Privacy Policy | TRUE FORM

This notice explains what personal information TRUE FORM collects, why, and what you can do about it. It covers this website, the client portal, and the coaching and Membership services delivered through them.

Who is responsible for your information

TRUE FORM is the controller for the personal information described here. Our registration and address details are on the Company Information page.

For anything about your personal information, email info@trueformlifestyle.com. We have not appointed a Data Protection Officer.

What we collect

Your account. Your name and email address, and the password you choose. Signing in is handled by our platform provider, which stores your password in a protected form. TRUE FORM never sees your password.

Signing in with Google. If you choose to sign in with Google, Google shares your name and email address with our sign-in system, which keeps them with your account. We use them to set up your client record.

Sign-in records. Our sign-in system records the IP address and the browser (user agent) of each signed-in session, and the IP address with each sign-in event. Our own database does not store your IP address.

What you send us. What you send through the contact form, a consultation booking or the readiness questionnaires, and a request for our free starter guide, together with the page you sent it from. You need an account to send these; a free account is enough. The free starter guide is claimed from your account in one click, and the request records the name and email address on your account. We do not run a newsletter.

Readiness questionnaires. Besides your health answers (see below), these can ask for your age, a typed signature and the date, the name and phone number of an emergency contact, and the name, phone number and address of your physician or clinic.

Withdrawing from a contract. If you use our withdrawal form, we keep what you send: your name and email address and, if you give them, your phone number, your address and the date of the contract, together with the wording of the notice you sent. You do not need an account to do this.

Membership and coaching. Which plan or coaching package you hold, when it started, its status, the date your access runs to, and any request to change plan.

Coaching intake. The answers you give in the coaching intake. Depending on your answers, this can include your age, training history, goals, lifestyle and nutrition habits, injuries, medical conditions, medication, and pregnancy or postnatal information. It also asks for the name and phone number of an emergency contact. This is health information and is treated separately below.

Check-ins and progress. If you agree to progress tracking: your check-in answers (training and nutrition adherence, energy, sleep and wellbeing ratings, your notes and your biggest challenge), your coach’s written review of each check-in, the measurements recorded, and your progress photos.

Your client file. When your coaching starts, your coach keeps a client file: your answers to our assessment forms — among them the PAR-Q+ health screening, your lifestyle and health history, your goals, and questions about nutrition and training — and the measurements and assessments your coach records in your sessions, some of them filled in together with you on our iPad. If you filled in the coaching intake, its answers are placed in your client file, and a copy of what you answered on the website is kept with them. Every change to an answer is kept with its date, so your coach can see how things changed. Your coach’s own notes and assessments in the file are seen by your coach only. This is health information and is treated separately below.

Videos and photos in your assessments. If you agree to it separately, your coach records videos and photos of your body during your assessments — your movement assessments, such as the overhead squat, and your progress photos — and keeps them in your client file, where only your coach can see them. Documents you give your coach for your file, such as a signed PAR-Q+ or a doctor’s clearance, are kept there too.

Your sessions and your portal invitation. Your coach keeps the date, time and place of your next session in your client file. When your coach asks, we email you a reminder of that session, or an invitation to your client portal with a one-time link to choose your own password. We keep when each was last sent; the link itself is not kept in our database once the email has gone. The weight, height, waist, hips and body fat your coach measures and records in your client file also appear in the Progress tab of your account, if you have agreed to progress tracking.

Forms you fill in your client portal. Your weekly check-in is in your client portal, and your coach may send you forms from your client file to fill in at home there, sometimes only the questions still missing. What you enter is saved in your client file, marked as entered by you, with the date, and is kept, used, exported and deleted exactly as the rest of your client file. We also keep which forms your coach sent you and when you sent each back. Your coach’s own notes are never shown in your portal.

Transformations, reviews and stories. If you take part: your before-and-after photos and the texts that go with them, your review or story with its rating, the name you choose to be shown under, and the record of your consent to publish them.

