Privacy & your data
WHAT WE DO WITH YOUR DATA.
This covers the Dual Performance Athlete Portal — what we collect, why we collect it, who else touches it, and what you can make us do about it. Plain language, no hedging.
Collection
WHAT WE COLLECT.
Only what we need to coach you. Most of it you enter yourself, and the optional parts stay optional.
Account information
Your name, email address, coaching start date, and the athlete code we use to identify your records.
Training information
The sessions we prescribe and what you log against them: completed sessions, sets, reps, weights, distances, times, perceived effort, and any notes you add.
Health and wellbeing information you choose to give us
Body check-ins covering sleep, energy, soreness, stress, motivation and bodyweight. Weekly check-in responses. Nutrition logs. Any injury, pain or niggle you report so we can adjust your programme.
This is sensitive information. We collect it only because you give it to us for the purpose of being coached, and we use it for nothing else. You can be coached without logging any of it.
Progress photos
Only where you choose to upload them. They are stored against your athlete record and visible to your coaching team.
Connected device data
Where you choose to connect a service such as Strava, Garmin or COROS. See connected devices below for what happens to it.
Technical information
Error reports and privacy-light usage analytics that keep the portal working: which pages and features get used, and basic device and browser information.
Our error monitoring is configured to strip access codes out of URLs and to discard any report containing an email address. We do not collect payment card details through the portal.
Purpose
WHY WE USE IT.
Coaching, and keeping the thing running. That is the whole list.
Building your programme
To write, deliver and adjust your training. To set and review nutrition targets. To spot fatigue, injury risk and missed sessions early, before they become a problem.
Running the portal
To send the reminders and coaching notifications you have enabled, to respond when you contact us, and to keep the portal secure, working and fixed when it breaks.
Wearables
CONNECTED DEVICES.
If you connect a service, we receive the activity and wellness data you authorise, and nothing else. Strava is live now. Garmin and COROS are described here as they will operate once those integrations are approved and switched on, and no data flows from either until you connect it yourself.
You authorise it, and only you
Connecting happens through the provider's own sign-in and consent screen. We never ask for, store or use your password for any of them, and we request the narrowest set of permissions that lets us coach you.
Who sees what depends on the provider
Strava. Your raw Strava feed is shown back to you only. Your coaches do not see it. They see the training log you confirm and submit inside the portal. This boundary is built into the system, not a policy we promise to follow.
Garmin and COROS. Where you connect one of these, your coaching team sees the activity and daily wellness data you authorised. Setting your training load and nutrition targets from measured energy expenditure rather than an estimate is the reason we ask for it. Nobody outside your coaching team sees it.
You can disconnect at any time
From inside the portal. When you disconnect we revoke our access with the provider and delete the stored access tokens and the cached activity data we hold for you. You can also revoke access from inside the provider's own account settings, and if you do we treat it identically. Where a provider notifies us that you have deregistered or asked for your data to be removed, we action it automatically on receipt rather than waiting for you to ask us twice.
Or delete the data without disconnecting
Request it in the portal, or email [email protected]. Either way it is recorded when we receive it and actioned within 30 days.
Strava
Activity type, duration, distance, pace, elevation and heart rate, plus your heart rate and pace zones. Shown back to you only.
Garmin
Activity detail for the sessions you record, and daily wellness summaries covering active and resting energy expenditure, heart rate, steps and sleep. Where you enable it, we also publish the sessions we prescribe to your Garmin Connect account so they sync to your watch.
COROS
Activity detail for the sessions you record, and daily wellness summaries covering energy expenditure, heart rate and sleep. Where you enable it, we also push the sessions we prescribe to your COROS account.
What we never receive
Your password for any provider, your payment details, or anything from a provider you have not connected. We request the narrowest permission scope that lets us coach you and nothing beyond it.
Automated processing
WHERE AI TOUCHES IT.
We use AI tooling in one narrow place: summarising your training week so your coach walks into your review already knowing what happened. You should know exactly what that means.
What it does
It reads the sessions and check-ins you logged that week and produces a short summary of volume, consistency and anything that looks off — a missed block of sessions, a run of poor sleep, a sharp change in load.
