Privacy policy

Version 1.0 | Effective 14 August 2026

This policy covers the TrackFit coaching membership. A separate privacy policy applies to purchases made through our online store.

 

---

1. WHO WE ARE AND HOW TO REACH US

TrackFit MX & Off-Road Performance Coaching is operated by:

TrackFit MX Performance Coaching Pty Ltd ACN 684 073 121 Perth, Western Australia

Email: josh@trackfitmxperformance.com.au Website: trackfitmxperformance.com

Email is the way to reach us about anything in this policy. It goes directly to Josh Parker, who runs TrackFit and is the only person who handles your information.

This policy is written to meet our obligations under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. If you're in New Zealand, section 16 explains how the Privacy Act 2020 (NZ) applies to you as well.

 

---

2. WHAT THIS POLICY COVERS

This policy applies to the TrackFit coaching membership. That includes:

• The signup and trial process

• Your training program and everything you do inside the Everfit app

• Check-in forms, onboarding forms and messages with your coach

• Emails and Instagram messages we send you

• Your use of trackfitmxperformance.com

It does not cover purchases from our online store. If you buy a playbook, merchandise or any other product from the store, that transaction is covered by our separate store privacy policy, available on our website.

If you're both a member and a store customer, both policies apply to the relevant parts of your relationship with us.

 

---

3. WHAT WE COLLECT

We collect four kinds of information. We've grouped them in plain terms rather than legal ones.

3.1 Who you are

• Name

• Email address

• Phone number (if you give it to us)

• Date of birth or age

• Country and state or region

• Your Instagram handle, if you contact us there

3.2 How you pay

• Card details, entered directly into Stripe at signup

• Billing history, subscription status, and any failed or retried payments

• Whether you've claimed the 30-day guarantee

We never see or store your full card number. Stripe handles card details. We can see the last four digits, the card type, and whether a payment succeeded or failed. Nothing more.

3.3 How you train

• Your discipline and race format

• Race class, experience level and goals

• Available training days, equipment access and riding load

• Your race calendar

• Completed sessions, sets, reps, loads and times logged in Everfit

• Check-in form answers

• Messages between you and your coach

• Anything you post in the member community

3.4 How you use the app and site

• Login times and activity within Everfit

• Email opens and clicks

• Website pages visited, via cookies (section 13)

---

4. HEALTH INFORMATION

This section is separate because health information is treated differently under Australian privacy law, and because it deserves a straight explanation.

4.1 What we collect

• Health declarations you complete at onboarding

• Injury history — past and current injuries, surgeries, ongoing problems

• Doctor's clearances — where a doctor has cleared you to train, or set restrictions

• Anything you tell us about your health in a message, on a call, or in a check-in form

4.2 Why we collect it

One reason only: to build you a training program that is safe for your body.

If you've had a shoulder reconstruction, we need to know before we program overhead pressing. If your doctor has restricted your loading, we program inside that restriction. Without this information we'd be guessing, and guessing with a rider's body is not acceptable.

4.3 What we never do with it

We do not use your health information for marketing. Ever.

Specifically, and without exception:

• It is never entered into Klaviyo, our email platform

• It is never entered into ManyChat, our Instagram messaging tool

• It is never shared with Meta, Google, or any advertising platform

• It is never used to target you with ads

• It is never sold, rented or traded to anyone

• It is never shared with our commercial partners, including Bulk Nutrients

Your health information lives inside Everfit and inside our secure clearance folder (section 8). It does not travel anywhere else.

4.4 Consent

By giving us health information, you consent to us collecting and using it for the purpose in 4.2. You can withdraw that consent by emailing us — but be aware that if you do, we can't safely build or maintain your program, and your membership would need to end.

For riders under 18, the parent or guardian gives this consent. See section 10.

4.5 Where health information reaches us by another route

If you phone us, text us, email us or message us on Instagram with a health or injury update, we type that information into your Everfit profile and then delete it from wherever it first arrived.

This is a deliberate rule. It means your health information doesn't end up scattered across a phone, an inbox and a social media account. It lives in one place.

 

---

5. WHY WE COLLECT WHAT WE COLLECT

We don't collect information we don't need. If a field on a form isn't necessary, we don't ask for it.

 

---

6. WHO WE SHARE IT WITH

We do not sell your personal information. We do not trade it. We share it only with the service providers we need to run TrackFit, and only with the parts they need.

6.1 The absolute rule

Klaviyo, ManyChat and Meta never receive health information. This is not a best-efforts commitment. It is a rule about what gets typed where, and it is enforced by the handling rule in 4.5.

6.2 Others we may share with

• A doctor, physio or emergency contact — only with your consent, or in an emergency where there is a serious threat to your life or health

• Our accountant — billing records only, for tax purposes

• Our insurer or lawyer — only if there's a claim or legal dispute involving you

• Law enforcement or a government agency — only where we're legally required to

6.3 Bulk Nutrients

We have a commercial relationship with Bulk Nutrients, and members receive a $100 voucher after their first payment. We do not give Bulk Nutrients your personal information. The voucher is issued to you as a code. What you do with it is between you and them, under their own privacy policy.

