Legal

Privacy policy

Last updated 30 September 2026

This policy explains what personal information The Rory Coleman Method (“RCM”, “we”, “us”) collects, why, who sees it, how long we keep it, and the choices you have. It covers this website, our coaching app, our emails and messages, and the optional connections to Strava and Intervals.icu.

The short version

• We collect what we need to coach you, or to talk to you about being coached or becoming a coach.
• Health details (heart rate, weight, sleep, mood, pain and injuries, check-in answers) are kept only if you say RCM may keep them, one kind at a time. You decide separately which of them your coach may see. You can change your mind in the app at any time.
• Your plan, and whether you’ve logged your sessions, are seen by your coach and by RCM’s head admins. Your health details are seen only by you and, for what you choose to share, your own coach. Other athletes never see anything of yours.
• We never sell your information, and we never use it to show you other companies’ advertising.
• Strava is optional. What it sends is shown to you, and your coach sees only the runs you confirm, as you agree when you connect. Disconnecting deletes everything Strava sent us.
• You can see, download, correct or delete your information. Ask us at rory@therorycolemanmethod.co.uk.

1. Who we are

The Rory Coleman Method is a way of coaching endurance runners, and RCM is the organisation that runs this website and the coaching app. Our coaches are trained and certified in the RCM method. When we say “your RCM coach”, we mean the RCM-certified coach assigned to you. They use our app to coach you, and follow this policy when they do.

RCM is the “controller” of your personal information under UK data protection law (the UK GDPR and the Data Protection Act 2018).

Contact: rory@therorycolemanmethod.co.uk · 106 King’s Road, Pontcanna, Cardiff, CF11 9DD, Wales, UK

2. What we collect, and why

When you visit the website

We count visits with Vercel Web Analytics, which records pages viewed, referring sites, and your rough location and device type. It uses no cookies and doesn’t identify you. On the public website we also use Google Analytics, which sets cookies only if you accept them (see Cookies below); if you don’t, it receives only basic page visits without any cookie. We don’t use Google Analytics inside the app, and never for advertising. Our hosting provider also keeps short-lived technical logs, including IP addresses, to keep the site secure and working.

When you apply for coaching

The application form asks for your name, email, phone number and country, and about your running: experience, weekly distance, longest ultra, current injuries, goals, target event and why now. We also record the IP address and browser you applied from, to stop spam and fraud. We use your application to decide whether and how we can coach you, and to get in touch about it. We only send you marketing if you tick the box to agree.

When you respond to one of our adverts

If you fill in a form in one of our Facebook or Instagram adverts, Meta passes us what you entered: typically your name, email, phone number and your answers to a few short questions. It also tells us which advert you responded to. The details reach us through Zapier and Google Sheets. We use them to contact you by email, phone or text about the coaching or coach certification you asked about.

When you join a webinar or our email updates

We keep the name and email you register with, and whether you attended. We send emails through Resend, which tells us whether an email was delivered, opened or clicked. We use that to avoid emailing people who aren’t interested, and to stop immediately if an address bounces or someone unsubscribes. Every marketing email has an unsubscribe link.

When you’re coached in the app

If you’re an RCM athlete, your account holds:

• your name, email, phone number (optional), time zone, units and profile photo (optional), and when you confirmed you’re 18 or over;
• your training plan and heart-rate ceiling, as your coach writes them, and your race and goals;
• what you log after each session: distance, time, elevation, how hard it felt, how it went, notes, and any pain or niggle you report;
• daily check-ins you choose to fill in: weight, resting heart rate, heart-rate variability, sleep, mood, soreness and hydration;
• weekly check-ins, pain reports you send your coach, and meals and fuelling you choose to log;
• what your coach writes for you: weekly reviews, comments on your sessions, and replies to your pain reports;
• your consent choices: what you agreed to, the exact wording, and when.

Your coach can also keep private notes about you, and a coach who hands you over to another coach can leave them a note. You don’t see these in the app, but they are yours to ask for, and they are included when you download your data.

We use all of this to coach you: to write and adjust your plan, spot injuries early and keep you on track. Who can see which part is set out in section 4.

