Member Privacy Notice

Last updated: 16 July 2026

Who we are

Brawn is a service operated by Brawn Power Ltd (“Brawn”, “we”, “us”), a company registered in England and Wales (company number 13062748), registered office 1 George Street, Snow Hill, Wolverhampton, West Midlands, WV2 4DG.

You can contact us about data protection at dataprotection@brawn.co.uk.

Who this notice is for

This notice is for gym members and prospective members who interact with Brawn — usually through a tool or funnel provided by your gym (for example a fitness calculator), and on WhatsApp.

You may not have seen the Brawn name. These tools carry your gym’s branding, so you may believe you are dealing only with your gym. In fact your gym and Brawn are independent controllers of the data you provide: your gym uses it to look after you as a member, and Brawn uses it to build your plan and run the tools. This notice explains Brawn’s part. Your gym’s own privacy notice explains theirs.

If you are a gym owner or operator using our Patch Report or market insights, a different notice applies: our Business Privacy Notice.

Our role: who is responsible for your data

Brawn’s role depends on how your data reached us. There are two situations, and they carry different responsibilities.

1. Data you give Brawn directly — Brawn is the controller. When you come to Brawn yourself, usually by scanning a code or following a link at your gym, and you use our tools or share information with us, Brawn decides how that data is used and is responsible for it as a controller. Your gym is a separate, independent controller of its own membership records. Brawn and your gym each use data for our own purposes; we are not joint controllers.

2. Data Brawn handles on your gym’s instructions — Brawn is the gym’s processor. Some processing we carry out on your gym’s behalf, using data your gym provides and following your gym’s instructions (for example, platform processing operated for the gym). For that processing, your gym is the controller and Brawn is its processor. Your gym’s own privacy notice covers it, and questions about it are best directed to your gym.

The distinction is about whose purposes the data is used for, not simply who handed it over. This notice describes the data for which Brawn is the controller. Where Brawn acts only as your gym’s processor, we act on the gym’s documented instructions and do not use that data for our own purposes.

What personal data we collect

You give us directly:

• Your name and mobile phone number
• Your WhatsApp messages with us, and their delivery and read status
• Details you give us when you use our tools or answer our questions — which may include your age, height, weight, body composition, training history, activity levels, dietary preferences and fitness goals
• Your bookings — trials, gym sessions, personal training
• Payment information. Your card details are captured directly by our payment provider, Stripe, through their secure payment form. Brawn never sees or stores your card number. We do record payment events (that you paid, when, how much, and for what) in our own systems for reporting and accounting.

We create:

• Personalised training and nutrition plans built from what you tell us
• Internal segmentation used to decide what to send you and when. See Automated decision-making below.

Health and fitness information

Some of what you tell us — your weight, body composition, fitness goals, injuries or health conditions — counts as health data, which is a “special category” of personal data under UK law and gets extra protection.

Where we process special category data, we must have both a lawful basis and a separate Article 9 condition. For Brawn, that condition is your explicit consent, which is:

• separately and clearly asked for, not bundled into general terms;
• specific about what data and what purpose;
• as easy to withdraw as to give;
• and recorded, so we can show you gave it.

We ask for this consent as a separate, unticked, affirmative choice before you answer any health or fitness question, and we record it with the date and the exact wording you agreed to. You can withdraw it at any time, as easily as you gave it, and we will stop processing that data.

Why we use your data, and our lawful basis

WhatsApp and marketing. Under the Privacy and Electronic Communications Regulations (PECR), WhatsApp messages count as electronic mail. We only send you marketing where you have consented, or where the law otherwise allows it.

You can opt out at any time. Reply STOP to any WhatsApp message from us, or email dataprotection@brawn.co.uk. This stops marketing messages; we may still send you essential service messages, such as a booking confirmation, where you have an active booking or purchase with us.

Who we share your data with

Your gym. We share plan and progress information back with your gym so they can look after you as a member.

Personal trainers. If you work with a personal trainer through Brawn, we share your information with that trainer so they can coach you. This includes the health and fitness information you have given us, such as your goals, body composition and training history.

Your personal trainer is a separate, independent controller of your data. A trainer working with you through Brawn uses your information on their own terms — their coaching, their methods, their follow-up — to build a plan for you. They are not part of Brawn and they decide how they use your data to coach you.

