Privacy & Cookie Policy

 

YTRAX Ltd, trading as MGPhoenix Nutrition & Performance

1. Introduction

YTRAX Ltd (“we”, “us”, “our”), trading as MGPhoenix Nutrition & Performance, is committed to protecting and respecting your privacy.

This policy explains how we collect, use, and protect your personal data in accordance with the Data Protection Act 2018 and UK GDPR.

2. Who We Are

Data Controller: YTRAX Ltd

Trading Name: MGPhoenix Nutrition & Performance

Email: contact@mgphoenixnutrition.com

Address: Available on request

ICO registration number: ZB961461

3. What Information We Collect

Personal Information

  • Name
  • Email address
  • Phone number
  • Date of birth
  • Gender
  • Emergency contact details

Health & Special Category Data

To provide nutrition and performance services, we collect the following health information:

  • Allergies and intolerances
  • Medical history
  • Current injuries and injury history
  • Supplements taken
  • Body composition data (weight, height, body fat, fat free mass)

This data is classified as special category data and is processed only with your explicit consent.

Diet and Training Information

We also collect:

  • Dietary habits
  • Fitness and training-related information
  • Consultation notes, nutrition plans and reports

Children’s Data

Where a client is under 18, we collect the personal and special category data set out above, together with parent/guardian contact details and parental consent records, as set out in our Parent/Guardian Consent Form. For clients under 18, body measurements are limited to height and weight; we do not carry out body fat or other body composition testing with young people. Processing of a child’s data relies on parental consent obtained in accordance with UK GDPR Article 8, in addition to the legal bases set out in Section 5.

Website Usage Data

  • IP address
  • Browser type and version
  • Pages visited
  • Time and date of visits
  • Device information

4. How We Collect Your Data

We collect data when you:

  • Sign up for our services
  • Fill out forms on our website
  • Contact us directly (email, phone, social media)
  • Use our website (via cookies and analytics tools)

5. Legal Basis for Processing

We process your data under the following lawful bases:

  • Contract: To deliver agreed services
  • Legitimate Interests: To manage and improve our services
  • Consent: for marketing communications
  • Explicit consent (Article 9(2)(a) UK GDPR): for processing health (special category) data, which we ask for separately on our Client Consent Form or, for clients under 18, our Parent/Guardian Consent Form (given by a parent or guardian)

You can withdraw your consent at any time.

6. How We Use Your Data

We use your data to:

  • Deliver personalised nutrition and performance coaching
  • Communicate with you about your programme
  • Provide ongoing support and updates
  • Improve our services and website
  • Send marketing communications (only where permitted)

7. Use of AI and Software Tools

We use software and AI-assisted tools to help deliver and administer our services, which may process data as data processors acting on our instructions. These may include tools for evidence-based research and reference (e.g. Consensus AI), scheduling and administration, and document or content preparation. Where any such tool generates a nutrition recommendation, this is always reviewed by a qualified practitioner before being provided to you, and is never delivered as a fully automated decision without human review. No identifiable personal information is shared with AI models.

We only use processors who provide appropriate guarantees around data protection, and we do not permit client personal or health data to be used to train third-party AI models.

8. Data Storage & Security

Your data is securely stored:

  • Client records are held in Microsoft 365 (OneDrive and SharePoint), a cloud service provided by Microsoft, which acts as our data processor. Our account is set up so that your data is stored in the UK
  • Access is limited to the practitioners named on your consent form and is protected by multi-factor authentication
  • Your health information (allergies and intolerances, medical history, current injuries and injury history, supplements taken, and body composition data) is held in separate password-protected files for extra security
  • Any temporary copy kept on a practitioner’s laptop is held on a password-protected device

We implement appropriate technical and organisational measures to protect your data from unauthorised access, loss, or misuse.

9. Data Retention

We retain your data only as long as necessary for the purposes collected. Typically:

  • Adult client records are retained for 6 years after your last interaction, for legal, insurance, and professional record-keeping purposes
  • Where a client was under 18 at the time of engagement, their records, including safeguarding-related records, are retained until their 25th birthday, in line with standard safeguarding record-keeping practice

You may request deletion of your data where legally permissible.

10. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of the breach, where required, and will notify affected individuals directly without undue delay where the breach is likely to result in a high risk to them.

11. Sharing Your Data

We do not sell your personal data. We may share your data with:

  • Coaches operating under YTRAX Ltd
  • Microsoft, our cloud storage provider, acting as our data processor (see Section 8), and AI-assisted software tools acting as data processors (see Section 7)
  • The video-call platforms we use for online consultations are Microsoft Teams and Google Meets. We do not record consultations
  • Payment processors
  • Professional advisors (e.g., legal or accounting)
  • Referral professionals (e.g. GP, dietitian, physiotherapist, psychologist), only with your consent or that of your parent/guardian
  • Statutory agencies (e.g. local authority, police) where required by law or in connection with a safeguarding concern, as set out in our Safeguarding Policy
  • Authorities where required by law

All third parties are required to handle your data securely and lawfully.

12. International Data Transfers

Your client records are stored in the UK in Microsoft 365. Some of our service providers, including Microsoft, may process data outside the UK, for example for technical support or service operations. Where this occurs, we ensure appropriate safeguards are in place, such as UK adequacy regulations, standard contractual clauses together with the ICO’s International Data Transfer Addendum, or the UK Extension to the EU-US Data Privacy Framework for certified organisations in the United States.

13. Your Rights

Under UK data protection law, you have the right to:

  • Access your personal data
  • Correct inaccurate data
  • Request deletion of your data
  • Restrict processing
  • Object to processing
  • Request transfer of your data

We will respond to your request within one month.

Where a client is under 18, these rights may be exercised by a parent/guardian on the child’s behalf, or by the young person directly where they have sufficient understanding to do so.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

14. Cookies Policy

What Are Cookies?

Cookies are small text files placed on your device when you visit a website. They help improve functionality and user experience.

How We Use Cookies

We use cookies to ensure the website functions properly, understand how visitors use our website, and improve performance and user experience.

Types of Cookies We Use

  • Essential Cookies: required for the website to function properly
  • Analytics Cookies: help us understand how users interact with the website (e.g., Google Analytics)
  • Functionality Cookies: remember your preferences and settings

Managing Cookies

You can control or disable cookies through your browser settings. Please note: disabling cookies may affect website functionality.

Cookie Consent

When you first visit our website, you will be asked to consent to the use of non-essential cookies via a cookie banner.

15. Marketing Communications

We will only send marketing communications if you have provided explicit consent, or you are an existing client and have not opted out. You can unsubscribe at any time by clicking the unsubscribe link in emails or contacting us directly.

16. Changes to This Policy

We may update this Privacy & Cookie Policy from time to time. The latest version will always be available on our website.

Last updated: 8th October 2026

17. Contact Us

If you have any questions or requests regarding your data, please contact: contact@mgphoenixnutrition.com

YTRAX Ltd. Company Reg. No. 16285386

MGPhoenix Nutrition & Performance  |  Trading name of YTRAX Ltd, Company Reg. No. 16285386