If you connect Strava (optional)

If you connect your Strava account, Strava sends us the activities you record: the type (run, walk, ride), date and time, distance, moving and total time, elevation, heart rate, cadence, pace for each kilometre, your laps, the device you used, the title and any notes you gave it, and whether you keep it private on Strava. We ask Strava for read-only access. We never post to Strava, and we never collect your GPS routes or maps.

• Each run is matched to the session in your plan it most likely was. Nothing goes into your training log until you confirm it.
• When you connect, you give RCM permission for your RCM coach, and RCM’s head coaches who oversee coaching, to see your Strava runs in full as part of coaching you: distance, time, pace, heart rate, elevation and the detail of each run (the recording through the run, splits, laps and Strava’s extra figures), whether you have confirmed it or not, including your earlier history. You can’t connect without giving it, and you can withdraw it at any time by disconnecting. Other RCM staff don’t see your Strava runs.
• If you connected before this permission was worded this way, your coach sees only the runs you confirm, with their distance, time, heart rate and elevation, and head coaches don’t see them, until you reconnect.
• Your own notes on a run and your effort rating on Strava are never shown to your coach or anyone else at RCM, and neither are runs you keep private on Strava (visible only to you).
• We never combine Strava data with data from your other sources: it is used only to show you your runs, with an overview of each and your trends over time, to show your coach the runs you allow them to see, and to fill in your own log. If you connect Intervals.icu or upload files from your watch, Strava is paused while you use them, and the Strava runs waiting in the app are deleted.
• RCM keeps a copy of your Strava activities, including the history already on Strava when you connect (distance, time, pace, heart rate, elevation, and splits and laps for runs brought in as they happen), so your progress can be tracked over time. For runs brought in as they happen we also keep the recording (heart rate, pace, cadence, altitude and the watch’s temperature through the run, never the route) and Strava’s extra figures (such as calories, best efforts and the shoes you picked). We keep them while you stay connected.
• RCM writes a short overview of each run from the plan with its own fixed rules. No AI ever reads your Strava data.
• Disconnecting, from the app or from Strava’s own settings, revokes our access and deletes everything Strava sent us, including the Strava figures in your log. Anything you typed yourself stays.

Strava’s own use of your data is covered by Strava’s privacy policy.

If you connect Intervals.icu, or upload files from your watch (optional)

Intervals.icu is a training service run by Intervals.icu Ltd in London. Many watches, including Garmin, send it your activities. If you connect it, it sends us the activities your watch records: the type, date and time, distance, moving and total time, elevation, heart rate, cadence, laps, the device, and the second-by-second recordings of heart rate, pace, cadence, altitude and temperature. We also read your Intervals.icu account settings, to check which devices send it your activities and whether the account is still in use. We don’t read the daily wellness figures Intervals.icu may hold (such as resting heart rate, heart-rate variability, sleep or weight); if we add that, it will be a separate choice you make in the app. We never collect GPS routes. Your connection also lets us add planned sessions to your Intervals.icu calendar; we’ll tell you in the app before we start doing that.

You, or your coach for you, can also upload activity files (.fit, .tcx or .gpx) from your watch. We read the same kinds of figures from them, and keep the file itself so it can be read again. A file from your watch can contain your GPS route: we don’t read, show or pass it on.

• Connecting, or uploading, is your consent for RCM to store those activities. To withdraw it, disconnect Intervals.icu, or ask us to delete the files you uploaded: the storage choices in Settings, Privacy & sharing don’t cover these activities. Whether your coach sees them, and their heart rate, is a separate choice you can change there at any time (section 3).
• From your activities, RCM works out training readings: how well you kept under your heart-rate ceiling, how your pace and heart rate held up over a long run, your training load, and similar. They are worked out automatically from your own data, never from Strava’s. While we check that a new kind of reading is right, your coach may see it before you do. Your readings are included when you download your data.
• Disconnecting Intervals.icu stops anything new arriving and tells Intervals.icu to remove our access; you can choose to delete the activities it sent at the same time. To have uploaded files deleted, ask us.

Intervals.icu’s own use of your data is covered by its own privacy policy.

If you apply to become an RCM coach

We keep your contact details and your answers about your coaching experience and capacity. We also keep notes of our calls and emails with you, and the time of any call you book. We use this to assess your application and, if you’re certified, to set up your coach account.

