LEGAL

PRIVACY
POLICY.

Effective 10 August 2026

Grayson Standard
ABN 94 647 769 354

Your privacy matters. This policy explains how Grayson Standard collects, uses, stores and protects personal information, including health information, when providing coaching and related services.

VIEW FULL PRIVACY POLICY (PDF)

FULL PRIVACY POLICY

01 — About this policy

Grayson Standard is operated by Will Grayson as a sole trader under the registered business name Grayson Standard (ABN 94 647 769 354). This Privacy Policy explains how Grayson Standard collects, holds, uses, discloses, secures and otherwise manages personal information in connection with its services and business operations. Grayson Standard provides in-person personal training, online coaching, exercise programming, movement and technique assessment, nutrition coaching and guidance, consultations, check-ins and progress tracking. Because these activities can involve assessing, maintaining or improving a person's physical health and collecting health information, Grayson Standard manages relevant information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy is intended to be clearly expressed and current. It will be reviewed when Grayson Standard materially changes its services, systems, service providers or information-handling practices.

02 — Personal information Grayson Standard may collect and hold

The information collected depends on the services you use and what is reasonably necessary to provide or administer those services. It may include:  identity and contact details, including your name, date of birth, email address, phone number and emergency contact details;  coaching information, including goals, training history, exercise preferences, availability, occupation, activity levels and other information relevant to programming;  health and sensitive information relevant to coaching, including pre-exercise screening responses, injuries, pain or physical limitations, relevant medical conditions, medications, pregnancy or postpartum information, and health-professional restrictions or recommendations;  body, performance and progress information, including height, bodyweight, training results, strength information, movement or technique assessments and progress measures;  nutrition and lifestyle information, including dietary requirements, food allergies or intolerances, nutrition targets or intake information, sleep, stress and alcohol-use information where relevant;  coaching media that you choose to provide, including technique or training videos and optional progress photographs;  communications and administrative records, including enquiries, consultation notes, appointment information, coaching communications, invoices, payment records and complaint or incident records; and  website and technical information collected through the Grayson Standard website and its service providers, such as analytics, cookie or device information, where applicable. Grayson Standard seeks to minimise collection and does not intentionally collect personal or sensitive information merely because it may be convenient. Health and other sensitive information is collected where it is reasonably necessary for the relevant coaching function and with consent unless an applicable legal exception permits collection without consent.

03 — How information is collected

Grayson Standard generally collects personal information directly from you. Collection may occur through onboarding and screening forms, consultations, coaching sessions, email, WhatsApp Business, Google Meet, check-ins, MyStrengthBook, the Grayson Standard website, booking systems, documents, photographs or videos you provide, and other communications connected with your coaching. With your consent, or where otherwise permitted by law, relevant information may also be received from another person or organisation, such as your parent or guardian, an authorised representative, physiotherapist, general practitioner or other health professional. If you provide another person's information, such as emergency-contact details, please provide only what is reasonably necessary and, where appropriate, ensure that person is aware their details have been provided.

04 — Why information is collected, held, used and disclosed

Grayson Standard may handle personal information to:  assess your needs, suitability for coaching and matters that may require further discussion, modification or referral;  design, deliver, monitor and adjust exercise programming, personal training, online coaching and nutrition related guidance;  provide technique review, feedback, check-ins, progress monitoring and client support;  communicate with you and manage consultations, appointments, bookings and service administration;  manage billing, direct debit, payment, accounting and business records;  maintain safety, quality, continuity and appropriate records of coaching services;  communicate with a health professional where you have authorised this or where another lawful basis applies;  respond to enquiries, access or correction requests, complaints, incidents, insurance matters or disputes;  comply with legal, regulatory, child-safety, tax, insurance and record-keeping obligations; and  protect the security, rights and legitimate interests of Grayson Standard and its clients. Grayson Standard does not sell client personal information.

05 — Health information and consent

Health information is sensitive information and is treated with additional care. Grayson Standard may ask about matters such as pre-exercise screening, injuries, pain, relevant medical conditions, medications and health professional guidance because that information can materially affect exercise selection, training load, safety and the scope of coaching. Where consent is required, consent will be sought before collecting sensitive information. Consent should be informed, voluntary, current and specific. You may choose not to provide information; however, if information is reasonably necessary to provide a service safely or appropriately, Grayson Standard may be unable to commence, continue or fully tailor that service without it. Grayson Standard provides coaching and does not use onboarding responses, software or automated processes to provide medical diagnosis or medical clearance. You may be asked to seek advice or clearance from an appropriately qualified health professional where appropriate.