 

---

7. WHERE YOUR INFORMATION GOES OVERSEAS

Most of the platforms we use are based outside Australia. This means your personal information is stored and processed overseas.

The countries your information may be stored in:

This includes your health information, which is stored by Everfit in the United States, and — in the case of doctor's clearances — by Google.

Under Australian Privacy Principle 8, we take reasonable steps to ensure overseas recipients handle your information consistently with the Australian Privacy Principles. In practice this means we use established platforms with published privacy and security commitments, rather than storing your information with providers we can't assess.

Australian privacy law may not apply to these providers in the same way it applies to us, and you may not be able to enforce Australian privacy rights against them directly. If something goes wrong, come to us — we're the ones responsible to you.

 

---

8. HOW WE KEEP IT SECURE

8.1 Where things live

• Everfit is where your account, training data, messages and health information live. It's password-protected and accessible only to you and your coach.

• Doctor's clearance letters are sent to us as attachments through private message inside Everfit — rider to coach only. They are then saved into a single encrypted folder in our Google account, restricted to Josh Parker alone, never shared, and not synced to any mobile device.

• Stripe holds card details. We don't.

8.2 What we do

• Two-factor authentication on the accounts that hold your information

• No shared logins — TrackFit is operated by one person, and only that person has access

• No health information stored on phones, in inboxes, or in messaging apps (see 4.5)

• Clearance files named and filed so they can actually be found and produced if you ask for them

8.3 What we can't promise

No system is completely secure. We take the steps above seriously, but we can't guarantee that a platform we rely on will never be breached. If one is, section 14 explains what happens next.

 

---

9. HOW LONG WE KEEP IT

9.1 Why we can't always delete on request

You can ask us to delete your information, and where we're able to, we will.

But we can't delete health records inside the retention periods above. These are records of coaching decisions made about your body, and they need to exist if a question is ever raised about them — by you, by an insurer, or by a court. Deleting them on request would leave both of us unprotected.

This means that if you cancel your membership and ask us to erase everything, we will:

• Remove you from all marketing lists immediately

• Close your account and stop all program delivery

• Retain your health and training records, and your billing records, for the periods above

• Delete them at the end of those periods

We'll always tell you honestly which parts we've deleted and which parts we've kept.

 

---

10. RIDERS UNDER 18 — INFORMATION FOR PARENTS AND GUARDIANS

This section is written for you, the parent or guardian. Please read it before signing your rider up.

TrackFit accepts riders aged 14 and over. If your rider is under 18, you need to know exactly what we collect about them and what we do with it.

10.1 You hold the membership, not your rider

The account is in your name, with your email address and your payment details. Your rider trains on it. You control it. You can see everything in it, and you can end it at any time.

10.2 You give consent, and you send the clearance

Consent to collect your rider's health information comes from you, not from them.

Doctor's clearance letters must be sent to us by you, from your account — never by the rider. This is deliberate. Medical decisions about a minor belong with their parent, and we don't want a private exchange about a young person's medical history happening between an adult coach and a child.

10.3 What we collect about your rider

• Their first name and age

• Their discipline, race class, experience and goals

• Their training days, equipment and riding load

• Their injury history and health declaration

• Any doctor's clearance or restriction

• Their completed sessions and logged training

• Anything they post in the member community

We do not collect their phone number, their home address, or their own email address. Contact runs through you.

10.4 The community, and how we keep it safe

The TrackFit member community sits inside Everfit and is mixed-age — adults and juniors in the same space. These rules apply to it:

• There is no private messaging between members. None. The feature isn't available.

• Every post is public and visible to Josh. Nothing happens in a corner.

• The only private messaging that exists is rider-to-coach, and for under-18 members, that channel runs through your account.

• Any adult member who attempts to contact a junior privately is removed from TrackFit immediately. No warning, no second chance.

• Josh Parker holds a current Western Australian Working With Children Check.

10.5 You can switch the community off

If you'd rather your rider didn't have community access at all, email us and we'll disable it. Their program, playbooks and coaching are unaffected. You don't have to give a reason.

10.6 Marketing and your rider

We will never use your rider's name, image, results or story in any marketing without asking you first and getting your permission in writing. That covers Instagram, TikTok, our website, emails, rider spotlights and everything else.

If you've given permission and change your mind, tell us and we'll take it down.

10.7 How long we keep it

Health information about a rider who was under 18 is kept until they turn 25, or seven years from the end of the membership, whichever is later. This is longer than for adults, and it's deliberate: it means the record still exists if a question is raised once they're an adult themselves.

10.8 Your rights, and theirs

You can ask to see, correct or delete your rider's information at any time, on the terms in section 11 and section 9. Once your rider turns 18, those rights become theirs.

If anything in this section concerns you, email josh@trackfitmxperformance.com.au and ask. We'd rather answer the question than have you guess.

 

---

11. SEEING AND CORRECTING YOUR INFORMATION

11.1 Asking to see it

You can ask us for a copy of everything we hold about you. Email josh@trackfitmxperformance.com.au with "Privacy — access request" in the subject line.