Because of this, sharing your health and fitness data with a trainer needs your explicit consent to that specific disclosure, which we ask for separately. You can decline or withdraw it. Each trainer we share your data with is also bound by a written agreement with Brawn governing that sharing. Once your data is shared, the trainer is responsible for it as an independent controller, and their own privacy terms apply to what they do with it.

Service providers (processors) who help us run the service. Each is engaged under a written contract as required by Article 28 UK GDPR. We do not publish our specific suppliers, but we categorise them below and maintain a full sub-processor register, which we keep current and make available on request. Our processors fall into these categories:

• Hosting, infrastructure and application platforms
• Payment processing
• Messaging and communications (WhatsApp, SMS and email)
• Customer relationship management and meeting scheduling
• Analytics and error monitoring
• Accounting and electronic signature

We also share data with professional advisers (accountants, lawyers, insurers) where needed, and with regulators and authorities where legally required.

We do not sell your personal data.

Sending data outside the UK

Some of our service providers process data outside the UK. Where that happens, we make sure your data is protected to UK standards by relying on one of the following, depending on the provider and country:

• the country having UK ‘adequacy’ status (the UK government recognises its protection as equivalent); or
• the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, incorporated into our contract with that provider, together with additional safeguards where needed.

You can ask us which safeguard applies to a particular provider, and request a copy of the relevant terms.

How long we keep your data

We keep your data no longer than we need it, and we can justify each period below.

• While you are an active member, and for 12 months after your last interaction with us — long enough to pick up where you left off if you return
• Health and fitness information: 12 months after your last interaction, or sooner if you ask us to delete it. We keep this for the shortest period we reasonably can, because it is sensitive
• Payment and accounting records: 6 years from the end of the relevant accounting period, as required by HMRC and to cover contract claims under the Limitation Act
• Consent and opt-out records: kept until you withdraw, then we retain a record of the withdrawal itself so we can continue to honour it
• WhatsApp message history: 24 months

We review what we hold and delete what we no longer need.

Automated decision-making and profiling

We use what you tell us to personalise your plan and the messages you receive, and we segment members internally to decide what to send and when.

This is profiling. It is not a decision made solely by automated means with legal or similarly significant effects on you — a person is involved in how we work with you. You can object to this profiling at any time (see Your rights).

Children

Brawn’s services are for adults aged 18 and over. We verify age at sign-up, before collecting any health or fitness information. We do not knowingly collect data from anyone under 18. If you believe we have, contact dataprotection@brawn.co.uk and we will delete it.

Cookies and similar technologies

We do not use Google Analytics or third-party advertising scripts on our member-facing surfaces.

Where we store anything non-essential on your device, including our own first-party analytics, we ask for your consent first. You can Accept or Reject, rejecting is as easy as accepting, and you can change your mind at any time. If you withdraw consent we stop recording and delete the identifier we placed.

Some storage is strictly necessary to deliver the plan you asked for and to record the consents you have given; this does not require consent, and rejecting analytics does not stop you completing the service or receiving your plan.

Data Protection Impact Assessment

Because we process health and fitness information and use data in newer ways, we treat this service as higher-risk and assess it accordingly. Brawn carries out and maintains a Data Protection Impact Assessment (DPIA) to identify and reduce privacy risks, and keeps it under review.

Your rights

Under UK data protection law you have the right to:

• Be informed about how we use your data (this notice)
• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data, in certain circumstances
• Restrict how we process your data, in certain circumstances
• Data portability, where processing is based on consent or contract and is automated
• Object to processing based on legitimate interests, and to direct marketing at any time, absolutely
• Withdraw consent at any time, including your consent to us processing health data
• Not be subject to solely automated decisions with legal or similarly significant effects

To exercise any of these, email dataprotection@brawn.co.uk. We will respond within one month, free of charge unless a request is manifestly unfounded or excessive.

If Brawn is acting as a processor for your gym, we may need to pass your request to your gym as the controller. We will tell you if that happens and help where we can.

Complaints. Please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk), the UK’s data protection regulator.

Changes to this notice

We may update this notice as our business or the law changes. The “last updated” date at the top will change accordingly.