Privacy Policy

Vigor Gym is run by Vigor Gym Pty Ltd (ABN 87 637 061 986). In this policy, “we”, “us” and “our” mean Vigor Gym Pty Ltd. This policy explains what personal information we collect, why we collect it, how we look after it and how you can access or correct it. It applies to members, pass holders, guests, people who enquire about joining, and visitors to our website.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. As a fitness centre in Western Australia we also follow the Fitness Industry Code of Practice, which says we only use or disclose your personal information with your written authority, or where the law requires or allows it.

Depending on how you deal with us, we may collect: your name, date of birth, contact details (mobile, email and postal address), gender (you can choose “prefer not to say”) and occupation where our sign-up form asks for them; an emergency contact; your membership or pass details, agreement, start and end dates, freezes and cancellations; your payment details and payment history; your key tag or QR credential and records of when you enter the club; notes about your enquiry, free trial or visit; and messages you send us; your typed name as a signature, and the date, time, IP address and browser details recorded when you sign or give consent online; and, for enquiries made on our website, which advertisement, website or page brought you to us.

When you send an enquiry through our website, we also record how you reached the form: the campaign tags in the link you used (and, within the same visit, the most recent campaign link), any advertising click identifier in those links, the website you came from, the first page you landed on, and whether you used a phone, tablet or computer. We work out the device type from your browser at the moment you send the form and do not keep your browser's full details. Your browser holds the campaign tags only for the length of your visit.

If we check an identity document at the desk, we record that we sighted it. Where we keep the document number, it is encrypted and only authorised staff can view it. We never keep a photocopy or photo of your licence. If you ask us to deal with your NDIS plan, we may record your NDIS participant number, which is also encrypted.

If we take a photo of you for your member profile, we use it only so staff can confirm it is you at the desk and door. We do not use it for facial recognition or marketing.

Before you start training we may ask you some health and pre-exercise screening questions, and whether there is anything our staff should know to help you exercise safely or in an emergency. The law treats health information as sensitive, so we ask for your separate, express consent before we collect it. That consent is a separate step from your membership agreement and is never ticked for you.

Your health answers are encrypted at field level in our system. Front-desk staff only see whether your screening is complete. The detailed answers can be opened only by staff the club has given health access to (by default, the club owner and branch managers for their own branch), and every time someone opens them it is recorded. Health information is never used for marketing, never sent to our analytics or website assistant, and never shared outside the club without your consent unless the law requires or permits it — for example, telling paramedics in an emergency.

You can ask to see or correct your answers at any time. You can withdraw your consent by telling us in writing; we will then stop using your answers. We keep health answers only for as long as we need them for your safety while you are a member and for a limited period afterwards, then remove their contents, keeping only a record that a declaration was made.

Western Australian law requires a parent or guardian to sign the membership agreement for a member under 18. We collect the parent's or guardian's name, relationship, contact details and signature, and we record their acceptance on the member's behalf. A parent or guardian may ask for information we hold about their child; we will consider the young person's own privacy where they are old enough to make their own decisions. Where a young person is old enough to make their own privacy decisions, we may also ask for their own consent, especially for health information.

We collect most information directly from you: at the front desk, on a sign-up tablet at the club, through a sign-up link we send you, through enquiry and booking forms on our website, by phone, email or social media, and when you use your key tag or QR code at the door. We may also receive information from your parent or guardian, from a member who referred you (only with that member's knowledge), or from our previous membership software when we move member records to our new system.

We use your information to: set up and manage your membership or pass; let you into the club and keep a record of entries; take payments and send receipts; keep you and others safe, including contacting your emergency contact if needed; respond to your enquiries and book tours or trials; send you service messages about your membership (for example payment notices, changes to opening hours, or cancellation confirmations); handle complaints; meet our legal obligations, including tax and record-keeping; and improve our club and website.

We also use how often you visit (recorded when you check in at the front desk or use your key tag or QR code at the door) to help our team notice when a member may need a hand, for example to call or email you if you have not been in for a while. This produces a simple internal 'engagement' indicator that only our staff see. It does not change your price, your access or your contract, and no person is refused anything because of it. If you would rather we did not contact you in this way, tell us and we will stop.

If you do not give us the information we need, we may not be able to provide a membership or certain services. We send marketing only with your consent (see “Marketing messages”).

Vigor Gym is open 24/7 to members with a key tag. Each time a key tag, card or QR code is used, our door access system records whose credential it is, the date and time, which door, and whether entry was allowed or refused. We use these records to control entry, protect members and the club, investigate incidents, understand how busy the club is, and answer your questions about your visits.

