Fortis Coaching Privacy Policy

Fortis Coaching is a business name of TJM Training Pty Ltd (ABN 84 643 791 842). In this policy, "Fortis", "we", "us" and "our" mean TJM Training Pty Ltd trading as Fortis Coaching.

We take your privacy seriously, and we take your health information especially seriously. This policy explains what we collect, why we collect it, who we share it with, and what you can do about it. It is written to meet our obligations under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

If anything here is unclear, ask us. We would rather explain it than have you guess.

1. Why we handle health information carefully

Coaching involves knowing things about your body. We ask about injuries, illness, medications, pregnancy, sleep, stress and training history, because programming without that information is guesswork and, in some cases, unsafe.

Health information is treated as sensitive information under the Privacy Act, which means it gets stronger protections than ordinary personal information. We only collect it with your consent, we only use it for your coaching, and we do not disclose it for marketing, ever.

2. What we collect

Identity and contact information. Your name, email address, phone number, postal or suburb location, date of birth, and emergency contact where you give one.

Health information. Injury and illness history, current injuries and niggles, medical conditions, medications where relevant, surgeries, pregnancy where you tell us, medical clearances, and anything else you disclose in your onboarding form or during coaching.

Training and performance data. Your sessions, times, distances, paces, heart rate, power, RPE, wellness and readiness scores, race results, goals and target events. This includes data that flows in from devices and platforms you connect, such as Garmin, Stryd or similar.

Payment information. Billing name, invoice history and payment status. We do not store your full card numbers. Card details are handled by our payment provider.

Communications. Emails, messages, check-in notes, call notes and comments on sessions.

Community activity. If you join the Fortis community on Circle, your profile, posts, comments and anything else you choose to share there.

Website, advertising and email analytics. Information about how you use our website, whether you open or click our emails, and activity captured by advertising and analytics tools on our site. This includes pages you visit, clicks, scrolling and how far you get through a form, which may be recorded as a session replay. See section 8 for detail on this, including the Meta Pixel and Contentsquare.

3. How we collect it

Mostly directly from you: your enquiry, onboarding form, athlete agreement, check-ins, messages and conversations.

We also collect it:

• from platforms you connect to your coaching, such as TrainingPeaks and any device or app you link to it
• from our payment provider, when you pay an invoice or set up a recurring payment
• from our email platform, when you subscribe or interact with our emails
• occasionally from someone acting on your behalf, such as a family member making an enquiry for you

If we ever collect information about you from someone other than you, we will tell you, unless it is impractical or unreasonable to do so.

4. Why we collect it, and what we use it for

We use your information to:

• design, deliver and adjust your programming
• assess whether training is safe and appropriate for you
• communicate with you about your training, check-ins and races
• run the Fortis community
• invoice you and manage payments
• keep records we are required by law to keep
• improve our programs and service
• send you updates, education and offers, where you have not opted out (see section 7)

We do not use your health information for marketing. We do not sell your personal information to anyone. We do not trade in personal information.

If we ever want to use your information for a purpose that is not listed here and not reasonably expected, we will ask you first.

5. Who we share it with

Our coaches and contractors. Fortis engages contractor coaches. If a coach other than Todd is delivering your programming, they will have access to the information they need to coach you safely and well. They are bound by confidentiality obligations and may only use your information to deliver Fortis coaching.

Our service providers. We use third party platforms to run the business. The main ones are:

Each of these only receives what it needs to do its job. We do not send health information to Stripe, Xero, Meta or Contentsquare.

Guest experts. Where you engage with a Fortis Friend, for example a dietitian or a strength and conditioning consultant, we will only share your information with them with your consent, and only what is relevant.

Where the law requires it. For example, in response to a court order, or where disclosure is necessary to lessen or prevent a serious threat to someone's life, health or safety.

We do not disclose your information to anyone else without your consent.

6. Overseas disclosure

Some of the platforms we use store data outside Australia. Based on our current providers, your information is likely to be stored or accessed in the United States (TrainingPeaks, Circle, Kit, Google, Stripe, Meta and BoloForms), the European Union (Contentsquare) and New Zealand (Xero). It may also be handled in other countries where those providers operate infrastructure or support teams, including the United Kingdom, Singapore and India.

Before disclosing information overseas, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, including relying on the provider's contractual commitments and published privacy and security terms.

If you would prefer your health information not be stored on a particular platform, talk to us. We may not be able to deliver coaching without some of them, but we will tell you honestly what is possible.

