Privacy Policy
FitQuest is a sole proprietorship registered in Ontario, Canada.
- Contact: tysonfinn@fitquest.training
- Mailing address: 2063 Vickery Drive, Oakville, Ontario, L6L 2J2, Canada
- Last updated: 10 August 2026
This policy has not been reviewed by a lawyer. It was written from the actual behaviour of the software rather than from a template, and everything in it is true as far as we can verify. It has not had a solicitor's eyes on it yet, and we would rather say so than imply otherwise.
This policy explains what personal information FitQuest collects, why, who else sees it, how long it is kept, and what you can do about it. It is written to meet Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).
1. The short version
FitQuest is a coaching relationship with software attached. To coach you well, a coach needs to know things about your health. That information is the most sensitive thing here, and it is treated as such: express consent, restricted access, and no sale of it to anyone, ever.
- We do not sell your personal information.
- We do not share it for advertising.
- Your health information is visible to you and to your coach. Not to other members. There is no leaderboard and no social feed.
- You can ask for a copy of your data, or ask us to delete it.
2. What we collect
You give us:
| Category | Examples | Why |
|---|---|---|
| Account | Name, email, password (hashed, never seen by us) | To create and secure your account |
| Health & fitness | PAR-Q answers, medical history, injuries, medications, training history, goals, measurements | To coach you safely. This is sensitive information under PIPEDA. |
| Advisory answers | Your own answers in the Advisory Intake | So your coach can build your plan |
| Activity | Sessions completed, daily deposits, streaks, Burn Points, workout logs | To run the app and track progress |
| Emergency contact | Name, relationship, phone | Safety during in-person training |
| Billing | Handled by Stripe. We store a customer/subscription identifier and status — never your card number | To take payment and manage your subscription |
| Correspondence | Emails and messages you send us | To answer you |
Collected automatically: IP address, browser and device type, pages viewed, and timestamps. Used for security, rate limiting and fixing faults.
Your coach creates: assessments, ratings, session notes, plans and reviews about you. These are professional records. You are entitled to access them under PIPEDA, subject to the narrow exceptions the Act allows.
We do not collect: your race, ethnicity, religion, sexual orientation, or political views. Please do not send them.
3. Consent
For most information, we ask you directly and you give it directly — that is your consent.
For health information, we ask for your express consent before you provide it, and we tell you what it is for. You can withdraw consent at any time, though withdrawing it may mean we can no longer coach you safely, and we will tell you plainly if that is the case rather than quietly continuing.
Marketing email is separate. You will never be signed up for it by accepting these terms or by buying anything. It requires its own opt-in, we record when and how you gave it, and every message carries an unsubscribe link that works. This is what Canada's Anti-Spam Legislation (CASL) requires and we would do it anyway.
4. Who else sees your information
We use these service providers. Each is bound by its own agreement with us and processes data only to provide its service.
| Provider | What it handles | Where |
|---|---|---|
| Supabase | Database, authentication, file storage | Canada. The project runs in the ca-central-1 region (Montreal). Your health records are stored in Canada. |
| Stripe | Payment processing | Card data goes directly to Stripe. FitQuest never receives or stores it. Stripe processes internationally, including in the United States. |
| Vercel | Website and app hosting | Global edge network. Serves pages and runs the small server functions behind checkout; it does not hold your health records. |
| Anthropic (Claude) | A tool your coach uses to check his own work on plans, statements and programming — never connected to the app, and never given anything that identifies you | United States. Used on a paid business tier, where your inputs are not used to train models. See How FitQuest Uses AI. |
The Claude row is different from the others and it is worth being precise about how. Supabase, Stripe and Vercel receive your information because the software sends it to them automatically. Claude does not: no part of FitQuest connects to it. Your coach writes your plan himself, and afterwards may type de-identified details into a separate tool to ask what he might have missed — "42-year-old, prior ACL repair, training three times a week" — with your name, email and date of birth left out. Nothing you enter into FitQuest reaches it by itself, and the tool does not write your plan or choose your exercises.
FitQuest does not currently send marketing email and has no email marketing provider. Account email — password resets and sign-in links — is sent by Supabase. If a marketing provider is ever added, this table changes before the first message goes out, not after.
Some of these providers process data outside Canada. Information stored in another country is subject to that country's laws, including lawful access by its courts and government. PIPEDA permits this provided we remain accountable for the information and use comparable safeguards — which we do.
We otherwise disclose personal information only: with your consent; to prevent or respond to an imminent threat to someone's life, health or security; or where a law, warrant, subpoena or court order requires it. If we are ever compelled to disclose your information, we will tell you unless we are legally prohibited from doing so.
5. How long we keep it
| Data | Retention |
|---|---|
| Account and activity data | While your account is open |
| Financial records (invoices, payment history) | 6 years, as the Income Tax Act requires |
| Health and advisory records | Not yet fixed — see below |
| Server and audit logs | Not yet fixed — see below |
Two of those periods are honestly marked "not yet fixed", and we would rather say that than print a number we made up. How long coaching and liability records should be kept is a question for a lawyer and an insurer, not for us, and we have not had that conversation yet. Until we do, those records are kept while your account is open and are deleted when you ask us to delete it. When the periods are set, this page changes and the date at the top changes with it.
