Last updated 5 September 2026

This explains what information Exercise Prescription holds about you, why, and what your rights are. It covers this website and the members’ hub. It’s written to be read, not skimmed past; if anything is unclear, ask.

The short version

• We keep the minimum we need to run your membership.
• We do not keep medical records in the hub, deliberately.
• The hub keeps no record of your chats with the AI assistants; only your own browser does.
• We never sell your information, and there are no advertising trackers on the website or the hub.
• This website sets no cookies. The hub uses one, to keep you signed in.
• The hub is for adults (see “Adults and under-18s” below).
• You can ask to see, correct or delete your information at any time.

Who we are

This website and the members’ hub are run by Exercise Prescription Limited, Tracey’s company, operating from The Stray, South Cave, Hull, HU15 2AN. It is the “data controller”, the one responsible for looking after your information. If you have any question about your data, contact Tracey@exercise-prescription.co.uk.

This website

Just visiting. The website sets no cookies and runs no analytics or advertising trackers. Like every website, the server keeps short-lived technical logs (your IP address and browser type) for security, and nothing else. The site’s fonts and a couple of standard code libraries are loaded from Google, Cloudflare and unpkg, which see your IP address when they serve them; none of them sets cookies through this site.

The contact form. What you type (your name, email address and message) is emailed to Tracey so she can reply. The website doesn’t keep a copy.

Videos on the site. The Cancer Fit page shows videos streamed by Vimeo. Vimeo may set its own cookies when you press play; its privacy policy explains what it does with them.

What the hub holds about you

If you’re a member, the hub holds:

• Your account: your name, email address, password (stored scrambled, so we can’t read it) and which membership you’re on.
• Your activity in the hub: fitness goals and workout minutes you choose to record, videos you’ve watched, classes you’ve booked, and recipes or downloads you’ve favourited.
• Bookings: the dates and times of personal training sessions and consultations you book.
• Payment status: whether your membership is paid up, but never your card number; those go straight to Stripe.

Chat messages are not on our servers. What you type to the hub’s chat assistants is sent to Anthropic to generate the reply, and a copy of your recent chats is kept in your own browser so you can look back at them. The hub’s database holds none of it (see “The AI assistants” below).

What we deliberately don’t hold

Medical and clinical information is never stored in the hub. Many of our members live with health conditions, so this is a rule we designed in from the start, not an afterthought. Anything clinical you discuss with Tracey (health history, conditions, recovery notes, your health screening form) is held by Tracey separately, outside the hub, as part of her own client records. The hub also never sees or stores card numbers.

What we use your information for

To run your membership: signing you in, showing you the content your membership includes, running class bookings and personal training sessions, and keeping your fitness tracking working. And to answer you when you get in touch. That’s it. We don’t sell it, share it for marketing, or use it to build advertising profiles.

We don’t send newsletters or promotions. If that ever changes, we’ll ask you first with a separate opt-in, and you’ll be able to opt out again at any time.

Why we’re allowed to (the legal basis)

UK data-protection law says we need a lawful reason for each thing we do with your information. Ours are:

• Running your membership (your account, what your level includes, bookings, payments and the emails that go with them, such as sign-in links, receipts and class changes): contract. We need this to give you what you’ve signed up for.
• Replying to your enquiry through the contact form: legitimate interests. You’ve asked us something and we’re answering.
• The chat assistants (sending what you type to Anthropic so you get a reply): legitimate interests. It’s a feature you choose to use, it doesn’t intrude on you, and you can simply not use it.
• Keeping the website and hub safe (spotting misuse, protecting members’ accounts and fixing faults): legitimate interests.
• Keeping payment records after you leave: legal obligation, because tax law requires it.
• Marketing, if we ever do any: consent, asked for separately and easy to withdraw.

