Privacy Policy

iIntroduction

Totality is a fitness coaching platform operated by Totality 360 Pty Ltd (ABN 58 698 902 975) ("we", "us", "our"). This Privacy Policy explains how we collect, use, store, and protect your personal information when you use the Totality platform and the Totality Nutrition app, including the web apps at totalityapp.com.au and totalitynutrition.com.au and any associated mobile applications (collectively, the "Platform").

By creating an account or using the Platform, you agree to the practices described in this policy. If you do not agree, please do not use the Platform.

1Information We Collect

We collect the following categories of personal information:

Account information

• Name and email address (required to create an account)
• Password (stored as a secure hash, never in plain text)
• Profile photo (optional, uploaded by you)
• Phone number (optional)
• Business name (for gym administrators)

Health and fitness data

• Body measurements, weight, and fitness goals entered by you or your trainer
• Session logs, exercise records, and programme data
• Nutrition logs and daily food entries
• Weekly check-in responses and progress photos (if provided)
• PAR-Q health screening responses (gym intake forms)

Wearable and health app data (optional)

• If you choose to connect Apple Health (iPhone) or Health Connect (Android), we read daily summaries of your steps, active calories, heart rate, resting heart rate, sleep, and exercise sessions
• This is entirely optional and only happens after you approve each permission on your device. See Section 4 for full details

Billing information

• Subscription tier and billing status
• Payment is processed entirely by Stripe. We never see or store your card details
• Stripe may retain a customer reference ID that we use to manage your subscription
• For marketplace purchases: buyer email address, product purchased, and transaction status
• For marketplace sellers (trainers and gyms): Stripe Connect account ID and payout status

Marketplace data

• If you purchase a product through the Totality marketplace, we record your email address, the product purchased, and the transaction status
• If a purchase includes a coaching relationship (e.g. a PT package), your details may be shared with the trainer or gym whose product you purchased, in order to deliver the service
• Totality 360 Pty Ltd (ABN 58 698 902 975) charges a platform fee of 3.5% on marketplace and point of sale (POS) payments made through Totality. The rest of each payment goes to the seller via Stripe Connect

Usage data

• Actions you take within the Platform (e.g. sessions logged, programmes created)
• Device type and browser information for technical support purposes

2How We Use Your Information

We use the information we collect to:

• Provide and operate the Platform and its features
• Allow trainers to manage client programmes, sessions, and progress
• Allow gym administrators to manage their business, trainers, and members
• Process subscription payments via Stripe
• Process marketplace purchases and route payments to sellers via Stripe Connect
• Send transactional emails (account confirmation, invitations, billing notices) via Resend
• Send push notifications to your device via OneSignal (session reminders, check-in alerts, messages)
• Respond to support requests and resolve technical issues
• Show you your own activity, sleep, and heart rate summaries if you choose to connect Apple Health or Health Connect
• Improve the Platform based on aggregated, anonymised usage patterns (this never includes data from Apple Health or Health Connect)
• Meet our legal obligations

We do not sell your personal information to third parties. We do not use your data for advertising purposes.

3Sensitive Health Information

Some information you enter into Totality, such as body measurements, fitness goals, health history, and PAR-Q screening responses, may be considered sensitive health information under Australian privacy law.

This data is entered voluntarily by you or, where applicable, by a trainer or gym administrator acting on your behalf with your consent. It is used solely to deliver the coaching and fitness tracking features of the Platform and is never shared with third parties except as described in Sections 4 and 5.

If you are a client whose data is managed by a trainer or gym, that trainer or gym administrator can view your fitness and session data within the Platform. You should contact your gym or trainer directly if you have questions about how they handle your data.

4Apple Health and Health Connect Data

Totality and Totality Nutrition can read activity and health data from Apple Health on iPhone and Health Connect on Android. This is optional. Nothing is read unless you choose to connect it and approve each permission on your device.

What we read

• Steps
• Active calories burned
• Heart rate (we keep the daily average)
• Resting heart rate
• Sleep (total time asleep)
• Exercise sessions (the number completed that day)

We only read this data. We never write to, change, or delete anything in Apple Health or Health Connect.

How it is stored and who can see it

We save one summary per day (the totals and averages above), not minute-by-minute readings. It is stored in your account on our database provider, Supabase, with the same access controls as the rest of your data (see Section 6). Only you can see it in the app. It is not shown to your trainer or gym administrator.

How we use it

We use it only to show you your steps, activity, heart rate, sleep, and workouts on your Dashboard and Wearables screen. These figures are general fitness information. They are not medical advice, and Totality is not a medical service.

