Privacy Policy

This policy explains what personal information we collect through the Diamond Physiques website and mobile app, why we collect it, who else can see it, and what you can do about it.

It is written to be read, not to be survived. If anything here is unclear, ask us.

Who we are. Diamond Physiques By Alex is a registered business name of Alexander Djurovic, a sole trader, ABN 69 247 339 445, based in Queensland, Australia. In this policy "we" and "us" mean that person and business, and "you" means a client or visitor.

Contact: alex@diamondphysiques.com. We answer privacy questions ourselves; there is no support desk in between.

1. The short version

We collect what we need to coach you, and nothing for advertising.

There are no analytics or tracking tools on our website or app. No Google Analytics, no Meta Pixel, no advertising SDKs, no session recording. We have never installed any.

We do not sell your information, and we do not share it with advertisers. Ever.

We hold no card or bank details at all. There are no in-app purchases.

You can delete your account, and everything attached to it, from inside the app.

2. What we collect

Information you give us

When you enquire. Your name, email address, and whatever you tell us in an enquiry or application form, including your training history, goals, and any injuries or health conditions you choose to mention.

When you become a client. Your name and email address, used to create your account, and your date of birth, which you give in your intake form or your coach records, so your coach knows your age when planning your training and nutrition.

When you use the app. Depending on what you use:

Training: the workouts assigned to you, and the sets, reps, weights and notes you log

Cardio: any runs, rides, walks or other cardio sessions you record, including how long they took, how far you went, the pace and calories you enter, and anything you note about them. Workouts can also come from Apple Health, if you connect it (see below)

Body measurements: weight, body fat percentage, and any other measurements you choose to record

Daily figures: your step count, resting heart rate, lean body mass, and the energy you burn and consume, if you choose to record them. These can also come from Apple Health, if you connect it (see below), along with the protein, carbohydrate and fat you eat as another app recorded them

Hours slept: if you choose to record them, or read from Apple Health if you connect it (see below)

Progress photos: only if you upload them

Nutrition: foods and quantities you log, recipes you build from foods, and your calorie and macro targets, whether your coach sets them or you set them yourself

Water: how much you drink, if you choose to record it, and the daily targets your coach sets for your water and steps

Weekly check-ins (online clients): your answers, which include ratings of sleep, stress and diet, the number of sessions you completed, and anything you report about injuries or pain

Your intake form (when you join): your date of birth, your goals, your training so far, when and where you can train, any injuries, pain or medical conditions, what a typical week looks like for you, how you eat, whether you smoke or vape, and anything else you tell your coach

Messages: what you send us through the app, including any photos, videos (up to a minute) and files such as PDFs you attach, the reactions you add, and the earlier words of a message you edit, which both of you can still read

Before a photo or video you attach leaves your phone or browser, it is copied into a new file that keeps the picture and sound and nothing else, so the location and the phone details your camera stored in it are not sent. A file such as a PDF is sent as you chose it.

Information collected automatically

Notification token. If you turn on notifications, your device gives us an anonymous token so we can send you a reminder. It identifies the device, not you personally. We stop using it when you sign out on that device, and it is deleted when you delete your account.

Cookies: there are two, and neither is for tracking. One keeps you signed in. The other is set only while you are resetting your password, contains nothing but a marker, and expires after 15 minutes. Both are strictly necessary for the site to work. We set no advertising or analytics cookies, and nothing we put in your browser identifies you or follows you to other sites.

Your IP address, when you open an invite link. Redeeming an invite records the IP address the request came from, so that someone cannot sit there guessing at invite links. It is used for that and nothing else, is not linked to your account, and is not used to work out where you are. These records are deleted after 90 days.

