Boost Fitness
Last updated 5 October 2026
Boost Fitness ("we", "us", "our") is the responsible party for the personal information described in this policy, as defined by the Protection of Personal Information Act 4 of 2013 ("POPIA"). Trading name: Boost Fitness Company registration number: 2023/005868/07 Registered address: Boost Fitness, 1st Floor, Dentsu Building, 183 Sir Lowry Road, Woodstock, Cape Town, 7925 Contact: david.cttrainer@gmail.com Information Officer: David John Thornhill, registered with the Information Regulator (South Africa), registration number 2026-063812. This policy applies to anyone who uses the Boost Fitness app, signs up for coaching, or otherwise provides us with personal information.
We only collect what we need to deliver coaching, training programmes, and nutrition plans safely and effectively. Identity and contact information: full name, email address, age, date of birth, height, sex, location, contact number, and a profile photo if you add one. How you found us: what you tell us at signup, the link or channel you signed up through, and how far you got through the signup steps. Parental/guardian information (16-17 year old clients only): your parent or guardian's name, email address, and phone number, collected to obtain and record their consent before your account can access any programme or nutrition content, see our separate Minors Policy. Billing and subscription information: your subscription tier, billing amount and frequency, trial dates, next billing date, and referral/promo code activity. Your card or EFT details themselves are handled directly by PayFast, we never see or store them ourselves. Health and medical information (special personal information under POPIA, processed with extra care): PAR-Q health screening answers, medical history, current and past injuries, medications, hormonal health information, pregnancy and postnatal details (due date, your baby's birth date, and whether the birth was by C-section), whether you're breastfeeding, any history of an eating disorder, menstrual cycle dates if you choose to add them, emergency contact details, GP/specialist clearance records where applicable. Lifestyle answers from your signup form: sleep, stress, alcohol and smoking, and similar questions about your day-to-day life. Fitness and progress data: training programme details, session completion records, exercise weights and performance history, Boost Benchmark results, body measurements and smart-scale readings, progress photos (stored privately and never shared without consent). Nutrition data: dietary preferences and restrictions, logged food intake, calorie and macro targets, favourite meals. Daily wellbeing data: self-reported energy, sleep, and mood scores, optional step counts, other activity you log, and notes. Communications: messages exchanged between you and your coach through the app, bug reports and feedback you submit. Community activity: your reactions to posted community events, pod/leaderboard participation if you're on Boost Together (opt-in, can be turned off at any time from your dashboard). Technical information: login timestamps, device/browser information collected automatically by our hosting providers for security and performance purposes, and technical details of any error or crash in the app.
We process your personal information to: Assess whether it is safe for you to train, and design a programme and nutrition plan appropriate to your goals, health, and physical condition. Draft training programmes, nutrition targets and progress reports using an AI system. AI-drafted programmes and reports are reviewed by a coach for Boost Coach and Coach+; on other plans they are delivered automatically. Track your progress and adjust your programme over time. Communicate with you about your coaching, including flagging anything that needs your attention. Respond to support requests and bug reports. Where you've opted in, show you community events and pod/leaderboard activity. Process your subscription billing, trial, and referral discounts through our payment processor, and send you related billing communications. Where you are 16-17, obtain and record verifiable parental/guardian consent before your account can access training or nutrition content. Only if you tick the box for it (it is never ticked for you, and saying no changes nothing about your plan), send you our monthly newsletter and the occasional offer. We record when you agreed and the exact wording. You can stop any time in Settings or with the unsubscribe link in every newsletter. Messages about your own coaching, reports, reminders and billing are service messages, not marketing, and keep coming while you're a client. Comply with our own legal, tax, and record-keeping obligations. Health information is collected specifically because personal training carries real physical risk, and we cannot design a safe programme without understanding your medical history. We do not use your health information for any purpose beyond your own coaching. Your right to a human review: some changes happen automatically, for example a new month of your programme or an update to your calorie targets. If an automatic change doesn't look right for you, message your coach in the app or email david.cttrainer@gmail.com and ask for a person to review it. A coach will look at it, tell you the outcome, and change it if it's wrong.
