Privacy Policy

Athlemove ("we", "us", or "our") is a business registered in Ontario, Canada. We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and protect information when you use:

• https://athlemove.com (the “Website”), and
• https://trainer.athlemove.com (the “Trainer Portal”),
• https://client.athlemove.com (the “Client Portal”), and
• https://athl.app (used for short sharing URLs)

Together referred to as the "Services". We refer to the Trainer Portal and the Client Portal together as the "Portals".

The Portals are used by two types of users:

• Trainers - fitness professionals (such as coaches and personal trainers) who use the Trainer Portal to manage clients and deliver training content.
• Clients - individuals who are invited by a Trainer to access the Client Portal in order to view content shared with them and, where available, interact with their Trainer through the Services.

This Privacy Policy applies to both Trainers and Clients, and to visitors of the Website. Where a section applies only to one group, this is noted.

By using the Services, you agree to the collection and use of information as described in this Privacy Policy.

1. Information We Collect

1.1 Account Information

Trainer accounts. When you create a Trainer account, we collect:

• First and last name
• Email address
• Password (stored only in hashed form - we never store plaintext passwords)

You may optionally provide additional profile information such as a business name or profile photo.

Client accounts. Client accounts are created by accepting an invitation from a Trainer. When you accept an invitation, we collect:

• First and last name
• Email address
• Password (stored only in hashed form - we never store plaintext passwords)

In both cases, you may instead sign in using a third-party authentication provider such as Google. When you do, we receive basic profile information from that provider (such as your name and email address) to create or link your account. We do not receive or store your Google password. Your use of Google sign-in is also subject to Google's Privacy Policy.

1.2 Client Profile Data (Entered by Trainers)

As a Trainer using the Trainer Portal, you may store information about your Clients, including names, contact details, demographic information (such as gender and date of birth), training dates, and notes. We refer to this as "Client Profile Data". You are responsible for ensuring you have appropriate consent from your Clients to store their information in the Services, and for the lawful basis on which you process it.

If you are a Client, the Client Profile Data your Trainer maintains about you is managed by that Trainer in their Athlemove account. Athlemove processes this data on behalf of your Trainer. The account-level information you provide directly when accepting an invitation and using the Client Portal (such as your login credentials and self-managed profile information described in Section 1.1) is processed by Athlemove as controller.

1.3 Content and Training Data

We collect and store content that users create or submit through the Services, including programs, workouts, exercises, notes, workout records, training logs, and communications exchanged between Trainers and their Clients.

Where a Trainer shares content with a Client through the Client Portal, that content is accessible to the Client. Content a Client submits in connection with their Trainer is accessible to that Trainer.

1.4 Billing Information

We use Stripe to process payments for Trainer subscriptions. We store only a reference to your Stripe customer account - we never store credit card numbers, bank details, or other payment credentials. All payment information is handled directly by Stripe in accordance with their Privacy Policy.

Clients are not billed by Athlemove for use of the Client Portal, and we do not collect payment information from Clients.

1.5 AI-Related Data

When you use AI-powered features (such as workout or program generation):

• Your inputs and the generated outputs are processed and stored to provide the feature and to maintain service reliability.
• AI requests are processed using third-party AI providers. These providers may temporarily process data in accordance with their own privacy policies.
• We do not use your data to train our own AI models.

1.6 Location Data

We use IP geolocation to determine your approximate country.

On the Website, the country signal is provided by Cloudflare, our edge network provider, derived from the IP address of the incoming request and made available to our servers as a country code only (see Section 1.7). It is used to tailor your experience - for example, to display the appropriate cookie and privacy notices for your region - and for marketing analytics.

Elsewhere in the Services, IP geolocation is performed entirely on our own servers using a local geolocation database, and your IP address is not shared with a third-party service for this lookup. It is used, for example, to display appropriate units of measurement.

We do not collect or store precise geolocation data.

1.7 Automatically Collected Data

Usage & Activity Data: We log certain actions taken within the Portals (such as creating, sharing, or inviting) along with timestamps, for the purpose of operating and improving the Services.

