Privacy Policy

M2x Fitness (ABN 39 119 387 801, "M2x", "we", "us") provides fitness coaching, training programs, and the M2x MuscleLab training and nutrition app to members in Australia and internationally. This policy explains what personal information we collect, why, and what we do with it.

We handle personal information in line with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).

Where it's lawful and practicable, you can deal with us anonymously or under a pseudonym, for example when making a general enquiry. We can't provide coaching, programming or app access without identifying you, because those services depend on tracking your individual training over time.

Depending on how you use M2x, we may collect:

• Identity and contact details: name, email address, mobile number.
• Account and membership data: your membership tier, program access, and community activity on Skool.
• Health and fitness data: workout logs, sets, reps and weights, body measurements, nutrition and macro logs, and progress photos if you choose to add them.
• Payment information: subscription payments are processed by Skool and its payment processor, not by us directly. We don't store your card details.
• Communications: messages you send us via the contact form, email, or SMS, and any enquiries about programs or support.
• Signal Read answers: if you take the Signal Read assessment, your name, email address and your answers about training, recovery, nutrition and mindset, plus the scores and result we work out from them.
• Website and usage data: pages you visit on m2xfit.au, links you click, how you arrived (for example a link from Instagram, including any campaign tags in that link), your approximate location (country, state and city, worked out from your IP address; never your precise location), and basic technical data (device, browser). We link this to a random visitor ID stored in a cookie, not to your name, unless you later give us your details through the Signal Read or a form.
• App usage data: when you use the MuscleLab app, we record when you open it, how long you use it, which screens you visit, and whether you opened it from your home screen. This is linked to your account and kept in our own systems; no third-party analytics service is used.

Health and fitness information, including body measurements and progress photos, is sensitive information under the Privacy Act. Sensitive information attracts higher protection, and we only collect it with your consent.

By entering training, nutrition, measurement or photo data into the MuscleLab app, you consent to us collecting and handling that information for the purposes described in this policy: delivering your programming, tracking your progress, and providing coaching.

You can withdraw that consent at any time by contacting us, though doing so may mean we can no longer provide personalised programming or coaching. You're never required to add progress photos or body measurements to use M2x.

• To create and manage your account and deliver the training programs, app, and coaching you've signed up for.
• To personalise your programming and track your progress over time.
• To send you service-related communications: session reminders, program updates, and responses to enquiries.
• With your consent, to send SMS training reminders and marketing communications. You can opt out of marketing at any time, and every marketing message includes an unsubscribe option.
• To improve M2x, by understanding what's working and what isn't.
• To see how members use the app, and to check in by email if you haven't used it for a while. You can unsubscribe from those emails at any time.
• To understand which posts, pages and ads bring people to M2x, and to show M2x ads to people likely to be interested, including people who have already visited the site.
• To meet our legal and accounting obligations.

We do not sell your personal information, and we do not use your health or training data to train third-party AI models.

The MuscleLab app uses your logged training data to calculate progressions, estimated one-rep maxes, and suggested load adjustments within the program you've chosen. These are calculations that support your training, not decisions that affect your legal rights or entitlements, and a coach reviews programming changes that matter.

If you'd like a human review of anything the app has calculated, contact us and we'll look at it personally.

We don't sell your personal information. We share it only where necessary to run the service, with:

• Skool: hosts our community and processes subscription payments.
• Supabase: hosts the MuscleLab app's database, including your training and nutrition data.
• Resend: delivers transactional emails (confirmations, digests, support replies).
• ClickSend: delivers SMS training reminders, if you've opted in.
• Cal.com: handles coaching call bookings, including your name, email and appointment details.
• Meta (Facebook and Instagram): measures and targets our ads using website activity, as described in Cookies and analytics.
• Vercel: hosts the website and our customer management dashboard, and provides website traffic analytics.
• Anthropic: generates the personalised written section of your Signal Read result from your first name and assessment answers. Anthropic doesn't use this data to train its models.
• Render: runs our customer management system, which stores Signal Read leads and website activity. Its database is hosted by Supabase and its dashboard by Vercel.

Apart from Meta, which also uses website activity for its own advertising services under its own policy, these providers only process your data to provide their service to us and aren't permitted to use it for their own purposes. We may also disclose information if required by law.

Some of the providers above store or process personal information outside Australia. This means your information, including sensitive health and fitness data, may be held overseas.

Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, including through the terms of our agreements with them. Under APP 8 we generally remain accountable for how these providers handle your information.

If you'd prefer your information not be disclosed overseas, contact us, though this may mean we can't provide the service.

Your data is stored with reputable cloud providers using industry-standard security practices, including encryption in transit and access controls. No system is completely secure, but we take reasonable steps to protect your information from misuse, loss, and unauthorised access.

If a data breach occurs that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as required under the Notifiable Data Breaches scheme.

The website uses a small number of cookies and similar technologies:

• Essential: needed for the site to work, such as remembering your currency choice on the pricing page.
• Visitor ID (m2x_vid): a random ID we set so we can tell which pages, links and campaigns lead to a Signal Read or a membership. It lasts 90 days and doesn't contain your name or email.
• Vercel Web Analytics: counts page views to show us overall traffic. It doesn't use cookies and doesn't identify you.
• Meta Pixel: code from Meta (Facebook and Instagram) that tells Meta when someone views the site, takes the Signal Read, clicks through to join, or clicks to book a call. Meta uses this to measure our ads and show them to relevant people. We never send Meta your name or email in readable form. When you complete the Signal Read we may send Meta a scrambled (hashed) version of your email address so it can match the visit to an account, without seeing the address itself. Meta handles this information under its own privacy policy.

We don't sell your browsing data.

Your choices: you can block or delete cookies in your browser settings, and the site still works without them. You can control how Meta uses website activity for ads in your Facebook or Instagram settings under Ad preferences, and you can opt out of interest-based advertising at youronlinechoices.com.au.

You can ask us to access, correct, or delete the personal information we hold about you at any time.

To make a request, contact us using the details below. We'll respond within 30 days. If we can't give you access or make a correction, we'll tell you why in writing and explain how you can complain.

If you think we've mishandled your personal information or breached the Australian Privacy Principles, contact us first using the details below. Tell us what happened and what outcome you're looking for.

We'll acknowledge your complaint within 5 business days and give you a written response within 30 days.

If you're not satisfied with how we've handled it, you can complain to the Office of the Australian Information Commissioner:

• Website: oaic.gov.au
• Phone: 1300 363 992

We keep your information for as long as your account is active, plus a reasonable period afterward for legal, accounting, or legitimate business purposes such as tax records. Financial records are generally kept for 5 years as required by Australian tax law.

You can request earlier deletion at any time, subject to any legal retention requirements.

M2x is not directed at children. You need to be 18 or older to hold an M2x membership. If we become aware that we've collected personal information from someone under 18 without appropriate consent, we'll delete it.

We may update this policy from time to time as the business evolves. We'll update the date at the top of this page when we do. If a change materially affects how we handle your information, we'll let you know directly.

Questions about your data or this policy? Get in touchand we'll respond directly.