Privacy Policy

This policy explains how FytMate Pty Ltd (ABN 43 701 728 010) ("FytMate", "we", "us") handles personal information in ClubKey, our software for gyms, studios and clubs. We follow the Australian Privacy Principles in the Privacy Act 1988. Our Tapvyn app has its own privacy policy.

1. Our two roles

Club owners and staff. When a club signs up and its staff use ClubKey, we collect their information and decide how it is used.

Members. When you join a club that uses ClubKey, the club collects your information and decides how it is used. We hold and process it for the club, under our agreement with it. The club's own privacy policy applies, and requests to see, correct or remove your information should go to the club. We will help the club respond.

2. What ClubKey holds

About club owners and staff:

• Name, email, role and club
• Passwords, stored only in scrambled (hashed) form, and two-factor sign-in settings
• Sign-in times, and a record of actions taken in ClubKey (the club's activity log)
• For the club's subscription: business name, ABN, billing contact and plan. Card or bank details are held by Stripe, not by us.

About members, held for their club:

• Name, email, phone, date of birth, address, emergency contact, member number and photo
• Membership plan, holds and cancellations, and signed membership agreements, including the signature and the time, IP address and browser used to sign, which the club keeps as evidence of signing
• Payments, invoices, receipts and purchases. Card and bank numbers are typed directly into Stripe's secure form and never reach ClubKey. We keep only the card brand, last four digits and expiry, or a bank account's BSB and last four digits.
• Door access: each entry and refused entry, with the time and door, and the key tag or card used
• Class and facility bookings
• A medical alert, if the club records one (see section 3)
• Notes the club's staff record
• Copies of the emails, text messages and app notifications sent to the member
• Whether the member has agreed to receive club news and offers
• A Fitness Passport number, if the member uses Fitness Passport

Phone location. When a member opens a door from the app, the app sends the phone's location once so ClubKey can check they are at the club. The location is not stored.

Technical information. Our hosting provider's logs record the IP address, browser and time of requests made to ClubKey.

3. Health information

A medical alert is health information, which the law treats as sensitive. Clubs should record one only with the member's consent and only where it matters for the member's safety. ClubKey stores medical alerts with an extra layer of encryption, and only owner, manager and reception roles can see them, not trainers.

4. How the information is used

• To provide ClubKey to clubs: running memberships, collecting payments, opening doors, taking bookings, and sending receipts, reminders and service messages
• To give support, keep ClubKey secure and prevent fraud
• To meet our legal obligations
• To improve ClubKey, using de-identified, combined information

We do not sell personal information, and we do not use members' information for our own marketing. A club may send its news and offers to members who have agreed to receive them, and must let them opt out.

5. Who we share it with

• The member's club
• Our service providers: Microsoft Azure (hosting and database, in Australia), Stripe (payments and fraud checks), Resend (email delivery), Google Workspace (our support mailbox) and, only if a club switches them on, Twilio (text messages) and Xero (accounting, which receives members' names, numbers, emails and invoices)
• The push notification service built into the member's browser or phone (Apple, Google or Mozilla), to deliver app notifications
• Fitness Passport, indirectly: a club can download a claim file with members' names and Fitness Passport numbers and send it to Fitness Passport itself
• Authorities, where the law requires

6. Where it is stored, and overseas

ClubKey's database and backups are in Microsoft Azure's Australia East region (Sydney). Stripe, Resend, Google, Twilio, Xero and push notification services may handle information in other countries, including the United States. We use providers that protect information to a standard comparable with the Australian Privacy Principles.

7. Security

Information is encrypted in transit and at rest, and each club's data is kept separate at database level. Staff accounts lock after repeated failed sign-ins and support two-factor sign-in, which clubs can require for owners and managers. Members sign in with one-time codes. Actions in ClubKey are logged, and payment details never reach our systems.

No system is perfectly secure. If a data breach is likely to cause serious harm, we will tell the clubs affected within 72 hours and help them notify members and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme.

8. How long we keep it

We keep a club's information while its account is open, because signed agreements and payment records are the club's evidence of its memberships. When an account closes, we keep the information for 30 days so the club can ask for an export, then delete it, except records the law requires us to keep, such as financial records, which are kept for seven years. Backups expire after 14 days and server logs after 180 days.

A member who wants their information removed should ask their club; we will help the club do it.

9. Access, correction and complaints

Members: ask your club. Club owners and staff: email support@clubkey.com.au. We respond within 30 days.

If you have a complaint about how we handle personal information, email us first. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at https://www.oaic.gov.au.

10. Cookies and browser storage

ClubKey does not use advertising or analytics cookies. The club portal and the member app use your browser's storage to keep you signed in and remember your club, and the member app keeps a copy of its own files so it opens quickly. Stripe's payment form may set its own cookies to prevent fraud, under Stripe's privacy policy (https://stripe.com/privacy).

11. Children

Club accounts are for people aged 18 and over. Clubs may record members under 18 under their own policies, with a parent's or guardian's consent where the law requires it.

12. Changes to this policy

We post changes here and update the date at the top. We tell club owners about important changes by email.

Contact

Privacy questions and requests: support@clubkey.com.au. FytMate Pty Ltd, Blacktown NSW 2148, Australia.