Privacy Policy

Version 2.0 – 17 September 2026 Previous version: 25 April 2025

1. Who we are

Health & Performance 3 Ltd ("HP3", "we", "our", "us") is a company registered in England and Wales, company number 13987354, registered office 17 Brogden View, Barnoldswick, Lancashire, BB18 5LH.

We provide endurance coaching, physiotherapy, nutrition coaching, bike fitting, biomechanical and physiological assessment, training plans, and educational content, to clients in the United Kingdom and internationally.

Health & Performance 3 Ltd is the data controller for the personal data described in this notice, except where section 3 says otherwise.

• Contact for all data protection matters: info@hp-3.co.uk, or write to us at the address above.
• ICO registration reference: ZC240167
• We are not required to appoint a Data Protection Officer, and have recorded the assessment behind that decision. Responsibility for data protection rests with the company directors; please use the contact above.

Because we work with clients across the UK, the EU/EEA and beyond, this notice is written to meet both the UK GDPR (with the Data Protection Act 2018) and, where you are resident in the EU or EEA, Regulation (EU) 2016/679 (EU GDPR). References to "the GDPR" mean whichever applies to you.

2. What this notice covers

This notice covers our website (hp-3.co.uk), our coaching and physiotherapy services, our assessments, our training plans, our communications with you, and any research we carry out. Please read it alongside our Coaching Agreement, Communication Policy, and Training Plan Disclaimer.

3. Who controls your clinical records

Some of our services are delivered with Worsley Physio Clinic, which also trades as Athlete Matters. Who holds your clinical record, and who is responsible for it, depends on which service you receive.

Where Worsley Physio Clinic is the controller, its own privacy notice governs that record and you should direct requests about it to the clinic. Its notice is available from the clinic on request. Where we are the controller, this notice applies and you can contact us at info@hp-3.co.uk.

If you receive both clinic-based and online treatment from us, you will have a record in both places. We will tell you which is which if you ask.

4. The information we collect

4.1 Information you give us

Your PAR-Q and Deep Health Questionnaire responses are collected through HubSpot, our customer relationship management system. Notes from an online physiotherapy consultation are written up as a paper clinical record.

4.2 Information we receive from other sources

• Wearables and platforms – training, GPS, heart rate, sleep and physiological data synced into TrainingPeaks from devices and services such as Garmin, Strava, Wahoo and Coros, under the connections you authorise.
• TrainingPeaks store – if you buy one of our training plans through TrainingPeaks and tick the opt-in box, TrainingPeaks sends us your name and email address.
• Referrals – where a clinic, coach or medical professional refers you to us with your agreement.
• Publicly available race results – ITRA, UTMB Index, Power of 10, runBritain, DUV and race organisers' published results, used to inform your plan.

4.3 Children and young people

We do not currently provide coaching to anyone under 18. Our services, our website and our content are directed at adults.

If we accept a client under 18 in future, our published Working With Young Athletes policy applies, and in summary:

• For physiotherapy, a person aged 16 or over may consent to their own treatment (Family Law Reform Act 1969). A person under 16 may consent if assessed as Gillick competent. Otherwise we require the consent of a person with parental responsibility.
• For coaching, we require the consent of a parent or guardian, and ask that they are a party to the coaching agreement.
• We would keep that person's records until their 25th birthday, or their 26th if they were 17 at their last contact with us.

Safeguarding. Whatever a client's age, where we believe a child or an adult at risk faces a risk of serious harm, we may share information with the appropriate authorities without consent. We will tell you we have done so unless doing so would increase the risk.

5. Why we process your data, and our legal basis

Health data is "special category" data. It needs both a lawful basis under Article 6 and a separate condition under Article 9. Both are set out below.

Where we rely on your consent, you can withdraw it at any time by emailing info@hp-3.co.uk. Withdrawing is as easy as giving consent, and it does not affect processing carried out before you withdrew. Because we cannot coach you safely without your health screening information, withdrawing that particular consent will bring your coaching engagement to an end – we will tell you this clearly before you give it. We would still keep a limited record of the engagement for insurance and legal reasons, under Article 9(2)(f).

Note that a clinical record is different. Because we rely on Article 9(2)(h) rather than consent for physiotherapy records, withdrawing consent does not remove a clinical record – we are required to retain it, and that is precisely why we do not rest it on a basis you could revoke.

Do you have to give us this information? Providing your identity, contact and health screening information is a contractual requirement – we cannot safely or lawfully coach or treat you without it, and we would have to decline or end the engagement. Everything else is optional, and declining it only limits how far we can personalise your programme.

6. Artificial intelligence in your coaching

Several of the tools we use apply artificial intelligence or automated modelling to your training and health data – to analyse data in order to spot trends, model your physiology, and summarise large data sets. This is now normal in endurance coaching.