We do not sell your personal information. We share it only with: Boost Fitness coaches (currently David Thornhill). This is the core purpose of the service. Service providers who process information for us, only for the purposes below: Supabase: our database, login and file storage (hosted in the EU). Vercel: hosts the app. Resend: sends our emails to you. PayFast: payments (a registered South African payment gateway). Your card details go straight to PayFast; we never see or store them. Anthropic (AI provider): receives your goals, training preferences, check-ins, measurements, food logs, relevant medical information you've told us, and photos of a scale or watch screen you upload for us to read. It uses these to draft your programme, nutrition targets and reports, and to read the numbers off those photos. Under its commercial terms, Anthropic doesn't use this to train its models. Slack (internal alerts to our coaches only): alerts may include your name and a short description of what needs attention, which can name a health condition or injury you reported. When you message your coach in the app, the alert includes your message. Sentry (error monitoring): receives technical crash details when something goes wrong in the app, such as the page, your device and browser, and the error. We set it up to leave out personal details where we can. GitHub: stores our own private backup copies of the database (see Section 6). Google: our email inbox, if you email us. Information sent outside South Africa: some of these providers process information outside South Africa (for example in the EU and the USA). We only use providers bound by contract to protect it, and by accepting this policy you consent to this transfer. Legal or regulatory authorities, only where we are required to by law. We do not share your health information, progress photos, or training data with any third party for marketing or advertising purposes.
We keep your personal information for as long as you are an active client. After you stop being a client, how long we retain different categories of your information depends on why we needed it in the first place: Financial and payment records: 5 years from the relevant transaction, in line with our obligations under the Tax Administration Act. Health screening records and signed liability waivers: at least 3 years after you stop being a client, in line with the general prescription period for civil claims. Messages between you and your coach: kept indefinitely, with no ability for you or your coach to delete individual messages or a whole conversation from the app. This is deliberate: an unaltered record protects both you and us if anything discussed is ever disputed, and supports how we build automated support and coaching tools in future. Coach Notes (your coach's own private working notes, not sent to you) remain separately deletable by your coach. You may still request deletion of your own messages under Section 8; we will weigh any such request against this stated purpose and tell you if we're unable to fully comply and why. Inactive accounts: if a free Boost Together account, or an account that has been cancelled, shows no activity for 60 days, we warn you in the app and by email. If there's still no activity 30 days after that warning, we delete the account and its data, apart from the records above that we have to keep. Using the app at any point before then stops this. All other personal information: deleted or de-identified once there is no longer a reason to keep it, generally shortly after you stop being a client. Backups: deleted information can stay in older backup copies for a while. We only use backups to recover from a failure. You can request deletion of your data at any time, see Section 8.
Your data lives in a managed Postgres database operated by Supabase, hosted in the EU. Vercel hosts the application itself. Your information is also handled by the providers named in Section 4, only for the purposes described there, and we keep our own daily backup copies of the database in a private GitHub repository that only Boost Fitness can access. Encryption: your data is encrypted in transit (HTTPS) between your device and our servers, and encrypted at rest in the database itself, using our infrastructure providers' standard encryption. Access control: the database enforces row-level security, meaning a client can only ever see their own data, and only Boost Fitness coaches can see client data, enforced at the database level itself, not just in what the app's screens choose to display. Progress photos are stored in a private storage bucket and only ever accessed via short-lived, signed URLs, never a public link. Backups: our database runs on a paid tier that includes automated daily backups, and we keep the separate daily copies described above, so your data is recoverable in the event of an infrastructure failure. Account security: two-factor authentication (TOTP, via an authenticator app) is available on every account, client and coach, and can be enabled from account settings at any time. No system is completely secure, and we cannot guarantee absolute security, but we take reasonable technical and organisational measures appropriate to the sensitivity of the information we hold, and review them as the app and its infrastructure evolve.
You have the right to: Know what personal information we hold about you and request a copy of it. Request correction of information that is inaccurate, incomplete, or outdated. Request deletion of your personal information, subject to our legal retention obligations. Object to the processing of your personal information in certain circumstances. Withdraw consent at any time where our processing relies on your consent. Lodge a complaint with the Information Regulator (inforegulator.org.za) if you believe we have not complied with POPIA. To exercise any of these rights, contact us at david.cttrainer@gmail.com.
To request deletion of your data, email david.cttrainer@gmail.com and we will process your request within 30 days, subject to the retention obligations set out in Section 5.
Boost Fitness does not knowingly collect personal information from anyone under the age of 16 through self-service signup. See our separate Minors Policy for how we handle training for younger clients.
We may update this policy from time to time. We'll tell active clients about material changes in the app or by email.
Questions about this policy or how we handle your information: david.cttrainer@gmail.com