On your phone, the app keeps a few things so it works without signal and opens quickly: your login session; your name, whether you are a coach or a client, your time zone, and the number that links your login to your coaching record; any sets, food or water you logged offline that have not been sent yet; which workout you are part-way through; cached copies of screens you have already seen, so the app can open with no signal: your Home screen (your next session, your latest figures, and the steps, water and sleep for the day), your Nutrition screen with your targets, food log and meal plan, your next workout as it was last loaded, your training history, or your client list if you are a coach; the recipes you can log, so one can still be logged with no signal; the time we last read each figure from Apple Health, and whether what you logged before has already been saved to Apple Health; and, if you agreed to food, water, steps and sleep logging, that you agreed and the date of the privacy policy you agreed to, so you can still log them with no signal. That list is everything, and it stays on your device.

Signing out takes almost all of it with you: your login, the name, role and coaching record link we had cached, the Apple Health times and what has been saved there, the recipes kept for logging, your agreement to food, water, steps and sleep logging, and every cached screen. Two things are kept on purpose (any sets, food or water you logged offline that have not been sent yet, and the workout you are part-way through), because those are work you have done that we have not received, and clearing them would lose it. All of it goes when you delete the app.

Information from Apple Health (iPhone)

If you choose to connect Apple Health, the app reads a fixed list from it: your step count; your workouts (the kind of workout, when it was, how long it took, the distance and the energy burned); your hours asleep each night; body weight, body fat percentage, lean body mass and resting heart rate; energy burned and energy consumed; and the protein, carbohydrate and fat you eat, as another app such as MyFitnessPal recorded them. That list is everything we read. We do not read the route or location of a workout, your heart rate outside the resting figure, your sleep stages, blood pressure, menstrual or reproductive data, clinical records, medications, or anything else in Apple Health. The app also saves what you log in it to Apple Health, as the next paragraph explains.

If you allow it, the app on your iPhone saves to Apple Health what you log in the app, so it shows in the Health and Fitness apps: each workout you finish (a strength workout, when it started and how long it took), including sessions your coach records with you; each cardio session you log in the app (the kind, when, how long, the distance and the calories you entered); the calories burned in a workout, which, when you did not enter them and no other app or device measured them, is an estimate from your latest weight, the kind of workout and how long it took; your weight, body fat percentage, lean body mass and waist measurement as recorded in the app by you or your coach; the calories, protein, carbohydrate, fat and fibre in the food you log, as a total for each day; and the water you log, as a total for each day. The first time, it saves everything you have logged in the app; after that your phone saves new entries whenever it opens, syncs or you leave the app, and keeps the last two weeks in Apple Health matching the app: something you change or delete in the app is changed or removed there too. It saves nothing else: not your sets, weights lifted, notes, ratings, photos or messages, and never anything about another person. A workout already in Apple Health for the same time (one your Apple Watch recorded, for example) is not saved a second time, and nothing the app saved is read back from Apple Health. You choose which of these to allow on the Apple Health permission screen and can change it at any time in the Health app or in iOS Settings; what is already saved stays in Apple Health until you delete it there.

Some of this is health information in the sense Australian privacy law uses, and section 3 applies to all of it.

It is read from your own iPhone, only after you allow it on the Apple Health permission screen, and only for as long as that permission stays on. You choose which of those figures to share and can allow some and refuse others. You can change any of it at any time: in the Health app under Sharing, or in iOS Settings under Privacy & Security, Health. If you turn a figure off we stop reading new values for it. Figures already saved stay with your other training data until you ask us to remove them or delete your account.

Your coach can see these figures. That is the reason for connecting. They are not used for advertising, not used to profile you, not sold, and not shared with anyone outside the providers listed in section 5.

Information from your Apple Watch

If you use the Diamond Physiques app on your Apple Watch, it shows your next workout, sent from the app on your iPhone. The sets you log on the Watch (reps and weight) and how hard you rated the workout are sent to the app on your iPhone and saved like sets you log there. If you start a workout on the Watch, it reads your heart rate and the energy you burn during that workout, only to show them on the Watch while you train, and saves the workout to Apple Health (a strength workout, when it started and ended, and the energy burned) so it counts towards your Activity rings. Your heart rate and the energy burned are not sent to us. The Watch keeps your next workout and the sets you logged until the workout is finished. You can turn the heart rate reading and the saving of workouts off at any time in the Health app or in iOS Settings, and the Watch still logs your sets.

