Privacy Policy

Travel Gym ("we", "us", "our") is committed to protecting your personal information and complying with the Australian Privacy Principles under the Privacy Act 1988 (Cth). This Privacy Policy explains how we collect, use, store and protect your personal data when you purchase and use a Travel Gym pass.

We believe in transparency, minimal data collection, and responsible information handling. By purchasing a pass and using our services, you consent to the collection and handling of your information as described below.

1. What information we collect

When you purchase a Travel Gym pass, complete the health screening, or use the check-in service at a partner gym, we may collect the following personal and sensitive information:

• Your name and email address (via Shopify at checkout).
• Payment details (processed by Shopify and their payment providers — we do not store card numbers).
• Emergency contact — name and phone number.
• Health screening responses to the Adult Pre-Exercise Screening System (APSS) Stage 1 questionnaire, including any medical conditions or considerations you disclose. This is classified as sensitive information under APP 3 and receives higher-level protection.
• Age attestation (18+, or 16-17 with parental/guardian consent). If you are 16 or 17, we also collect your parent or guardian's name and phone number.
• Purchase and pass details — the pass type, start date, unique code, and check-in history.
• Approximate location data if you use the "Find near me" feature on our gym locator. Location data is used only for that search and is not stored.
• Technical information — IP address, device type, and browser information collected automatically when you use our website.

2. How we use your information

We use your data solely to operate and support the Travel Gym service. This includes:

• Processing and verifying your pass purchase.
• Managing gym check-ins at partner locations.
• Sharing relevant safety or medical information with the specific gym you check in at, if you have disclosed a condition that is material to safe exercise.
• Providing customer service and operational support.
• Meeting legal, regulatory, and insurance requirements.
• Improving the quality, security, and reliability of the service.

We do not sell or rent your personal information to third parties for marketing.

3. How your information is shared

Your data is only shared with:

• Our own authorised team members, for support and administration.
• The specific partner gym you check in at — limited to the information necessary for that check-in (name, pass validity, and any safety-relevant medical disclosures).
• Emergency responders, if needed based on the emergency contact and health information you provided.
• Our platform providers listed in section 6, who process data on our behalf under contractual privacy obligations.

4. How your information is stored and secured

We take the security of your data seriously:

• All personal and sensitive information is stored in Google Cloud Firestore, with encryption at rest and in transit.
• Access to our administrative systems is restricted to authorised personnel and enforced via Firebase Authentication with strong passwords.
• Requests between our website, our app, and our backend are transmitted over HTTPS and authenticated using industry-standard signing (Shopify App Proxy HMAC verification for Shopify-originated requests).
• Cloud Function secrets and API keys are managed via Google Secret Manager and are not exposed to the browser or third parties.
• Despite these measures, no digital platform is completely risk-free. We encourage you to use unique, strong passwords and to notify us promptly of any suspected compromise of your account or data.

5. Your rights and responsibilities

By purchasing a pass and using our platform, you agree to provide accurate, up-to-date information during checkout, health screening, and check-in.

Under the Australian Privacy Act, you have the right to:

• Access the personal information we hold about you.
• Correct or update your information.
• Request deletion of your personal data (note: this will invalidate any active pass without refund).
• Withdraw your consent to future data collection.
• Lodge a complaint with us in the first instance, and with the Office of the Australian Information Commissioner (OAIC) if unresolved.

To exercise any of these rights, contact us using the details in section 10.

6. Third-party services and international transfers

To operate the Travel Gym service, we use the following trusted platforms. Some are located overseas, which means your data may be transferred outside Australia. We take reasonable steps to ensure each provider maintains privacy standards comparable to the APPs.

• Shopify (Canada / United States) — e-commerce platform, checkout, payments, and customer accounts. See Shopify's Privacy Policy.
• Google (Firebase / Firestore / Cloud Functions / App Hosting, United States) — hosting for our check-in database, cloud backend, and partner portal. See Firebase Privacy and Security.
• Resend (United States) — transactional email (order confirmations, pass code delivery, partner notifications). See Resend Privacy Policy.
• Mapbox (United States) — map rendering and address search on the gym locator. See Mapbox Privacy Policy.

7. Cookies and analytics

Our website uses cookies and similar technologies for essential site functionality (such as your shopping cart) and, where you consent, for analytics. Analytics helps us understand how visitors use the site so we can improve it. You may disable cookies in your browser settings, though some parts of the service may not function correctly without them.

8. Direct marketing

If you subscribe to Travel Gym updates or opt in during checkout, we may send you occasional marketing emails. Every marketing email contains an unsubscribe link, and you can opt out at any time. Transactional emails (pass codes, receipts, service notices) are not marketing and cannot be opted out of while you hold an active pass.

9. Children's privacy and minors

Travel Gym is intended for adults aged 18 and over. Individuals aged 16 or 17 may use Travel Gym only with the express consent of a parent or guardian, and we will collect and store the parent or guardian's contact details as part of the health screening. Travel Gym is not available to anyone under 16.

If you are a parent or guardian and believe your child under 16 has provided us with personal information, please contact us immediately and we will delete it.

10. Data breach notification

Travel Gym complies with the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988. In the event of an eligible data breach that is likely to result in serious harm, we will notify affected individuals and the OAIC as required by law.

11. Changes to this policy

We may update this policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations. Any updated version will be posted on this page with a revised effective date. Your continued use of Travel Gym after an update means you accept the revised policy.

12. Contact us

If you have any questions, requests, or complaints regarding this Privacy Policy, please contact:

Travel Gym — Privacy
Support: support@travelgym.com.au

You may also lodge a complaint directly with the Office of the Australian Information Commissioner: oaic.gov.au.