The part that matters: a human always decides

No AI system sets your training, changes your programme, or gives you nutrition advice on its own. Every AI-generated suggestion is reviewed by your coach and then accepted, adjusted, rejected or rewritten before it reaches you. Coaching with HP3 means a qualified human being has made the decision, knows your circumstances, and can explain the reasoning if you ask.

That is a coaching commitment first and a legal position second. In legal terms it means we do not make decisions about you by automated means alone, and you are not subject to automated decision-making or profiling producing legal or similarly significant effects within the meaning of Article 22 of the GDPR.

The tools we use

Where a provider offers a choice about whether customer data is used to train its models, we take the option under which it is not.

Automated analysis is not new in this field. WKO5 has modelled athletes' physiology on the coach's own computer for many years, long before generative AI arrived, and TrainingPeaks has drawn trends from training data for longer still. What has changed recently is that some of these tools now run on other companies' servers, and that they draft language as well as numbers. That is precisely why the table above says where your data goes in each case – and why the human decision point matters more than it used to, not less.

Nutrition planning with Hexis

We use Hexis with a small number of athletes to support nutrition and fuelling planning. It connects to your TrainingPeaks account and uses your training load to model your daily fuelling needs.

We hold a limited number of Hexis licences, so most athletes will never use it. If we propose using it with you, we will tell you before anything is connected, and it is your choice – declining means we plan your nutrition without it, which we are perfectly able to do. If a licence is later reassigned, we disconnect your account.

Hexis receives your training data and the profile information needed to model your fuelling. As with everything else in this section, the plan you actually receive is the one your coach has reviewed and signed off.

What we send, and what you can do about it

• We minimise where we can. In the tools we drive directly – principally Claude – we send only the data the analysis needs and strip identifiers the analysis does not need. In platforms where you hold your own account (TrainingPeaks, Hexis) the data is inherently linked to you, because that is how the service works.
• You can object. If you would prefer your data was not processed by AI tools, tell us. We will handle your file manually and, where the tool is optional, disconnect it. This may slow our turnaround, and in the case of TrainingPeaks' own built-in features you may also need to check your settings with TrainingPeaks directly. It will not affect the quality of your coaching.

7. Who we share your data with

We never sell your data. We share it only as follows.

Service providers acting on our instructions (processors), each under a written contract:

Note on TrainingPeaks: where you hold your own TrainingPeaks account, TrainingPeaks is also a data controller in its own right for that account. Its own privacy policy applies directly to that account and to the analysis TrainingPeaks itself performs on it: https://www.trainingpeaks.com/privacy-policy

Note on WKO5: WKO5 is analysis software installed on HP3's own equipment. It draws on data we already hold and performs its modelling locally, so using it does not send your data to a further third party and it does not appear in the table above.

Others we may share with:

• Worsley Physio Clinic (Athlete Matters) – for clinic-based physiotherapy and bike fitting, where the clinic is the controller of the resulting clinical record (section 3).
• Your other healthcare professionals – GP, consultant, surgeon, other therapists – with your consent, or where necessary for your care.
• Race organisers and medical teams – where you ask us to support you at an event, including emergency contact details.
• Our professional advisers, insurers and indemnity providers – where necessary to obtain advice or defend a claim.
• Regulators and authorities – the HCPC, the ICO, safeguarding authorities, or where the law requires it.
• The University of Salford – for approved research only, and only where you have consented (section 9).

8. International transfers

Several of our providers are outside the UK, mainly in the United States. When your data is transferred outside the UK, we protect it using one of these:

• an adequacy decision by the UK Government (this covers, for example, Canada and the EEA);
• the UK International Data Transfer Agreement, or EU Standard Contractual Clauses with the UK Addendum, supported by a transfer risk assessment; or
• the UK Extension to the EU–US Data Privacy Framework, where the provider is certified.

You can ask us for a copy of the safeguards in place for any specific transfer by emailing info@hp-3.co.uk.

9. Research and publication

We carry out academic research in sports and exercise medicine and physiotherapy, in some cases in collaboration with the University of Salford.

• We will never use your identifiable data in research without asking you first, separately and specifically. Our coaching agreement does not include research consent.
• Research consent is separate from your coaching or treatment, and refusing it has no effect on your care or your relationship with us.
• Research is subject to approval by a Research Ethics Committee, and to the Article 89 safeguards.
• For case reports and single-athlete studies we will show you the full manuscript before submission and you may request changes or withdraw consent up to the point the journal accepts it.
• Even where we anonymise or pseudonymise, we will tell you honestly where people in your sport might still be able to work out who you are.
• Research records and signed consent forms are held under the relevant institution's records policy, usually for at least 10 years after publication.