What we do not do

• We do not sell this data
• We do not use it for advertising, marketing, or profiling, and we do not share it with advertising platforms, data brokers, or information resellers
• We do not use it for credit, insurance, or employment decisions
• We do not use it to develop or improve anything other than the features you can see in the app, and it is excluded from our aggregated usage analysis
• We do not share it with anyone except Supabase (to store it for you), or where you ask us to, or where the law requires it
• Our staff do not read it unless you ask us to in a support request, it is needed to investigate abuse or a security issue, or the law requires it

Totality's use and transfer of information received from Health Connect adheres to the Health Connect requirements in the Google Play Developer Program Policy, including the Limited Use requirements. Information received from Apple Health is used only to provide the health and fitness features described above, in line with Apple's HealthKit requirements.

Your choices

• You can turn off access at any time in your phone's Apple Health settings or in Health Connect's app permissions
• Disconnecting in the app stops further syncing
• To delete the daily summaries we have already saved without closing your account, email us at admintotality@gmail.com and we will remove them within 30 days
• Closing your account deletes them (see Section 7)

5When We Share Your Information

We share personal information only in the following limited circumstances:

• Stripe: payment processing for subscriptions and marketplace purchases. Stripe handles all card data under their own privacy policy (stripe.com/au/privacy). We never see or store your card details. For marketplace transactions, Stripe Connect routes payments directly to the seller's (trainer or gym's) connected Stripe account. Totality 360 Pty Ltd (ABN 58 698 902 975) retains a 3.5% platform fee from marketplace and POS transaction amounts; the remainder is paid to the seller.
• Supabase: our database and authentication provider. Your data is stored on Supabase infrastructure hosted in the United States. Supabase complies with applicable data protection standards.
• Resend: transactional email delivery (account invitations, billing emails, platform announcements). Only your email address and name are shared for this purpose.
• OneSignal: push notification delivery to mobile and web devices. Your device token (a technical identifier for your device) is shared with OneSignal to enable push notifications. OneSignal's privacy policy is available at onesignal.com/privacy_policy. You can disable push notifications at any time in your device settings.
• Legal requirements: we may disclose information if required to do so by law, court order, or government authority.
• Business transfer: in the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before any such transfer.

We do not share your data with any other third parties.

6Data Storage and Security

Your data is stored on Supabase's infrastructure, which is hosted in the United States. By using the Platform, you consent to your data being transferred to and stored in the United States.

We take the following security measures to protect your information:

• All data in transit is encrypted using HTTPS/TLS
• Passwords are hashed and never stored in plain text
• Database access is controlled by row-level security policies
• Payment card data is never transmitted to or stored on our servers
• Access to production systems is limited to authorised personnel only

While we take reasonable precautions, no system is completely secure. We encourage you to use a strong, unique password and to contact us immediately if you suspect any unauthorised access to your account.

7Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Platform's services.

If you close your account, we will delete or anonymise your personal information within 90 days, except where we are required to retain it for legal or accounting purposes (e.g. billing records, which may be retained for up to 7 years under Australian tax law).

Health and fitness data (session logs, nutrition entries, programme records) is deleted along with your account unless your gym or trainer is required to retain it for compliance or legal reasons.

Daily summaries from Apple Health or Health Connect are deleted with your account. Disconnecting in the app stops further syncing but does not remove summaries already saved. You can ask us to delete them at any time (see Section 4).

8Your Rights

Under the Australian Privacy Principles, you have the right to:

• Access: request a copy of the personal information we hold about you
• Correction: request that we correct inaccurate or incomplete information
• Deletion: request that we delete your personal information (subject to legal retention obligations)
• Portability: request your data in a portable format where technically feasible
• Complaints: lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au if you believe we have breached the Privacy Act

To exercise any of these rights, please contact us using the details in Section 11. We will respond to all requests within 30 days.

9Cookies and Local Storage

The Totality Platform uses browser local storage and session cookies solely for the purpose of maintaining your login session and remembering your in-app preferences (such as onboarding status).

We do not use advertising cookies, tracking pixels, or third-party analytics tools. No third-party cookies are placed on your device through our Platform.

10Children's Privacy

The Totality Platform is intended for use by adults aged 18 and over, or by minors under the supervision of a parent or guardian and with the explicit consent of a qualified fitness professional.

We do not knowingly collect personal information from children under 13 without verifiable parental consent. If you believe we have inadvertently collected such information, please contact us and we will delete it promptly.

12Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For material changes, we will notify you by email or via an in-app notice before the changes take effect.

Your continued use of the Platform after any changes constitutes your acceptance of the updated policy.