Privacy Policy
1. Who we are
I AM FITNESS is a business name of Axient AI Pty Ltd, ABN 21 688 793 151 ("we", "us"), of 3/40 Maria St, Petersham NSW 2049, Australia. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
This policy explains what personal information we collect, why, who we share it with, where it is kept, how long we keep it, and how you can access it, correct it, or complain. Our Collection Notice gives the short version at each point where we collect information.
Privacy requests and questions: privacy@iamfitness.com.au. They are handled personally by our privacy officer (the owner of Axient AI Pty Ltd).
2. You can use an alias
You never need to give us your real name. Choose a first name or a nickname; that is what we show in the app and in emails. You can sign in with any email address you control, including a private relay address.
3. What we collect, and why
Waitlist. Your email address; the name you would like us to use (optional); what you are most interested in (optional); your preferred language (optional); your confirmation that you are 18 or over; your consent to our emails; and the post, link or ad that brought you to us. We use this to hold your place, to email you what you asked for, and to understand which of our posts bring people here. We do not ask for any health information on the waitlist.
7-Day POWER Challenge. Your email address, your alias, your confirmation that you are 18 or over, your consent to the challenge emails and (optionally) to ongoing emails, your device's time zone (so each day opens at 4 am for you), the post or ad that brought you here, and which challenge days you complete. We use this to run the challenge and send the challenge emails.
Health check (challenge and membership). Before Day 2 of the challenge, and when you set up a membership, we ask health questions: the Adult Pre-Exercise Screening System (Stage 1), whether you are pregnant or have recently given birth, whether you have pelvic pain, and whether you have an injury or disability that affects how you move, with an optional note. At membership set-up we also ask your year of birth, height, weight, lifestyle (activity, exercise, sleep, stress), fitness level, time available and goals. This is sensitive information. We collect it only with your express consent, and we use it only to choose safe, suitable sessions for you, to build your plan and to show you your own progress. If you do not consent, you cannot join the challenge past Day 1 or complete membership set-up, but you can still use the library with gentle sessions.
Progress photos (optional, members, later release). Only with a separate consent, and only for you to see unless you choose to share a set with Ida.
Account. Your sign-in email, alias, preferences (theme, notifications, language), consents (which version, when), and your membership status.
Billing. Handled by Stripe. Stripe collects your card or wallet details and any billing name you choose. We keep only a reference to your Stripe customer record, your plan and its status. We never see or store card numbers.
Your visits. A random analytics ID (not linked to your name or email), the pages you view, your cookie choices, and, if you allow ad measurement, a scrambled (hashed) version of your email and analytics ID for Meta. We do not record your IP address against your analytics ID.
Support. What you send to support@ or privacy@, and our replies.
Safety. If a note you write contains words that suggest you may be at risk, the app shows crisis contacts straight away and tells our owner and Ida that an alert was raised. The alert carries the time only, never your note, your alias or your email.
We collect information directly from you, from your device (time zone, cookies), from Stripe (billing status), from our email provider (delivery, opens, unsubscribes) and from Meta and Instagram (which post or ad you came from). We do not buy data about you.
4. How we keep your health information separate
Your health and body information lives in a separate system from your email, alias and billing details. It is stored under a random member key, not your name or email. The only link between the two systems is encrypted, and only our server can use it, one person at a time, for a logged reason. No report, export or role can join the two in bulk.
Your health information is never used for advertising, never sent to Meta, our analytics or email providers, and never visible to our billing or finance staff. Ida (as coach) can see a "check before training" flag and, only if you turn on "Let Ida see this note", your injury note. Our owner can see your health information only through a logged "break-glass" step with a recorded reason, for example to answer your own access request or to respond to a safety incident.
5. Who we share it with
We share personal information only with the providers that run I AM FITNESS, and only what each needs. We do not sell personal information.