Security Logs: For security and fraud prevention purposes, we may log information such as IP addresses, browser user-agent strings, and timestamps associated with authentication-related actions, including invitation acceptance and Client Portal sign-in.

Website Analytics: The Website (not the Portals) uses Google Analytics and Microsoft Advertising (Bing Ads UET tag) to collect usage data such as pages viewed, browser type, device information, and conversion events from ad campaigns. These help us understand how visitors find and use the Website and measure the effectiveness of paid acquisition. We do not run analytics inside the Portals.

Error Monitoring: We use Sentry to detect and diagnose technical issues in the Portals and the Website. Sentry may collect technical information including IP addresses, browser details, page URLs, and error stack traces. In some cases, user-identifying information (such as a user ID) may be included in error reports for debugging purposes.

Edge Network & Bot Protection: We use Cloudflare as the edge provider in front of the Website and the Portals. As part of routing every request, Cloudflare automatically processes connection metadata - including IP address, user-agent string, request headers, and TLS information - to provide TLS termination, CDN caching, DDoS mitigation, and Web Application Firewall (WAF) protection. On sign-up, password-reset, and contact forms, Cloudflare's Turnstile is used as a bot-protection challenge. Cloudflare may retain this connection metadata for short periods in accordance with its own privacy policy. We do not use Cloudflare to track individual users across sessions.

1.8 Cookies and Browser Storage

We use cookies, local storage, and similar technologies to support essential functionality such as authentication, and may also use them for analytics and performance purposes.

In addition, our edge provider Cloudflare may set short-lived security cookies on requests to the Website and the Portals, for purposes such as bot management and verifying that a request comes from a legitimate visitor. These cookies are strictly necessary for the security of the Services and cannot be disabled while using them.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Services, including the Client Portal
• Create and manage Trainer and Client accounts
• Enable Trainers to manage their clients and share content with them
• Enable Clients to access content shared with them by their Trainer and, where applicable, to interact with their Trainer through the Services
• Process payments and manage Trainer subscriptions
• Generate AI-powered content and features
• Store and display content you create
• Personalize your experience (such as displaying appropriate units of measurement based on your location)
• Send transactional emails (such as Client Portal invitations, account verification, password resets, subscription updates, content-sharing notifications, and notifications when a Client account is deleted)
• Monitor, analyze, and improve the performance and reliability of the Services
• Detect, prevent, and address technical issues and security threats
• Comply with legal obligations

3. Data Storage and Processing

Your application data is stored and processed on servers located in the United States. We use cloud infrastructure providers to host and operate the Services.

Requests to the Website and the Portals are first received by Cloudflare's global edge network and routed through the Cloudflare point of presence nearest to you. Cloudflare terminates TLS at the edge and re-encrypts traffic over TLS before forwarding it to our origin servers in the United States. Connection metadata (such as IP address and request headers) is processed by Cloudflare at the edge as described in Section 1.7.

By using the Services, you consent to the transfer and processing of your information as described above, including transit through Cloudflare's global edge and storage and processing in the United States.

4. Sharing of Information

We do not sell or rent your personal data.

We may share information in the following circumstances:

• Between Trainers and their Clients. A Trainer can see information related to the Clients they manage in their account, including Client Profile Data they have entered and any content or activity associated with those Clients in the Services. A Client can see content their Trainer has shared with them through the Client Portal. This sharing is a core function of the Services.
• Service providers that help us operate the Services, including cloud hosting, edge network, DDoS protection, and content delivery, payment processing, email delivery, AI processing, authentication, bot detection, analytics, and error monitoring. These providers are permitted to process data only for their intended purpose.
• When required by law, regulation, or legal process.
• To protect rights and safety - to protect the rights, safety, or property of Athlemove or its users.

5. Content Sharing and Public Access

The Services offer two distinct ways of sharing content:

• Public share links. Trainers can generate unique links to share certain content (such as a single program or workout) outside the Portals. Shared content may be accessible to anyone with the link without requiring an account. A Trainer can revoke access to a public share link at any time and is responsible for the information they choose to share.
• The Client Portal. Trainers can share content with specific Clients through the Client Portal. Content delivered this way is accessible only to the relevant Client after they have signed in to their Client account.