10. How long we keep your data

We do not keep anything indefinitely. In no case do we keep your personal data for longer than 10 years after our last interaction with you, other than research records held under an ethics approval and financial records where a longer period is required by law.

Retention periods for clinical records follow the NHS Records Management Code of Practice 2021, as applied by the Chartered Society of Physiotherapy. Paper records are destroyed by cross-cut shredding at the end of the retention period, and the destruction is logged.

11. Cookies and similar technologies

Our website uses cookies and similar technologies. Cookies that are strictly necessary for the site to work – including your session, security and your cookie preferences themselves – are set without consent, as PECR permits. Everything else is set only if you accept it.

When you first visit hp-3.co.uk you will see a banner offering Accept all, Decline all, and Manage cookies. Nothing non-essential is set until you choose. You can change your choice at any time via the Cookie Preferences control on the site, or by clearing cookies in your browser.

Our website is built on Squarespace. Squarespace's cookie declaration is at https://www.squarespace.com/cookie-policy

12. How we protect your data

Electronic records

• Data is held in access-controlled cloud services with encryption in transit and at rest.
• Devices used to access client data are encrypted, password-protected and kept up to date.
• Multi-factor authentication is enabled on our core systems, and passwords are unique and managed.
• Access to health information is restricted to the coach or clinician working with you, and to the directors. Health and wellbeing fields in our CRM carry field-level access restrictions.
• Written contracts are in place with our processors requiring equivalent standards.

Paper records

Clinical notes from online physiotherapy are kept as paper records in a locked cabinet at our registered office, accessible only to the treating physiotherapist and the directors. They are not removed from the premises other than where necessary, they are never left unattended, and they are destroyed by cross-cut shredding at the end of their retention period. Paper records are covered by data protection law in the same way as electronic ones, and all the rights in section 14 apply to them.

Breaches

We have a procedure for identifying and responding to personal data breaches, and we will report qualifying breaches to the ICO within 72 hours and tell you directly where a breach is likely to result in a high risk to your rights and freedoms.

A word about messaging. WhatsApp, SMS and ordinary email are convenient but they are not clinical-grade secure channels. Please do not send us detailed clinical information that way – use TrainingPeaks or ask us for a secure route. No system connected to the internet can be guaranteed absolutely secure, and while we take the measures above seriously, we cannot promise perfect security.

13. Links to other websites

Our site contains links to third-party websites we do not control. This notice does not apply to them and we are not responsible for their privacy practices. Please read the privacy notice of any site you visit.

14. Your rights

Under the GDPR you have the right to:

• Be informed – this notice.
• Access a copy of the personal data we hold about you, including paper records.
• Rectification of inaccurate or incomplete data.
• Erasure of your data, where no overriding reason to keep it applies. Note that we cannot delete a clinical record before its retention period expires.
• Restrict our processing in certain circumstances.
• Object to processing based on legitimate interests. You can object to direct marketing at any time, and we will always stop.
• Data portability – receive data you gave us, in a machine-readable format, or have it sent to another provider.
• Withdraw consent at any time, where we rely on consent.
• Not be subject to solely automated decision-making producing legal or similarly significant effects. We do not do this – see section 6.

How to exercise them. Email info@hp-3.co.uk. We will respond within one month, and will tell you if we need up to two further months because the request is complex. There is no charge, unless a request is manifestly unfounded or excessive. We may ask you to verify your identity before we release health information – this protects you.

If your request concerns a record held by Worsley Physio Clinic (section 3), please contact the clinic directly. We will tell you if we need to redirect you.

15. Complaints

Please raise any concern with us first at info@hp-3.co.uk. We would rather hear from you and put it right. Our Feedback and Complaints Policy is on our website.

You also have the right to complain to a supervisory authority.

• In the UK: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Helpline 0303 123 1113. www.ico.org.uk/make-a-complaint
• Outside the UK: you may complain to the supervisory authority in your country of residence or place of work.

Complaints about the conduct of a registered physiotherapist may also be made to the Health and Care Professions Council: www.hcpc-uk.org

16. Changes to this notice

We review this notice at least annually and whenever our services or the law change. The current version is always published at hp-3.co.uk/privacy-policy with its version number and date.

Where a change is significant, we will tell you directly using the contact details we hold. Where a change affects processing that relies on your consent, we will ask for your consent again – we will not treat your continued use of our services as agreement to a change.

Version 2.0 – 17 September 2026. Supersedes the version of 25 April 2025. Health & Performance 3 Ltd, company number 13987354, 17 Brogden View, Barnoldswick, BB18 5LH. info@hp-3.co.uk