06 — Clients aged 15 to 17

Grayson Standard currently accepts clients aged 15 years and older. For clients under 18, Grayson Standard requires a parent or legal guardian to authorise the coaching arrangement and participation, including the relevant contractual and payment arrangements. Privacy rights still apply to the young person. Grayson Standard will take the young person's maturity and capacity into account, provide information in a form they can reasonably understand, and involve them in decisions about their personal and health information. Where appropriate, consent may be sought from the young person, the parent or guardian, or both. Information about a young client will not automatically be disclosed to a parent or guardian merely because the client is under 18. Disclosure will depend on consent, capacity, the purpose of the disclosure, safety considerations and applicable law.

07 — Coaching photographs, videos and testimonials

Progress photographs are optional. Grayson Standard may recommend them where visual progress is relevant to a client's goal, but a client is not required to provide body-progress photographs as a general condition of coaching. Technique and training videos are also voluntary, although Grayson Standard may strongly recommend them where video review is important to providing effective technique feedback or online coaching. Technique videos are ordinarily submitted through MyStrengthBook and feedback may be provided through that platform. Material supplied for coaching is used for coaching and record-management purposes. Supplying a photograph, video, result or testimonial for coaching does not give Grayson Standard permission to publish it, use it in advertising, post it on social media or use it as a public case study. Separate, specific permission will be obtained before identifiable client material is used for marketing or promotional purposes.

08 — Systems and service providers

Grayson Standard uses third-party systems to operate the business and deliver coaching. These may include:  Google Workspace and related Google services for business email, forms, documents, spreadsheets, cloud-based records, Google Calendar and Google Meet;  MyStrengthBook for exercise programming, training results, check-ins, bodyweight or progress information, technique videos, coaching feedback and optional progress photographs;  WhatsApp Business for client communication and support;  Wix for the Grayson Standard website and, if enabled, website booking or related website functions;  EziDebit for direct-debit payments for relevant in-person services;  Stripe and payment methods made available through Stripe or Wix for relevant online payments; and  banking, bookkeeping, accounting, insurance, legal or other professional service providers used by Grayson Standard from time to time. The exact systems used may change as the business develops. Grayson Standard will review this policy when a change materially affects how personal information is handled.

09 — How information is stored and protected

Google Workspace is Grayson Standard's primary administrative client-record environment. MyStrengthBook is used for coaching delivery and related coaching records. WhatsApp Business is primarily a communication channel rather than the authoritative health record; where a client communicates information that materially affects training or safety, Grayson Standard may record an appropriate factual note in the client's primary record. At present, Will Grayson is the only person authorised by Grayson Standard to access the main client-record system. Grayson Standard takes reasonable technical and organisational steps appropriate to the sensitivity of the information held. These may include:  using a dedicated Google Workspace business account and controlled sharing permissions;  multi-factor authentication and strong account credentials;  password-protected devices, automatic screen locking, current software/security updates and device encryption where available;  limiting access to personal information to what is required for the relevant purpose;  avoiding unnecessary permanent downloads or local copies of client health information;  separating active and inactive client records and applying retention-review processes;  using reputable service providers and reviewing relevant privacy/security settings; and  maintaining processes for access, correction, incident response, deletion and de-identification. No electronic storage or transmission method can be guaranteed to be completely secure. Grayson Standard nevertheless takes reasonable steps to reduce privacy and security risks and will adjust safeguards as the nature, quantity and sensitivity of information or the business changes.

10 — Disclosure to other people and organisations

Grayson Standard may disclose personal information where reasonably necessary to provide or administer services, where you have consented, where you would reasonably expect a related disclosure and the law permits it, or where disclosure is otherwise required or authorised by law. Examples may include disclosure to technology, payment, booking, accounting or professional service providers; a health professional you have authorised Grayson Standard to communicate with; insurers or advisers in connection with an incident or claim; and regulators, law-enforcement bodies or other parties where required or permitted by law. Where practical, consent to communicate with a health professional will identify the practitioner, the information to be shared and the purpose rather than operating as indefinite blanket authority.

11 — Overseas recipients and cloud services

Some service providers used by Grayson Standard operate internationally. As a result, personal information may be disclosed to overseas recipients, or processed or stored using infrastructure outside Australia, depending on the provider, service configuration, support arrangements and sub-processors in use at the relevant time. Likely overseas recipients may include service providers or their related entities, support providers and subprocessors in countries where the relevant providers operate. This may include, depending on the service used, countries such as the United States, Canada, Israel and countries in Europe. Provider locations and subprocessors can change, so it is not always practicable to provide an exhaustive country list in this policy. Where APP 8 applies to an overseas disclosure, Grayson Standard will take reasonable steps required in the circumstances. Grayson Standard will also review material service-provider arrangements and update this policy where a material change makes the overseas-disclosure description inaccurate.

