Who runs NoFadFit
Christopher Cachia, trading as NoFadFit, is based in Banbury, Oxfordshire, United Kingdom. He is the data controller for the information described here.
Contact: chris@nofadfit.net
NoFadFit, PureGym Banbury, Banbury Cross Retail Park, Lockheed Close, Banbury OX16 1LX
ICO registration: ZC251409
Who this applies to
This policy covers:
- People who apply for coaching via the application form on nofadfit.net
- Active coaching clients
- People who use the NoFadFit app
- People who contact NoFadFit by email
You must be 18 or over to hold an account on the NoFadFit app.
What information is collected
When you apply for coaching, the application form collects:
Contact details
- Name
- Email address
- Phone number (if provided)
- Location (city/region)
Training and goals
- Training history
- Current activity level
- Goals
- Availability
Health information (special category data under UK GDPR)
- Injuries, past and current
- Pre-existing medical conditions
- Medications relevant to training
- Pregnancy status (where applicable)
- PAR-Q+ readiness screening answers
Health information is only collected because it's required to design a training programme that's safe for you. Without it, programming you properly isn't possible.
Once you're a client
- Your training programme and any nutrition guidance written for you
- Body composition measurements where taken — weight, body fat, muscle mass, BMI, visceral fat, RMR
- Coaching notes about your training, including injuries and how you respond to exercise
Measurements and injury notes are health information too, and are treated the same way as your screening answers.
If you use the NoFadFit app
- Your name, email address and phone type (iPhone or Android), used to invite you to the app and sign you in
- The devices you sign in from
- What you record in each session — weights, reps, times, distances, reps in reserve (RIR), what you tick off, when you finish, and any notes you add yourself
- When each entry was made and when it arrived, which device sent it, and every change made to it
- A record of which version of these terms you agreed to, and when
The app also holds the programme written for you, so you can read it and log against it.
How it's used
Your information is used only to:
- Review your application
- Decide whether NoFadFit is the right fit for you (and you for it)
- Design and adjust your training and nutrition programme
- Communicate with you during coaching
- Deliver your programme through the app and show you what you've logged
Your information is never sold, shared with advertisers, or used for marketing without your separate consent.
Where it's stored
- Application and screening form data is collected via Tally (tally.so), a GDPR-compliant form provider. Tally stores submissions on its servers.
- Submissions are emailed to the coach's private email address.
- Coaching notes are held privately and are accessible only to Christopher Cachia, trading as NoFadFit.
- App data — your programme, your logs, your consent record, and the record kept after you leave — is held in databases hosted by Cloudflare in Western Europe. The app itself runs on Cloudflare's network near wherever you use it.
- The app also keeps your programme and what you log on your own phone, so it works without signal. That copy is cleared when you sign out. If your account is paused or closed, it's cleared the next time the app connects, after sending anything still waiting that can still be accepted.
- No data is stored on shared drives or third-party CRMs.
Lawful basis for processing
NoFadFit relies on the following lawful bases under UK GDPR:
- Standard personal data: legitimate interest (delivering the coaching service you've applied for) and contract (where coaching is active).
- Health and special category data: explicit consent under Article 9(2)(a). You tick a consent box on the application form before submitting, and again in the app before you start using it. You can withdraw consent at any time by emailing the address above.
- Records kept after you leave: establishing, exercising or defending legal claims, under Article 9(2)(f).
- Business and tax records: legal obligation.
If you withdraw consent to health information being held, coaching you safely is no longer possible, so the coaching arrangement would end.
How long it's kept
- Unsuccessful applications: deleted within 6 months.
- Sign-in limits: when someone asks for or enters a sign-in code, a scrambled form of the email address is kept to stop codes being requested or guessed too often. It's deleted within 3 days of last being used.
- Your app account: deleted from the app about a week after Chris records that you've stopped coaching, or paused if you plan to return. A paused account is reviewed after six months and closed if you're not coming back.
- Record of what happened: the app keeps a record of what happened, such as sign-ins, consent and deletions, under random IDs rather than names, and it isn't deleted. If Chris deletes your records early, the reason he types is kept with it, as written.
- Your account details, programmes, training logs, screening answers and consent record: kept for 6 years after Chris records that you've stopped coaching.
Six years is how long a claim can be brought, and those records are how it would be answered. They're reachable only by Christopher Cachia, trading as NoFadFit. The app holds its own separately from the live system and deletes them automatically once the six years are up; Chris deletes the rest himself at the same time.
You can request earlier deletion at any time (see Your Rights below).
Anything deleted from the app's databases can still be restored from their own history for up to 30 days, and is then gone.
Who else sees it
These services handle your information on NoFadFit's instructions only. None of them use it for their own purposes.
- Tally — runs the application and screening forms, and stores submissions in the European Union. When a form emails a submission to Chris, Tally sends it through SendGrid in the United States, under the safeguards Tally's data processing agreement requires for transfers outside Europe.
- Cloudflare — hosts the website, the app and its databases. The databases are held in Western Europe; the app runs near wherever it's used. Information about visits, such as IP addresses, is processed in Cloudflare's data centres in the United States and Europe. Transfers to the US rely on Cloudflare's certification under the Data Privacy Framework's UK Extension, with standard contractual clauses and the UK Addendum as a back-up.
- Resend — sends the app's emails: invitations (your first name, email address and a code), sign-in codes, and alerts to Chris that name no client. Resend stores all email data, including what the emails say, in the United States, under standard contractual clauses with the UK Addendum and the Data Privacy Framework's UK Extension.
- Google — hosts Chris's nofadfit.net mailbox (Google Workspace), where form submissions and client email arrive and where replies to the app's emails go. Google may process it in any country where it has facilities. Transfers to the US rely on Google's certification under the Data Privacy Framework's UK Extension, and transfers elsewhere on standard contractual clauses with the UK Addendum.
No other third parties have access to your information. It would only be shared further if the law required it, or to establish or defend a legal claim.
Keeping it safe
Everything sent between the app and its server is encrypted.
The coach account is protected by a passkey on top of an emailed code, so an email address on its own isn't enough to reach anyone's information. The app is built so that it only ever sends a client their own information, and that is tested.
Cookies and website tracking
nofadfit.net and the app both use Cloudflare Web Analytics to count visits, which sets no cookies and doesn't track anyone across other sites. They don't use advertising cookies or tracking pixels. The site sets only essential cookies required for functionality (e.g. Cloudflare bot protection and the application form embed).
The app sets one cookie, which keeps you signed in on that device. It also stores your first name, your programme, what you log and its own files on your phone, so it opens and works without signal. None of it is used for tracking.
If analytics or advertising that use cookies are added in future, a cookie consent banner will be added at the same time.
Your rights
Under UK GDPR, you have the right to:
- Access the information held about you
- Have inaccurate information corrected
- Have your information deleted (right to erasure)
- Restrict or object to how your information is used
- Receive your data in a portable format
- Withdraw consent at any time
- Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113
To exercise any of these rights, email chris@nofadfit.net. There's no charge.
Requests are normally answered within 14 days, and always within a month.
If you're unhappy with how your information has been handled, you can complain to the ICO. Please come to me first so I can put it right.
Changes to this policy
If this policy changes, you'll be told by email, the changes are posted on this page, and the "Last updated" date at the top will change. The app will ask you to read and agree to the new version before you carry on using it.
Questions
Email chris@nofadfit.net.