Privacy Policy
Last Revised: March 2026•GDPR & CCPA Compliant
Commitment to Privacy: We never sell personal data, biometrics, or athlete transformation photos to advertising brokers. All client data belongs solely to the coach and athlete.
1. Information We Collect
We collect information you provide directly when creating accounts, inviting clients, logging workouts, or integrating wearable devices:
- Account Data: Name, email address, password hash, billing credentials (processed via Stripe PCI-DSS Level 1).
- Biometric & Performance Data: Workout logs, exercise tonnage, body weight, RPE ratings, sleep hours, and check-in questionnaires.
- Progress Media: Front, back, and side athlete transformation photos uploaded strictly under coach-athlete permissions.
2. How We Safeguard Sensitive Health Data
All personal metrics and progress media are encrypted using AES-256 at rest and TLS 1.3 in transit. Access is restricted via role-based access controls (RBAC) ensuring coaches only view their assigned athletes.
3. Your Rights Under GDPR & CCPA
Coaches and athletes retain complete rights over their personal records, including:
- Right to access and download a full JSON/CSV data export.
- Right to rectify incorrect physiological metrics.
- Right to erasure ("Right to be Forgotten") deleting all athlete records and uploaded media within 30 days.
4. Contacting the Data Protection Officer (DPO)
If you have inquiries or wish to submit a data deletion request, contact our Data Protection Officer at privacy@upliftapp.com.