This page explains what personal information I collect, where it comes from, why I use it, who else handles it and what you can do about it. I’ve kept it in plain English. If anything isn’t clear, email me.
The short version
I’m Henry Hunt and I run HH Fitness on my own. I’m responsible for your information.
I collect what you give me on my forms, in messages and on calls, and what you post publicly on Instagram if I message you first. If you become a client, I also collect health details so I can coach you safely.
I use it to reply to you, coach you and take payment. If you’ve asked about or bought my coaching, I also send emails about it, which you can unsubscribe from at any time.
I never sell your information. I never use your health details for marketing, and I only use your photos or words with your permission.
You can ask to see, correct or delete your information at any time.
01Who I am
I’m Henry Hunt. I’m a sole trader in the UK and I trade as HH Fitness, an online fitness coaching business. I coach HYROX and hybrid racers, and women over 40.
For the information on this page I’m the “controller”. That means I decide how it’s used and I’m responsible for looking after it.
I only collect what I need. Here is all of it, grouped by where it comes from.
Forms on this website
Everything you send through these forms goes into my CRM (my customer database), which is run by HighLevel.
The Rebuild application: your name, email address, phone number, Instagram handle (optional), how many HYROX races you’ve done, your best finish time, how many days a week you train, whether your time has stalled, what you’ve tried, your next race date (or that none is booked), your goal time, which coaching option you want, and that you agree to the guarantee conditions.
The fuelling floor calculator: your name and email address are sent to my CRM. The body and training numbers you type in stay in your browser. They are not sent to me.
The join box on my page for women: your first name and WhatsApp number, so I can add you to the free WhatsApp group.
Facebook and Instagram
Lead forms in my ads: your name, email address, phone number and your answers to the questions (for example how many HYROX races you’ve done and your best time). Meta passes these to my CRM.
Messages and comments: if you message me, comment on my posts or interact with my content, I see your username, your profile and what you write. I may reply or send you a message.
Public Instagram profiles: I sometimes send a first message to people whose public posts or comments show an interest in HYROX, hybrid training, fitness or healthy eating. I find them through hashtags and through the likes and comments on public posts. I use your username, your public profile and what you posted. If you tell me to stop, I won’t message you again.
Booking a call
When you book a call through my booking calendar (run by HighLevel), I get your name, email address, phone number and the time you picked.
Paying me
Payments go through Stripe. You can pay by card, Apple Pay, Klarna, Link, Revolut Pay or Amazon Pay, depending on what’s offered. I receive your name, email address, phone number and what you bought. I never see your full card number.
If you become a client
To coach you I collect:
your answers to my starting questionnaire: injuries, health conditions, medication, training history and goals
your programmes, check-ins and training logs
your food logs
body measurements and progress photos, if you choose to send them
This happens through the Kahunas coaching app and WhatsApp. Some of it is health information, which gets extra protection. See Health information.
Messages, calls and email
If we talk on WhatsApp, by phone, by text, by email or in Instagram DMs, I have the messages and your contact details. My email runs on Microsoft Outlook.
The free WhatsApp group
If you join my free WhatsApp group for women over 40, I have your name and number. Other members can usually see your WhatsApp name and number, and anything you post. Please only share what you’re happy for the group to see.
When you visit these pages
These pages are hosted by HighLevel. Like most websites, they receive technical information such as your IP address, browser, device and the pages you look at. The Meta Pixel also runs on them (see Cookies and the Meta Pixel). Some pages load fonts from Google Fonts, so Google receives your IP address.
Do you have to give me any of this?
No. But I can’t reply to you without your contact details, and I can’t coach you safely without your health information.
03Health information
Some of what clients, and sometimes people thinking about coaching, tell me is about their health: injuries, health conditions, medication, body measurements, progress photos, food logs and anything health related in check-ins. UK GDPR calls this “special category data” and gives it extra protection.
Why I need it: I can’t write you a safe programme without knowing about your injuries, conditions and medication.
