Privacy Policy

Last updated: 2026-08-07

This policy explains what Coaches Corner Consulting(“we”, “us”, the “Platform”) collects when you use this coaching platform, why we collect it, who we share it with, how long we keep it, and how you can get it back or delete it.

The Platform is white-label software used by independent fitness and nutrition coaches. If you are a client, your coach is the person who decides what to ask you for and how to use it — in data protection terms your coach is generally the controller and we act as a processoron their behalf. For coaches’ own account data, we are the controller.

1. Who we are and how to contact us

• Operator: Coaches Corner Consulting, 97 Fireside Cove, Cochrane, Alberta T4C 0X4, Canada.
• Privacy contact: admin@coachescorner.io (also our contact for data subject requests, deletion requests and complaints).
• Data protection contact / representative, where one is required: admin@coachescorner.io.
• Governing law and venue: Alberta, Canada.

2. What we collect

We only collect what the Platform actually needs to work. The list below reflects the real data model, not a generic template.

Account and identity

• Email address and a hashed password (authentication is handled by Supabase Auth; we never store your password in plain text).
• Name, profile photo, time zone and locale, where you provide them.
• For coaches: business name, brand colours, logo, public landing-page content and subdomain slug.
• Membership status, tier, team/seat role and referral codes.

Health and fitness data

Much of this is special-category / sensitive health data. We process it only to deliver the coaching service you signed up for, and only on the lawful basis of your explicit consent and the contract between you and your coach.

• Body weight logs and weight-trend history.
• Body measurements and biometrics (circumferences, body-fat estimates and similar).
• Progress photos you upload, stored in private storage buckets.
• Weekly check-ins — free-text answers about training, nutrition, sleep, stress, energy, adherence and anything else your coach asks.
• Food and nutrition logs, macro targets, meal plans, saved meals, dietary likes, dislikes and allergies.
• Blood panel results you or your coach enter, including flagged out-of-range markers.
• Menstrual cycle logs, including cycle phase and symptoms.
• PAR-Q health screening and waiver answers, including cardiac and other medical risk questions, and whether your answers flagged a need for medical clearance.
• Wearable / Apple Health metrics you choose to sync: steps, resting heart rate, heart-rate variability, sleep minutes, active energy, workout minutes and body weight.
• Supplement protocols (products, dosages, timing) and adherence.
• Habits you tick off and your daily completion history.
• Workout logs — exercises, sets, reps, loads, RPE and personal records.
• Goals, assessments, client notes and tasks recorded by you or your coach.

Communications and community

• 1:1 and group messages between you and your coach, and posts, comments and reactions in community spaces.
• Voice notes you record, stored as audio files.
• Group video call participation (calls are hosted by a third-party video provider — see section 5).
• Notification preferences and web-push subscription endpoints for your browser or device.

Contracts, payments and records

• E-signature data for coaching agreements: the typed legal name you signed with, the signature timestamp, and — as required to make an electronic signature evidentially useful — your IP address and browser user-agent string at the moment of signing.
• Payment records: subscription and package status, amounts, currency, invoice/charge identifiers and payment state. Card numbers are handled entirely by Stripe and never touch our servers.

Technical data

• Session cookies needed to keep you logged in, and a cookie storing your light/dark theme choice.
• Server logs generated by our hosting providers (IP address, timestamp, request path) used for security, abuse prevention and debugging.
• Rate-limiting counters tied to your account or IP, used to stop abuse.

We do not run advertising SDKs, third-party analytics trackers, session recording, fingerprinting or cross-site tracking of any kind. There are none in this application.

3. How we use your data

• To provide the coaching service: build and deliver meal plans, training programs, habits, check-ins and progress tracking.
• To let your coach — and only your coach and any team members they have explicitly granted a seat — review your progress and respond to you.
• To send transactional email and push notifications you have opted into (check-in reminders, new message alerts, macro updates, appointment reminders).
• To take payment for coaching packages and subscriptions.
• To keep the service secure: authentication, rate limiting, abuse and fraud prevention.
• To meet legal, tax and accounting obligations.

We never use your health or fitness data for advertising, ad targeting, or audience building, and we never sell or rent your personal data to anyone. We do not share it with data brokers. This is a hard product commitment, not just a policy statement — the application contains no advertising or analytics integrations.

4. Automated processing and AI

We do not send your data to an AI provider ourselves. Earlier versions of this platform generated check-in summaries and meal plans using an AI model; those features have been removed, and the platform now contains no AI integration of its own.

There is one way your data can still reach an AI provider, and it is your coach’s choice rather than ours. Coaches can connect an outside AI assistant to their account so it can help them with their coaching work. If your coach does that, the assistant can read:

• your name, and the tier or package you are on;
• your check-in answers and your coach’s reviews of them;
• messages between you and your coach;
• your training programs, workouts, habits, nutrition and supplement protocols, and adherence.

