1. About this policy
Strong By Rucci provides online coaching and remedial massage with Dan Rucci, based in North Beach, Perth, Western Australia. In this policy, “we”, “us” and “our” mean Strong By Rucci.
This policy covers our website, enquiries, bookings, coaching, nutrition support, massage services, subscriptions and digital product purchases. It describes our approach to personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, where applicable.
Contact Dan at dan@strongbyrucci.com or 0483 608 056 about anything in this policy. You can ask for a free copy in another accessible format.
2. Information we collect
The information we need depends on the service you use. It can include:
- Contact and booking details: your name, email, phone number, age or date of birth, suburb or location, appointment details and emergency contact information.
- Coaching information: your goals, training history, exercise records, weekly check-ins, nutrition or food diaries, measurements, and progress photos or technique videos you choose to provide.
- Health and treatment information: relevant symptoms, injuries, medical history, medications, intake answers, consent records, treatment notes and information you authorise another practitioner to share.
- Enquiries and account records: messages, feedback, invoices, payment status and transaction references. Card payments are processed through payment providers; please do not send card numbers through the general contact form.
- Website information: device and browser details, IP address, pages visited and security or cookie information collected through our website and its providers.
We collect information directly from you through forms, bookings, conversations, messages and coaching platforms. We also create coaching and treatment records. With your permission, we may receive relevant information from your healthcare practitioner or another person acting for you.
Health information is sensitive. We seek your consent to collect it when it is reasonably necessary to provide our services, unless collection is otherwise permitted or required by law. Please give only relevant information and let us know if your circumstances change. If you provide an emergency contact’s details, please let that person know.
3. How we use your information
We use information to answer enquiries, arrange appointments, assess whether a service suits you, plan and deliver coaching or treatment, review progress, provide feedback, and communicate with you. We also use relevant records to manage payments, handle complaints, protect our systems and meet legal obligations.
We use or disclose information for the purpose it was collected, with your consent, or as otherwise permitted or required by law. Health information is not used to create advertising audiences. A general enquiry does not automatically subscribe you to marketing.
We ask for separate permission before publishing an identifiable testimonial, photo, video or client story. You can withdraw permission for future use by contacting Dan. We will explain what can be removed from channels we control and any limits involving material already distributed.
4. Sharing and service providers
We share relevant information with providers that help us deliver our services. The providers involved depend on the service you use:
- Netlify: website hosting, contact form submissions and related enquiry notifications.
- Square: remedial massage bookings and payments only.
- Stripe: subscription payments and digital product purchases, including related billing details, payment status and transaction records.
- TrueCoach and CoachForge: coaching apps used to deliver online coaching and manage training programmes, client records, check-ins, messages and feedback, depending on the app used for your coaching.
- Google services: client forms and the preparation or storage of client documents, including Google Forms and Drive where used.
- Communication and business support providers: email, video calls, IT support, accounting, professional advice and insurance, where relevant.
We may share relevant information with another health professional at your request or with your consent, or when disclosure is otherwise permitted or required by law. This can include a serious safety concern, a lawful request or the handling of a claim. We do not sell client information.
AI-assisted administration
We may use AI-assisted tools, including OpenAI tools, to help organise intake information or prepare draft summaries for Dan to review. Before using identifiable health information in an AI tool, we will explain the proposed use, the provider and relevant privacy implications, and seek specific consent. You can ask about an alternative process. Publishing this policy does not itself give that consent.
Dan reviews any assisted summaries and remains responsible for coaching and treatment decisions. We aim to use the minimum information needed and remove identifying details where practical.
Providers also have their own privacy notices: Netlify, Square, Stripe, TrueCoach / Xplor, Google and OpenAI. Those notices explain the providers’ handling of information; they do not replace our responsibilities.
5. Overseas storage and processing
Some service providers operate internationally, so information can be stored, processed or accessed outside Australia. Depending on the provider and service, locations can include the United States, Canada, the United Kingdom, New Zealand, Japan, Ireland, France and Spain. Other locations may be used within providers’ international infrastructure, as described in their privacy notices.
We take reasonable steps required by applicable privacy law when arranging overseas handling of personal information. Contact Dan if you would like details about the providers and locations relevant to your service, or if you have concerns about overseas processing.
7. Storage, security and retention
We hold information in electronic records, including service-provider systems, enquiry records, messages and client documents. Any paper records are kept with access limited to people who need them for the service or a lawful business purpose.
We take reasonable steps to protect information against misuse, loss and unauthorised access, change or disclosure. These include controlling account and record access, protecting devices and reviewing how information is shared. No internet transmission or storage system can be guaranteed completely secure.
We keep information for as long as reasonably needed for the purpose collected, ongoing care or coaching, and applicable legal, recordkeeping or claims obligations. Retention depends on the record and circumstances. When information is no longer needed and retention is not required, we take reasonable steps to securely destroy or de-identify it. Backup deletion can follow the relevant provider’s retention process.
If a data breach occurs, we will assess it and notify affected people and the relevant regulator when required by law.
8. Your choices, access and corrections
You can make a general enquiry without giving your full identity where practical. We may need accurate identity, contact and health details to book or provide a service safely. If you choose not to provide necessary information, we will explain any limits on the service we can offer.
Contact Dan to request access to information we hold about you or to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. We may need to verify your identity. We aim to respond within 30 days, or explain if more time is needed.
There is no charge to make a request or request a correction. If a reasonable access charge is permitted and necessary, we will explain it beforehand. If we cannot provide access or make a requested correction, we will explain why, where lawful, and how you can complain. You can ask us to attach a statement of your requested correction.
You can ask us to stop an optional use or delete information. We will consider your request and explain any records we must retain. Withdrawing consent may affect services that depend on the information, but does not undo handling that was lawful before withdrawal.
9. Questions and complaints
Please contact Dan first if you have a privacy question or concern. Describe what happened and the outcome you are seeking. We will acknowledge your complaint, review the relevant records and aim to provide a response within 30 days. If we need longer, we will keep you informed.
If you are not satisfied with our response, or have not received one within a reasonable time, you can contact the Office of the Australian Information Commissioner (OAIC). Its website explains how to lodge a privacy complaint.
10. Updates to this policy
We may update this policy when our services, providers or privacy practices change. The current version will be available on this page with its updated date. Where a change requires further notice or consent, we will provide it or seek it separately.