My lawful basis: your explicit consent (Article 9(2)(a) UK GDPR). Giving me health information is always your choice. When you send it to me, for example in my starting questionnaire, you’re agreeing that I can use it to coach you, and only for that.
Who sees it: me. It’s kept in Kahunas, WhatsApp, my email, short notes in my CRM and the programme files on my own computer, and never anywhere public. I also use an AI assistant, Claude by Anthropic, to help me read food logs and write programmes (see Who I share it with).
If you mention your health before you’re a client (on a call or in a message), I only note what I need to answer you safely, and it follows the same rules.
What I never do: use it for marketing, or put it in posts or ads.
Changing your mind: you can withdraw your consent at any time by emailing me. I’ll then delete your health information. It doesn’t affect anything I did before you withdrew.
To be honest with you: I can’t keep coaching you safely without this information, so withdrawing consent usually means the coaching stops.
04Why I use it (lawful bases)
UK GDPR says I need a lawful reason, called a “lawful basis”, for each thing I do with your information. Here they are.
What I do
Lawful basis
Reply to your application, enquiry, booking or message
Contract or legitimate interestsSteps you’ve asked me to take before signing up, or my interest in answering people who contact me.
Send a first Instagram message to people whose public posts show an interest in what I do
Legitimate interestsFinding people my coaching could help. Tell me to stop and I will.
Follow up by phone, WhatsApp, text or email after you’ve enquired
Legitimate interestsYou asked about my coaching. Tell me to stop and I will.
Deliver the coaching, programmes or PDFs you’ve bought
Consent or legitimate interestsLegitimate interests where you’ve bought from me or asked about my coaching (the “soft opt-in”). Unsubscribe at any time.
Run the free WhatsApp group
ConsentYou choose to join and can leave at any time.
Measure my ads and show them to the right people, using the Meta Pixel
Legitimate interestsKnowing which ads work. You can object, and see how to block it in Cookies.
Use your photos or words in posts or on my pages
ConsentOnly ever with your permission.
Keep these pages working and secure, and deal with any legal claims
Legitimate interests
Where I rely on legitimate interests, you have the right to object. I’ll stop unless I have a strong reason to carry on that outweighs your interests.
I don’t sell your information, and I don’t share it for anyone else’s marketing.
05Who I share it with
I use a small number of services to run my business. They handle your information so they can provide their service to me.
HighLevel (also called GoHighLevel or LeadConnector): hosts these pages and runs my CRM, booking calendar and email newsletter.
Meta: Facebook and Instagram (ads, lead forms, messages and the Meta Pixel) and WhatsApp (messages, coaching chats and the free group).
Stripe: takes payments. If you pay with Klarna, Apple Pay, Revolut Pay or Amazon Pay, that company also handles your details for the payment.
Kahunas: the coaching app where client programmes, check-ins and logs live.
Microsoft: Outlook, for email.
Anthropic: Claude, the AI assistant I use to help me run my business, for example to draft messages and emails, read food logs and check-ins, and write programmes. It may see client details, including health information.
Google: serves the fonts on some of my pages, so it receives your IP address.
An accountant, if I use one, for my business accounts.
Meta, Stripe and the payment providers also use some information for their own purposes, such as preventing fraud and, for Meta, advertising. For that, their own privacy policies apply. You can read Stripe’s privacy policy on Stripe’s website, and Meta’s in the Facebook or Instagram app.
I’ll also share information if the law requires it, for example with HMRC, the police or a court.
06Transfers outside the UK
Some of these companies are based in the USA or store data there: HighLevel, Meta (including WhatsApp), Stripe, Google, Microsoft and Anthropic. Kahunas may also store data outside the UK.
When your information goes outside the UK, it’s protected by safeguards approved under UK law, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK-US “data bridge” where the company is certified under it. Email me if you’d like more detail.
07Cookies and the Meta Pixel
Cookies are small files a website stores in your browser. Here is what runs on my pages.
The Meta Pixel. A small piece of code from Meta that runs as soon as a page loads. It tells Meta when you view a page and when you send a form: a “Lead” event when you send a coaching application, and a separate event when you sign up for something else, such as the calculator or the WhatsApp group. Meta uses this to show me which ads work and to show my ads to people likely to be interested. Meta may link it to your Facebook or Instagram account. It sets cookies such as _fbp (lasts up to 90 days) and _fbc (if you arrived from an ad). Meta and I are joint controllers for collecting this information and sending it to Meta, and the same goes for my ad lead forms. What Meta does with it after that is Meta’s responsibility, under Meta’s privacy policy.
HighLevel. My page host may use cookies or similar technology that the pages and forms need to work.
Google Fonts. Some pages load fonts from Google, which receives your IP address.
Stripe. Stripe’s checkout pages are run by Stripe and use Stripe’s own cookies, for example to help prevent fraud.
How to refuse or clear them
In your browser: clear your cookies after your visit, or block cookies for henryhuntfitness.com in your browser settings. The _fbp cookie is set on this site’s own address, so blocking only “third-party” cookies won’t stop it. A private window, or a browser or extension that blocks trackers, also helps.
With Meta: in the Facebook or Instagram app, open Accounts Centre. “Your activity off Meta technologies” lets you disconnect and clear activity that websites like mine send to Meta. “Ad preferences” lets you control the ads you see.
If you block all cookies, some parts of these pages may not work properly.
08Marketing and unsubscribing
Email: I send a weekly email, and now and then an email about a new offer, to people who have asked about or bought my coaching. Every email has an unsubscribe link. Click it and the emails stop.
WhatsApp, texts, calls and DMs: after you’ve enquired, or if you’re in my free WhatsApp group, I may get in touch this way about my coaching. Reply “stop” or just tell me, and I’ll stop.
Everything at once: email [email protected] at any time to opt out of all marketing. No reason needed.
When you unsubscribe, I keep a note of your email address or number marked “do not contact”, so you aren’t added back by mistake.
09How long I keep it
Information
How long
Enquiries, applications and leads who don’t become clients
Up to 2 years after our last contactThen deleted.
Free WhatsApp group membership
While you’re a memberLeave at any time. Your details in my CRM follow the 2 year rule above.
Client training and health records: questionnaire, programmes, check-ins, logs, measurements and photos
Deleted within 12 months of coaching endingSooner if you ask, unless I have to keep something for a legal reason.
Payment and tax records
6 yearsBecause HMRC requires it.
Your photos or words used with your permission
Until you ask me to take them downI’ll remove them from my pages and accounts. I can’t control copies other people have already shared.
“Do not contact” notes
As long as needed to respect your choice
10Your rights
Under UK GDPR you have these rights over your information:
See it
Get a copy of the information I hold about you.
Correct it
Have anything wrong or incomplete fixed.
Delete it
Have your information erased, unless I have to keep it, for example tax records.
Restrict it
Pause how I use it while something is sorted out.
Object
Stop me using it where I rely on legitimate interests. You can always object to marketing, no reason needed.
Move it
Get information you gave me in a format you can take elsewhere, where I rely on consent or a contract.
Withdraw consent
At any time, for anything I do based on your consent.
No computer-only decisions
I don’t make decisions about you by automated means alone that have legal or similarly significant effects.
To use any of these rights, email [email protected]. It’s free. I’ll reply within one month. If your request is complicated I may need up to two more months, and I’ll tell you if so. I may ask you to confirm who you are first.
11How to complain
If you’re unhappy with how I’ve handled your information, please tell me first and I’ll do my best to put it right. I’ll acknowledge your complaint within 30 days.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator:
Under 18s: my coaching and these pages aren’t aimed at anyone under 18. If you’re under 18, please don’t send me your details. If I find I have them, I’ll delete them.
Security: I use established services, keep my accounts protected and only share what each service needs to do its job.
Other websites: Stripe’s checkout pages, Facebook, Instagram and WhatsApp have their own privacy policies.
13Changes to this policy
If I change this policy, I’ll update this page and the date at the top. If a change matters for clients, I’ll tell you directly.