We do not collect your location, contacts, browsing history, or advertising identifiers. The only things we read from another app are the Apple Health figures listed above, and only if you turn them on.

3. Health information, and why we ask for consent

Some of what we collect is health information, which Australian privacy law treats as sensitive and holds to a higher standard. That includes injuries, pain, body measurements including body fat and lean body mass, your resting heart rate, the cardio sessions and workouts you record, your step count and hours slept, the energy you burn and consume, the protein, carbohydrate and fat you eat, sleep and stress ratings, whether you smoke or vape, and anything you tell us about a medical condition.

Figures read from Apple Health are health information too. Everything in this section applies to them, and connecting Apple Health is its own separate consent that you give on your device and can take back there.

We collect it only with your consent, and only to coach you. By using the app and answering check-ins you are consenting to that. You can withdraw consent by deleting your account, or by asking us to remove specific information (see section 8).

Two commitments about health information specifically:

1. We do not share it with anyone outside the systems listed in section 5, all of which are infrastructure providers processing it on our behalf.

2. If you report an injury or pain, a human reads it. We do not and will not put an automated system in charge of deciding what to do about your body. Any automated feature we add for programming or nutrition will route an injury or pain report to your coach and stop there.

This app is not a medical service. We are personal trainers, not doctors. Nothing in the app is medical advice, and it is not a substitute for seeing a health professional.

4. Why we collect it

Name, email: to create your account, identify you, and contact you.

Enquiry answers: to decide whether we can help you, and how.

Training logs: to write your program, track your progress, and progress your loading safely.

Body measurements, photos: to show you change over time, and only what you choose to record.

Nutrition and water logs: to set and review targets with you.

Intake form answers: to build your first program around you, and so your coach knows you before your first session.

Check-in answers: to coach you week to week, and to notice when something is wrong.

Injury and pain reports: to keep you safe and adjust what we ask you to do.

Daily figures (step count, workouts, resting heart rate, body composition, sleep, the energy you burn and consume, and the protein, carbohydrate and fat you eat): to see how you are training, recovering and eating between sessions, so your coach is working from what actually happened rather than what either of you remembers.

Messages, and anything attached to them: so you and your coach can talk between sessions, including a video of how a lift felt or a photo of a meal.

Notification token: to send you a check-in reminder.

We do not use any of it for advertising, profiling, or automated decisions that affect you without a human involved.

5. Who else can see it

Nobody, except the infrastructure providers we use to run the service. They process your information on our behalf, under their own security obligations, and are not permitted to use it for their own purposes.

Supabase: database, sign-in, and storage of progress photos and of the photos, videos and files sent in Messages. Sydney, Australia (ap-southeast-2).

Vercel: website and app hosting. Global edge network.

Resend: sending emails to you. United States.

Expo: delivering push notifications to your device, and hosting the update server the app checks for new versions. United States.

About that update check: each time you open the app it asks Expo's server whether a newer version of the app's code is available. It sends the app's version number, the platform, and a random identifier created when the app was installed. It does not send your name, your account, your training data or anything read from Apple Health. The identifier is not linked to your account and is not used to work out who you are; it exists so the server can tell one installation from another. It goes when you delete the app.

Newie: the payment platform Alex uses for coaching fees. It receives your name and email address, and nothing else. Darwin, Northern Territory, Australia.

Newie is not like the four above, and the sentence at the top of this section does not describe it. It is an independent business rather than a provider handling information on our behalf: it has its own legal obligations, including tax and anti-money-laundering record-keeping, and it uses what we give it to meet them. Its privacy policy also allows information to be stored, processed in, or transferred to countries outside Australia, including the United States, so unlike your training and health data, the name and email address it holds may leave the country.

