Privacy Policy

This Privacy Policy explains how Papawadee Ongworawut, trading as ND Fitness ("We", "Us" or "Our"), collects, uses, shares and protects personal information about clients and people who contact Us, and the rights you have over it.

We are the data controller for your personal information under Thailand's Personal Data Protection Act B.E. 2562 (2019) (the "PDPA"). If you have any questions, please contact Us.

The website

The ND Fitness website at https://ndfitness.info (the "Website") does not use cookies, analytics or any other tracking, and has no forms or accounts. It does not collect personal information from you. See our Cookies Policy for details.

Like every website, it is delivered by a hosting provider, Cloudflare, which processes technical information such as your IP address and browser type in order to deliver the pages and protect the Website from attacks. We do not use this information to identify you.

Information we collect

We collect information when you contact Us, book a session, or train with Us. You give most of it to Us directly.

• Contact details: your name, phone number, email address and LINE name.
• Booking and payment details: the sessions and packages you book, where you train, attendance and cancellations, and records of your payments. We do not collect or store payment card details.
• Health information: your medical conditions, injuries, pain, medications, pregnancy, and any clearance from your doctor or other health professional.
• Fitness information: your goals, assessment results, body measurements, training programs, progress notes and check-in updates, and any food or nutrition information you share with Us.
• Photos and videos: photos or videos of you exercising, taken only with your permission, for example so We can check your technique or track your progress.
• Messages: what you send Us by LINE, phone, email or other channels.
• Emergency contact: the name and phone number of someone We can contact in an emergency, if you choose to give it.

Health information

Health information is sensitive personal data under section 26 of the PDPA, and We handle it with extra care.

• We ask for your explicit consent before We collect health information, usually when you complete Our health questions before your first session.
• We use it only to keep you safe and to design your training: to decide which exercises suit you, which to avoid, and when you need a doctor's clearance first.
• We do not share it with anyone without your explicit consent, except in an emergency where it is needed to protect your life or health and you cannot give consent, or where the law requires it.
• You can withdraw your consent at any time. We will then stop using your health information and delete it, but We may no longer be able to train you safely, and may need to stop sessions until you give Us the information We need.

Body measurements, photos and progress records may also reveal information about your health. We treat them with the same care.

How we use your information, and why

What we use it for	Legal basis under the PDPA
Replying to your enquiries and arranging sessions	Taking steps at your request before a contract
Providing training, Pilates and online coaching, including assessments, programs and check-ins	Performance of our contract with you
Using your health information to train you safely	Your explicit consent
Taking and using photos or videos of you	Your consent
Keeping payment and booking records	Performance of our contract, and legal obligations such as tax records
Contacting your emergency contact or emergency services if you are hurt or unwell	Preventing or suppressing a danger to life, body or health
Sharing your photos, videos or a testimonial on the Website or social media	Your separate, specific consent, given for each use
Protecting Our legal rights in a dispute	Our legitimate interests

We do not use your information for marketing without your consent, and We never sell it.

Who we share it with

We share your information only as needed to provide Our services:

• Messaging, email and storage services that We use to communicate with you and keep records, such as LINE, Our email provider and cloud storage. They process your information on Our behalf.
• Your doctor, physiotherapist or other health professional, only if you ask Us to or give your consent.
• Gyms, condo buildings or studios where you train, only the details needed to give the Trainer access, such as your name and unit or membership details.
• Emergency services and your emergency contact, if you are hurt or unwell during a session.
• Authorities, where the law requires it, for example a court order or tax authority request.

Transfers outside Thailand

Some of the services We use, such as messaging, email and cloud storage providers, may store information on servers outside Thailand. Where this happens, We use providers that protect personal information to the standards the PDPA requires, or rely on your consent.

How long we keep it

• Health and fitness information, photos and videos: while you are a client, and for up to 12 months after your last session or coaching month, so We can pick up where you left off if you return. After that We delete it. You can ask Us to delete it sooner.
• Payment and booking records: as long as Thai tax and accounting law requires, usually up to five years.
• Messages and enquiries from people who do not become clients: up to 12 months.

When information is no longer needed, We delete, destroy or anonymise it.

How we protect it

We keep your information on password-protected devices and accounts, limit access to the Trainer only, and do not discuss your health or progress with other clients or in group chats. Paper forms, if used, are stored securely and destroyed when no longer needed.

No method of storage or transmission is completely secure. If a data breach puts your rights at risk, We will notify the Personal Data Protection Committee and, where required, notify you.

Clients under 20

The age of legal adulthood in Thailand is 20. For clients under 20, We need consent from a parent or guardian before collecting health information or taking photos or videos.

Your rights

Under the PDPA you have the right to:

• Access your personal information and get a copy of it.
• Correct information that is wrong, out of date or incomplete.
• Delete your information, or have it anonymised, when We no longer need it or you withdraw your consent.
• Restrict how We use your information, for example while We check a correction.
• Object to Our use of your information in some circumstances.
• Move your information to another provider in a commonly used format.
• Withdraw your consent at any time. This does not affect what We did before you withdrew it.
• Complain to the Personal Data Protection Committee of Thailand (PDPC) if you believe We have not handled your information lawfully.

To use any of these rights, contact Us. We may ask you to confirm your identity first, and will respond within 30 days.

If you live in the European Union or the United Kingdom, you may have similar rights under the GDPR, and We will respect them in the same way.

Other websites

The Website links to other services, such as LINE. Their own privacy policies apply when you use them.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page shows when it last changed. If We make a significant change to how We use your health information, We will tell current clients directly and ask for new consent where needed.

Contact Us

If you have any questions about this Privacy Policy, or want to use your rights, you can contact Us:

• By email: hello@ndfitness.info
• By LINE: @ndfitness