What it sees
The sessions and check-ins you logged in the portal for the period under review. It does not receive data from any connected provider, it does not receive your progress photos, and it does not receive your name or email address.
A human always decides
The summary goes to your coach, not to you. A coach reads it, agrees or disagrees with it, and writes what actually reaches you. No decision that affects your programme, your nutrition targets or your coaching is made by software alone, and nothing written by a model is ever presented to you as though a coach wrote it.
It is not used to train anything
We send this data to Anthropic's API under terms that prohibit using it to train their models. It is processed to produce the summary and is not retained for any other purpose. We do not build profiles of you, and we do not use AI to infer anything about your health beyond what you have told us directly.
Third parties
WHO ELSE PROCESSES IT.
Each of these processes information only to provide their service to us. Some store or process it outside Australia, and by using the portal you consent to that transfer.
Supabase · Singapore
Database and file storage. This is where your training and check-in records live.
Vercel · Australia
Application hosting and the server routes every request passes through.
Cloudinary · United States
Progress photo storage, where you upload them.
Sentry · United States
Error monitoring, configured to strip access codes and discard anything containing an email address.
GoHighLevel · United States
Scheduling and transactional email.
Anthropic · United States
The AI summarisation described in automated review, under terms that prohibit training on your data.
Connected services
Strava, and Garmin and COROS once those integrations go live. These are sources rather than processors: they send us data at your instruction, and we do not send them your records. See connected devices for exactly what each one shares. This list is updated whenever a new integration is added.
Security
HOW WE PROTECT IT.
Access is deny-by-default. Nothing is reachable unless a server route has established who you are first.
Encrypted, always
All data is encrypted in transit and at rest.
No direct database access
Every table has row level security enabled with no public or signed-in-user policies. No browser ever queries the database. All reads and writes pass through authenticated server routes that establish who you are from a verified session and ignore any identity the browser claims.
Tokens stay server-side
Access tokens for connected services are held on the server only and are never exposed to your browser.
Only your coaches
Your coaching records are visible to your coaching team, and only for the purpose of coaching you.
If something goes wrong
If a breach affects your information we will tell you and notify the Office of the Australian Information Commissioner as required under the Notifiable Data Breaches scheme.
Report a problem
Found a security issue? Email [email protected] rather than exploiting it, and we will fix it.
How long we keep it
Your training and coaching records are kept for as long as you are an athlete with us, and for a reasonable period afterwards so your history is intact if you come back.
Coaching notifications are kept for 30 days. Sign-in attempt records are kept for 7 days. Data from a connected provider is kept only while that connection is active, and is deleted when you disconnect, when you ask us to, or when the provider tells us you have revoked access.
When you ask us to delete your account we delete your records within 30 days, except where we are required to keep limited records for legal, tax or security reasons.
Your control
WHAT YOU CAN ASK FOR.
All of it is in the portal under Preferences. Email works too if you would rather.
Your rights
See what we hold. Export everything, from Preferences inside the portal.
Correct it. Tell a coach, or email the privacy address.
Delete your device data, or delete your account entirely. Both are controls inside the portal.
Withdraw consent for anything optional, any time. You do not have to log body check-ins, nutrition or photos, or connect a device, to be coached.
Detail
A FEW MORE THINGS.
The parts people ask about.
How do you contact me?
Coaching reminders are delivered through the portal only — push notifications and an in-app inbox. We do not send coaching reminders by SMS. Every category can be turned off in Preferences.
Is there an age limit?
The portal is not intended for anyone under 16, and we do not knowingly create accounts for under 16s. Athletes under 18 need a parent or guardian to agree to our terms and sign the coaching agreement on their behalf.
Does AI read my check-ins?
Only to summarise your training week for your coach, and a coach always reviews it before anything reaches you. It never receives data from a connected device. The full detail is in automated review.
Do my coaches see my watch data?
It depends which service you connected. Strava stays between you and the portal. Garmin and COROS are shared with your coaching team, because measured energy expenditure is what lets us set your load and nutrition targets properly. The breakdown is in connected devices.
What happens when this policy changes?
We update this page and revise the date at the top. If a change materially affects how we handle your information, we will tell you inside the portal rather than relying on you to notice.
What if I am not happy with your answer?
Email [email protected] and we will respond within 30 days. If you are still not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.