| Provider | What it does | What it receives | Where it processes |
|---|---|---|---|
| Supabase | Databases and sign-in | Account data (one project); health data under the member key (a separate project) | Sydney, Australia |
| Vercel | Hosts the website and app | Requests as they pass through; short-lived logs without health content | Our application code runs in Sydney, Australia; Vercel's global network delivers pages. Vercel is a US company. |
| Stripe | Payments, invoices, billing emails, cancellation | Card or wallet details, billing name, email, plan | Stripe (Australian account); Stripe stores data on its own systems, which may be outside Australia |
| MailerSend | Sends our sign-in and account emails | Email address, alias, the email content | European Union (provider-hosted) |
| MailerLite | Sends the waitlist, challenge and newsletter emails | Email address, alias, interest, language, which challenge step you are on, membership status | European Union (provider-hosted) |
| Cloudflare | Streams our videos; protects forms from bots (Turnstile) | Video playback requests; a bot-check token from your browser | Global network |
| Sentry | Error monitoring | Technical error reports with personal information removed | United States |
| Meta | Measures our ads and Instagram posts | Only if you allow ad measurement: a hashed email, a hashed analytics ID and ad cookies. Never health data, and never from inside the app | United States |
Our product analytics tool (PostHog, United States) is switched off at launch. When we turn it on we will update this policy; it will receive only an anonymous analytics ID and allow-listed events, never health data.
We may also disclose information when the law requires it, for example to a regulator or court, and to professional advisers under confidentiality.
6. Overseas disclosure
Our databases are in Sydney. Some of our providers, listed above, process information outside Australia, in particular in the United States. Before using a provider we check its privacy and security terms and limit what it receives. Where a provider is overseas, APP 8 applies and we take the steps described here to protect your information; by using the service you acknowledge that these providers hold the information listed against them.
7. Emails and marketing
We send three kinds of email:
- Account emails (sign-in codes, confirmations, your data export): sent because you need them.
- Billing emails (receipts, trial and renewal reminders, failed payments): sent by Stripe, not by us.
- Marketing and lifecycle emails (waitlist updates, the challenge sequence, Ida's tips and offers): sent only with your consent, with an unsubscribe link in every one, as the Spam Act 2003 requires.
Unsubscribing from marketing does not stop account or billing emails. We never send marketing by SMS without separate consent.
8. Cookies and analytics
See our Cookies notice for each cookie, what it does and how long it lasts. You can turn ad measurement off at any time on that page.
9. Security
We use encryption in transit and at rest, row-level access controls, separate keys and backups for the account and health systems, two-factor sign-in for staff, audit logs, and least-privilege access. No system is perfectly secure; if we have a data breach that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme.
10. How long we keep it
| Information | Kept for |
|---|---|
| Waitlist entry not confirmed | 30 days, then deleted |
| Waitlist entry confirmed, never became an account | Up to 24 months, then deleted |
| Challenge participant who never became a member, inactive | 24 months after last activity, then deleted (with notice if you still receive our emails) |
| Account, membership and health data | For as long as your account exists. Dormant accounts (no sign-in and no membership for 24 months) are deleted after 30 days' notice |
| Health and body data, injury notes, progress | Life of the account; you can delete items at any time |
| Consent evidence (type, version, time; email as a one-way hash) | 7 years after withdrawal or deletion, as evidence under the Spam Act and Privacy Act |
| Billing records | Held by Stripe for the period tax law requires (7 years for invoices) |
| Support correspondence | Life of the account; 24 months for non-customers |
| Privacy request records (type, dates, outcome only) | 7 years |
| Safety alert record (category, level, times, actions; no text) | 7 years |
| Backups | Expire within 30 days |
Deleting your account (Account → Privacy and data) cancels any membership, removes your account and health data within 24 hours, deletes you from our email provider, and clears backups within 30 days. Stripe keeps the invoice records the law requires.
11. Access, correction and your other rights
You can:
- see and change most of your information yourself in Account → Profile and Account → Privacy and data;
- ask for a copy of everything we hold about you (members can download it in the app; anyone can ask by email);
- ask us to correct information, or add a note where we disagree;
- ask us to delete your account and data;
- withdraw a consent (marketing, health data, photos) at any time; withdrawing health-data consent deletes your health information and your plan but keeps your account;
- unsubscribe from marketing with the link in any email.
Email privacy@iamfitness.com.au. We will confirm receipt within 2 business days and respond within 30 days. We may need to verify that the request comes from the account holder; we do this by a code sent to your sign-in email. There is no charge for access or correction.
12. Complaints
If you are concerned about how we have handled your information, email privacy@iamfitness.com.au and tell us what happened. We will acknowledge your complaint within 2 business days, investigate, and reply within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992.
13. Changes to this policy
Each version has a number and an effective date. For a significant change we will tell you in the app and by email, and members will be asked to read and accept the new version. The current version is always at iamfitness.com.au/privacy.
14. Contact
Privacy officer: the owner, Axient AI Pty Ltd Email: privacy@iamfitness.com.au Post: Axient AI Pty Ltd, 3/40 Maria St, Petersham NSW 2049, Australia General enquiries: support@iamfitness.com.au