The companies that help us

Like almost every website, we’re built on established services. Each one only receives what it needs to do its job:

• Cloudways hosts this website on a server in London.
• Supabase holds the hub’s database (your account and activity) on its secure servers in Stockholm, Sweden, inside the EU.
• Mailtrap sends the hub’s own emails to you, such as your sign-in link and payment confirmations (your name and email address).
• Vercel hosts the hub itself.
• Vimeo streams the workout videos, on the hub and on this website.
• Zoom runs the live classes and online PT sessions.
• Cal.com handles session and consultation bookings (your name, email and appointment time).
• Anthropic processes what you type to the hub’s chat assistants so they can reply, then deletes it from its systems within 30 days.
• Stripe takes your card payments and runs the monthly subscriptions. Your card details go directly to Stripe and never touch the hub.

This website and the hub’s database stay in the UK and the EU, which UK law treats as giving your information the same protection it has here. Most of the other companies are based in the United States, so some of your information does leave the UK. Each of those transfers is covered by a safeguard UK data-protection law recognises:

• Stripe, Vercel, Vimeo, Zoom and Mailtrap are certified under the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”), which the UK government has approved for sending personal data to the US.
• Anthropic and Cal.com have signed the Standard Contractual Clauses with the UK International Data Transfer Addendum, the contract approved by the Information Commissioner’s Office for transfers out of the UK.

The AI assistants

The hub includes chat assistants (Electric Tracey, the AI assistant). What you type is sent to Anthropic, the company whose technology powers them, to generate the reply. Anthropic deletes what it receives within 30 days and does not use it to train its models. The hub itself keeps no copy of your chats: your own browser stores your most recent conversations so you can look back at them, and clearing your browser data removes them.

These chats are for fitness and nutrition guidance. They’re not medical advice, and it’s best not to type detailed medical information into them. Anything important about your health belongs in a conversation with Tracey, your GP or the specialist team looking after you.

Cookies

This website sets none. The hub sets one, and it’s the boring kind: it keeps you signed in. No advertising cookies, no tracking cookies, no third-party analytics. This is why there’s no cookie pop-up on either: there’s nothing to ask consent for.

How we protect it

Everything that passes between your device and the website or hub is encrypted in transit (both addresses always start with https, and anyone who types the address without it is sent straight to the encrypted version). The hub’s database is encrypted where it’s stored, and passwords are kept scrambled so that nobody, including us, can read them. Only Tracey and the small team who run the hub can see member information, each signing in with their own account. Card details never touch the hub at all.

How long we keep things

• Your account and activity: for as long as you have a membership. If your membership ends, your account stays so you can pick up where you left off if you come back. If you ask us to, we delete your account and the activity attached to it.
• Payment records: some may need to be kept longer where tax law requires it, up to seven years.
• Contact form messages: in Tracey’s email for as long as she needs them to deal with your enquiry.
• Chats with the AI assistants: the hub keeps none. Your browser keeps your recent chats until you clear them, and Anthropic deletes what was sent to it within 30 days. Deleting your account doesn’t reach into your browser, so clear the chat history there too if you want it gone.

Adults and under-18s

The hub is for adults. Tracey works with some clients aged 16 or 17, and only where a parent or guardian has agreed it with her directly. In that case the parent or guardian holds the arrangement with Tracey and is responsible for the account, and we hold the same everyday information about the young person as we would about any member (name, email address, activity in the hub), nothing more. We don’t offer accounts to anyone under 16 and don’t knowingly hold information about them; if you think we do, tell us and we’ll remove it.

If there’s ever a data breach

If we ever lose control of your information, we’ll tell the Information Commissioner’s Office within 72 hours where the law requires it, and we’ll tell you directly if there’s a real risk to you: what happened, what it means for you and what we’re doing about it.

Your rights

Under UK data-protection law (UK GDPR), you can ask us to:

• show you everything we hold about you,
• correct anything that’s wrong,
• delete your information,
• object to, or ask us to limit, a use that rests on legitimate interests,
• withdraw any consent you’ve given, for example to marketing,
• or hand it over in a portable format.

Just ask: Tracey@exercise-prescription.co.uk. If you’re ever unhappy with how we’ve handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk.

Changes to this policy

If anything here changes meaningfully (a new service, a new use of your information) we’ll update this page and let members know, not just quietly edit it.