Privacy Policy

How we collect, use, store and protect your information. Last updated 20 May 2026.

1. Who we are

The Coaching Nexus is operated as a sole-trader business by Robert Gregory, based in South Australia, Australia, trading under the registered business name The Coaching Nexus (ABN on request). In this document, “we”, “us” and “our” refer to that business; “you” refers to any individual whose personal information we hold.

We are bound by the Privacy Act 1988 (Commonwealth) and the Australian Privacy Principles (APPs).

2. What this policy covers

This policy applies to information we collect when you:

Visit our website at thecoachingnexus.com.au or any subpath;
Purchase a profiling product (CVMP, FVMP, NVMP, BVMP, HVMP or PMP-Frontline) directly or via a practitioner;
Take a profiling assessment in our member portal;
Book a coaching debrief or other paid service;
Make an enquiry through any contact form, email, or phone;
Interact with us in person, by phone, or by email.

3. What information we collect

Category	Examples
Identity	Name, email address, phone number where you provide it, sport/role context.
Assessment responses	Your answers to the multi-item profiling instruments and any free-text annotations.
Derived psychological information	Dimension scores, polarity positions, conversation-map output, and any practitioner annotations or session notes generated as part of coaching engagement.
Goals data	Goals you set, daily check-in responses, free-text notes you choose to record.
Payment information	Transaction records of purchases. Card numbers are not stored by us, they are handled directly by Stripe.
Technical data	IP address, browser type, device type, basic interaction logs needed to run the portal and prevent abuse.
Communication records	Emails you send us, contact-form submissions, debrief booking history.

Sensitive information

Some assessment responses can be considered sensitive information under the Privacy Act because they relate to mental, behavioural and identity states. We collect this information only:

With your active consent (by completing an assessment);
For the specific purpose of producing your coaching profile and supporting any coaching engagement you choose to enter;
With clear notice that your responses are not a clinical assessment and do not produce a diagnosis.

We do not collect health information, medical records, biometric identifiers, or genetic information.

4. How we use your information

We use the information we collect to:

Provide and run the profiling instrument you have purchased or been assigned;
Generate the written or chart-based output that is the product of the instrument;
Send transactional emails (account access, magic links, password resets, results notifications);
Send follow-up emails about coaching debriefs and related services, until you opt out;
Operate the practitioner-side functions where your assigned practitioner views your results to support coaching conversations;
Process payments through Stripe for any paid products or services;
Generate AI-assisted summaries of your profile to support coaching, where you or your practitioner have triggered that function (described in section 6);
Improve the instruments, the portal, and the service over time;
Comply with our legal obligations (record-keeping, tax, anti-fraud).

5. Who sees your information

Who	What they see
You	All of your own data, at any time, via your portal account.
Your assigned practitioner (if you were invited by one)	Your dimension scores, assessment responses, any practitioner notes they have taken, and AI-generated summaries they trigger. Your practitioner does not see goal check-ins by default.
Rob Gregory (as the sole operator)	Has system-level access to all data, used only for support, debugging, or where you have requested assistance.
Your club, employer, or organisation	Does not see your individual data automatically. If your practitioner is engaged through your club, your dimension-level results may be discussed in the coaching context, but raw responses are not shared with the club unless you have specifically agreed.
Third parties	Only where required by law (court order, valid government request) or where you have given specific consent.

6. Third-party service providers

We use a small number of trusted service providers to run the platform. We have reviewed each for their privacy and security posture. They process the data described below on our behalf and under contract.

Provider	Used for	Data shared	Location of processing
Supabase	Database, authentication, file storage	All portal data (account, responses, goals, notes)	AWS, Asia-Pacific region
Netlify	Website and portal hosting, serverless functions	Server-side logs of requests and responses	Global edge network
Stripe	Payment processing	Email, payment amount, transaction metadata. Card details are handled by Stripe and not transmitted to us.	Stripe global infrastructure, primarily United States
Resend	Transactional and follow-up emails	Email address, message contents	United States
Anthropic (Claude API)	AI-generated narrative summaries of profiles	De-identified profile data (name, scores, notes) at the moment a summary is generated. Anthropic states that API content is not used to train their models.	United States
Meta (Facebook Pixel)	Conversion tracking on public landing pages only	Anonymous page-view events. No personally identifying data is sent.	Global Meta infrastructure

Where any of these providers process your data outside Australia, we rely on standard contractual protections to ensure your data remains protected to a standard comparable to Australian privacy law.

