Privacy Policy

Base Performance Centre ("Base Performance", "we", "us") is a performance nutrition and coaching practice run by Gareth Morris. We coach online worldwide, with in-person coaching in Sydney.

We are the entity responsible for the personal information collected through this website (baseperformance.io), through our booking pages, and through coaching relationships.

• Email: gareth@baseperformance.io
• Use the contact details above to ask for access, correction, deletion or a copy of your data.

This policy covers this website and our coaching services. It does not cover third-party services you use under their own policies, which we name in section 8.

If you create an account for assistant connections, we store your sign-in identity and display name with Lovable Cloud. Your profile is private to your account. You can change your display name on the account page or use our contact details to request deletion. Connected assistants require your approval and can read your own display name and public service information. They cannot access client records, personal blood results or RED-S check-in answers. Your sign-in provider and connected assistant also have their own privacy policies.

We only ask for what a coaching relationship needs. That falls into four groups.

Information you give us

• Contact details: name, email address, phone number, timezone and preferred contact method.
• Your goal and date: the event or race you're preparing for, target times or outcomes, and your availability.
• Training history: current sessions, load, frequency, equipment, past injuries and what you can and can't do.
• Nutrition information: usual intake, food preferences and exclusions, allergies and intolerances, appetite, gut tolerance, and food logs or photos you send.
• Body data: weight, measurements, body composition and progress photos, if you choose to share them.
• Health information: medical conditions, medications and supplements, blood and pathology results, sleep, stress, menstrual cycle, energy availability, and eating-disorder history where relevant.
• Anything else you raise in email, WhatsApp, calls or check-in notes.

Information from your booking

• Name, email, timezone, and any details you type into the Calendly booking questions.
• The appointment you choose, plus reschedule and cancellation notices.

Information from labs and your clinicians

• Blood and pathology results from accredited Australian laboratories, ordered through Base Performance Centre.
• Referral notes or clearances from your GP, physio or specialist, where you ask them to send them to us.

Technical information

• Basic server logs kept by our hosting provider: IP address, approximate location, browser and device type, pages requested, and timestamps.
• Third-party cookies set by the services embedded on this site (see section 7).

• This website: the free guides form, the enquiry and referral links, and the embedded Calendly booking window.
• Directly from you by email, WhatsApp, phone or video call.
• Coaching apps and tools you use for logging food, training and measurements.
• Pathology collection centres and laboratories for blood panels.
• Your own documents: blood results, training files, race results, medical clearances.

We don't buy personal information from data brokers, and we don't run sign-up forms that quietly store your details in a database without telling you. Where a form on this site hands your details to a third party, we say so in section 6.

Each use has a reason. We don't use your data for anything beyond these purposes.

• To deliver coaching: building, progressing and adjusting your nutrition and training plan.
• To keep you safe: screening before you start, spotting red flags, and referring anything outside healthy ranges to your GP.
• To review blood and pathology results in a coaching context and turn them into actions.
• To communicate: scheduling, check-ins, feedback, reminders and answers to your questions.
• To send guides or resources you asked for.
• To track progress against the goal you set at the start.
• To run the business: invoicing, tax records, insurance and professional advice.
• To keep this website working and secure, and to understand roughly how many people use it.

Where a legal basis is required (for example under the Australian Privacy Act 1988 or the UK/EU General Data Protection Regulation), we rely on your consent, the contract between us, our legitimate interest in running the practice, and — for health data — explicit consent plus the health-care and medical-treatment exemptions available to us.

• We ask for the minimum needed. You can decline any question; if we can't coach safely without it, we'll tell you why rather than push.
• Access is limited to Gareth and any practitioner you agree is involved in your coaching.
• Results are read as coaching context, not diagnosis. Anything outside healthy ranges is referred to your GP.
• We store health data separately from marketing lists, and health data is never added to a newsletter or advertising audience.
• You can withdraw consent for us to hold health data. That may mean we can no longer coach you, and we'll say so plainly.
• We won't publish your health data, results or photos anywhere — including case studies — without your written permission.

If you tell us about a medical condition, medication, pregnancy, disordered eating, or symptoms that need medical care, we will direct you to your GP or the appropriate clinician first. Coaching supports medical care; it doesn't replace it.

Blood and pathology results have their own dedicated notice, covering where they come from, who can see them, how long they're kept and how to have them deleted: Blood Work & Health Data Privacy.

Free guides form

The guides form on this site opens your own email app with a pre-filled message to us. The address you type is not saved in a database by this website — it reaches us as an email. We use that address to send the guides you asked for and to reply. We don't add you to a marketing list from that form unless you ask.

