BASELINE Privacy Notice

Version: baseline-mvp-2026-10-05-v2.

Shannon Smuts, sole trader trading as BASELINE, is responsible for your information. Privacy/Information Officer contact: Shannon Smuts, howzit@baselineathletics.co.za. We aim to respond within 2 business days.

Ordinary service information includes account identity and contact details, appointment and payment/service references, service communications and consent records. Special health information may include relevant training history, injuries, medical conditions, medication/supplement information, questionnaire answers, assessments and private coaching records; blood-work information is collected only where relevant to a later programme. We use information to provide and safely administer the agreed coaching service, keep appropriate service and consent evidence, and handle lawful privacy, safety and service requests. Health information is confidential and is not used for unrelated marketing. Health processing requires separate explicit consent, independently of accepting Service Terms. Unknown information remains unknown.

BASELINE is coaching, not a medical practice. Shannon does not diagnose, prescribe medication, advise starting medication, change medication or doses, or clinically interpret blood-test results. Blood work is not required for the R500 assessment. Additional programme requirements are specified by Shannon; the required panel is not inferred by the app.

The public website links to the protected app before questionnaire entry. Answers never belong in public URLs or marketing analytics. Firebase UID is the canonical account identity. Access is limited to the client and authorised assigned coaches; private coach notes are not automatically client publications. Shannon explicitly approves client publication. Document uploads and recording/transcription are unavailable and do not request consent.

Google/Firebase/Google Cloud provide identity, hosting and protected data infrastructure. Bookem manages appointments, native video and booking communications, with payments through Yoco checkout. The app does not collect or store payment-card details. These descriptions reflect the inspected architecture, not a certification of every provider arrangement. The intended regional database/backend is Johannesburg (africa-south1); this does not mean all information stays in South Africa. Foreign transfers require an applicable lawful transfer basis and safeguards. This policy does not activate AI processing of real health information: the processor and applicable production and cross-border safeguards must be separately approved first.

Identifiable client and consent/policy records are retained for 3 years after the last verified paid BASELINE service, subject to genuine lawful retention reasons or holds. Booking status alone is not paid-service proof. Unfinished questionnaires are deleted after 30 days at the latest; the browser-only draft expires after 24 hours. Financial/invoice records are handled for 5 years operationally where applicable, subject to applicable obligations. Daily backups have rolling 30-day retention. Anonymous aggregates may be retained only when re-identification is not reasonably possible; no pseudonymous individual archive is treated as anonymous. Where safe anonymisation is unavailable, the default is deletion. See the Retention Schedule.

Request access, correction, objection, consent withdrawal or deletion at howzit@baselineathletics.co.za. We verify identity and assess lawful retention requirements before action. Withdrawal does not invalidate earlier lawful processing and may prevent continued service requiring health information. The supervised Privacy Request Procedure applies. We do not promise instantaneous removal from every backup.

You may complain to South Africa's Information Regulator through its official complaints page, eServices portal, or POPIAComplaints@inforegulator.org.za using the prescribed process. The official contact page provides current contact details.

Security includes authenticated protected APIs, assigned-coach checks, restricted service identities and deny-all direct browser database rules. Safeguards do not guarantee perfect security or constitute an unqualified claim of full POPIA compliance.