We keep access records linked to you only for a limited period — we aim for around 13 months — after which the link to you is removed or the records are deleted. Where an entry is also part of a class booking, a personal-training session or a staff time record that we keep for its own purpose, that record continues to refer to the entry. Records of staff overriding a refused entry, or of emergency door modes, are kept with our audit records.

CCTV operates at Vigor Gym, including on the training floor, at the entrances and, where cameras cover it, in the car park area. Signs are displayed to let you know. Cameras are not placed in toilets, showers or change rooms, and the club's cameras are not used to record conversations.

We use CCTV for security, for the safety of members, guests and staff (including during unstaffed hours), to investigate incidents, and to protect property. We do not use footage for marketing.

Footage is kept for a limited period and is then overwritten, unless we need it to investigate an incident or a claim, or the law requires us to keep it or give it to police or another authority. Only authorised staff can view footage.

You can ask us about footage of yourself by emailing info@vigorgym.com.au with the date, time and place. We will consider your request under the Privacy Act. We may need to limit what we provide — for example by blurring or withholding images — to protect other people's privacy, or where the law allows us to refuse, and we will tell you why.

Today, memberships and passes bought online are processed through ClubFit, our current membership and billing provider. If you enter card or bank details on ClubFit's pages, they are handled by ClubFit and its payment partners under their own terms.

As we move to our own system and our own bank's direct debit service, bank account details you give us for direct debit are sealed (encrypted at field level) the moment they are captured. Only a small number of named parts of the system can open them, and only to send your debits to our bank. Staff normally see only a masked version. We do not store card numbers in our systems — card payments are handled by the payment provider or the bank's terminal.

We keep your Direct Debit Request and its acceptance record, as banking rules require, for at least seven years after your last debit.

We share personal information only as needed to run your membership and our business, with: Byalitech, which provides our website and membership management system; our hosting, database, email and storage providers listed below; ClubFit and its payment partners while we still use them; our bank, for direct debits and payments; our professional advisers such as accountants and lawyers; and, if your account remains unpaid after we have contacted you, a debt collection agency.

We may also disclose information where the law requires or allows it — for example to police or emergency services, or to respond to a court order. We do not sell your personal information.

Our member database is hosted by Neon in Sydney, Australia. Our website and system run on Vercel, with our servers in Sydney, and public website images are stored in Vercel's Sydney storage. When we start storing private files (such as member photos or uploaded documents), they will be kept in Amazon Web Services' Sydney region. Neon and Vercel are United States companies and may access or process technical data, such as server logs, from the United States.

Some of our providers are based overseas, so your information may be accessed or held outside Australia: Resend (United States) delivers our emails and keeps delivery records in the United States; Anthropic (United States) processes questions typed into our website assistant, if it is switched on; Google (United States) serves the map on our website; Cloudflare (United States; its network operates worldwide, so the check may be handled outside Australia) runs the spam check on our member portal sign-in page; and, if we switch on website analytics, PostHog stores analytics data in the region we choose (the United States or the European Union), which we will name here when analytics is turned on. Health information and bank account numbers are not sent to any of these providers.

When you first visit our website, a small bar lets you choose “Accept” or “Only necessary”. We store one necessary cookie to remember your choice (for six months). Sign-in cookies are used only if you log in to a staff or member area.

If we use PostHog website analytics, before you choose it does not use cookies or browser storage — it counts page views and forgets your browser when you leave, although, like any website, it receives your IP address and browser details with each page view. Only if you choose “Accept” does it use cookies and browser storage to recognise a returning visitor. We do not use it for session recordings or advertising, and it respects “Do Not Track”. We also use Vercel Speed Insights, which measures how quickly our pages load without using cookies.

Where our website shows a Google map, Google may receive your IP address and browser details when the map loads. Our member portal's sign-in page uses Cloudflare Turnstile to check that a request for a sign-in code comes from a person, not a bot. When you ask for a code by e-mail, Cloudflare receives your IP address and technical details of your browser and device, and our server sends Cloudflare your IP address to check the result. Cloudflare also uses this information to improve its bot detection.

If our website shows an “Ask us anything” assistant, your question is sent to Anthropic in the United States to produce an answer from our own website content. We keep the question, the answer and the page you were on for up to 12 months so we can improve our information; we do not ask for your name. Please do not type personal, health or payment information into the assistant. It cannot see your membership details.