Booking a call (Calendly)

Our "Book your Free Performance call" button opens a Calendly booking window inside this site. Anything you enter there — name, email, timezone, and your answers to the booking questions — is collected and stored by Calendly Inc. under its own privacy policy, and is used by us to prepare for and confirm your call. Calendly is based in the United States, so your booking details are held offshore. Only share what you're comfortable with.

Email, WhatsApp and calls

Messages you send by email or WhatsApp are processed by those providers (Google, Meta), and phone or video calls are recorded by the platform we use. Calls are not recorded unless we tell you first and you agree. We keep useful coaching notes from calls in your client file.

Referrals from physios and clinics

If a physio, clinic or GP refers you to us, they pass your contact details and relevant history with your permission. We treat that referral as part of your health record.

This site does not load advertising networks, behavioural tracking, retargeting pixels or session-recording tools. There is no cookie wall, and we don't build advertising audiences from your visit.

The things that are loaded, and what they see:

• Our hosting platform's basic server logs (IP, browser, page requested, time) used to keep the site running and secure.
• Google Fonts, which serves our typefaces and receives your IP address as part of that request.
• Calendly, embedded in the booking window, which sets its own cookies and stores your booking details.
• On the Challenge page, api.country.is receives your IP address to estimate your country and choose an initial currency. We do not request precise location or send names, goals or health information to this service. If you have already selected a currency, no lookup is made. Diagnostics stays in AUD.
• Your manual currency selection is saved in this browser's local storage as bpc_currency_preference until you clear site data. It overrides location detection, including when you use a VPN.

If we ever add analytics or advertising tools, this page will be updated first, and where the law requires consent we'll ask for it before those tools run. You can block or delete cookies in your browser settings; that may affect how the booking window behaves.

We don't sell or rent personal information. We share it only with the people and services needed to deliver your coaching, and only the minimum required.

• Accredited Australian pathology laboratories, for blood panels you choose to run.
• Calendly Inc. (United States), for booking and scheduling.
• Google (Gmail, Google Calendar, Google Drive) and Meta (WhatsApp), for email, files, calls and messaging.
• Coaching and logging platforms you use with us, for food, training and progress data.
• Our accountant, professional indemnity insurer and legal or professional advisers, for business and compliance purposes.
• Your GP, physio or specialist, when you ask us to share results or notes with them.

Some of these providers sit outside Australia, so your information may be held overseas. Where you're in the EU, UK or another region with stronger transfer rules, we rely on your consent and standard contractual protections, and we'll tell you which country your data goes to if you ask.

We'll also disclose information if we're legally required to, or to protect someone's life, health or safety — for example a serious medical red flag.

• Enquiries and bookings that don't become coaching: up to 3 years, so we can pick up a conversation you started.
• Coaching and health records: 7 years after your last session, in line with professional and tax record-keeping expectations.
• Records for athletes under 18: 7 years after their 18th birthday.
• Marketing consent and guide requests: until you withdraw it or ask us to delete you.
• Blood and pathology results: with your coaching record, for the same period.

When records reach their limit, we delete or de-identify them. If you ask us to delete earlier, we will, except where we must keep something for legal, tax or insurance reasons — and we'll tell you what that is.

• This site is served over HTTPS, and our accounts use strong passwords and multi-factor authentication.
• Health data is stored in access-controlled files and folders, not in shared or public places.
• Only Gareth and practitioners you've agreed are involved can see your client file.
• We don't send your results or photos in public channels, and we don't post client outcomes without written permission.
• If a breach affects you and causes serious harm, we'll tell you what happened and what we're doing about it.

No system is perfectly secure. If you're sending anything especially sensitive, ask us first and we'll agree the safest way to do it.

You can ask us, at any time and at no cost, to:

• Tell you what personal information we hold about you.
• Give you a copy of it in a usable format.
• Correct anything that's wrong or out of date.
• Delete it, subject to the legal exceptions in section 9.
• Stop contacting you for marketing, or stop using a particular type of data.
• Explain how we got something or who we've shared it with.

If you're in the EU, UK or another region under the GDPR or UK GDPR, you also have rights to restriction, portability, and to lodge a complaint with your local data protection authority. In Australia, our obligations sit under the Australian Privacy Principles in the Privacy Act 1988.

We'll verify your identity before releasing anything, and we'll respond within 30 days.

For athletes under 18, a parent or guardian must consent to this policy and to the health information we hold, and we coach with their involvement. We don't knowingly collect personal information from children other than through a parent, guardian or club.

If we change this policy, we'll update the "Last updated" date at the top of this page and, for significant changes, email current clients.

Complaints: email us first and we'll work it out with you. If you're not satisfied, in Australia you can contact the Office of the Australian Information Commissioner (oaic.gov.au). If you're outside Australia, contact your local privacy regulator.