7. AI-assisted analysis, important note

The portal includes optional AI features that generate narrative summaries of your profile. These features:

Are only triggered when you or your practitioner request them;
Send a structured summary of your profile (scores, notes, goals where applicable) to the Anthropic Claude API;
Are governed by Anthropic's commercial terms, which state that API-submitted content is not used for model training;
Produce coaching-oriented summaries only and do not constitute a clinical interpretation or diagnosis.

If you do not wish your data to be used in AI-assisted analysis, you can let us know and that feature will not be used on your profile.

8. How long we keep your data

Data type	Retention
Active account & assessment data	For as long as you maintain an account, and for 12 months after you close it (so you can re-open if needed).
Completed assessment records (historical profiles)	7 years, to maintain a coaching history that supports longitudinal patterns. You may request earlier deletion.
Payment records	7 years, in line with Australian tax record-keeping requirements.
Email logs	30 days for transactional logs, then deleted from our records (Resend retains its own logs subject to its policy).
Anonymised aggregate data	May be retained indefinitely for product improvement once identifying information is removed.

9. Your rights

Under the Australian Privacy Principles you have the right to:

Access the personal information we hold about you. You can do this at any time through your portal account or by emailing us.
Correct information that is inaccurate, out of date, or incomplete.
Delete your account and the personal data associated with it, subject to the retention requirements above.
Opt out of marketing or follow-up emails at any time. Every automated email contains an unsubscribe link.
Restrict the use of AI features on your profile if you choose.
Complain to us in the first instance. If unresolved, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

10. How we protect your data

We take reasonable technical and administrative steps to protect your information, including:

HTTPS encryption on all traffic (TLS 1.2 or higher) with HSTS enforcement;
Database-level Row-Level Security (RLS) in Supabase that prevents one user from reading another user's data;
Multi-factor authentication available on practitioner accounts;
HMAC-signed unsubscribe tokens to prevent unauthorised opt-out actions;
Strict Content Security Policy headers to mitigate injection-based attacks;
Separation of payment data, your card details never touch our systems;
Restricted access to administrative tooling, available to Rob Gregory only;
Daily database backups, retained per our hosting provider's policy.

No system is perfectly secure. If we become aware of a data breach that is likely to result in serious harm, we will notify affected individuals and the OAIC in accordance with the Notifiable Data Breaches scheme.

11. Cookies and similar technologies

We use:

Essential cookies, to keep you signed in to the portal. These cannot be disabled without breaking the portal.
localStorage, to preserve your in-progress assessment responses on the device you are using, so a connection drop does not lose your work.
Facebook Pixel (public marketing pages only), to measure how visitors arrive at our paid landing pages and which marketing channels are working. You can opt out via your browser's privacy controls or via Meta's ad preferences.

We do not use third-party advertising cookies or trackers anywhere within the portal itself.

12. Children and young people

Our pathway products are available to athletes aged 13–18, but only via invitation by their assigned practitioner. Where a young person under the age of 18 takes an assessment, we treat their data with the same protections as any adult's data, and we expect the engaging practitioner to obtain age-appropriate consent. We do not knowingly collect data from children under 13.

13. Changes to this policy

We may update this policy from time to time as our service changes or as Australian privacy regulation evolves. The current version is always available at this URL. Material changes will be communicated by email to active account holders.

Contact

For any privacy-related question, request, or complaint:

Rob Gregory
The Coaching Nexus
South Australia, Australia
rg@thecoachingnexus.com.au

We aim to respond to privacy requests within 14 days.