Payment

You don’t pay inside the app. We invoice separately and keep the billing records the law requires.

3. Health information, and your consent

Much of what you record in the app is health information: heart rate, heart-rate variability, weight, sleep, mood and soreness, pain and injuries, what you eat and drink, and your answers to check-ins. The law gives it extra protection, and we only keep and use it with your explicit consent. Recording something is not consent on its own: the app asks you.

• One kind at a time, before you first record it. Before your first daily check-in, weekly check-in, food entry or session log with distance, time, effort or notes, the app asks about that kind of information. It is never bundled into signing up, and nothing is ticked for you.
• Two separate choices. For each kind, “RCM may store this”, and “my coach may see this”, which names your coach. Your coach can only see what RCM stores.
• What’s needed and what’s optional. Pain reports and the health questionnaire are needed for coaching: without them your coach can’t coach you safely, and if you’d rather not share them we’ll talk to you about whether coaching can carry on. Everything else is optional, and coaching carries on if you say no. The app says which is which.
• Pain reports carry their own consent. Every time you report pain or a niggle, the form shows a statement naming your coach, which you tick to send it. That report then reaches your coach; no other setting can stop it. You can withdraw a report after sending it, and your coach then stops seeing it. We keep a withdrawn report; ask us if you want it deleted. Ticking the statement, on a report or on a session log where you note pain, also lets your coach see the pain you note on your session logs, and reports you sent before they were your coach. You can stop that in Settings, Privacy & sharing; ticking the statement again shares it again.
• Changing your mind. In the app, Settings, Privacy & sharing shows every choice and lets you withdraw it in one tap. Stop sharing, and your coach stops seeing it straight away. Stop RCM storing it, and it isn’t recorded from then on; the daily check-in entries of that kind are deleted at once, and for other kinds you can ask us to delete what we hold. Activities from Intervals.icu or files you upload are the exception: they are stored on the consent you gave when you connected or uploaded, so to stop them, disconnect Intervals.icu or ask us to delete the files (section 2). Withdrawing doesn’t affect what we did before.
• A new coach. Your choices to share name your coach. If you move to a different coach, they see none of your health information until you choose to share it with them. Your previous coach can leave them a handover note, which may mention injuries or other health matters; your new coach reads it only once you confirm them as your coach in the app.
• Information recorded before we asked. If you recorded something before the app asked for consent, the app asks whether RCM may keep it. Say no and it’s deleted straight away; until you say yes, your coach doesn’t see it.
• Only for coaching. We use health information only to coach you and keep you safe, never for marketing, and we never sell it.

4. Who can see your information

• You see everything in your account.
• Your coach sees your plan, your sessions and whether you’ve logged them, and which kinds of health information you’ve chosen to share. They see the health information itself only for the kinds you share with them by name, and every pain report you send them. From Strava, they see only what you allow when you connect it (section 2).
• RCM’s head admins run the service. They see your plan, your coach, your sessions and whether you’ve logged them, whether your connections are working, and which kinds of information you’ve chosen to share, but not your health information itself, unless they are your coach.
• Support. To fix a problem, an RCM admin can view the app as you. Every time they do, it’s recorded. While they do, they can’t give, refuse or withdraw consent for you.
• Nobody else in the app. Our database rules stop other coaches and other athletes seeing anything of yours.

5. Our legal reasons for using your information

• To coach you, and to run your account: performing our agreement with you.
• Health information: your explicit consent, given in the app for each kind (section 3), together with our agreement with you.
• Replying to an application or an advert form you sent us: taking steps you asked for before an agreement, and our legitimate interest in answering enquiries.
• Marketing emails and texts: your consent, or, if you’re already a client, our legitimate interest in telling you about similar services. You can opt out at any time.
• Security, fraud prevention and site analytics: our legitimate interests in running a safe, working service.
• Billing records: our legal obligations.

6. Who we share it with

We never sell your information. Beyond your coach (section 4), we share it only with the service providers who run parts of the service for us. They act on our instructions and must keep it secure:

• Supabase: our database, file storage and sign-in, hosted in the EU (Ireland), and the functions that receive and process data from your watch.
• Vercel: website and app hosting (servers in Dublin, Ireland) and website analytics.
• Google (Analytics): measuring visits to the public website.
• Resend: sending email.
• Twilio: sending text messages, where we use them.
• Zapier and Google (Sheets): passing advert enquiries to us.
• Meta: running our Facebook and Instagram advert forms.
• Zoom: running webinars.
• Cal.com: booking calls.

