This policy explains, in plain language, what information Nick Mirow Coaching collects about you, why we collect it, how we look after it, and the rights you have over it. Where you are a coaching client, please read it together with the Health & Performance Data Consent Form you sign at onboarding, which is where you give specific consent for us to collect your health and performance data and to use AI as described in section 6.

1. About this policy

Nick Mirow Coaching ("NMC") is the rowing coaching business of Nicholas Mirow, trading as Nick Mirow Coaching (ABN 69 748 436 102), a sole trader based in Annandale, Sydney NSW. Because NMC is a sole trader, when this policy says "we", "us", "our" or "NMC" it means Nick Mirow personally.

This policy applies to everyone who deals with NMC, including current and prospective clients, the parents and guardians of junior athletes, and visitors to the NMC website. It covers information collected through the Services and through the website.

Two sets of privacy laws apply to NMC, and this policy is written to meet both:

• the federal Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (the APPs); and
• the NSW Health Records and Information Privacy Act 2002 (the HRIP Act) and its 15 Health Privacy Principles (the HPPs), which apply specifically to your health information.

2. Why these privacy laws apply to us

A small business with annual turnover under $3 million is usually exempt from the Privacy Act. That exemption does not apply to NMC, because we provide a health service and hold health information. Under section 6D(4) of the Privacy Act 1988 (Cth), a business that provides a health service and holds health information is treated as an APP entity no matter how small it is. So we follow the APPs in full.

On top of that, because we collect and hold health information in NSW, the NSW HRIP Act and its 15 HPPs also apply to us. This policy is written to meet the NSW health-privacy requirements as well as the federal ones.

3. The information we collect and hold

We collect the kinds of information set out below. Your health and physiological information is "sensitive information" under the Privacy Act (s 6) and "health information" under the HRIP Act (s 6), so it gets the highest level of protection and we only collect it with your consent (see section 7).

Category	What it includes
Identity and contact	Your full name, date of birth, email address and phone number.
Rowing profile	Your club affiliation, competition or athlete category, and training goals.
Health information (sensitive)	Your PAR-Q+ responses, injury and medical history, current and past medical conditions, cardiovascular risk factors, and medications where you disclose them.
Performance and physiological data	Ergometer test results, resting and training heart rate, and lactate test results where applicable. Some of this is also health information and is treated as sensitive.
Strength and mobility	Compound lift maxes and the results of your strength & conditioning and mobility assessment.
Body composition (optional)	Body weight and body-fat percentage, where you choose to provide them.
Wellness	Your daily readiness and recovery scores.
Coaching records	Video you submit for analysis, technique and session notes, and session logs.
Payment	Billing details for payment. All payments run through Stripe, so those details are processed by Stripe and we never see or store your card or bank account number.
Website	Details you submit through the enquiry or contact form, plus your IP address and analytics data (see section 15).
For a Minor	All of the above about the athlete, plus the Guardian's name and contact details and our record of the Guardian's consent.

Telling us this information is your choice. But if you don't give us the health and performance information we need, we may not be able to design or deliver your coaching safely.

4. How we collect it

Wherever it is reasonable and practicable, we collect information directly from you. We collect it:

• through your onboarding intake questionnaire and PAR-Q+ health form, completed in Google Forms;
• from the performance and heart-rate data you upload to TrainingPeaks (from Concept2 ErgData, wearables, or entered manually);
• from your emails and in-person updates, including injury reports and wellness check-ins;
• from our own observations during in-person sessions, including technique and session notes; and
• through the enquiry and contact forms on our website.

For a Minor, we collect this information from and through the Guardian, who provides it and consents to it through the Parental Consent Form.

At or around the time we collect information from you, we tell you what we are collecting and why, in a short "collection notice".

