Privacy policy.
Last Updated: July 2026
At Nerthus Personal Training your privacy is important to us. This Privacy Policy outlines how your personal data is collected and used in line with the requirements of General Data Protection Regulations (GDPR).
This privacy notice supplements any other privacy notices that we may provide to you at the point that we collect data from you and should be read in conjunction with those notices.
Nerthus Personal Training acts as the Data Controller and My PT Hub operates as the Data Processor. More detail about this is provided below.
If you have any enquiries about how your data is handled, please contact Kathryn Orviss.
Data Controller: Kathryn Orviss, trading as Nerthus Personal Training
Contact Email: kathryn@nerthuspt.com
1. The Types of Personal Data Collected
To provide safe, effective, and personalised fitness coaching, Nerthus Personal Training collects and processes the following information:
Identity Data: Your name, age, gender and date of birth.
Contact Data: such as email and phone number.
Financial Data: bank account/card details for payments and invoicing.
Special Category Data: this will be collected via questionnaires, conversations, photos (with consent), and other forms such as email. This data will include: health and medical data. It may be relevant to collect information regarding your race, religion and other personal information to support the effective delivery of services.
Lifestyle information: to support the development of your plan and ongoing support, we will collect information on your lifestyle including sleep, stress levels and nutrition.
We will collect, process and store personal data only if it is directly provided to us by you via direct interactions, automated technology on the My PT Hub app, online forms and questionnaires, website enquiries, .
Technical Data: By accessing www.nerthuspt.com basic technical data (such as IP addresses, location data, browser type, and cookies) is automatically collected via my hosting provider to monitor site performance.
2. How Your Data is Used
Under the UK General Data Protection Regulation (UK GDPR), your data will be used in the following ways:
To meet the contractual obligations between you and Nerthus Personal Training such as to design, manage, bill, and deliver the personalised training programmes and services you have signed up for.
For processing health, medical, and special category data to ensure your training is safely adapted.
For day-to-day business administration, internal auditing, analysing website traffic via Squarespace Analytics, and sending relevant business news or fitness updates to existing clients (which you can opt out of at any time).
To protect your life or physical safety in the event of a medical emergency during a training session.
To maintain proper financial, tax, and professional insurance records.
3. Third-Party Sharing & Emergency Disclosures
Nerthus Personal Training does not sell, rent, lease, or share your personal data with any third-party marketing companies, advertisers, or outside businesses unless you have explicitly given consent.
The only circumstances under which your data is shared are:
Medical Professionals (With Explicit Consent): If a medical questionnaire or baseline assessment flags a safety concern, Nerthus Personal Training will only share relevant health information with your GP, midwife, or other medical professionals after obtaining your explicit, written consent to do so.
Emergency Services: In a critical health emergency where you are incapacitated, or if you have explicitly requested that I do so, I may share your relevant medical history or emergency contact info directly with medical staff or paramedics to ensure your safety.
Service Providers & Business Transitions: Nerthus Personal Training uses a limited number of trusted core platforms/services for website hosting and business administration.
Legal Compulsion: Where strictly required by law, court orders, or insurance mandates for safety, legal compliance, or litigation.
4. International Data Transfers & Software Providers
To deliver services, Nerthus Personal Training uses a select group of industry-leading software providers. Because some of these companies are headquartered outside of the United Kingdom, your data may be transferred to, or stored on, secure cloud servers located internationally (such as in the United States or the European Union).
These platforms are:
Squarespace: for website hosting, contact form submissions, and basic website analytics. Squarespace, Inc. is based in the US and protects UK user data by utilising approved Standard Contractual Clauses (SCCs) and adhering to the UK-US Data Bridge framework.
Google Workspace: for email communications, calendar scheduling, and cloud storage of client documentation. Google processes data globally and utilises rigorous security protocols, Standard Contractual Clauses (SCCs), and the UK-US Data Bridge to guarantee UK data compliance.
My PT Hub (Fitii Ltd): Used to deliver workout programming, track client biometrics, and manage client coaching files. My PT Hub is a UK-based entity that operates in full compliance with UK GDPR standards.