We send news and offers by email or SMS only if you have given consent, using a separate box that is never ticked for you. We keep a record of what you agreed to and when. Every marketing message identifies us and includes a free, simple way to unsubscribe without logging in, and we act on unsubscribe requests within five working days. Unsubscribing from marketing does not stop service messages about your membership.

We keep a short staff note when we contact you about your membership (for example that we called you and what we discussed). Please do not tell us health details you would rather we did not record. We use website visit and campaign tags (such as the page you came from) only to see which of our own campaigns bring in enquiries; reports contain totals, not your name. Records of messages we send are kept for 24 months, after which the address and content are removed. Your marketing consent and unsubscribe records are kept for as long as we need them to show we acted with your permission, and the e-mail addresses on our 'do not email' list are kept so we never write to them again.

If you have agreed to marketing messages, we may also send you a greeting on your birthday (we use only the day and month, never your age) or on the anniversary of the day you joined. We do not send marketing messages to members we know to be under 18.

Some decisions are made automatically by computer systems — ours, and those of the providers we use for door access and billing. The door system decides in real time whether to let a key tag or QR code in, using your membership or pass status, start and end dates, any freeze, which club your membership covers, the status of your key tag and, where the club has switched this on, whether payments are overdue. Our sign-up system uses your date of birth to send applications for people under 18 to the front desk for a parent or guardian. Our billing system may automatically retry a failed payment, add a dishonour fee shown in your agreement summary, send payment reminders and overdue notices, pause access after repeated failed payments, and — where an account stays unpaid past the limits set in our collection policy — refer it to a debt collection agency and end the membership.

Staff can review a refused entry at the desk. If you think an automatic decision about you is wrong, contact us and a person will look at it.

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access or disclosure. These include: encryption of sensitive fields such as health answers, bank details and identity numbers; data hosted in Australia; separation so one club can never see another club's data; staff access limited by role and branch; sign-in protection including two-step verification where switched on; and records of who viewed or changed sensitive information.

We keep personal information only as long as we need it, then delete or de-identify it. As a guide: if an enquiry or form you send through our website does not lead to a membership, then once it has had no activity for 24 months we remove your name, email address, phone number, answers and any notes from it, and we clear any details we had filled in on a sign-up link for you. We keep only a bare record that an enquiry arrived (its date, the form or page it came from, the campaign tags and the stage it reached) so we can count how our own campaigns perform. If you gave a marketing consent or unsubscribed when you sent the enquiry, that record is kept separately, as described under “Marketing messages”, and it still shows which form it was given on. We remove or anonymise the records of finished follow-up tasks and automations 24 months after they end, and we empty staff notes about contacting you 24 months after the contact. Website assistant conversations are deleted after 12 months; unfinished online sign-ups after 72 hours; and rejected or withdrawn online applications have their personal details removed after 30 days.

Member records are de-identified seven years after your membership ends, because tax law and the banking rules for direct debits require us to keep payment and direct debit records for up to seven years. Payment, receipt and tax records are kept for seven years. Records of your marketing consent and of what you agreed to are kept as evidence for as long as we need them to show we acted with your permission.

You can ask for a copy of the personal information we hold about you, or ask us to correct it, by emailing info@vigorgym.com.au or asking at the front desk. We will need to confirm your identity first. We aim to respond within 30 days and do not charge for making a request. If we refuse a request, we will tell you why in writing and how to complain. Some records, such as payment and agreement records, must be kept by law even if you ask us to delete them — we will explain what we keep and why. If we do not agree to correct your information, you can ask us to attach a statement to it saying you believe it is wrong, and we will do so.

If we suspect a data breach, we act quickly to contain it and assess it within 30 days. If a breach is likely to result in serious harm, we will notify the people affected and the Office of the Australian Information Commissioner, and tell you what happened, what information was involved and what you can do to protect yourself.

If you have a concern about how we have handled your personal information, please contact our privacy officer at info@vigorgym.com.au. We will acknowledge your complaint, investigate it and aim to give you a response within 30 days. If you are not satisfied, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Privacy Officer, Vigor Gym Pty Ltd (ABN 87 637 061 986) · 1885 Albany Highway, Maddington WA 6109 · Email: info@vigorgym.com.au · Phone: +61 8 6183 7804.

We may update this policy when our practices or the law change. The latest version is always on this page, with the date it was last updated. If a change affects how we use information we already hold about you in a significant way, we will tell you directly.