5. Why we collect it, and how we use it

Our main purpose for collecting your information is to provide the Services. Specifically, we use it to:

• design a training programme built around your physiology, goals and health profile;
• screen for anything that makes a test, exercise or training load unsafe for you, before we prescribe it;
• deliver your coaching and adapt your training blocks to your data over time;
• monitor your progress;
• communicate with you about your programme and sessions;
• process your payments; and
• meet our legal and record-keeping obligations.

We only collect what is genuinely necessary for these purposes. We use your information only for the purpose we collected it (your coaching), or for a directly related purpose you would reasonably expect, or where you have consented, or where the law allows or requires it. We do not use your information for marketing or advertising, and we never sell it. The only exception is a testimonial you separately and voluntarily provide for publication: we publish that under its own specific consent, and only what you have agreed to (your words, the name format you choose, and a photo only if you say yes). You can ask us to take it down at any time.

6. AI-assisted processing

NMC uses Anthropic's Claude as a drafting and analysis aid. For example, it helps prepare an initial Baseline programme draft from your self-reported data, or helps analyse training data between blocks. Nick reviews, edits, and approves all AI-assisted output before it is used or sent to you; AI does not make coaching, programming, or clinical decisions on its own.

Only the data described in section 3 is used this way, for your coaching only. Full detail, including how to consent and withdraw consent, is set out in the AI-processing section of the Health & Performance Data Consent Form, which you sign at onboarding.

NMC has turned off the account-level "Help improve Claude" model-training setting on the Claude account it uses. This means conversations, including any client data used for AI-assisted drafting or analysis, are not used to train Anthropic's models, and Anthropic's standard retention for such conversations applies rather than the extended retention that applies when model-training is enabled.

7. Your health information, and your consent

Your health and physiological information is the most sensitive information we hold, and we treat it that way. We collect it only with your explicit, written consent, given through the Health & Performance Data Consent Form you sign at onboarding, which is kept separate from the coaching agreement as best practice.

For a Minor, the Guardian gives this consent through the Parental Consent Form. You can withdraw your consent at any time (see section 16).

8. When we share your information, and who can access it

Day to day, the only person who accesses your personal and health information is Nick Mirow. We do not sell, rent, trade or share your information for anyone else's marketing. We disclose information outside NMC only:

• to the third-party platforms we need in order to deliver the Services (see section 9), and then only the information each platform needs to do its job;
• where you have given us separate written consent;
• where the disclosure is directly related to your coaching and you would reasonably expect it;
• where we are required or authorised to disclose it by law; or
• where we reasonably believe it is necessary to lessen or prevent a serious threat to someone's life, health or safety.

9. The platforms we use, and sending information overseas

To deliver the Services we rely on these third-party platforms, each with its own privacy policy: TrainingPeaks (programme delivery and monitoring, and in-app coaching messaging on the coaching tiers, which processes the content of messages exchanged between you and NMC); Google Meet (video calls); Google Workspace (email, storage, scheduling and forms); Anthropic's Claude (a drafting and analysis aid, see section 6); Stripe (payment processing for all NMC fees, being card payments for Baseline, Programme and the Full Assessment Fee, and BECS direct debit for coaching subscription renewals); and WhatsApp (Meta), used only as a broadcast-only announcement channel for in-person / club session logistics. Casual in-person sessions are paid in cash on the day and involve no payment platform. NMC never sees or stores your card or bank account numbers; those are handled by Stripe.

Several of these platforms are run by overseas-based providers and may store or process your information on servers outside NSW, and outside Australia, including in the United States. We rely on the following bases for those transfers: the transfer is necessary to perform our coaching contract with you; you consent to it through the Consent Form and this policy; and we take reasonable steps to use reputable providers that protect your information to a standard comparable to the APPs and the HPPs. Where Stripe is used, we do not store or process card numbers ourselves; Stripe handles all card data under the PCI-DSS standard.

10. How we store and protect your information

Your information is held in TrainingPeaks, which is cloud-based, password-protected, and accessible only through Nick's coach account; a restricted-access Google Drive folder (Nick only); and password-protected spreadsheets on Nick's work device. Where AI-assisted drafting or analysis is used (section 6), relevant data also passes through Claude for that specific processing.