Where data is transferred internationally by these provider networks, they are required to provide, legally approved safeguards and ensure they are maintained to guarantee your data receives an equivalent level of protection to UK law.
5. Website Cookies (Squarespace)
www.nerthuspt.com uses cookies and similar technologies to help it run effectively, provide a great user experience, and provides vistor usage information to Nerthus Personal Training.
Functional & Required Cookies: These are always used, as they allow Squarespace to securely serve the website to you.
Analytics & Performance Cookies: These are used only when you acknowledge our cookie banner. They allow me to view data regarding site traffic, popular pages, and visitor trends. You can choose to block or disable cookies at any time through your web browser settings.
6. Electronic Communication & Data Security
Digital Storage: All electronic questionnaires, waivers, and programming data are securely stored using encrypted, password-protected systems via Google Workspace and My PT Hub. Any hard-copy documents are kept in a secure, locked location.
Transmission Risk: Please note that transmitting information via the internet, email, or social media is not completely secure. While I take strict precautions to protect your data, any digital transmission is at your own risk.
Data Retention: To comply with standard UK fitness industry insurance mandates and the UK Limitation Act, client data and medical records are safely retained for a period of 7 years after you cease being a client, after which they are securely destroyed.
7. Your Rights Under UK GDPR
You hold full control over your personal data. By law, you can exercise the following rights at any time:
Right of Access: Request a copy of the personal data Nerthus Personal Training holds about you.
Right to Rectification: Request that Nerthus Personal Training correct any inaccurate or outdated information.
Right to Erasure ('Right to be Forgotten'): Request the deletion of your data, subject to legal or insurance retention requirements.
Right to Restrict or Object to Processing: Request that Nerthus Personal Training stops processing your data or object to it being used for specific purposes (including an absolute right to object to direct marketing).
Right to Data Portability: Request that Nerthus Personal Training transfer your data to another provider in a machine-readable format.
Right to Withdraw Consent: Withdraw your consent for Nerthus Personal Training to actively process your health data at any time. (Please note: because health data is essential for designing safe programming, withdrawing consent may mean Nerthus Personal Training can no longer provide services to you).
If you wish to exercise any of these rights, please contact Nerthus Personal Training via the email listed above.
If you are unhappy with how Nerthus Personal Training handle your data, you also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK regulator for data protection (www.ico.org.uk).
8. Integrated Services: My PT Hub
To deliver personal training services effectively, Nerthus Personal Training utilises My PT Hub (operated by Fitii Ltd) as a primary software platform.
When you create an account to access your workouts, your data is co-processed securely through their system. For your transparency, their data framework is outlined below.
MY PT HUB DATA & PRIVACY FRAMEWORK (SUMMARY)
As the software provider for Nerthus Personal Training, My PT Hub (Fitii Ltd) acts as a secure Data Processor. They host the digital infrastructure used to build your plans, log your workouts, and track your biometrics.
a. Data Collected by the Platform
When using the My PT Hub app or website, the platform collects:
Account registration details (Name, email, password).
Fitness exercises, nutritional logging, biometric data, and data relating to your physical fitness as inputted by you or your coach.
Device and log information (IP addresses, cookies) to ensure app security, correct functionality, and platform improvement.
b. Data Security & Encryption
Secure Servers: All information provided to My PT Hub is stored on highly secure servers.
Payment & Financials: Any payment transactions or billing completed through the platform are fully encrypted using Secure Sockets Layer (SSL) technology.
Access Control: Users are entirely responsible for keeping their unique app passwords confidential.
c. Data Ownership
While My PT Hub provides the secure digital container for your information, the data inputted belongs to you and your coach. My PT Hub does not sell or distribute your identifiable personal data to third-party advertisers.
For the full, unedited legal terms, cookie usage tracking, and technical specifications of the platform, you can review the official document directly at www.mypthub.net/legal/privacy-policy
Policy Acknowledgement & Agreement
By continuing to engage the services of Nerthus Personal Training, including the use of our website, submitting your information, or using our training platforms, you confirm that you have read, understood and agreed to this Privacy Policy. You will be asked for explicit consent to collect, process and use your special category data e.g. health and medical information including medications and referrals, gender, religion, race and culture.