Privacy policy.
What personal information Aspire Coaching & Physio collects, why, what we do with it, and the rights you have over it. It covers this website and our coaching, physiotherapy and nutrition services.
On this page
01Who we are
Aspire Coaching & Physio is the data controller for the information described here. We work from Jasmine City, 2 Soi Sukhumvit 23, Khlong Toei Nuea, Watthana, Bangkok 10110, Thailand.
For anything in this policy, including a request about your own data, call us or use our contact page.
02What we collect
We only collect what we need to answer you, coach you or treat you.
- Your name, email address and phone number, when you contact us or book a consultation
- What you tell us about your goals, your training history and your circumstances
- Payment records and invoicing details for clients
- Appointment and attendance records
- Correspondence between you and our team, including email, WhatsApp, LINE, Messenger and phone
- Technical information your browser sends when you visit this site, such as pages viewed, IP address, approximate location, device and referring site
03Health information
Coaching and physiotherapy cannot be done safely without some health information. Depending on the service, this may include your body composition and measurements, injury and medical history, medications relevant to exercise, pain and movement assessments, and results you choose to share with us such as blood work.
Under section 26 of the PDPA, health information is sensitive personal data. We collect it only with your explicit consent, which we ask for at your assessment, and we use it only to assess you, design and adjust your program, and treat you. You can withdraw that consent at any time, though it may mean we can no longer coach or treat you safely.
04Why we use it, and our legal basis
- To provide the service you asked for
- Necessary for the performance of a contract with you.
- To assess, program and treat
- Explicit consent, because this involves health information.
- To reply to enquiries and manage bookings
- Legitimate interest in running the business and answering people who contact us.
- To keep accounting, tax and clinical records
- Compliance with a legal obligation.
- To send you marketing
- Consent, which you can withdraw at any time.
- To keep the website working and improve it
- Legitimate interest, using the tools described below.
07Sending data outside Thailand
Some of the software we use stores data on servers outside Thailand. Where that happens we rely on providers that offer an adequate standard of protection or appropriate safeguards, as required by sections 28 and 29 of the PDPA.
08How long we keep it
Enquiries that do not become clients are deleted within two years. Client coaching and clinical records are kept for as long as you are a client and for a period afterwards, in line with the retention rules that apply to physiotherapy records and to accounting in Thailand. Accounting records are kept for the statutory period. After that, records are deleted or anonymised.
09How we protect it
We use access controls, encrypted connections, reputable providers and staff training, and we limit access to the people who need it for their job. No system is completely secure, so we do not claim that. We keep access tight and review it. If a breach put your rights at risk, we would notify the Office of the Personal Data Protection Committee within 72 hours of becoming aware of it and tell you where the law requires it.
10Your rights
Under the PDPA you have the right to:
- Be told what we hold about you and get a copy of it
- Have inaccurate or incomplete information corrected
- Ask us to delete or anonymise your information
- Ask us to stop or restrict how we use it
- Object to us using it, including for marketing
- Receive your data in a portable format, or have it sent to another provider
- Withdraw consent at any time, without affecting anything done before you withdrew it
Ask through our contact page or call us. We will respond within 30 days and we do not charge for this.
If you are not satisfied with how we handle it, you can complain to the Office of the Personal Data Protection Committee in Thailand.
11Marketing
If you have agreed to hear from us, we may send you occasional information about our services, offers and articles. Every email carries an unsubscribe link, and you can tell any of our team to stop calling or messaging you at any point.
That is separate from account messages such as appointment reminders, results and changes to your program, which we send because you are a client.
12Children
We do not knowingly collect personal information from anyone under 20 without the consent of a parent or legal guardian. Where we coach a young athlete, we take that consent in writing before we begin.
13Other websites
This site links to other websites. We are not responsible for how they handle your information, so check the privacy policy of any site you go on to.
14Changes to this policy
We update this page when our practices change. The date at the top tells you when it last changed. Our Terms and Conditions cover how we work with clients.
15PostPilot and its LinkedIn connection
This section applies to PostPilot at the PostPilot workspace, an internal content-planning and publishing tool operated by Fitcorp Asia (“we”, “us”). It supplements this privacy policy and extends its coverage to PostPilot. Where the general website policy describes website-only practices, this section describes the additional practices applicable to PostPilot. PostPilot is not a health-record system; do not place private client health information in publishing drafts or AI prompts.
