Privacy Policy

Last updated: 9 October 2026

This policy explains what Base Form collects, why, who processes it for us, and the choices you have. Base Form does not sell personal information and does not show ads.

What we collect

• Account details: your email address, name, and the organizations you belong to.
• Coaching records a trainer enters: client profiles (such as age, height, weight, goals and notes), programs, schedules, and messages.
• What clients log: food, weigh-ins, workouts and check-ins. Some of this is health-related information, and is treated with the same care as the rest of the account.
• Notifications (only if you turn them on): a technical address for the device you allowed, used only to send you reminders, messages and payment problems about your own account. Turn it off in the app any time, and it is deleted with your account.
• Phone number (only if you turn on text reminders): used only to text you about your own bookings, and only after you tick the box yourself. Reply STOP to any text, or turn it off in the app, and it stops straight away. It is deleted with your account.
• Enquiries and announcements: if you fill in a business's enquiry form, they see your name, email, phone and message so they can reply. Businesses can email announcements to their clients and enquirers, at most once a week per person, and every one has an unsubscribe link that stops that business's announcements straight away.
• Phone health data (only if you connect it in the app): daily steps, sleep, resting heart rate, active energy and weight, read from Apple Health or Health Connect. It is read only after you allow it, is shown to you and your coach, and is never used for advertising or sold. You can disconnect at any time and erase what was saved.
• Health questionnaire: your answers and emergency contact are visible to you and your coach and are deleted when you delete your account.
• Progress photos and measurements (only if you add them): visible only to you and your coach, and never sent by email.
• Bookings and payments: what was booked and paid for, amounts, and payment status. Card details are entered on Stripe’s pages and are never stored by Base Form.
• Technical data: basic logs such as IP address, browser and error reports, kept to keep the service secure and working.

Health data

Questionnaire answers, weigh-ins, measurements, food logs, check-ins, progress photos, form videos and phone health data are health data. Base Form collects them only after a client gives separate permission, shows them only to the client and their coach, and never sells them or uses them for advertising. The Consumer Health Data Policy explains exactly what is collected, who it is shared with, and how to see it, delete it or withdraw permission.

Optional exercise-form videos are processed and hosted by Cloudflare Stream for private playback by you and authorized coaches in your business. Uploaded clips are scheduled for deletion after 90 days and can be deleted sooner from the review. Written coaching feedback remains until account deletion.

How it is used

• To run the service: sign you in, show trainers and clients their records, take bookings.
• To process payments and Base Form’s fees, and to prevent fraud.
• To send emails you need: sign-in links, invites, and messages about your account.
• To fix problems and improve Base Form.

A trainer sees the records of their own clients. A client sees their own records and their trainer’s schedule. People in a class never see each other’s details.

Who processes it for us

• Vercel hosts the application.
• Neon hosts the database.
• Stripe processes payments and verifies trainers who take payments.
• Resend delivers email, and Twilio delivers text reminders you turn on.
• Cloudflare hosts exercise-form videos.
• Anthropic reads a meal description or food-diary screenshot, only when you ask the app to.
• Apple and Google deliver phone notifications you turn on.

These companies process data only to provide their service to Base Form. We may also share information when the law requires it.

Cookies and storage

Base Form uses only what it needs to work: a session cookie that keeps you signed in, a cookie that remembers which organization you are working in, and your light or dark theme choice stored in your browser. There are no advertising or tracking cookies.

How long it is kept

Account and coaching records are kept while the account is active. Payment records are kept as long as tax and accounting rules require. When an account is closed, its personal data is deleted or anonymised within 90 days, except where we must keep it by law.

Your choices

• You can ask for a copy of your data, a correction, or deletion.
• If you are a client, your trainer controls your coaching records. You can ask them, or us, and we will help.
• Depending on where you live (for example California or the EU), you may have further rights. We honour those requests.

Base Form is not for children under 16, and we do not knowingly collect their information.

Security

Data is encrypted in transit, access is limited to each organization’s own members, and sign-in uses single-use email links instead of passwords.

If there is a data breach

If personal or health data is accessed, used or disclosed without permission, we will:

• tell the people affected by email without unreasonable delay, and no later than 60 days after we discover it, saying what happened, what data was involved, what we are doing about it and what they can do to protect themselves;
• tell the US Federal Trade Commission where its Health Breach Notification Rule applies (for example to health data read from Apple Health or Health Connect), and state regulators and, for large breaches, the media where the law requires;
• tell the business whose clients are affected straight away, so they can help their clients.

Contact

Privacy questions and requests: support@baseform.coach.