Messages and documents. Messages exchanged between you and your coach through the portal, and documents your coach shares with you or asks you to provide.

Your coach’s notes. Your coach may keep private working notes about your coaching.

Orders and payments. What you bought, the amount, the tax, the currency, the payment status and the dates, the billing address you give at checkout (street and number, postal code, city and country), the version of the terms you accepted and when, whether you asked us to start before your withdrawal period ended, the reference numbers our payment provider gives us so a payment can be matched to your order, and our record of each payment notification the provider sends us. For each payment we issue an invoice, which keeps your name, email address and billing address as they were when it was issued; money we give back is recorded on a credit note, and a credit note issued in error is put right by a correction invoice. Card and bank details are never sent to or stored by TRUE FORM — you enter them on our payment provider’s own checkout page.

Records that keep the service safe and accountable. A record of significant actions on accounts and coaching (who did what, and when); a count of how often your account sends requests, kept for one day to stop misuse; our service emails; the notes that record what you withdrew and when, without its content; and, if you ask us to erase your data, a record that the erasure was carried out.

Why we use it, and on what legal basis

We use your information to create and run your account, to deliver the Membership or coaching you bought, to prepare and adjust your programme, to answer what you send us, to take payment and keep the records that go with it, to send service emails about your purchase, renewal, cancellation or a failed payment, and to keep the service secure and working correctly.

The legal bases we rely on are:

Performance of a contract — running your account, delivering coaching and Membership, handling your orders, your messages with your coach, and the service emails that go with them; and answering what you send us before a contract.
Legal obligation — keeping the order and payment records, invoices, credit notes and correction invoices that tax law requires us to keep, and keeping the records that show we honoured your rights — withdrawal notices, the notes of what you withdrew, and erasure records.
Your explicit consent — health answers in the coaching intake, a consultation booking and the readiness questionnaires; your client file, and the videos and photos in it; progress tracking (check-ins, measurements and progress photos); and publishing your transformation, story or review. You can withdraw consent at any time.
Legitimate interests — keeping the service secure and preventing misuse: sign-in records, the count of requests and the record of significant actions. We use this only where it does not override your interests.

Health information

Coaching cannot be done safely without knowing something about your health, so some of what you tell us is health information: injuries, medical conditions, medication, pregnancy and postnatal status, and answers that reveal how you sleep, eat, drink and feel. Your check-ins, measurements and progress photos are health information too.

Health information is a special category under data protection law and needs more than an ordinary legal basis. We rely on your explicit consent. Every form that asks health questions — the coaching intake, a consultation booking and the two readiness questionnaires — asks you to tick a consent box, and will not accept health answers without it. The box is never ticked for you.

Check-ins, measurements and progress photos need your agreement to progress tracking, which you give once in the client portal. Until you agree, none of them can be recorded.

Your client file needs your consent to health information too: the consent you gave in the coaching intake or, if your coach starts your file in a session, the client-file consent you read and agree to on our iPad first. Nothing can be recorded in your client file without one of the two.

Videos and photos of your body in your assessments need a separate consent of their own, which you read and agree to on our iPad before the first one is recorded. We never use them for marketing and never publish them, unless you give a second, separate consent for that.

We store the date and the version of the consent wording you agreed to, so there is a durable record of what you consented to and when. Our systems will not accept health information without it.

Where a form asks health questions as optional extras, you can leave them blank, or say you would rather discuss something privately. If you would prefer we did not keep answers you have already sent us, email us and we will remove them.

We use health information to build and adjust your programme, to judge whether training is safe for you, and to decide when to ask you to speak to a doctor first.

Health answers are kept apart from ordinary enquiry details in our systems, and they are not included in any email we send. When a purchase notification goes out, it records only whether an intake was submitted — never what it said.

You can withdraw your consent to progress tracking at any time on your account page. Withdrawing deletes your check-ins, measurements and progress photos, and the answers, videos, photos and documents in your client file, which is then closed; your coaching continues. A closed client file can be opened again only after you give the client-file consent again; what was deleted does not come back. To withdraw your consent for health answers you gave in the coaching intake, a booking or a readiness questionnaire, or for your client file or the videos and photos in it, email info@trueformlifestyle.com.

