LEGAL REVIEW REQUIRED. This is an unreviewed first draft prepared for counsel. Do not publish.

Privacy Policy

This describes the system we actually built, not a system a template imagined. If we change the system, this document changes on the same day.

Who holds your data

Four companies, and I will name all of them.

Who	What they hold	Why
Supabase	Your account, your screening answers, your training logs	It is the database and the login system
Stripe	Your payment details	It takes the money. We never see a card number
Resend	Your email address and the emails we send you	It delivers email
Vercel	Server logs, IP address, request data	It hosts the site

That is the whole list at launch. There is no analytics warehouse, no CRM, no data broker, nobody else. {{DECIDE: whether to publish a live sub-processor page and commit to notifying members before adding one}}

What we collect

Because you gave it to us. Your email address. Your display name if you set one. Your equipment path and timezone. Your rescan date if you enter one.

Because you answered the screening. Eight questions. Your T-score band, whether you have fractured in the last two years and the detail if you have, whether you have had a vertebral fracture, any spinal conditions you told us about, your bone medication status, a short list of health flags, whether a doctor has restricted your exercise, and whether you can get up off the floor unaided.

Because you trained. Every set. Weight, reps, RPE, timestamps, which sessions you completed, your technique checkpoints, your benchmarks and your streak.

Because you arrived from somewhere. Which landing page variant you saw, UTM parameters on your first visit, and the time of that first visit.

Because a web server logs things. IP address, browser, pages requested.

The screening answers deserve their own paragraph

Those eight answers are health information about you. Real health information, the kind you would tell a doctor.

We store them because the program cannot be safe without them. Bone density band, fracture history and specific spinal conditions are what determine whether high-intensity loading is appropriate for a given person, which is why the screening gates access rather than just decorating it. They are held in your own row in the database, and Supabase row-level security means your account can read your rows and nobody else's account can.

Two more things you should know. The screening table is append-only, so if you retake it we mark the old answers superseded rather than overwriting them, and we keep the trail. And a very small number of named people on our side can read individual member records through the admin tools, for support and for refunds. {{DECIDE: how many admin accounts, whether admin reads are logged, and whether members are told when their record is opened}}

We are almost certainly not a HIPAA covered entity, since we are not a provider, a plan, or a clearinghouse. {{DECIDE: counsel to confirm HIPAA status and whether any state health-privacy law, such as Washington's My Health My Data Act, applies to us}}

Payments

Stripe handles checkout. Your card number never touches our servers and is never stored by us. What we keep is a Stripe customer identifier and a payment method token, which is what makes the one-click upgrade offer work without asking you to type your card again.

That token can charge your card. It only ever does so when you press a button showing the total. There is no recurring charge on any product we sell.

Email

Resend sends everything: your magic link, the welcome email, the milestone emails, and the rescan reminders.

You can unsubscribe from the lifecycle emails at any time. You cannot unsubscribe from the magic link, because that is how you log in.

Advertising and tracking

Here is the line we drew.

On the public marketing pages, meaning the advertorial, the Doctor Briefing opt-in and the sales page, we run advertising pixels and conversion tracking. {{DECIDE: exact list of ad platforms and pixels, plus whether we run a consent banner or geo-gate consent}}

No ad-network pixel fires on any authenticated route. Once you are logged in and inside the app, no advertising platform receives an event from us. Not your session completions, not your screening tier, not the fact that you were on a page about osteoporosis. That was a deliberate build decision and it is enforced in code, not in policy.

What we never do

We do not sell your data. Not to anyone, at any price, including on a change of control. We do not rent it, trade it, or hand it to a data broker.

We do not send your health answers to an advertiser.

Your control

Two things you can ask for by email, and we will do both:

Export. Everything we hold on you, in a machine-readable file. Screening answers, every set you logged, orders, the lot. {{DECIDE: turnaround commitment, e.g. within seven days}}

Deletion. We delete your account, your screening answers and your training history. Financial records tied to a purchase have to survive for tax and accounting reasons, and Stripe keeps its own transaction record independently of us. So deletion means the health and training data is gone and a payment record remains. I would rather say that plainly than promise a clean wipe I cannot deliver.

Depending on where you live you may also have the right to correct your data, object to processing, or complain to a regulator. {{DECIDE: which of GDPR, UK GDPR, CCPA/CPRA and Australian Privacy Principles apply, based on where we sell, and add the required rights language and regulator contact for each}}

Write to {{DECIDE: privacy contact email address}}.

How long we keep things

Active accounts keep everything, because a strength chart is worthless without three years of history behind it. Dormant accounts {{DECIDE: retention period for inactive accounts and whether we delete or anonymise}}. Server logs {{DECIDE: log retention window, Vercel default is short}}.

Security

Magic link login, so there is no password of yours to leak. Row-level security on every member table. Encrypted in transit and at rest by our providers.

No system is perfectly safe. If we suffer a breach that affects your data we will tell you, and we will tell you what was in it rather than sending you a paragraph of nothing. {{DECIDE: breach notification window, and mandatory regulator notification timelines once jurisdiction is settled}}

Children

This is a program for postmenopausal women. Nobody under eighteen should have an account and we do not knowingly keep data on anyone under eighteen.

Changes

If we add a provider or change what we collect, this page changes and account holders get an email. Last updated {{DECIDE: effective date}}.