Information we collect and when. When you choose to connect or reconnect your LinkedIn account through LinkedIn’s authorization screen, PostPilot obtains your LinkedIn member identifier, display name, access token and token expiry. We store the credential, including the member identifier, encrypted on the server; we store the display name to identify the connected profile. We do not ask for or store your LinkedIn password. The connection requests the openid, profile and w_member_social permissions. The current integration does not request your LinkedIn email address, contacts, connection list, messages or inbox, and it does not import your LinkedIn feed or profile history. We fetch identification details during authorization, not through scheduled profile polling.
PostPilot also stores the content you independently enter or upload, your workspace identity, saved drafts and publishing plans. When you prepare a LinkedIn publishing review, it stores a copy of the reviewed text and the selected profile name. When you separately approve publication, we send that text to LinkedIn and record the outcome and any post reference LinkedIn returns.
How we use the information. We use LinkedIn information to identify the account you connected, authenticate requests you authorize, publish approved text, display results and protect against accidental duplicate publication. Connecting an account alone does not publish anything. In the current release, each publication requires a separate review and explicit approval; it publishes immediately and publicly to your personal profile. Calendar dates are planning dates, not automatic LinkedIn publishing instructions. The current integration does not publish to company Pages, send messages or deliver first comments.
Sharing, hosting and AI. Approved post text is sent to LinkedIn, whose own privacy policy governs its processing. PostPilot uses OpenAI Sites for hosting and access management and Cloudflare infrastructure for application processing and storage. Authorized administrators and service providers may process information as necessary to operate and secure the tool. We do not sell LinkedIn information or use it for advertising targeting. The LinkedIn integration does not send LinkedIn credentials, member identifiers, profile names or returned post references to AI models. Separately, when you use an optional AI feature, the content and reference material you choose for that feature may be sent to the selected provider, such as OpenAI, Anthropic or xAI; the provider’s applicable terms and privacy practices apply. Processing may occur outside your country; contact us for information about applicable service providers and transfer arrangements.
Retention and security. We retain the connection information while you keep the connection in PostPilot, until you delete it or we otherwise remove it. An expired credential cannot be used to publish; continued use requires reconnecting and authorizing again. Publishing review snapshots and returned LinkedIn post references are retained until you delete the connection data or we remove them. OAuth authorization state is single-use and valid for ten minutes; expired pending state is cleared when another connection starts or when connection data is deleted. We use encrypted credentials, authenticated workspace access and server-side authorization checks. No system can guarantee absolute security.
Withdrawing consent and deleting LinkedIn data. In PostPilot’s Publishing panel, select Disconnect & delete LinkedIn data and confirm. This control remains available to signed-in users even if their publishing entitlement is inactive. It removes the stored LinkedIn credential and member identifier, profile name, pending authorization state, review text snapshots, profile labels in publishing records and returned LinkedIn post references from active PostPilot application records. A delayed authorization or publishing response cannot restore those deleted fields.
Your independently authored drafts and posts are not deleted by this action. PostPilot keeps minimal, content-free local submission records, including local record identifiers, timestamps and submission status, to avoid sending the same saved post again after an uncertain or completed submission. These records do not retain the LinkedIn member identifier, token, profile name, reviewed text or returned LinkedIn post identifier. They remain associated with the saved post while it is retained; this control is deletion of LinkedIn connection data, not closure of your entire PostPilot account.
Deleting local data cannot recall a request already sent to LinkedIn or delete posts already published there. Manage those posts directly on LinkedIn. To revoke LinkedIn’s authorization grant as well, remove PostPilot from LinkedIn’s permitted services in your account’s privacy settings. Reconnecting later requires a new authorization.
For access, correction, deletion beyond these controls, withdrawal of consent, or closure of your PostPilot workspace, contact us and mention PostPilot. We may need to verify your identity before acting on a request. We will handle applicable rights requests under the laws that apply to you. Where retention is legally required, we will explain the relevant exception. If you cannot sign in, use this contact route rather than reconnecting LinkedIn merely to request deletion.
Changes. If we introduce external customers, subscriptions, additional social networks, broader permissions or materially different uses of information, we will update this section and obtain further consent where required before using information for those purposes.