DRAFT PRIVACY POLICY

PRIVACY & DATA HANDLING

How EARN plans to handle coaching enquiries, training records and athlete information.

DRAFT — NOT YET APPROVED FOR LIVE USEThis page is a working draft. EARN must confirm business contact details, hosting/data practices and the final terms before accepting paid memberships or handling athlete health information. Obtain appropriate Australian legal/privacy advice.

Draft 31 October 2026 · Registered business name: EARN. SPORTS METHOD · ABN 38 940 034 610 · Perth, Western Australia

1. Who we are

EARN Sports Method is a registered Australian business name operating from Perth, Western Australia. A dedicated contact email, the legal name of the ABN holder and formal privacy contact details must be added before public launch.

2. What information may be collected

Enquiry stage: your name, contact email, enquiry type, optional primary sport and training goal, and your message. Please do not include medical history or other sensitive health details in the public enquiry form.

If you become an athlete: your contact and membership details; training plans, completed workouts and TrainingPeaks export files; workout duration, pace, heart rate, power, load and related performance measurements; check-in feedback; sleep, recovery, HRV or injury information if relevant and voluntarily supplied; coach observations, communications and published reports. Billing records may be processed by a payment provider once selected.

3. Why we use information

To assess coaching enquiries, provide individualised training advice, monitor progress, adjust plans, communicate with you, generate coach-reviewed reports, run the EARN XP and loyalty program, administer billing, meet legal requirements and maintain security.

4. How we obtain and handle training data

Training plans are delivered in TrainingPeaks, where compatible devices and apps may automatically upload completed activities to the athlete's TrainingPeaks account. EARN's separate reporting and XP process uses TrainingPeaks data exported for coach processing, rather than a live EARN–TrainingPeaks integration. Training data and reports may be stored in EARN's separate coaching system. Only authorised coaching and relevant support personnel should have access where needed. The final operating procedures, access controls and storage protections need verification before launch.

5. Sensitive information and consent

Health-related information (including injury, recovery and certain training metrics) may be sensitive information under Australian privacy law. Where required, EARN will request appropriate consent and provide additional information before collecting it. The public enquiry form is not intended to collect sensitive information.

6. Service providers and overseas processing

Website hosting, form processing, email, TrainingPeaks and any future payment or athlete-platform providers may handle relevant information. TO CONFIRM BEFORE LAUNCH: actual providers, hosting locations, whether data is disclosed overseas and, where practicable, the relevant countries. EARN should not promise Australian-only storage unless verified.

7. Retention and deletion

The EARN loyalty/XP ledger is separate from underlying personal training records. Cancelling membership resets EARN program XP and loyalty eligibility; it does not automatically delete all personal information. Training records, reports, communications and billing data will be retained only as reasonably required for legitimate purposes and legal obligations. TO CONFIRM: specific retention periods, backup handling and secure disposal process.

8. Access, correction and complaints

Athletes can request access to or correction of their information and raise privacy concerns through the designated privacy contact once published. EARN will investigate and respond in accordance with applicable privacy law. If unresolved, an eligible privacy complaint may be referred to the Office of the Australian Information Commissioner (OAIC).

9. Security and changes

EARN intends to use appropriate authentication, access controls and data handling safeguards. Those controls must be tested and documented for the actual production environment. This policy will be updated before launch and whenever handling practices materially change.