We take reasonable steps to protect your information from loss, misuse and unauthorised access, use, modification or disclosure. Those steps include strong, unique passwords and multi-factor authentication where the platform offers it, keeping access limited to Nick alone, using reputable providers, and disposing of records securely when we no longer need them.

11. Data breaches

If a data breach happens that is likely to result in serious harm to you, we will act to contain and assess it, and we will notify you and the Office of the Australian Information Commissioner (OAIC), as required by the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act.

12. How long we keep your information, and when we destroy it

Health information. NSW law sets minimum retention periods for health service providers. We keep your health information for at least seven years from the last time we provided you a coaching service. If we collected the information while you were under 18, we keep it until you turn 25, whichever period is longer.

Other personal information. We keep this only for as long as we need it for the purposes in this policy, or for as long as the law requires. After that we destroy it or de-identify it.

Payment and business records. We keep these for as long as Australian tax and business-record law requires (generally at least five years).

13. Accessing, correcting, updating and deleting your information

You can ask us at any time what information we hold about you and to see it, and we will give you access without unreasonable delay or expense. If anything we hold is wrong or out of date, tell us and we will correct it. We may need to verify your identity before we act on a request.

Asking us to delete your information. Non-health information (for example, your contact details, website enquiry data, and general coaching notes that are not health information) is deleted or de-identified on request once we no longer need it for the purposes in this policy or for a legal obligation.

Health information is different. NSW law requires us to keep your health records for a minimum period, being at least seven years from the last coaching service, or until you turn 25 if we collected it while you were under 18. While that period runs, we cannot delete your health records even if you ask us to. What we can and do promise is that during that period those records are held securely, accessed only by Nick, used only for the purposes in this policy, and never used for anything else, and that once the retention period ends, they are securely destroyed or de-identified.

14. Dealing with us anonymously; identifiers; record linkage

You are welcome to make a general enquiry without identifying yourself. But we cannot safely design or deliver a coaching programme without knowing who you are and your health background, so the coaching itself cannot be provided anonymously.

We do not adopt government identifiers (such as a Medicare number) as our own way of identifying you, and we do not put your records into any shared health-records linkage system.

15. Our website: forms, cookies and analytics

When you use the NMC website, we may collect the details you submit through the enquiry or contact form, and your IP address and browsing data through analytics tools such as Google Analytics.

Analytics data is anonymised visitor-behaviour data, used only to improve the website. It is not linked to your individual coaching records. This policy is linked in the footer of every page of the website, free of charge and in plain language.

16. Withdrawing your consent

You can withdraw your consent to us collecting or using your health and performance data, or to our use of AI as described in section 6, at any time, by emailing us. If you do, we may not be able to keep delivering your coaching safely, or as quickly. We will talk it through with you and explain your options. Withdrawing consent does not affect anything we did lawfully before you withdrew it.

Withdrawing consent is not the same as deleting your records. Even after you withdraw consent, the health-information retention rule in sections 12 and 13 still applies: we must keep your health records for the minimum legal period, held securely and used for nothing else, before destroying them.

17. Questions and complaints

If you have a question or a concern about how we have handled your information, please contact us first, at hello@nickmirow.com.

We will acknowledge your complaint promptly and aim to respond within 30 days. If you are not satisfied with our response, you can escalate your complaint:

• for your health information, to the Information and Privacy Commission NSW (IPC) at ipc.nsw.gov.au or 1800 472 679; and/or
• for matters under the federal Privacy Act, to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or 1300 363 992.

18. Changes to this policy

We review this policy at least once a year and update it when our practices change. If we make a material change, we will let active clients know by email. The current version is always available on our website and on request.

19. How to contact us

Nick Mirow Coaching (Nicholas Mirow), ABN 69 748 436 102. Email: hello@nickmirow.com.

Based in Annandale, Sydney NSW.

← Back to nickmirow.com