• We'll respond within 30 days

• It's free

• We may need to confirm it's really you before we release anything

We can refuse in limited circumstances set out in the Privacy Act — for example, where releasing information would unreasonably affect someone else's privacy. If we refuse, we'll tell you why in writing, and how to complain about it.

11.2 Asking us to correct it

If something we hold is wrong, out of date, incomplete or misleading, tell us and we'll fix it. Same email, same 30 days, no charge.

If we disagree that it's wrong, you can ask us to attach a statement to the record saying so, and we will.

11.3 Asking us to delete it

See section 9.1. Short version: we'll delete what we can, we'll keep what we're required to keep, and we'll tell you which is which.

 

---

12. MARKETING AND HOW TO STOP IT

12.1 What we send

• Emails via Klaviyo — training content, updates, offers

• Instagram messages via ManyChat — usually because you commented or messaged us first

12.2 How to stop it

• Email: click unsubscribe at the bottom of any email, or email us and ask

• Instagram: reply STOP, or just tell us

We'll action it promptly.

12.3 What doesn't stop

Opting out of marketing does not stop service messages, and can't. While you're a member you'll still receive:

• Billing and payment notifications

• Trial expiry reminders

• Messages from your coach about your program

• Notices about changes to the service or to this policy

These aren't marketing. They're part of the service you're paying for.

12.4 What we never do

We never use health information to decide what marketing you receive. See section 4.3.

 

---

13. COOKIES AND THE WEBSITE

Our website, trackfitmxperformance.com, uses cookies. So does the signup flow.

• Essential cookies keep the site and cart working. You can't turn these off without breaking the site.

• Analytics cookies (Google Analytics) tell us which pages people read and where they leave.

• The Meta pixel tells us whether an ad led to a signup, and lets us show ads to people who visited but didn't sign up.

You can block or delete cookies in your browser settings. Parts of the site may not work properly if you do.

The Meta pixel never receives health information. It sees website activity only — pages viewed, buttons clicked. It has no access to Everfit, to your program, or to anything you've told us about your body.

Once you're inside Everfit, this section no longer applies. Everfit's own privacy policy governs the app.

 

---

14. IF SOMETHING GOES WRONG

We're covered by Australia's Notifiable Data Breaches scheme. Here's what that means in practice.

If we find out that your information may have been accessed, lost or disclosed without authorisation:

1. We investigate immediately and take whatever steps we can to contain it.

2. We assess within 30 days — usually much faster — whether the breach is likely to cause you serious harm.

3. If it is, we tell you. Directly, by email, in plain language: what happened, what information was involved, what we're doing, and what you should do.

4. We notify the Office of the Australian Information Commissioner at the same time.

If a breach happens at one of our providers — Everfit, Stripe, Google — we'll pass on what they tell us as soon as we have it, and we won't wait for a complete picture before warning you that there's a problem.

Health information is the most sensitive thing we hold. If a breach touches it, you'll hear from us.

 

---

15. COMPLAINTS

15.1 Come to us first

If you think we've mishandled your information, email josh@trackfitmxperformance.com.au with "Privacy complaint" in the subject line. Tell us what happened and what you'd like us to do about it.

We'll acknowledge it within 5 business days and give you a full response within 30 days.

15.2 If you're not satisfied

You can take it to the Office of the Australian Information Commissioner. They generally require you to have complained to us first and given us 30 days to respond.

Office of the Australian Information Commissioner (OAIC) Website: oaic.gov.au Phone: 1300 363 992 Email: enquiries@oaic.gov.au Post: GPO Box 5218, Sydney NSW 2001

Privacy complaints must be made in writing. The OAIC's website has an online complaint form.

Complaining to the OAIC is free.

 

---

16. NEW ZEALAND MEMBERS

If you're in New Zealand, the Privacy Act 2020 (NZ) and its 13 Information Privacy Principles apply to how we handle your information, alongside our Australian obligations.

Everything in this policy applies to you. The practical differences:

• Your information is stored in the countries listed in section 7, including Australia

• You have the same rights to access and correct your information, under principles 6 and 7 of the NZ Act

• Our breach obligations under the NZ Act sit alongside the Australian ones in section 14

If you're not satisfied with our response to a complaint, you can contact:

Office of the Privacy Commissioner (New Zealand) Website: privacy.org.nz Freephone: 0800 803 909 Post: PO Box 10094, Wellington 6140

They also ask that you complain to us first before coming to them.

 

---

17. CHANGES TO THIS POLICY

We'll update this policy when what we do changes. When we do:

• The version number and effective date at the top will change

• If the change is significant — new provider, new use of your information, a change to how health information is handled — we'll email you before it takes effect

• Minor corrections and clarifications won't be emailed, but the version history below will always show what changed

Continuing your membership after a change takes effect means you accept the updated policy. If you don't, you can cancel.

 

---

VERSION HISTORY

---

 

TrackFit MX Performance Coaching Pty Ltd · ACN 684 073 121 · josh@trackfitmxperformance.com.au