Privacy Policy

iIntroduction

Totality is a fitness coaching platform operated by Totality 360 Pty Ltd (ABN 58 698 902 975) ("we", "us", "our"). This Privacy Policy explains how we collect, use, store, and protect your personal information when you use the Totality platform, including the web app at totality-omega.vercel.app and any associated mobile applications (collectively, the "Platform").

By creating an account or using the Platform, you agree to the practices described in this policy. If you do not agree, please do not use the Platform.

1Information We Collect

We collect the following categories of personal information:

Account information

• Name and email address (required to create an account)
• Password (stored as a secure hash — never in plain text)
• Profile photo (optional, uploaded by you)
• Phone number (optional)
• Business name (for gym administrators)

Health and fitness data

• Body measurements, weight, and fitness goals entered by you or your trainer
• Session logs, exercise records, and programme data
• Nutrition logs and daily food entries
• Weekly check-in responses and progress photos (if provided)
• PAR-Q health screening responses (gym intake forms)

Billing information

• Subscription tier and billing status
• Payment is processed entirely by Stripe — we never see or store your card details
• Stripe may retain a customer reference ID that we use to manage your subscription
• For marketplace purchases: buyer email address, product purchased, and transaction status
• For marketplace sellers (trainers and gyms): Stripe Connect account ID and payout status

Marketplace data

• If you purchase a product through the Totality marketplace, we record your email address, the product purchased, and the transaction status
• If a purchase includes a coaching relationship (e.g. a PT package), your details may be shared with the trainer or gym whose product you purchased, in order to deliver the service
• Totality 360 Pty Ltd (ABN 58 698 902 975) does not take a percentage of marketplace transactions — payments flow directly between buyer and seller via Stripe Connect

Usage data

• Actions you take within the Platform (e.g. sessions logged, programmes created)
• Device type and browser information for technical support purposes

2How We Use Your Information

We use the information we collect to:

• Provide and operate the Platform and its features
• Allow trainers to manage client programmes, sessions, and progress
• Allow gym administrators to manage their business, trainers, and members
• Process subscription payments via Stripe
• Process marketplace purchases and route payments to sellers via Stripe Connect
• Send transactional emails (account confirmation, invitations, billing notices) via Resend
• Send push notifications to your device via OneSignal (session reminders, check-in alerts, messages)
• Respond to support requests and resolve technical issues
• Improve the Platform based on aggregated, anonymised usage patterns
• Meet our legal obligations

We do not sell your personal information to third parties. We do not use your data for advertising purposes.

3Sensitive Health Information

Some information you enter into Totality — such as body measurements, fitness goals, health history, and PAR-Q screening responses — may be considered sensitive health information under Australian privacy law.

This data is entered voluntarily by you or, where applicable, by a trainer or gym administrator acting on your behalf with your consent. It is used solely to deliver the coaching and fitness tracking features of the Platform and is never shared with third parties except as described in Section 4.

If you are a client whose data is managed by a trainer or gym, that trainer or gym administrator can view your fitness and session data within the Platform. You should contact your gym or trainer directly if you have questions about how they handle your data.

4When We Share Your Information

We share personal information only in the following limited circumstances:

• Stripe — payment processing for subscriptions and marketplace purchases. Stripe handles all card data under their own privacy policy (stripe.com/au/privacy). We never see or store your card details. For marketplace transactions, Stripe Connect routes payments directly to the seller's (trainer or gym's) connected Stripe account — Totality 360 Pty Ltd (ABN 58 698 902 975) does not retain any portion of marketplace transaction amounts.
• Supabase — our database and authentication provider. Your data is stored on Supabase infrastructure hosted in the United States. Supabase complies with applicable data protection standards.
• Resend — transactional email delivery (account invitations, billing emails, platform announcements). Only your email address and name are shared for this purpose.
• OneSignal — push notification delivery to mobile and web devices. Your device token (a technical identifier for your device) is shared with OneSignal to enable push notifications. OneSignal's privacy policy is available at onesignal.com/privacy_policy. You can disable push notifications at any time in your device settings.
• Legal requirements — we may disclose information if required to do so by law, court order, or government authority.
• Business transfer — in the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before any such transfer.

We do not share your data with any other third parties.

5Data Storage and Security

Your data is stored on Supabase's infrastructure, which is hosted in the United States. By using the Platform, you consent to your data being transferred to and stored in the United States.

We take the following security measures to protect your information:

• All data in transit is encrypted using HTTPS/TLS
• Passwords are hashed and never stored in plain text
• Database access is controlled by row-level security policies
• Payment card data is never transmitted to or stored on our servers
• Access to production systems is limited to authorised personnel only

While we take reasonable precautions, no system is completely secure. We encourage you to use a strong, unique password and to contact us immediately if you suspect any unauthorised access to your account.

6Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Platform's services.

If you close your account, we will delete or anonymise your personal information within 90 days, except where we are required to retain it for legal or accounting purposes (e.g. billing records, which may be retained for up to 7 years under Australian tax law).

Health and fitness data (session logs, nutrition entries, programme records) is deleted along with your account unless your gym or trainer is required to retain it for compliance or legal reasons.

7Your Rights

Under the Australian Privacy Principles, you have the right to:

• Access — request a copy of the personal information we hold about you
• Correction — request that we correct inaccurate or incomplete information
• Deletion — request that we delete your personal information (subject to legal retention obligations)
• Portability — request your data in a portable format where technically feasible
• Complaints — lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au if you believe we have breached the Privacy Act

To exercise any of these rights, please contact us using the details in Section 10. We will respond to all requests within 30 days.

8Cookies and Local Storage

The Totality Platform uses browser local storage and session cookies solely for the purpose of maintaining your login session and remembering your in-app preferences (such as onboarding status).

We do not use advertising cookies, tracking pixels, or third-party analytics tools. No third-party cookies are placed on your device through our Platform.

9Children's Privacy

The Totality Platform is intended for use by adults aged 18 and over, or by minors under the supervision of a parent or guardian and with the explicit consent of a qualified fitness professional.

We do not knowingly collect personal information from children under 13 without verifiable parental consent. If you believe we have inadvertently collected such information, please contact us and we will delete it promptly.

11Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For material changes, we will notify you by email or via an in-app notice before the changes take effect.

Your continued use of the Platform after any changes constitutes your acceptance of the updated policy.