Privacy Policy

‘Tony Muratori Coaching’ is an organisation that provides exercise, diet and holistic lifestyle coaching for those who wish to improve their health.

We understand that when you share your details with us, we must look after this information (Your personal data) and comply with data protection laws, specifically the UK General Data Protection Regulation (‘UK GDPR’) and the UK Data Protection Act 2018 (‘DPA’). We need to tell you what we are collecting, why and what we are using your information for. We want you to be confident that your data is safe and secure with us and that you understand how we will use it.

We also need to tell you that we are the ‘Controller’ of the information collected, that is Tony Muratori Coaching. You can contact us at [email protected]

What do we collect about you?

Generally, we collect information (your personal data) that you provide on our questionnaires and forms. We may be provided with copies of some information by someone else if you have been referred to us. We will particularly collect your name, address, contact details, DOB, any relevant information about health or health conditions and lifestyle information. Your information will also include details about payment methods which may include your bank details for BACS or direct debits.

Under the UK GDPR, some of this information is known as Special Category Data or Sensitive Data because it relates to your health which may include images, reports, or correspondence. We ensure that we have all the necessary arrangements in place to secure this data.

We will also collect information you provide when you register on the PTEnhance website, book appointments and track any training packages via this service.

Why do we need this and what allows us to collect it?

Without the information described above we cannot provide you with a professional and safe service. We need your contact details to be able to make appointments and agree training packages with you.

When you make initial contact with us, this will be with your Consent.

This is known as the Lawful or legal basis for collecting your information. You can withdraw your consent at any time (see ‘Your Rights below’). If you have been referred to us, this will be by a person or organisation known to you and they will obtain your consent to share your information with us.

When we do agree to work together, we will form a Contract. This means that we need to collect your information to enable us to monitor and perform the contract agreed. Part of this contract will include payment terms and we have a Legitimate Interest to hold payment details to be able to invoice and collect payment.

Storing your information

We are committed to take all reasonable steps to ensure that your information is held securely and to prevent unauthorised access.

We hold both electronic and paper records. For electronic records, these are held in an online facility that has a unique login and password. Paper records are held under ‘lock and key’. When we transfer any records, we use technical and physical security appropriate to that transfer.

We do hold certain information such as your name and appointment details in the PTEnhance online system. This is secured by unique login and the suppliers undertake all security measures necessary to comply with UK and EU data protection laws, and as a USA company, they take all legal steps to provide an adequate level of protection to your information. You can read more about PTEnhance and how they collect and use your information at the following link Privacy Policy - PT Enhance.

Sharing you information

We may have to share information to seek professional or security advice but this will only be with accredited and approved professionals who we believe meet our expectations of privacy and protection of any information shared. We will contract with any such professionals and ensure that these contracts include all necessary clauses for protecting data.

We may share your information and outcomes with any referring person or organisation, or your GP but we will discuss this with you first and seek your consent

We will not allow any others to have access to your information unless we are required to share this with them by law or we are ordered to do so by a court.

Overseas Transfers and decision-making

We endeavour to avoid transferring your information to other countries as far as possible but we do use PTEnhance which is based in the USA. We have a contract in place with them and relevant clauses are in place.

We do not use your information for automated decision-making, nor do we use it for profiling purposes.

How long we keep your information

We will keep your information whilst you are receiving services from us and for up to 12 months after you have completed the programme.

We do have some legal obligations to keep certain data. For example, we are required by the HMRC to maintain financial records for the current financial year plus another 6 years, after which we will securely destroy all information. We are also required to keep copies of contract for 6 years after the end of the contract.

Your rights

You have a number of rights linked to you information under the data protection laws. Generally, you are not required to pay a fee to exercise these rights and we have to comply with your requests within set timescales.

To summarise your rights these are:

Right to access (the Subject Access Request or SAR – a right to request access to your information and obtain a copy of this)
Right to Rectification (correcting inaccurate information)
Right to Erasure (also known as the right to be forgotten)
Right to Restriction of processing (to ask to not do process your information in certain circumstances)
Right to Data Portability (asking us to provide a machine-readable copy of electronic data you have provided to us with your consent where we technically do this)
Right to Object (asking us not to do some actions such as marketing or profiling)
Rights linked to automated decision-making and profiling (asking for a person to be involved if a decision is made by automated means)

