Privacy Policy

Last updated October 5, 2026

This Privacy Notice for DruFit ("we," "us," or "our") describes how and why we may access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

• Visit our website at www.dru-fit.com, or any website of ours that links to this Privacy Notice
• Apply for, sign up for, or receive our online coaching
• Engage with us in other related ways, including email, social media, marketing, or events

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you have any questions or concerns, please contact us at aernest@dru-fit.com.

Summary of Key Points

What personal information do we process? It depends on how you interact with us. For coaching clients, this includes contact details, fitness and training information, health and injury information, and training videos and progress photos. Learn more about personal information you disclose to us.

Do we process any sensitive personal information? Yes. We process health data when necessary, with your consent, to build safe training programs. Learn more about sensitive information we process.

Do we collect any information from third parties? We may collect limited information from publicly available social media profiles when we reach out about our coaching services. We do not buy data or use data brokers. Learn more about information collected from other sources.

How do we process your information? To provide and improve our coaching and website, communicate with you, process payments, keep our Services secure, and comply with law. Learn more about how we process your information.

Who do we share personal information with? Only with the service providers that help us run DruFit, such as our payment processor and email provider. We do not sell your personal information. Learn more about when and with whom we share your personal information.

What are your rights? You can ask to access, correct, or delete your personal information at any time. Learn more about your privacy rights.

How do you exercise your rights? Visit www.dru-fit.com/contact or email aernest@dru-fit.com.

Table of Contents

1. What Information Do We Collect?

Personal information you disclose to us

In short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you apply for or sign up for coaching, subscribe to our emails, express an interest in our Services, take part in coaching activities, or otherwise contact us.

Personal Information Provided by You. The personal information we collect depends on how you interact with us and may include:

• Names
• Email addresses
• Phone numbers
• Contact preferences
• Job titles and general information about your work and daily routine
• Age or date of birth
• Sex
• Body weight
• Fitness goals and training history
• Current lift numbers and training performance data
• Health and injury information
• Progress photos
• Training and exercise videos
• Signatures on agreements and waivers

Sensitive Information. When necessary, with your consent or as otherwise permitted by applicable law, we process the following category of sensitive information:

• Health data, such as injuries, medical screening answers, and health conditions relevant to training

We use health data only to build safe, personalized training programs and to avoid aggravating injuries. We never sell it or use it for advertising.

Payment Data. All payment data is collected, handled, and stored by our payment processor, Stripe. We do not store or have access to your full payment card details. We receive only limited information about your payments, such as your name, email address, billing details, and transaction amounts. You can find Stripe's privacy notice here: https://stripe.com/privacy.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Information automatically collected

In short: Some information, such as your IP address and browser and device characteristics, is collected automatically when you visit our website.

We automatically collect certain information when you visit, use, or navigate our website. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, country, approximate location, information about how and when you use our website, and other technical information. This information is primarily needed to maintain the security and operation of our website, and for our internal analytics and reporting purposes.

Like many businesses, we also collect information through cookies and similar technologies. The information we collect includes:

• Log and Usage Data. Service-related, diagnostic, usage, and performance information, such as your IP address, browser type and settings, the date and time of your visit, and the pages you view.
• Device Data. Information about the computer, phone, tablet, or other device you use to access our website, such as device type, operating system, and browser.
• Location Data. Approximate location (such as country, state, or city) based on your IP address. We do not collect precise GPS location.

Information collected from other sources

In short: We may collect limited information from publicly available social media profiles.

To introduce our coaching services to people who have publicly shared an interest in strength training, we may view publicly available social media profiles and keep limited information, such as your name, username, and public posts related to training. If you do not reply to our outreach, we delete this information within 30 days. We do not buy personal information, use data brokers, or use information from other sources for targeted advertising.

2. How Do We Process Your Information?

In short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes only with your prior explicit consent.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To deliver and facilitate delivery of services to you. We may process your information to provide you with the requested service.
• To create personalized training programs. We use your goals, training history, and health information to build a program that is safe and fits you.
• To review training videos and provide technique feedback. We review the videos you send us to give you feedback on your form and technique.
• To track your progress and adjust your programming over time. We track your lifts, body weight, and check-ins to adjust your program as you progress.
• To schedule and conduct coaching calls and check-ins. We use your contact information to schedule and hold coaching calls and check-ins.
• To respond to inquiries and offer support. We may process your information to respond to your questions and solve any issues you might have with our Services.
• To send administrative information to you. We may process your information to send you details about our Services, billing, scheduling, and changes to our terms and policies.
• To fulfill and manage your orders. We may process your information to manage your coaching purchases, subscriptions, payments, and cancellations.
• To request feedback. We may process your information to ask for feedback and to contact you about your use of our Services.
• To send you marketing and promotional communications. We may process your information for our marketing purposes, in line with your marketing preferences. You can opt out at any time. For more information, see "What are your privacy rights?" below.
• To contact potential clients through social media. We may contact people who have publicly shared an interest in strength training to introduce our coaching services.
• To keep records of applications, agreements, and waivers. We keep these records to protect our legal rights and resolve disputes.
• To protect our Services. We may process your information as part of our efforts to keep our Services safe and secure, including fraud monitoring and prevention.
• To identify usage trends. We may process information about how you use our website to understand how it is being used so we can improve it.
• To determine the effectiveness of our marketing. We may process your information to understand which marketing efforts are most relevant and useful.
• To save or protect an individual's vital interest. We may process your information when necessary to save or protect an individual's vital interest, such as to prevent harm.

