoing.

Withdrawing consent

If you wish to withdraw explicit consent for future health-data processing, contact feelnaturallyfit@gmail.com.

We will stop processing on the basis of consent where required, but withdrawal will not make earlier lawful processing unlawful. We may also need to retain limited records where another lawful basis permits or requires this, for example for legal claims or statutory record keeping.

Questions about your health information

For questions, access requests, corrections or concerns about health information held by Naturally Fit, contact:

feelnaturallyfit@gmail.com