data breach response

Any time personal information we hold is seen, taken, changed or lost without permission. For example:

• a coach or client seeing records that aren't theirs, in their own gym or another;
• someone signing in to an account that isn't theirs;
• an email, file or export sent to the wrong person;
• a key or password of ours getting out;
• a breach at a company that handles data for us, such as our host or email service.

• Response lead, one of Trainbase's founders

  What they do

  Runs the response from start to finish. Decides whether a breach is notifiable, and signs off every notice.

• Engineering lead

  What they do

  Stops the exposure, keeps the evidence, finds the cause, fixes it and proves the fix holds.

• The gym's owner

  What they do

  Is told by us if their gym's records are involved. Helps us reach their clients, and tells us anything they know.

• You

  What they do

  Tell us as soon as you suspect something (section 6).

1. Stop it. Close the gap first: revoke a key, sign out a session, switch off an account or take a feature offline. We don't wait to understand a breach before stopping it.
2. Keep the evidence. Save the logs and records that show what happened before anything is cleaned up.
3. Work out what happened. What information was involved, whose, how many people, and whether it's likely to cause any of them serious harm. Health information is treated as likely to cause serious harm unless the facts clearly say otherwise.
4. Decide, within 30 days. If we suspect a breach but aren't sure, we finish this assessment within 30 days of first suspecting it, and sooner wherever we can. The law allows 30 days; we aim to need far fewer.
5. Tell the people affected and the OAIC when the breach is likely to cause serious harm and we haven't been able to stop that harm (section 4).
6. Fix the cause and prove the fix holds. We close an incident when its cause is gone, which can be later than the moment it stops showing.

When: as soon as we can, once we know a breach is likely to cause serious harm. You hear from us while we are still investigating, with what we know so far and what we don't.

Who we tell:

• the OAIC, with a statement in the form it asks for;
• each person affected, directly, by email where we can. If we can't reach everyone directly, we publish the statement on our website and take reasonable steps to make it known;
• each affected gym's owner, at the same time or sooner, so they can support their clients.

What the notice says:

• who we are and how to contact us;
• what happened, and when;
• what kinds of information about you were involved;
• what we've done about it;
• what we recommend you do, if anything.

If we act quickly enough that no one is likely to be seriously harmed, the law doesn't require a notice. We may still tell you, and we will tell the gym's owner.

If a company that handles data for us has a breach that involves our customers, we treat it as our own and follow these same steps. Where it is also notifiable for that company, we agree between us who notifies, so you get one clear notice, not two confusing ones.

If you think personal information in Trainbase has been exposed, email hello@trainbase.io with "Security" in the subject line, straight away. Tell us what you saw and when. Please don't share it anywhere else while we look into it.

• We look back at every breach, notifiable or not, and ask how our own systems let it happen, so the same gap can't open twice.
• We keep a record of every suspected breach, what we found and what we decided, even when we decide it isn't notifiable.
• If the review changes how Trainbase works, we update the affected pages and their effective dates.