3. What Legal Bases Do We Rely On to Process Your Information?

In short: We only process your personal information when we believe it is necessary and we have a valid legal reason (legal basis) to do so under applicable law, like with your consent, to comply with laws, to provide you with services or fulfill our contractual obligations, to protect your rights, or to fulfill our legitimate business interests.

If you are located in the EU or UK, this section applies to you.

The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on in order to process your personal information. As such, we may rely on the following legal bases:

• Consent. We may process your information if you have given us permission (consent) to use your personal information for a specific purpose, including processing your health data. You can withdraw your consent at any time. Learn more about withdrawing your consent.
• Performance of a Contract. We may process your personal information when necessary to fulfill our contractual obligations to you, including providing our coaching, or at your request before entering into a contract with you.
• Legitimate Interests. We may process your information when reasonably necessary to achieve our legitimate business interests, as long as those interests do not outweigh your interests and fundamental rights and freedoms. For example, we may process your personal information to:
  • Send users information about special offers and discounts on our services
  • Analyze how our website is used so we can improve it
  • Support our marketing activities
  • Diagnose problems and/or prevent fraudulent activities
  • Understand how our clients use our services so we can improve their experience
  • Introduce our coaching services to individuals who have publicly shared an interest in strength training
  • Protect our legal rights and resolve any disputes
• Legal Obligations. We may process your information where necessary to comply with our legal obligations, such as to cooperate with a law enforcement body or regulatory agency, exercise or defend our legal rights, or disclose your information as evidence in litigation in which we are involved.
• Vital Interests. We may process your information where necessary to protect your vital interests or the vital interests of a third party, such as situations involving potential threats to the safety of any person.

If you are located in Canada, this section applies to you.

We may process your information if you have given us specific permission (express consent) to use your personal information for a specific purpose, or in situations where your permission can be inferred (implied consent). You can withdraw your consent at any time.

In some exceptional cases, we may be legally permitted under applicable law to process your information without your consent, including, for example:

• If collection is clearly in the interests of an individual and consent cannot be obtained in a timely way
• For investigations and fraud detection and prevention
• For business transactions provided certain conditions are met
• If it is contained in a witness statement and the collection is necessary to assess, process, or settle an insurance claim
• For identifying injured, ill, or deceased persons and communicating with next of kin
• If we have reasonable grounds to believe an individual has been, is, or may be a victim of financial abuse
• If it is reasonable to expect collection and use with consent would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province
• If disclosure is required to comply with a subpoena, warrant, court order, or rules of the court relating to the production of records
• If it was produced by an individual in the course of their employment, business, or profession and the collection is consistent with the purposes for which the information was produced
• If the collection is solely for journalistic, artistic, or literary purposes
• If the information is publicly available and is specified by the regulations
• We may disclose de-identified information for approved research or statistics projects, subject to ethics oversight and confidentiality commitments

4. When and With Whom Do We Share Your Personal Information?

In short: We share information only with the service providers that help us run DruFit, and in the specific situations described below. We do not sell your personal information.

Service Providers. We share personal information with trusted service providers who perform services for us and are only allowed to use it to provide those services. These include:

• Stripe for payment processing
• Kit for email newsletters and email marketing
• Squarespace for website hosting, forms, and website analytics
• Google for email, calendar, file storage, and spreadsheets
• Supabase and Netlify for the private tools we use to manage client information
• Scheduling and file-sharing tools we use to book calls and receive training videos

Testimonials and Progress Photos. We only share your progress photos, videos, results, or testimonials publicly with your written permission. You may withdraw that permission at any time by contacting us.

Legal Requirements. We may disclose your information where required by law, such as to comply with a court order or legal process, or to protect our legal rights.

Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

5. Do We Use Cookies and Other Tracking Technologies?

In short: We use cookies and similar technologies for basic site functions, security, and analytics. We do not use them for advertising.

Our website uses cookies and similar tracking technologies to keep the site secure, prevent errors, remember your preferences, support basic site functions, and understand how visitors use the site through our website provider's built-in analytics.