It can also create content in your coach’s account — a program, a habit, a task, a note, or a draft message for them to review before it is sent.

It cannot read your progress photos, blood panels, PAR-Q answers, body-weight history, cycle logs or payment data. Those are outside what a connected assistant can reach.

Your coach chooses which assistant to connect and is responsible for that choice under the data processing agreement between us: for this transfer they act as the controller, and we cannot control how their chosen provider stores or retains what it receives. Ask your coach which assistant they use, or ask them to disconnect it — they can revoke its access at any time, immediately, from their account settings. Nothing here makes automated decisions with legal or similarly significant effects about you; a human coach reviews the output.

5. Who we share data with

These are our service providers (sub-processors). We share only what each one needs.

• Supabase — application database, authentication and file storage (progress photos, voice notes, uploads). Effectively all data described above is stored here.
• Stripe — payment processing for coaching packages, subscriptions and coach payouts. Stripe receives your email, name and payment details directly; we receive back only charge/subscription identifiers and status.
• Resend — transactional email delivery (invites, check-in reminders, password resets, notifications). Receives your email address and the message content.
• Jitsi / 8x8 — hosting of group video calls. Receives your display name and the call room identifier while you are in a call.
• Web push services operated by Apple, Google and Mozilla — delivery of browser/device push notifications to the endpoint your browser registered. These services receive the notification payload we send.
• Your coach (and any team members they have granted a seat) — they see the data you submit to them. Other clients never see your health data; they only see what you voluntarily post in a shared community space.
• Hosting infrastructure — Vercel serves the application and generates request logs.

We may also disclose data where we are legally required to, or where it is necessary to establish, exercise or defend legal claims, or to protect someone’s vital interests.

6. International transfers

Our providers may process data outside your country, including in the United States. Where required, such transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum.

7. How long we keep it

• Account, coaching, health and messaging data: kept for as long as your account is active, then deleted when you delete your account (see section 9).
• Financial and tax records: retained for the period required by Alberta and Canadian law, typically several years, even after account deletion.
• Signed contracts and their e-signature audit data: retained for the limitation period applicable to the agreement, so the signature stays verifiable.
• Server and security logs: short retention, per our providers’ defaults.

8. How we protect it

• All traffic is encrypted in transit (TLS); data at rest is encrypted by our hosting providers.
• Every table enforces row-level security in the database, so a coach can only read their own clients’ rows and a client can only read their own.
• Progress photos, voice notes and uploaded files are held in private storage and served only via short-lived signed URLs.
• Payment card data never reaches our servers.
• Passwords must be at least 8 characters, and email confirmation is required before an account can be used — so nobody can claim an account by guessing your email address.

9. Your rights — including deletion and export

Depending on where you live you have some or all of the following rights. We honour these requests for everyone, regardless of location.

• Access and export. You can request a machine-readable copy of your data. Coaches can export their roster and account data from the dashboard; clients can download their own data from Account → Settingsinside their coach’s app, or request it by emailing admin@coachescorner.io. We respond within 30 days.
• Deletion. You can delete your account and the personal data associated with it at any time, yourself, from your account settings — clients at /account/settings in their coach’s app, coaches at /dashboard/settings/account. Deletion removes your profile, health logs, check-ins, photos, voice notes and messages, subject only to records we are legally required to keep (section 7). You can also email admin@coachescorner.io and we will action it for you.
• Correction. You can edit most of your data in the app directly.
• Withdraw consent. You can stop syncing wearable data, turn off push notifications, or stop submitting health information at any time — this does not affect processing already carried out.
• Object / restrict. You can ask us to stop or limit certain processing.
• Complain. You can complain to your data protection authority (the Office of the Privacy Commissioner of Canada). We would appreciate the chance to resolve it first at admin@coachescorner.io.

If you are a client, your coach also holds a copy of the coaching relationship data. Where your coach is the controller, we will forward your request to them and assist them in fulfilling it.

10. Children

The Platform is not intended for anyone under 16 (or the minimum age in your country, if higher), and we do not knowingly collect data from them. If you believe a child has created an account, contact admin@coachescorner.io and we will delete it.

11. Cookies

We use only strictly necessary cookies: an authentication session cookie, a short-lived cookie used during password recovery, and a cookie that remembers your light/dark theme. There are no advertising, analytics or tracking cookies, so there is nothing to opt out of.

12. Changes to this policy

If we make a material change we will update the date at the top of this page and notify account holders by email or in-app before the change takes effect.

13. Contact

Questions, requests or complaints: admin@coachescorner.io — Coaches Corner Consulting, 97 Fireside Cove, Cochrane, Alberta T4C 0X4, Canada.