Privacy Policy

Two groups of people use FitStrand, and our role differs for each:

• Organizations and their staff — gym owners, admins and trainers who create an organization account and use the platform to run their business. We handle this information as the business we contract with.
• Members — clients invited into an organization by that organization. We handle member information on behalf of the organization that invited them; the organization decides who is invited, what is entered, and how the information is used in their coaching.

• Account information — name, email address, password credentials handled by our authentication provider, organization name, role (owner, admin, trainer or member) and organization branding such as a logo.
• Organization-provided member data — information a gym uploads or enters about its clients, including names, email addresses and any list imported through the bulk member import feature.
• Training and health-related content — workouts and programs, completed sessions, exercise logs, nutrition targets and food logs, body measurements, progress photos where uploaded, check-ins, goals and similar information entered by a member or their coach.
• Messages and communications — coach-to-member messages, group conversations, announcements and challenge activity.
• AI feature content — the questions members send to the in-app AI coach and the plan or activity context used to answer them.
• Subscription and billing information — organization plan, subscription status, seat usage and billing records. Card details are entered with and held by Stripe, not by us.
• Technical and usage information — basic log and device information generated when the platform is used, and information from analytics or advertising tools where they are enabled.

• To provide, operate, secure and support the platform and the features an organization has enabled.
• To create and manage accounts, invitations, roles, organization membership and access.
• To deliver coaching functionality — programs, workouts, nutrition, progress tracking, groups, challenges and messaging.
• To power AI-assisted features by sending the relevant question and context to our AI service provider to generate a response.
• To manage subscriptions, seat allowances, renewals, cancellations and billing through Stripe.
• To send service and transactional communications such as invitations, password resets and billing notices.
• To investigate misuse, protect the platform and comply with legal obligations.

We do not sell personal information, and we do not use member training or health-related content to advertise to those members.

An organization decides which of its clients are invited to FitStrand and what information is entered about them. The organization is responsible for having the appropriate authority and consent to collect that information, to add a client to the platform, and to use client information for coaching — including where the organization imports an existing client list.

Owners, admins and assigned trainers of an organization can see the member content connected to their coaching. Organizations are responsible for telling their clients how the organization uses this platform.

We rely on third-party providers to run the platform. They receive only what they need to perform their function:

• Supabase — database, authentication and file storage.
• Stripe — subscription payments and billing. Card information is provided directly to Stripe.
• Resend — transactional and invitation email delivery.
• AI model providers — processing of AI coach requests through our AI gateway.
• Hosting, analytics and marketing tools used to operate the platform and our website, including Meta advertising tools where enabled.

These providers may process and store information outside Canada. We do not make any representation about where a given provider stores information at a given time.

• Account and organization records are kept while the organization account is active.
• When a member is removed from an organization, that organization's access to the member is revoked. Historical coaching records such as completed workouts, notes and past messages may be retained as part of the organization's business records.
• When an organization ends its subscription, data is retained for a period to allow reactivation, then deleted or de-identified.
• Billing records are kept as long as needed for financial and legal purposes.
• An organization or an individual may request deletion of information by contacting us at hello@fitstrand.com. Member requests are normally handled together with the organization that holds the relationship.

Subject to applicable Canadian privacy law, you may request access to the personal information we hold about you, ask that it be corrected, or ask that it be deleted. Contact us at hello@fitstrand.com and we will respond within a reasonable time. If you are a member of a gym, we may direct your request to that gym, since it controls your participation.

We use access controls and per-organization data separation designed so that each organization sees only its own information. No online service can be guaranteed to be completely secure, and we make no certification, audit or compliance claim about the platform.

FitStrand is intended for adults. Organizations should not add clients under the age of majority in their province or territory without appropriate parental or guardian consent.

We may update this policy as the platform changes. The date at the top reflects the current version, and material changes will be communicated to organization owners.

Questions about this policy or about information held in FitStrand can be sent to hello@fitstrand.com.