Not all rights will apply to all situations and where we cannot comply with your request, we will tell you the reasons.If you wish to exercise any of these rights, you can do so by speaking to us or contacting us at [email protected]. More information about your rights can be found on the Information Commissioner’s Website at www.ico.org

How to complain

We hope that you will never need to complain about how we are handling or using your information but if you do with to raise a complaint you can do so by contacting us at [email protected] We would like the opportunity to resolve this with you.If you are not satisfied with our response or believe we are using your information in a way that is not compliant with data protection laws, you can raise a concern with the Information Commissioner’s Office at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, Telephone 0303 123 1113 (Local Rate) or by completing their online form at Your personal information concerns | ICO.Privacy Notice Reviews

This notice will be reviewed every 2 years or sooner if there are any legislation changes. The date of the last review is May 2024.

Data Complaints Policy

1. I am committed to providing a high-quality service, in accordance with data protection law. At all times, I seek to comply with data protection principles by ensuring I:

• process personal data lawfully, fairly and in a transparent way;

• collect personal data for specific and legitimate purposes and do not process personal data in a way that is incompatible with those purposes;

• collect and use adequate, relevant and minimal personal data;

• take reasonable steps to make sure personal data is accurate and kept up to date;

• do not keep personal data longer than necessary; and

• implement appropriate security measures.

2. I acknowledge that I may not always get things right, so if something has gone wrong, I need you to tell me. This will help me to improve our standards of service and data protection controls.

3. How to make a complaint

3.1. You can contact me in writing (by email to the following email address [email protected] using the words ‘Data complaint ‘ in the subject heading. Alternatively you can send a letter to the postal address set out in our Privacy Policy).

4. Acknowledging and verifying your complaint

4.1. I will contact you within 30 days acknowledging your complaint.

4.2. I will take reasonable steps to verify the identity of the person making the complaint. This may involve requesting further information or documentation from you. If the complaint is made on behalf of someone else, I will also need to check that the person making the complaint is properly authorised to do so.

4.3. If, having requested additional information, I am not in a position to identify the person making the complaint or I am not satisfied that they have proper authority to make the complaint, I may refuse to deal with it - see section 7.2.1 below.

5. Investigating your complaint

5.1. I will investigate your complaint. This will usually involve:

5.1.1. reviewing your complaint;

5.1.2. locating and reviewing the records I hold about you;

5.1.3. establishing the relevant facts; and

5.1.4. liaising with individuals who you may have dealt with.

5.2. I may also need to ask you for further information or documents. If so, I will ask you to provide the information within a specific period of time.

5.3. I will update you on the progress of your complaint at appropriate times.

6. Notifying you of the outcome of our investigation

6.1. I will contact you at the end of our investigation to tell you what I have done and what I propose to do to resolve your complaint.

6.2. I usually aim to do this within 30 days of the date of receiving your complaint. However, this time period may be extended where:

6.2.1. I ask you to provide further information to verify your identity or your authority to make the complaint, or in relation to the complaint itself;

6.2.2. your complaint is complex or involves locating and/or reviewing a large volume of information; or

6.2.3. you have made several complaints, which I need to investigate at the same time.

6.3. I will tell you if I need more time to properly investigate your complaint and explain why.

7. Refusing to deal with your complaint or charging a fee

7.1. I prefer to deal with complaints and, preferably, to resolve them. I will not usually charge a fee for handling a complaint.

7.2. I may, however, refuse to deal with a complaint where:

7.2.1. after requesting additional information in accordance with section 4.2, I am not in a position to identify you and/or to verify that you are authorised to make the complaint; or

7.2.2. I have asked for more information in relation to the complaint itself (section 5.2), but you have not provided this within a reasonable time.

7.3. Where I consider the complaint to be manifestly unfounded or excessive, eg because you have made the same complaint repeatedly, I may:

7.3.1. refuse to act on the complaint; or

7.3.2. charge a reasonable fee for dealing with the complaint, based on our reasonable administrative costs - I will notify you of the proposed fee in advance of incurring it.

8. What to do if I cannot resolve your complaint

8.1. If you are unhappy with the outcome of your complaint, you can complain to the data protection authority of the country where you are based. In the UK this is the Information Commissioner’s Office (ICO), or you can seek to take action in the courts.

8.2. The ICO’s contact details are:

Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline number: 0303 123 1113

More details on how to complain to the ICO are available on the Complaints page of the ICO’s website. You should usually submit your complaint to the ICO or other data protection authority within three months of your last contact with me.