12 — Website analytics, cookies and tracking technologies

The public Grayson Standard website may use cookies, website analytics and similar technologies to understand website use, improve the website and support marketing. Where required, users will be given appropriate notice and choices concerning these technologies. Grayson Standard does not intend to place advertising or third-party marketing pixels on client health-screening or coaching-record environments in a way that would disclose health or other sensitive information to advertising platforms. If marketing technologies are introduced or materially changed, Grayson Standard will review their configuration and update relevant website notices and this policy.

13 — Direct marketing

Grayson Standard currently uses email primarily for client service and responding to enquiries rather than general promotional mailing lists. If direct marketing is introduced, Grayson Standard will comply with applicable privacy and electronic-marketing requirements and provide appropriate opt-out mechanisms. Sensitive information, including health information, will not be used or disclosed for direct marketing unless the required consent has been obtained.

14 — Accessing and correcting your information

You may request access to personal information Grayson Standard holds about you and may ask for information that is inaccurate, out-of-date, incomplete, irrelevant or misleading to be corrected. Requests should be emailed to willgrayson@graysonstandard.com.au. Grayson Standard may need to verify your identity before providing access or making a correction. Requests will be handled within a reasonable period and in accordance with applicable law. If access or correction is refused, Grayson Standard will provide the reasons and available complaint mechanisms where required.

15 — Retention, deletion and de-identification

Grayson Standard retains personal information only for as long as it is reasonably needed for a permitted purpose, or where retention is required or permitted by law, insurance requirements, dispute or claim management, or other legitimate record-keeping needs. The retention periods below reflect Grayson Standard's current record-management practices and may be extended where a continuing lawful or operational need applies. CURRENT RETENTION APPROACH Tax, payment and accounting records: At least 5 years, or longer where applicable tax requirements require it. Adult onboarding, screening, consent, core health/injury and coaching records: Generally 7 years after the last service, subject to any continuing legal, insurance, complaint or claim need. Adult incident/injury records: Generally 7 years after the incident or last relevant service, subject to any continuing need. Core records for clients who were under 18: Until at least age 25 or 7 years after the last service, whichever is later, subject to any continuing need. Technique/training videos: Generally during active coaching and up to 12 months afterwards unless reasonably required longer. Optional progress photographs: Generally during active coaching and up to 12 months afterwards unless reasonably required longer; earlier deletion may be considered where appropriate. Enquiries that do not become clients: Generally up to 12 months, unless a longer period is reasonably required. Marketing/testimonial consent records: For as long as the material is used and for a reasonable evidence period after use ends. Obsolete duplicates or unnecessary working copies: Deleted as soon as reasonably practicable. When a coaching relationship ends, relevant records may be moved from active to inactive storage. When the applicable retention period expires, Grayson Standard will review whether there is any continuing reason to retain the information. Information no longer needed will be destroyed or de-identified using reasonable steps. A retention review does not require automatic deletion where an unresolved complaint, claim, legal requirement, insurance issue or other permitted purpose justifies continued retention.

16 — Data breaches

Grayson Standard maintains a process for responding to suspected loss, unauthorised access, unauthorised disclosure or other compromise of personal information. If an incident occurs, reasonable steps will be taken to contain the incident, assess what occurred and reduce the risk of harm where possible. Where Grayson Standard has reasonable grounds to believe an eligible data breach has occurred under the Notifiable Data Breaches scheme, affected individuals and the Office of the Australian Information Commissioner (OAIC) will be notified as required by law.

17 — Anonymity and pseudonyms

Where practicable, you may deal with Grayson Standard without identifying yourself or by using a pseudonym for a general enquiry. Identification will ordinarily be impracticable for services such as personal training and coaching where Grayson Standard needs to know who the client is, maintain health and safety records, manage appointments or payments, or perform contractual and legal obligations.

18 — Privacy complaints

If you have a concern or complaint about how Grayson Standard has handled your personal information, please email willgrayson@graysonstandard.com.au and provide enough information for the issue to be understood and investigated. Grayson Standard will acknowledge and assess the complaint, may request further information where necessary, and will respond within a reasonable period. If you are not satisfied with the outcome, you may be able to complain to the Office of the Australian Information Commissioner (OAIC). OAIC: www.oaic.gov.au

19 — Changes to this policy

Grayson Standard may update this Privacy Policy when its services, systems, service providers, legal obligations or information-handling practices change. The current version will be made available free of charge through graysonstandard.com.au or otherwise provided on request. The effective date on the first page identifies the current published version.

20 — Contact

For privacy enquiries, access or correction requests, or privacy complaints: Will Grayson Grayson Standard ABN 94 647 769 354 Email: willgrayson@graysonstandard.com.au Website: graysonstandard.com.au

PRIVACY ENQUIRIES

Will Grayson
Grayson Standard
ABN 94 647 769 354

willgrayson@graysonstandard.com.au
graysonstandard.com.au