Our marketing emails may contain small tracking pixels (web beacons) that tell us whether an email was opened and which links were clicked. This helps us understand which emails are useful to our readers.

We do not use cookies or tracking technologies for targeted advertising, and we do not sell or share information collected through them for advertising purposes.

Most web browsers are set to accept cookies by default. You can usually set your browser to remove or reject cookies, and you can turn off images in your email app to block email tracking pixels. If you choose to remove or reject cookies, some features of our website may not work properly.

6. How Long Do We Keep Your Information?

In short: We keep your information only as long as needed for the purposes in this notice, unless the law requires otherwise.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). Specifically:

• Client records, intake forms, waivers, and agreements: kept for 3 years after coaching ends, to protect our legal rights and resolve any disputes.
• Payment and billing records: kept for 7 years, as required for tax and accounting purposes.
• Training videos: deleted within 90 days after coaching ends.
• Progress photos: deleted within 90 days after coaching ends, unless you have given written permission to use them as a testimonial. You may withdraw that permission at any time.
• Email subscribers: kept until you unsubscribe.
• Social media outreach contacts: deleted within 30 days if there is no reply.
• Website analytics data: kept according to our website provider's standard settings.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it, or, if this is not possible (for example, because it is stored in backup archives), we will securely store it and isolate it from any further processing until deletion is possible.

7. Do We Collect Information From Minors?

In short: We do not knowingly collect data from or market to children under 18 years of age or the equivalent age as specified by law in your jurisdiction.

We do not knowingly collect, solicit data from, or market to children under 18 years of age or the equivalent age as specified by law in your jurisdiction, nor do we knowingly sell such personal information. By using our Services, you represent that you are at least 18 or the equivalent age as specified by law in your jurisdiction. If we learn that personal information from users under that age has been collected, we will take reasonable measures to promptly delete it from our records. If you become aware of any data we may have collected from children under 18, please contact us at aernest@dru-fit.com.

8. What Are Your Privacy Rights?

In short: No matter where you live, you can ask to access, correct, or delete your personal information. Depending on your location, you may have additional rights under the law.

Wherever you live, you may contact us at any time to request access to the personal information we hold about you, or to ask us to correct or delete it. We will consider and act upon any request in accordance with applicable data protection laws.

In some regions (like the EEA, UK, Switzerland, and Canada), you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information, (ii) to request rectification or erasure, (iii) to restrict the processing of your personal information, (iv) if applicable, to data portability, and (v) not to be subject to automated decision-making. We do not make decisions about you that produce legal or similarly significant effects solely by automated means. In certain circumstances, you may also have the right to object to the processing of your personal information. You can make such a request by using the contact details in "How can you contact us about this notice?" below.

If you are located in the UK and are unhappy with how we have handled your personal information, you can make a complaint directly to us. This is in addition to the rights you have under the UK General Data Protection Regulation and the Data Protection Act 2018.

How to contact us:

• Online: www.dru-fit.com/contact
• Email: aernest@dru-fit.com

What happens after you complain:

• We will acknowledge your complaint within 30 days of receiving it.
• We will investigate without unjustifiable or excessive delay.
• We will keep you informed of progress and explain the outcome.

If you are not happy with our final response, you can refer your complaint to the Information Commissioner's Office, the UK supervisory authority:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your Member State data protection authority or UK data protection authority.

If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

Withdrawing your consent: If we are relying on your consent to process your personal information, which may be express and/or implied consent depending on the applicable law, you have the right to withdraw your consent at any time by contacting us using the details in "How can you contact us about this notice?" below. This will not affect the lawfulness of the processing before its withdrawal nor, when applicable law allows, processing conducted in reliance on lawful grounds other than consent.

Opting out of marketing and promotional communications: You can unsubscribe from our marketing and promotional communications at any time by clicking the unsubscribe link in our emails, replying "STOP" or "UNSUBSCRIBE" to our SMS messages, or contacting us using the details in "How can you contact us about this notice?" below. You will then be removed from our marketing lists. We may still send you service-related messages, such as coaching updates, billing information, or responses to your requests.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing to subcontractors in support services, such as customer service, is permitted. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

If you have questions or comments about your privacy rights, you may email us at aernest@dru-fit.com.

9. Controls for Do-Not-Track Features

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Notice.

California law requires us to let you know how we respond to web browser DNT signals. Because there currently is not an industry or legal standard for recognizing or honoring DNT signals, we do not respond to them at this time.

10. Do United States Residents Have Specific Privacy Rights?

In short: If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, or any other state with a consumer privacy law, you may have the right to request access to and receive details about the personal information we maintain about you and how we have processed it, correct inaccuracies, get a copy of, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law.

Categories of Personal Information We Collect

The table below shows the categories of personal information we have collected in the past twelve (12) months. For a full list of the personal information we process, please see "What information do we collect?"