Deleting your account
Ask us and we will delete your account and your data. Email tysonfinn@fitquest.training. We will confirm what has been deleted and what has been kept, and we answer within 30 days as PIPEDA requires.
What we keep after a deletion, and why:
- Financial records — invoices and payment history, for 6 years, because the Income Tax Act requires it. This is not a choice we can make differently.
- Nothing else. Your health answers, advisory, plans, reviews, coach notes, logs and account go.
This is currently a manual process, not a button. A self-serve export and delete is being built. We are telling you it is manual rather than describing a button that does not exist yet — the request works the same either way, it just goes through a person.
Encrypted backups roll off on their own cycle, which is set by our database provider's plan rather than by us. Anything in a backup is not restored into live use after a deletion request.
6. Your rights
You can:
- See it. Request a copy of the personal information we hold about you.
- Export it. Ask and we will send you your data in a portable format. Like deletion, this is a person doing it today rather than a button in your profile; the self-serve version is being built.
- Correct it. If something is wrong, tell us and we will fix it.
- Delete it. Ask us to delete your account and your data, subject to §5.
- Withdraw consent. At any time, subject to legal or contractual limits we will explain.
- Complain. To us first, at tysonfinn@fitquest.training. We respond within 30 days, as PIPEDA requires. If you are not satisfied, you may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.
If you are in Quebec, the European Union, the United Kingdom, or California, additional rights may apply to you. Contact us and we will honour them.
7. Security
- All traffic uses HTTPS/TLS.
- Passwords are hashed by our authentication provider. Nobody at FitQuest can read your password.
- Database access is enforced row by row, so one member cannot read another member's records.
- Your coach's private assessment notes sit in a separate table that member accounts cannot reach at all.
- Card details never touch our servers.
No system is perfectly secure. If a breach creates a real risk of significant harm to you, we will notify you and the Privacy Commissioner, as PIPEDA requires.
7.1 Why health information is handled differently
PIPEDA requires safeguards proportionate to the sensitivity of the information. Health information is at the top of that scale, so it gets a higher standard than your name and email do:
- Express consent, never implied. We ask before you give it, and we tell you what it is for. Silence is not consent and a pre-ticked box is not consent.
- Purpose limitation. It is used to coach you. It is not used for marketing, not used to train any model, and not shared beyond the providers in section 4. Where your coach checks his own work against an AI tool, identifying details are removed first and the tool is on a tier that does not train on the input — see section 10 and How FitQuest Uses AI.
- Access on a need-to-know basis. You and your coach. Not other members. Coach access to your record is logged.
- Shorter retention. Health records are not kept indefinitely — see section 5.
- An unanswered question is never treated as a "no." Blank means blank. No health field carries a default or comes pre-ticked, because assuming something about your health is how people get hurt.
A note on PHIPA and HIPAA. Ontario's Personal Health Information Protection Act binds "health information custodians" — regulated health professionals, hospitals, pharmacies and the like. A personal trainer is generally not one, so PHIPA does not govern FitQuest and we do not claim it does. HIPAA is a United States statute and does not apply to us at all. PIPEDA is the law that governs your health information here, at its sensitive-information standard, which is what the practices above describe.
8. Cookies, tracking and third-party requests
There is no analytics on FitQuest. No advertising pixel, no session recording, no third-party tracker. We are not describing a setting you can turn off; none of it is installed.
What is stored in your browser is strictly necessary and does not require consent: your sign-in session, your light/dark preference, and a saved draft of the intake form so you can close the tab and come back to it.
One thing worth telling you plainly, because it is the kind of detail most privacy policies leave out: our pages currently load fonts from Google. That means Google receives your IP address when a page loads, before you have agreed to anything. We are not using it for tracking and we get nothing back from it, but it is a request to a third party that you did not ask for, and we are working on hosting those font files ourselves so it stops happening.
9. Children
FitQuest is not intended for anyone under 18. If a minor is coached, a parent or guardian must consent and sign (see the Parent/Guardian Consent form in the client packet). We do not knowingly collect information from a child without that consent.
10. Automated decisions and AI
No automated system decides your plan, your pricing, or your access to care. A human coach does, every time. FitQuest's founding documents prohibit reducing a person to a score, and no composite number ever appears in your Health Net Worth Statement.
No AI runs inside FitQuest. Nothing you enter is passed to a model by the software. An automated test checks this on every build.
Your coach does check his own work against an AI tool — he writes your plan, then asks the tool what he might have missed — with identifying details removed before anything goes in. The tool does not write your plan and does not choose your exercises. Every document you receive carries a line at the bottom saying so. How FitQuest Uses AI explains exactly what that does and does not mean, including which tool and why your data is not training it.
11. Changes
If we change this policy materially, we will tell you before the change takes effect and record your acknowledgement. The version and date at the top of this page always reflect what is currently in force.
12. Contact
Email: tysonfinn@fitquest.training
By post: 2063 Vickery Drive, Oakville, Ontario, L6L 2J2, Canada
Privacy questions and access requests go to either. We answer within 30 days, as PIPEDA requires.