Privacy Policy

M2x Fitness (ABN 39 119 387 801, "M2x", "we", "us") provides fitness coaching, training programs, and the M2x MuscleLab training and nutrition app to members in Australia and internationally. This policy explains what personal information we collect, why, and what we do with it.

We handle personal information in line with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).

Where it's lawful and practicable, you can deal with us anonymously or under a pseudonym, for example when making a general enquiry. We can't provide coaching, programming or app access without identifying you, because those services depend on tracking your individual training over time.

Depending on how you use M2x, we may collect:

• Identity and contact details: name, email address, mobile number.
• Account and membership data: your membership tier, program access, and community activity on Skool.
• Health and fitness data: workout logs, sets, reps and weights, body measurements, nutrition and macro logs, and progress photos if you choose to add them.
• Payment information: subscription payments are processed by Skool and its payment processor, not by us directly. We don't store your card details.
• Communications: messages you send us via the contact form, email, or SMS, and any enquiries about programs or support.
• Usage data: basic technical data (device, browser) when you use the website or app, mainly for keeping things running and diagnosing issues.

Health and fitness information, including body measurements and progress photos, is sensitive information under the Privacy Act. Sensitive information attracts higher protection, and we only collect it with your consent.

By entering training, nutrition, measurement or photo data into the MuscleLab app, you consent to us collecting and handling that information for the purposes described in this policy: delivering your programming, tracking your progress, and providing coaching.

You can withdraw that consent at any time by contacting us, though doing so may mean we can no longer provide personalised programming or coaching. You're never required to add progress photos or body measurements to use M2x.

• To create and manage your account and deliver the training programs, app, and coaching you've signed up for.
• To personalise your programming and track your progress over time.
• To send you service-related communications: session reminders, program updates, and responses to enquiries.
• With your consent, to send SMS training reminders and marketing communications. You can opt out of marketing at any time, and every marketing message includes an unsubscribe option.
• To improve M2x, by understanding what's working and what isn't.
• To meet our legal and accounting obligations.

We do not sell your personal information, and we do not use your health or training data to train third-party AI models.

The MuscleLab app uses your logged training data to calculate progressions, estimated one-rep maxes, and suggested load adjustments within the program you've chosen. These are calculations that support your training, not decisions that affect your legal rights or entitlements, and a coach reviews programming changes that matter.

If you'd like a human review of anything the app has calculated, contact us and we'll look at it personally.

We don't sell your personal information. We share it only where necessary to run the service, with:

• Skool: hosts our community and processes subscription payments.
• Supabase: hosts the MuscleLab app's database, including your training and nutrition data.
• Resend: delivers transactional emails (confirmations, digests, support replies).
• ClickSend: delivers SMS training reminders, if you've opted in.
• Cal.com: handles coaching call bookings, including your name, email and appointment details.

These providers only process your data to provide their service to us and aren't permitted to use it for their own purposes. We may also disclose information if required by law.

Some of the providers above store or process personal information outside Australia. This means your information, including sensitive health and fitness data, may be held overseas.

Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, including through the terms of our agreements with them. Under APP 8 we generally remain accountable for how these providers handle your information.

If you'd prefer your information not be disclosed overseas, contact us, though this may mean we can't provide the service.

Your data is stored with reputable cloud providers using industry-standard security practices, including encryption in transit and access controls. No system is completely secure, but we take reasonable steps to protect your information from misuse, loss, and unauthorised access.

If a data breach occurs that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as required under the Notifiable Data Breaches scheme.

The website uses minimal, functional cookies needed to make the site work properly. We don't run invasive tracking or sell browsing data to advertisers.

You can ask us to access, correct, or delete the personal information we hold about you at any time.

To make a request, contact us using the details below. We'll respond within 30 days. If we can't give you access or make a correction, we'll tell you why in writing and explain how you can complain.

If you think we've mishandled your personal information or breached the Australian Privacy Principles, contact us first using the details below. Tell us what happened and what outcome you're looking for.

We'll acknowledge your complaint within 5 business days and give you a written response within 30 days.

If you're not satisfied with how we've handled it, you can complain to the Office of the Australian Information Commissioner:

• Website: oaic.gov.au
• Phone: 1300 363 992

We keep your information for as long as your account is active, plus a reasonable period afterward for legal, accounting, or legitimate business purposes such as tax records. Financial records are generally kept for 5 years as required by Australian tax law.

You can request earlier deletion at any time, subject to any legal retention requirements.

M2x is not directed at children. You need to be 18 or older to hold an M2x membership. If we become aware that we've collected personal information from someone under 18 without appropriate consent, we'll delete it.

We may update this policy from time to time as the business evolves. We'll update the date at the top of this page when we do. If a change materially affects how we handle your information, we'll let you know directly.

Questions about your data or this policy? Get in touchand we'll respond directly.