Withdrawing consent stops us using that information going forward and does not affect what we did while the consent was in place. In practice, coaching that depends on knowing your health may not be able to continue without it.

Who else is involved

We do not sell your personal information, and we do not share it for anyone else’s marketing. Your information is handled by a small number of companies that provide the technology behind this service:

Supabase — hosts our database, sign-in system, private file storage and the server functions that run the service. Our project is hosted in the European Union.
Vercel — hosts and serves this website. Like any web host, it receives your IP address and browser details when your device asks for a page.
Mollie — our payment provider. We send Mollie the amount, a short description and our own reference numbers — not your name or email address. You enter your payment details on Mollie’s own checkout, and Mollie handles that under its own responsibility and its own privacy notice. Mollie does not receive your intake, health or check-in information.
Resend — sends our emails: service emails, confirmations of what you send us, and the notifications we send ourselves, including account emails such as sign-up confirmations, password resets and invitations to your client portal, and the session reminders your coach asks us to send. It receives the address each email goes to and the message itself. Our emails never contain your intake, health or check-in answers.
Google — provides our business mailbox, where our own notifications arrive, and sign-in if you choose to sign in with Google, as described above.

Once a week our server asks the public npm software registry whether two software libraries we use have updates. It sends only the names and versions of those libraries, never personal information.

The WhatsApp button on every page is an ordinary link: nothing is loaded from WhatsApp unless you tap it. If you message us there, the conversation takes place on WhatsApp, under WhatsApp’s own terms. Some videos in the client portal’s library open on YouTube or Vimeo, under their own terms, when you choose to watch them.

We may also share information where the law requires it, or where we need to establish or defend a legal claim.

Where your information is processed

Our database, sign-in system and file storage sit in a European Union region. Our other providers are international companies, and some of their processing, support or infrastructure may take place outside the European Economic Area.

Mollie processes your information in the European Union. Vercel, Resend and Google are companies based in the United States; transfers to them rely on the EU–US Data Privacy Framework.

If you need specifics for a particular provider before deciding to use the service, ask us and we will tell you what we know.

How long we keep it

We keep your account, coaching and health information while you are a client. What happens after that, and to other information, is set out below.

Deleted automatically every day. A service email, 90 days after it was sent. A record of an account or coaching action, after 12 months. The count of your account’s requests, after one day. The note of a withdrawn review, story or progress-tracking consent, two years after the withdrawal. The record of a completed erasure, two years after the erasure, once we no longer keep any other record about you.

Periods we have set, not yet applied automatically. For the information below we have decided how long we keep it, and the automatic deletion that applies these periods is built, but it is not switched on yet. Until it is, this information stays until you ask us to delete it or to erase your account:

a free account that has not been used for 12 months, with a warning email at 11 months;
a sign-up that was never completed, on the same periods;
an enquiry that did not lead to you becoming a client, 12 months after the last contact, with a notice 30 days before;
a coaching intake that was never paid for, 90 days after you sent it;
a withdrawal notice you sent us, kept while it is being handled, and for two years after it has been handled, as proof of what was agreed;
a former client’s account and data, 24 months after the end of your last paid service, plus 30 days;
the videos, photos and documents in your client file, 12 months after your coaching ends or your client file is closed, whichever is later;
order and payment records, seven years after the end of the calendar year of your last payment, the period tax law requires;
invoices, credit notes and correction invoices, seven years after the end of the calendar year in which the last of them was issued, the period tax law requires; an invoice, its credit notes and its correction invoices are deleted together.

Invoices, credit notes and correction invoices. We keep them for seven years after the end of the calendar year in which the last of them was issued, the period tax law requires, and we delete them together.