6. Data Retention

• Account data (for both Trainer and Client accounts) is retained for as long as the account is active.
• Content you create (programs, workouts, exercises, Clients, and related records) may be soft-deleted and retained for a period to allow recovery, before permanent deletion.
• Activity and security logs are retained for operational and security purposes.
• AI request logs are retained while the relevant Trainer account is active and deleted upon account deletion.
• Pending Client Portal invitations are retained until they are accepted, expire, or are revoked by the Trainer.
• When a Trainer removes a Client, the corresponding Client account is also permanently deleted from our systems, and the Client is notified by email.

You may request deletion of your account and associated data at any time (see Section 7).

7. Account Deletion

7.1 Trainer Accounts

You may delete your Trainer account at any time through the Trainer Portal. When you do:

• Your account and all associated data (including Client Profile Data, programs, workouts, exercises, files, and AI request logs) are permanently deleted from our systems.
• Any active subscription is cancelled.
• Client accounts that were linked to your Trainer account will lose access to content that was shared by you through the Client Portal.
• If you signed in using a third-party provider such as Google, deleting your Athlemove account does not affect your Google account. You may also wish to revoke Athlemove's access from your Google account settings.
• A confirmation email is sent to your registered email address.

7.2 Client Accounts

You may have your Client account deleted at any time. The simplest way is to ask your Trainer to remove you as a Client - when your Trainer does so, the account-level information you provided directly (such as login credentials and self-managed profile information) is permanently removed from our systems, you will no longer be able to sign in to the Client Portal, and we will send you an email notification confirming the deletion. If you prefer, you may also contact us directly to request deletion of your Client account.

The Client Profile Data your Trainer maintains about you in their own account is under your Trainer's control. To request changes to or deletion of that data, contact your Trainer directly. You may also exercise the rights described in Section 8 with respect to that data.

7.3 Third-Party Records

Third-party services (such as our payment processor) may retain their own records in accordance with their respective retention policies and legal obligations.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict certain processing
• Withdraw consent where applicable
• Request data portability

To exercise any of these rights, please contact us through the Contact Us page on our Website. We will respond to your request in accordance with applicable law.

If you are a Client and your request concerns Client Profile Data managed by your Trainer (see Section 1.2), we may direct your request to your Trainer or work with your Trainer to fulfil it, in accordance with applicable law.

9. Data Security

We implement reasonable technical and organizational measures to protect your data, including:

• Password hashing using industry-standard algorithms
• Encrypted connections (HTTPS) for all data in transit
• Edge protection via Cloudflare, including DDoS mitigation, a Web Application Firewall (WAF), and Turnstile bot protection on sign-up, password-reset, and contact forms
• Secure token-based authentication with automatic rotation
• Rate limiting on sensitive endpoints to prevent abuse
• Single-use, time-limited invitation tokens for Client Portal onboarding

However, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

10. Third-Party Links

The Services may contain links to third-party websites or services. We are not responsible for the privacy practices or content of those third parties. We encourage you to review their privacy policies before providing any personal information.

11. Children's Privacy

Account holders - both Trainers and Clients with Client Portal accounts - must be at least 16 years old. We do not knowingly collect personal data directly from individuals under the age of 16, and Trainers must not invite anyone under 16 to create a Client Portal account.

A Trainer may, however, work with a minor and store information about that minor as Client Profile Data in the Trainer's own Athlemove account, where permitted by applicable law and where the Trainer has obtained the consent of the minor's parent or legal guardian. In that case, the Trainer is the controller of the minor's Client Profile Data and is responsible for complying with all applicable child and youth privacy laws (such as COPPA, GDPR, and equivalent local rules), including any consent, notice, and recordkeeping obligations. The minor should not be invited to the Client Portal.

If we become aware that we have collected data directly from a child in a way that does not meet these requirements, we will take steps to delete it promptly.

12. International Users

Athlemove is operated from Canada, and our Services are hosted in the United States. If you are accessing the Services from outside of these regions, please be aware that your data may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Effective Date" at the top of this page. We encourage you to review this Privacy Policy periodically.

For material changes, we may notify you via email or through a notice within the Services.

14. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us through the Contact Us page on our Website.