Privacy Notice
Last updated: 16 July 2026
1. Who we are
Toby Maddison Human Performance ("TMHP", "we", "us", "our") is operated by Toby Maddison, a sole trader based in No 4 The Citadel, Mottram Street, Stockport, SK1 3PH, United Kingdom.
For the purposes of UK data protection law, Toby Maddison is the data controller responsible for your personal data.
Contact: privacy@tmhp.co ICO registration number: xxx-xxx-xxx-xxx
2. What this notice covers
This notice explains how we collect, use, store and protect personal data when you:
Visit the TMHP website
Complete an Assessment
Create a membership account
Use Athlete Support (check-ins, dashboard, pillar tracking)
Contact us directly
3. What data we collect
Account data Name, email address, password (stored encrypted), membership tier, account creation date.
Assessment data Movement limitations, training background, recovery profile, injury history, development pathway responses.
Athlete Support / check-in data Weekly check-in inputs (sleep, fatigue, soreness ratings, session-completion status, free-text flag notes), pillar scores, limiting-factor results, progress trends over time.
Payment data We do not store your card details. Payments are processed securely by Stripe. We retain a record of transaction dates, amounts and membership status, but not full card numbers.
Technical data Pages visited, general usage patterns, device/browser type, collected via Framer's built-in analytics.
4. Special category data
Some of the information collected through Assessment and Athlete Support — particularly injury history, and check-in data that may indicate physical or mental wellbeing — can constitute special category data ("health data") under UK GDPR.
We only collect this data with your explicit consent, given at the point of completing an Assessment or check-in. This data is used solely to:
Identify your limiting factor across the Five Pillars
Guide training, recovery and coaching recommendations
Track your development over time
We do not use this data for any other purpose, and we do not sell or share it with third parties for marketing purposes.
You can withdraw consent at any time by contacting us, though this will limit our ability to provide Athlete Support and coaching recommendations.
5. Why we use your data (legal basis)
For the purposes of:
Providing your account and membership
Delivering Assessment and Athlete Support® Contract / Explicit consent (for special category data)
Processing payments
Improving the service
Legitimate interests
Sending service-related emails
Sending marketing communications (consent required, opt-in only)
Complying with legal obligations (e.g. tax records)
Legal obligation
6. Who we share data with
Stripe — payment processing
Bubble — application hosting and membership/scoring logic (acts as our data processor)
Framer — website hosting and analytics
We do not sell your personal data. We do not share Assessment or Athlete Support® data with any third party for advertising purposes.
Some of our providers (e.g. Stripe, Bubble) may process data on servers located outside the UK. Where this happens, we rely on their standard contractual safeguards (such as the UK International Data Transfer Addendum or equivalent) to ensure your data remains protected.
7. Cookies
The website uses Framer's built-in analytics, which may use minimal cookies or similar technologies to understand aggregate site usage.
We use a small number of cookies to run and improve this site.
Essential cookies — required for the site and membership platform to function (e.g. keeping you logged in). These can't be switched off.
Analytics cookies — collected via Framer's built-in analytics, to understand general visitor patterns (e.g. which pages are popular). These are only set if you accept them.
We do not use third-party advertising or tracking cookies. We do not sell or commodify this data in anyway shape or form.
8. How long we keep your data
Account data: for as long as your membership is active, plus [X years] after closure for legal/accounting purposes.
Assessment and Athlete Support data: for as long as your membership is active, so your progress history remains meaningful. Deleted within [X] days of account closure unless you request earlier deletion.
Payment records: retained as required by UK tax law (currently 6 years).
9. Your rights
Under UK GDPR, you have the right to:
Access the personal data we hold about you
Correct inaccurate data
Request deletion of your data
Restrict or object to certain processing
Request a portable copy of your data
Withdraw consent at any time (where consent is the legal basis)
To exercise any of these rights, contact privacy@tmhp.co. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been mishandled.
10. Children
TMHP services are intended for users aged 18 and over. We do not knowingly collect data from anyone below this age.
11. Changes to this notice
We may update this notice from time to time. Material changes will be notified to active members by email.
12. Contact
Questions about this notice or your data: privacy@tmph.co