7. Marketing and how to stop it

If you are on our list, we may send you training education, updates, community news and occasional offers.

Every marketing email we send includes an unsubscribe link, and it works. You can also just reply and tell us to stop, or email us at the address in section 14.

We do not use your health information to target marketing at you, and we do not provide your details to third parties for their own marketing.

Service messages, such as invoices, program updates and anything about your actual coaching, are not marketing and will continue while you are an athlete with us.

8. Our website, cookies and advertising

Cookies. Our website uses cookies and similar technologies. Some are necessary for the site to work. Others help us understand how the site is used and measure our advertising.

Meta Pixel. We use the Meta Pixel on our website. It records actions you take on our site, such as visiting a page or starting a signup, and sends that information to Meta (Facebook and Instagram). We use it to measure whether our advertising is working and to show ads to people likely to be interested in Fortis. Meta may match this information to a Meta account if you have one, and Meta handles that data as a controller in its own right under its own terms.

Contentsquare. We use Contentsquare to understand how people use our website. It records on-page behaviour such as the pages you view, where you click, how you scroll and how far you get through a form, and it can replay that activity as a session recording so we can see where the site is confusing. We use it only to improve the website. Contentsquare is a French company, and your data may be processed in the European Union and the United States.

What we do not do. We never send health information, injury information or training data to Meta, Contentsquare or any other advertising or analytics platform. Our forms are configured so that the text you type into form fields is masked and is not captured in session recordings. These tools sit on our public website and signup pages, not inside your coaching platforms.

How to opt out. You can control this in several ways: adjust your ad preferences in your Facebook or Instagram account, opt out of Contentsquare measurement at contentsquare.com/privacy-center/, use your browser's cookie controls or a tracking blocker, or decline non-essential cookies where our site offers that choice. Contentsquare also honours browser "Do Not Track" and global privacy control signals where your browser sends them. Opting out will not affect your coaching or your access to anything you have paid for.

9. How we store and protect it

Your information is held in the platforms listed in section 5, and in our own systems and files.

We protect it with measures including access controls and strong authentication, multi-factor authentication where the platform supports it, limiting access to people who need it, choosing reputable providers with their own security standards, and reviewing access when someone stops working with us.

No system is perfectly secure, and we will not pretend otherwise. What we can commit to is taking reasonable steps to protect your information and acting quickly if something goes wrong.

If a data breach happens that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner, as required by the Notifiable Data Breaches scheme.

10. How long we keep it

We keep your information while you are an athlete with us, and for a period afterwards.

Health and coaching records are generally retained for seven years after your last session with us. This is deliberate. If a question ever arises about advice given or programming prescribed, those records protect both of us. Financial records are kept for at least five years, as tax law requires.

After that, we destroy or de-identify information we no longer need.

If you ask us to delete your information sooner, we will do what we can, but we may need to keep some records to meet legal obligations. We will tell you if that is the case.

11. Accessing and correcting your information

You can ask us for a copy of the personal information we hold about you, and you can ask us to correct anything that is wrong.

Email us at the address in section 14. We will respond within a reasonable time, usually within 30 days, and we will not charge you for making a request.

If we refuse access or refuse to make a correction, we will tell you why in writing and explain how you can complain about that decision.

You can also access much of your training data yourself, directly in TrainingPeaks.

12. Anonymity

You can make a general enquiry without giving us your name. Once you start coaching with us, we need to know who you are and we need your health information, so anonymous or pseudonymous coaching is not something we can offer.

13. Under 18s

Our services are intended for adults. You must be at least 18 to train with us, and we do not knowingly collect personal information from anyone under 18. If you believe we have, contact us and we will delete it.

14. Complaints, and how to contact us

If you think we have mishandled your information, tell us first. We would rather fix it directly.

Email: info@fortiscoaching.com.au
Post: TJM Training Pty Ltd, 6 Neptune Ave, Medowie NSW 2318
Web: fortiscoaching.com.au

We will acknowledge your complaint promptly, investigate it, and give you a written response, normally within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner:

Web: oaic.gov.au
Phone: 1300 363 992
Post: GPO Box 5218, Sydney NSW 2001

You may also have a right to take direct court action for a serious invasion of privacy under Australian law.

15. Changes to this policy

We may update this policy from time to time. The current version is always at fortiscoaching.com.au/privacy, and the date at the top tells you when it last changed. If we make a significant change, we will let you know.