When you erase your account. We delete your information, except: the records of your orders and payments, for the tax-law period above (your name and billing address are removed from them); your invoices, credit notes and correction invoices, for their tax-law period, with your name, email address and billing address as they were issued, because the law requires us to keep them unchanged; any withdrawal notice you sent us, for the period set out above; the notes of what you withdrew and when; and a record that the erasure was carried out, which keeps a coded fingerprint of the email address the request came from instead of the address itself, so that we can answer whether an address was erased and nothing more.

Backups. Our database provider keeps a daily backup for seven days, so information we delete leaves those backups within seven days. Stored files are not part of those backups: we occasionally make a separate copy of them, kept outside our live systems. We keep only the most recent copy; when a new copy is made, the previous one is deleted, so erased files leave it with the next copy.

Our providers’ own records. Your sign-in session is removed when you sign out or when your account is erased. Our providers keep technical logs for a short period under their own terms.

Security

Access to client information requires an account, and what an account can reach is restricted at the database level rather than only in the interface. Your files are held in private storage and cannot be reached by a public link; only the photos and texts you agree to publish are placed where the website can show them, and they are removed if you withdraw.

Administrative access is limited to accounts that need it, requires a second sign-in factor, and significant actions are recorded. An automatic check watches administrator sign-ins and alerts us to unusual activity.

If something goes wrong

If a security incident affects personal information, we record it. We report it to the Autoriteit Persoonsgegevens within 72 hours unless it is unlikely to put anyone’s rights and freedoms at risk, and if it is likely to put you at high risk, we tell you directly.

Automated decisions

We do not make decisions about you by automated means that produce legal effects or similarly significantly affect you. Some rules are applied automatically — for example, whether a particular coaching package can be combined with one you already hold, or deleting information when its period ends — but these are fixed rules applied the same way to everyone, not automated assessments of you as a person, and a human is behind every coaching judgement.

Children

These services are intended for adults. We do not currently operate an age check at sign-up or purchase, and both readiness questionnaires accept an age below 18; the readiness screening asks anyone under 18 to go through it with a parent or guardian. If you are a parent or guardian and believe a child has given us personal information, contact us and we will deal with it.

Your rights

Under data protection law you can ask us to give you a copy of your information, correct it, delete it, restrict what we do with it, or provide it in a portable form, and you can object to how we use it and withdraw consent you have given. This is how to do each of them today:

A copy of your information. Email us and we will send it to you as a download: a file with your information in a machine-readable form, together with your photos, a list of your invoices, credit notes and correction invoices (their PDFs are in My Invoices on your dashboard), your answers in your client file, and a list of the videos, photos and documents in it with their sizes (ask us for copies of those files). If you have agreed to progress tracking, you can also download it yourself: on your account page, choose Withdraw consent on the Progress tracking card and then Download my data and photos. Nothing is withdrawn unless you go on to confirm.
Erasing your account and data. On your account page, use Erase my data; you will be asked to sign in again first. We carry out the erasure within one month or, if you still have paid access, at the end of it if you choose. You can cancel the request on the same page until we begin, and we confirm both by email. You can also ask by email. What we keep after an erasure is set out above.
Withdrawing consent. Progress tracking: on your account page. Your transformation, story or review: on your dashboard. Health answers you gave in the coaching intake or a form, your client file, and the videos and photos in your assessments: by email.
Correcting your information. Email us to correct your name or email address; they cannot yet be changed in the portal. You can change your password with Forgot password? on the sign-in page.
Restricting, objecting and portability. Email us.

Some of these rights depend on the circumstances — for example, we must keep payment records and invoices even if you ask us to delete everything else, because the law requires it. If we cannot do what you ask, we will tell you why.

We may need to check who you are before we act, so that nobody else can obtain your information.

Cookies and browser storage

What this website does and does not store on your device is set out in the Cookie Policy.

Complaints

If you are unhappy with how we have handled your information, tell us first — email info@trueformlifestyle.com and we will look into it. You also have the right to complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

Changes to this notice

This notice describes how the service works today. If we change what we collect, why we collect it, or who is involved, we will update this page and change the date below.

Last updated: 18 October 2026