YouTube (Google): some exercise videos your coach chooses are YouTube videos. They play in YouTube's privacy-enhanced player (youtube-nocookie.com), on the app and on this website, and only when you press play: until then nothing is sent to YouTube. When you do play one, YouTube receives what any website sees when it shows you a video, which is your device's internet address, the type of device and browser, and that the video was played on our app or website. It does not receive your name, your account, your training data or anything read from Apple Health. Like Newie, YouTube is an independent business, not a provider working on our behalf: what it does with that information is governed by Google's privacy policy, not this one. United States.

When your coach adds a YouTube video, our server asks YouTube whether it exists and can be played inside other apps, and asks again from time to time so a video that has been removed can be flagged. That question names only the video. Nothing about you is in it.

Your training data, health information, progress photos and anything sent in Messages are stored in Australia. Email and notification delivery involve providers in the United States, which means the content of an email we send you, and the text of a notification, passes through servers outside Australia.

Progress photos, and the photos, videos and files sent in Messages, are held in private storage. They are not publicly addressable and cannot be reached by a URL alone. Something sent in a conversation can be opened only by the two people in it, through a link that stops working after an hour. Exercise demonstration images and videos are in public storage, because they are library content shown to every client. They contain nothing personal about you.

We will disclose information without your consent only where the law requires it (for example a court order) or where there is a serious and imminent threat to someone's life or health.

6. Financial information

We hold no financial information about you. No card numbers, no partial card numbers, and no bank details are collected, processed or stored. Not by the app, not by this website, and not in our database.

The app also does not sell anything. There are no in-app purchases.

7. How long we keep it

While you are a client, and while you have an account. Training history is only useful because it is long: deleting last year's logs would remove the thing that shows you progressed.

When you delete your account, we delete it. Not archive, not anonymise: delete. See the next section for exactly what goes.

If you enquire and never become a client, we keep your enquiry so we can follow up, and delete it on request.

Invite-link IP records are deleted after 90 days. They exist only to stop someone guessing at invite links, and are no use to anyone after that.

8. Your rights, and how to use them

Delete your account. In the app: More → Delete account. It asks you to confirm, then removes:

your sign-in and password

your client record

every workout, session and set you logged

your body measurements and progress photos, including the image files themselves

your nutrition logs, recipes and targets

your intake form

your check-in answers

your messages, and the photos, videos and files sent in them by you or your coach

your notification tokens

your email address from our email records

It cannot be undone, and we cannot restore it afterwards.

Get a copy of your information. Ask us and we will send you everything we hold about you, in a readable format, within a reasonable time and at no cost.

Correct something. Tell us and we will fix it.

Ask us to delete something specific rather than everything, for example one progress photo, or an answer you would rather not have given. Ask and we will remove it.

Complain. If you think we have mishandled your information, tell us first and we will investigate and respond. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

If you are in the European Union or the United Kingdom, you have further rights under the GDPR, including data portability and objecting to processing. Contact us and we will honour them.

9. Security

All traffic is encrypted in transit (HTTPS).

Your information is protected at the database level by access rules that scope every query to the account making it. A client can only ever read their own records; this is enforced by the database, not only by the app.

Progress photos and Messages attachments are in private storage, not public storage.

We do not store passwords ourselves: authentication is handled by Supabase, and passwords are hashed and never visible to us.

We do not email you your password, and we will never ask you for it.

No system is perfectly secure. If a breach ever occurs that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

10. Children

The app is not intended for anyone under 16. We do not knowingly create accounts for under-16s. If you are a parent or guardian and believe we hold information about your child, contact us and we will delete it.

Where we coach a minor with parental consent, that arrangement is agreed directly with the parent or guardian, in writing, before any account is created.

11. Changes to this policy

If we change what we collect or who we share it with, we will update this policy and change the date at the top. If a change materially affects you, we will tell you directly rather than relying on you noticing.

12. Contact

Alexander Djurovic, trading as Diamond Physiques By Alex.

ABN 69 247 339 445

alex@diamondphysiques.com

Queensland, Australia

Who collects this

Alexander Djurovic, sole trader, trading as DIAMONDPHYSIQUESBYALEX.
ABN 69 247 339 445
Queensland, Australia
alex@diamondphysiques.com