We only collect sensitive personal information as permitted by applicable privacy laws or with your consent. Sensitive personal information may be used, or disclosed to a service provider or contractor, for additional, specified purposes. You may have the right to limit the use or disclosure of your sensitive personal information.

We may also collect other personal information outside of these categories when you interact with us in person, online, or by phone in the context of receiving help through our support channels, taking part in surveys, or receiving our Services.

We will use and retain the collected personal information as needed to provide the Services or for:

• Category A: up to 3 years after coaching ends, or until you unsubscribe from our emails, as described in "How long do we keep your information?"
• Category B: up to 3 years after coaching ends, or up to 7 years for billing records
• Category C: up to 3 years after coaching ends
• Category D: up to 7 years for billing and tax records
• Category F: website analytics are kept according to our website provider's standard settings; email engagement data is kept until you unsubscribe
• Category G: approximate location from website analytics is kept according to our website provider's standard settings
• Category H: training videos and progress photos are deleted within 90 days after coaching ends, unless you have given written permission to use photos as a testimonial
• Category I: up to 3 years after coaching ends
• Category K: up to 3 years after coaching ends
• Category L: up to 3 years after coaching ends

Sources of Personal Information

Learn more about the sources of personal information we collect in "What information do we collect?"

How We Use and Share Personal Information

Learn more about how we use your personal information in "How do we process your information?"

Will your information be shared with anyone else? We may disclose your personal information to our service providers, as described in "When and with whom do we share your personal information?" Our service providers may only use it to provide services to us.

We have not sold or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. We will not sell or share personal information belonging to website visitors, clients, or other consumers in the future.

Your Rights

You have rights under certain US state data protection laws. These rights are not absolute, and in certain cases, we may decline your request as permitted by law. These rights include:

• Right to know whether or not we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to request the deletion of your personal data
• Right to obtain a copy of the personal data you previously shared with us
• Right to non-discrimination for exercising your rights
• Right to opt out of the processing of your personal data if it is used for targeted advertising (or sharing as defined under California's privacy law), the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects ("profiling"). We do not currently do any of these.

Depending on the state where you live, you may also have the following rights:

• Right to access the categories of personal data being processed (as permitted by applicable law, including the privacy law in Minnesota)
• Right to obtain a list of the categories of third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in California, Delaware, and Maryland)
• Right to obtain a list of specific third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in Minnesota and Oregon)
• Right to obtain a list of third parties to which we have sold personal data (as permitted by applicable law, including the privacy law in Connecticut)
• Right to review, understand, question, and depending on where you live, correct how personal data has been profiled (as permitted by applicable law, including the privacy law in Connecticut and Minnesota)
• Right to limit use and disclosure of sensitive personal data (as permitted by applicable law, including the privacy law in California)
• Right to opt out of the collection of sensitive data and personal data collected through the operation of a voice or facial recognition feature (as permitted by applicable law, including the privacy law in Florida)

How to Exercise Your Rights

To exercise these rights, you can contact us by visiting www.dru-fit.com/contact or by emailing us at aernest@dru-fit.com.

Under certain US state data protection laws, you can designate an authorized agent to make a request on your behalf. We may deny a request from an authorized agent that does not submit proof that they have been validly authorized to act on your behalf in accordance with applicable laws.

Request Verification

Upon receiving your request, we will need to verify your identity to confirm you are the same person about whom we have the information in our system. We will only use personal information provided in your request to verify your identity or authority to make the request. If we cannot verify your identity from the information we already have, we may ask you for additional information for the purposes of verifying your identity and for security or fraud-prevention purposes.

If you submit the request through an authorized agent, we may need to collect additional information to verify your identity before processing your request, and the agent will need to provide written and signed permission from you to submit the request on your behalf.

Appeals

Under certain US state data protection laws, if we decline to take action regarding your request, you may appeal our decision by emailing us at aernest@dru-fit.com. We will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decision. If your appeal is denied, you may submit a complaint to your state attorney general.

California "Shine The Light" Law

California Civil Code Section 1798.83, also known as the "Shine The Light" law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing by emailing us at aernest@dru-fit.com.

11. Do We Make Updates to This Notice?

In short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Last updated" date at the top of this Privacy Notice. If we make material changes, we may notify you either by prominently posting a notice of such changes or by sending you a notification directly. We encourage you to review this Privacy Notice regularly to stay informed about how we are protecting your information.

12. How Can You Contact Us About This Notice?

If you have questions or comments about this notice, you may contact us at:

• Email: aernest@dru-fit.com
• Online: www.dru-fit.com/contact

13. How Can You Review, Update, or Delete the Data We Collect From You?

You have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. To request to review, update, or delete your personal information, please visit www.dru-fit.com/contact or email aernest@dru-fit.com.

This Privacy Policy was created using Termly's Privacy Policy Generator and customized for DruFit.