Privacy Policy

Last Updated: October 2026

At LitheForm, I respect your privacy and am committed to protecting your personal data. This Privacy Policy explains how I collect, use, store, and safeguard your personal and health-related information when you visit my website, make an enquiry, or train with me.

LitheForm operates in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Important Information & Who I Am

LitheForm is the data controller responsible for your personal data.

  • Business Name: LitheForm Personal Training

  • Contact Name: Ruth

  • Location: Lower Bristol Road, Bath

  • Email: info@litheform.co.uk

If you have any questions about this Privacy Policy or how your data is handled, please contact me using the email address above.

2. What Personal Data I Collect

I may collect, use, store, and transfer different kinds of personal data about you, categorised as follows:

  • Identity & Contact Data: Your name, email address, telephone number, age/age bracket, and gender.

  • Health & Lifestyle Data (Special Category Data): Physical health status, medical history, joint/injury details (e.g., hypermobility, surgeries, conditions like PCOS), exercise history, health goals, and PAR-Q (Physical Activity Readiness Questionnaire) responses.

  • Transactional & Financial Data: Details about payments made for personal training packages and services.

  • Technical & Usage Data: Information about how you use my website, IP addresses, and page navigation (collected automatically via Squarespace standard cookies and analytics).

3. How Your Data Is Collected

Your personal data is collected through:

  • Direct Interactions: When you fill out a contact form on my website, email or text me, complete an intake/PAR-Q form, or discuss your goals during a consultation.

  • Automated Technologies: As you interact with my website, Squarespace may automatically collect technical data using standard cookies (see the Cookie Policy for details).

4. How I Use Your Personal Data & Legal Basis

I will only use your personal data when the law allows me to. Most commonly, I use your data under the following legal bases:

  1. Performance of a Contract: To respond to your initial enquiry, assess suitability for training, arrange schedules, and deliver tailored 1-to-1 personal training sessions.

  2. Explicit Consent (Health Data): Health and medical details are classified as "Special Category Data." I collect and process this data only with your explicit consent so I can safely design and deliver customised exercise programmes.

  3. Legal Obligation: To keep accurate financial and tax records as required by UK law.

  4. Legitimate Interests: To improve my services, run my business smoothly, and protect against legal claims.

5. Data Sharing & Third-Party Processors

I do not sell, rent, or trade your personal information to third parties.

I only share your data with trusted service providers who help me operate my business, and only to the extent necessary:

  • Website Hosting: Squarespace (hosts my website and processes web form submissions).

  • Communication & Admin Tools: Secure email and cloud storage providers.

  • Payment Processors: Secure third-party payment platforms (e.g., Stripe, bank transfer providers).

All third-party processors are required to respect the security of your personal data and treat it in accordance with UK data protection laws.

6. How Long I Keep Your Data

I will only retain your personal data for as long as necessary to fulfil the purposes I collected it for, including for satisfying any legal, accounting, insurance, or reporting requirements:

  • Prospective Client Enquiries: Retained for up to 6 months if you choose not to proceed with training.

  • Client Health & Training Records: Retained for 7 years following the end of our working relationship, in line with UK personal training insurance requirements and professional liability standards.

  • Financial & Tax Records: Retained for 6 years from the end of the relevant UK tax year in compliance with HMRC rules.

7. Data Security

I have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, accessed in an unauthorised way, altered, or disclosed. Access to your health and personal details is strictly limited to myself as your trainer.

8. Your Legal Rights

Under UK data protection laws, you have rights regarding your personal data:

  • Request Access: Obtain a copy of the personal data I hold about you.

  • Request Correction: Ask me to correct incomplete or inaccurate data.

  • Request Erasure: Ask me to delete your personal data when there is no good reason for me continuing to process it.

  • Withdraw Consent: Withdraw your consent for processing health data at any time (note this may mean I can no longer safely deliver personal training sessions).

  • Object / Restrict Processing: Object to or ask to restrict the processing of your data under certain circumstances.

To exercise any of these rights, please contact me at [Insert Your Email Address].

9. How to Complain

If you have any concerns about my use of your personal data, you have the right to make a complaint to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues: