Privacy Policy

1. Introduction

Bulk Training Systems Pty Ltd (ABN 79 674 792 593), trading as Bulk Training Systems (“BTS”, “we”, “us”, “our”), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at bulktrainingsystems.com or engage with our services.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Many small businesses are exempt from the Privacy Act if their annual turnover is $3 million or less. That exemption does not apply to us. Under the Privacy Act, an organisation that provides a health service and holds health information is covered regardless of turnover, and coaching that assesses, maintains or improves your physical health is a health service. Because we also operate from New South Wales and hold health information, we comply with the Health Privacy Principles in the Health Records and Information Privacy Act 2002 (NSW).

2. Information We Collect

We may collect the following types of personal information:

• Contact details (name, email address, phone number)
• Information you provide via contact forms, enquiry forms, or booking requests
• Payment and billing information (where applicable, processed via third-party payment providers)
• Technical information such as IP address, browser type, device information, and website usage data
• Information collected through cookies and tracking technologies
• Emergency contact details

Health information

To coach you safely we also collect health information, which is treated as sensitive information under the Privacy Act:

• Pre-exercise screening responses
• Current and past injuries, surgeries, pain and physical limitations
• Medical conditions, medications and allergies, where they affect safe training
• Pregnancy or post-partum status, where you tell us
• Reports, clearances or referrals from your doctor, physiotherapist or other practitioner, where you provide them
• Sleep, stress, fatigue and recovery notes you report, which feed directly into RPE-based programming

Training and performance information

• Programs, session records, loads, sets, reps and RPE ratings
• Body measurements and body weight
• Assessment results, movement screens, and technique notes or video
• Progress photos, where you consent

3. How We Collect Information

We collect personal information when you:

• Fill out a form on our website (e.g. contact, enquiry, or lead capture forms)
• Sign up for our email list or marketing communications
• Interact with our website (via analytics and tracking tools)
• Contact us directly via email, phone, or social media
• Engage our services as a client
• Complete pre-exercise screening or health questionnaires
• Tell us about an injury, condition or how you are recovering, in a session or a message

Wherever it is reasonable and practicable, we collect personal information directly from you. Occasionally we collect it from someone else, such as a health practitioner you have authorised to speak with us, a person who refers you, or a family member in an emergency. If we receive information about you from a third party and you would not reasonably expect it, we will take reasonable steps to tell you.

4. Health Information and Your Consent

Health information is sensitive information under the Privacy Act, and we only collect it where it is reasonably necessary to deliver coaching to you, and where you consent.

You give that consent when you complete our pre-exercise screening, health questionnaire or intake forms, or when you tell us about an injury or condition. You can withdraw consent at any time using the contact details in section 11.

If you choose not to give us health information, or you withdraw consent, we may not be able to coach you safely, and we may need to decline or end coaching. That is a safety decision, not a commercial one.

We will always ask before taking or using progress photos or technique video. You can say no, and you can change your mind later.

5. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies, including:

• Google Analytics — to understand how visitors use our site
• Meta Pixel (Facebook/Instagram) — to measure ad performance and build audiences for advertising
• GoHighLevel (GHL) — our CRM and marketing automation platform, used to manage enquiries, follow-up communications, and email/SMS marketing

These tools may collect information about your browsing behaviour and may set cookies on your device. You can control or disable cookies through your browser settings, though this may affect site functionality.

6. How We Use Your Information

We use the personal information we collect to:

• Respond to enquiries and provide requested information
• Screen you for safe participation in resistance training
• Design, deliver and adjust your program, including RPE-based load adjustments
• Deliver and manage our personal training services
• Send marketing communications (with your consent, and with an option to opt out at any time)
• Improve our website and services through analytics
• Run and measure the performance of advertising campaigns
• Comply with legal obligations
• Respond to a medical emergency or a serious threat to your life, health or safety

7. Disclosure of Information

We do not sell your personal information. We may share information with:

• Service providers who help us operate our business (e.g. GoHighLevel, Google, Meta), who are bound by their own privacy and data handling obligations
• Payment processors, where applicable
• Health practitioners, but only with your consent, for example to coordinate around an injury
• The gym operator, where access, membership or an incident requires it
• Emergency services and your emergency contact, where there is a serious and imminent threat to your life, health or safety
• Government or regulatory bodies where required by law

Some of these providers may store or process data on servers located outside Australia, most commonly in the United States. Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure that the recipient does not breach the Australian Privacy Principles, as APP 8 requires. Overseas privacy laws may differ from Australian law, and we may not be able to control how an overseas recipient handles information once it is disclosed.

8. Data Security

We take reasonable steps to protect the personal information we hold from misuse, loss, unauthorised access, modification, or disclosure. Those steps include password protection and multi-factor authentication on the accounts holding client records, limiting access to health information to those who need it, and storing records in reputable cloud platforms rather than unsecured personal devices.

If a data breach occurs that is likely to result in serious harm to you, we will comply with the Notifiable Data Breaches scheme under the Privacy Act: we will assess the breach, notify you, and notify the Office of the Australian Information Commissioner as soon as practicable.

However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes outlined in this policy, or as required by law.

Because we are a private sector health service provider in New South Wales, section 25 of the Health Records and Information Privacy Act 2002 (NSW) sets minimum retention periods for health information:

• Health information collected while you were an adult: at least 7 years from the last occasion on which we provided a health service to you.
• Health information collected while you were under 18: until you turn 25.

We also keep financial and transaction records for at least 5 years, as tax law requires. This means that if you ask us to delete your records, we may be legally required to refuse in relation to health information until the retention period has passed. We will tell you if that is the case, and when the information can be destroyed.

Once a retention period has passed and we no longer need the information, we take reasonable steps to destroy it or de-identify it.

10. Your Rights

You have the right to:

• Request access to the personal information we hold about you
• Request correction of inaccurate information
• Opt out of marketing communications at any time (via the unsubscribe link in our emails or by contacting us directly)
• Withdraw your consent to us holding your health information, subject to section 9
• Lodge a complaint if you believe your privacy has been breached

To make a request, contact us using the details in section 11. We will need to verify your identity, and we will respond within 30 days. Access is normally free, though if a request takes substantial time or copying we may charge a reasonable cost-based fee and will tell you before proceeding. There are limited circumstances in which we may refuse access or correction, for example where it would pose a serious threat to someone’s life or health, unreasonably affect another person’s privacy, or where the law requires it. If we refuse, we will tell you why in writing.

Complaints

Please raise any complaint with us first, using the details in section 11. We will acknowledge it within 7 days and respond in writing within 30 days. If you are not satisfied with our response, you can escalate to:

• Office of the Australian Information Commissioner (OAIC) — www.oaic.gov.au, phone 1300 363 992, GPO Box 5288, Sydney NSW 2001
• Information and Privacy Commission NSW, for complaints about health information handled in New South Wales — www.ipc.nsw.gov.au, phone 1800 472 679

11. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, contact us at:

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated “last updated” date.