Strava and Intervals.icu are services you choose to connect: we receive data from them as described above, and tell them only what they need to send it to us. We’ll also share information if the law requires it, or to protect someone’s safety.

7. Information that leaves the UK

Some of these providers are based in, or use services in, the United States. When your information goes outside the UK, we rely on the protections the law requires: the UK Extension to the EU–US Data Privacy Framework, or the UK’s International Data Transfer Agreement or Addendum. Email us for details.

8. How long we keep it

• Enquiries and applications that don’t go further: 24 months from our last contact, then deleted.
• Your coaching account and training history (logs, check-ins, activities from your watch, readings, reviews, comments and your coach’s notes): while you’re coached, then 2 years after coaching ends, so you can come back to it. After that it’s deleted, unless you ask us to delete it sooner.
• Pain reports, including ones you’ve withdrawn: while you’re coached and for 2 years after, unless you ask us to delete them sooner.
• Your consent choices: for as long as we hold the information they cover, and afterwards for as long as we may need to show what you agreed to.
• Strava activities and the Strava figures in your log: while you stay connected. Disconnecting deletes them.
• Email delivery records: 24 months.
• Unsubscribe requests: kept for as long as we send email, so we never email you again by mistake.
• Billing records: 6 years, as tax law requires.

9. Your rights

You can ask us to:

• give you a copy of the information we hold about you. In the app you can download it yourself, from Settings: it includes your coach’s notes about you, your readings and your consent choices;
• correct anything that’s wrong;
• delete your information, or your whole account (you can ask from Settings in the app);
• restrict how we use it, or object to our using it;
• send it to you, or to another service, in a common format;
• stop marketing to you. Every email has an unsubscribe link, or just tell us.

Where we rely on your consent, you can withdraw it at any time: for health information in the app (section 3), or for anything by emailing rory@therorycolemanmethod.co.uk. We’ll answer within one month.

Complaints. If you’re unhappy with how we handle your information, tell us at rory@therorycolemanmethod.co.uk. We’ll acknowledge your complaint within 30 days, look into it, and tell you what we’ve done. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

10. Cookies

These cookies are needed for the site to work:

• Sign-in: keeps you logged in to the app. It lasts for your session and is renewed while you use it.
• Language (rcm_locale): remembers the language you chose, for up to a year.
• Theme (rcm_theme): remembers whether you chose the light or dark look in the app, for up to a year.
• Strava connection (strava_oauth_state, strava_share_consent): used only while you connect Strava, and gone within 10 minutes.
• Intervals.icu connection (intervals_oauth_state, rcm_source_storage_consent, rcm_pause_strava): used only while you connect Intervals.icu, and gone within 10 minutes.
• Support access (rcm_impersonation): set only for an RCM admin viewing the app as an athlete, for up to 12 hours.

With your permission only, on the public website: Google Analytics cookies (_ga, _ga_*), which tell us how visitors use the site, for up to two years. We ask the first time you visit and remember your answer in rcm_analytics for six months. To change your mind, clear this site’s cookies and you’ll be asked again. We use no advertising cookies.

11. Keeping it safe

Your information is encrypted in transit and at rest. Access is limited to the people who need it, and our database rules stop one athlete from ever seeing another’s data, and a coach from seeing health information you haven’t shared with them. The keys that connect Strava and Intervals.icu are kept on our servers, where only our own systems can read them, and are never sent to your browser. Data from your watch is received and processed by our database provider, not by the website’s servers.

12. Children

Our coaching and this website are for adults. We don’t knowingly collect information from anyone under 18. In the app you confirm you’re 18 or over when you set your password or, at the latest, before you give any consent about your health information.

13. Changes to this policy

When we change this policy we’ll update the date at the top. If the change is significant, we’ll tell you by email or in the app. If the wording you consented to changes, the app asks you to confirm it again.

Questions: rory@therorycolemanmethod.co.uk · Back to the home page