2110 Fitness2110 Fitness
    v1.3.87
    We use cookies to improve your experience. By clicking Accept, you agree to our use of cookies.

    Privacy Policy

    How we handle your personal data at 2110 Fitness.

    Privacy Policy — 2110 Fitness Coaching Platform

    This policy explains what the 2110 Fitness coaching platform (the "Platform") collects, why, who it is shared with, and the choices you have. It is operated by 2110 Fitness, Calgary, Alberta, Canada.

    Contact: chris@theathleticyou.com

    Last updated: September 29, 2026

    1. Roles

    Your coach decides what client information to collect and how to use it in their coaching practice. We provide the software and process that information on their behalf, and on our own behalf for operating and securing the Platform.

    2. What we collect

    Account: name, email address, optional phone number, password hash, locale, and timezone.

    Coaching data you or your coach enter: training programs and workout logs; nutrition logs, targets, and food photographs; body weight, body measurements, and progress photographs; recovery metrics such as HRV and sleep, including screenshots you upload; habits; check-in responses; and messages between you and your coach.

    Technical: IP address, browser and device information, and usage events for operating and securing the service.

    We do not collect payment card details. Coaches who subscribe pay through a payment processor that handles card data directly; we never see full card numbers.

    3. Why we process it

    To provide the Platform to you and your coach; to generate AI assistance your coach has enabled; to secure the service and investigate abuse; to meet legal obligations; and, with your consent, to measure product usage.

    Legal bases where GDPR applies: performance of a contract, our legitimate interests in operating and securing the Platform, your consent for analytics and for health-related data, and compliance with legal obligations.

    4. Artificial intelligence — what is sent where

    To produce coaching assistance, relevant content is sent to AI providers (currently Anthropic and OpenAI) for processing:

    • Sent: the coaching context needed for the task — for example your training program, recent logs, nutrition entries, check-in text, and messages in the conversation being assisted.
    • Progress photographs and food photographs are sent only when a feature you or your coach invoked requires image analysis.
    • Not used to train models. Features built into the Platform call these providers' business APIs, under commercial terms that do not permit training on submitted content.
    • Coach-supplied keys: where your coach supplies their own provider key, processing occurs under that coach's account with that provider.

    We also operate internal AI assistants that we use to run 2110 Fitness itself — for example to prepare progress reports, review bloodwork and body-composition trends, and draft coaching material. These assistants can read and write the same coaching data described above, they are operated by us rather than by your coach, and they send that data to Anthropic for processing. They are listed separately in section 6 because this is a different flow from the in-app features above, on different terms, and we would rather be exact about that difference than leave you to assume it away:

    • The in-app features call the providers' business APIs, under commercial terms that do not permit training on submitted content.
    • The internal assistants run on a Claude subscription, to which Anthropic's consumer terms apply. That flow is not covered by a data-processing agreement. The setting that would let Anthropic use this content to improve its models is turned off, so it is not used for training, and Anthropic's standard 30-day retention period applies to it.
    • Before the Platform is used by any coaching business other than our own, we will move the internal assistants onto the same commercial terms the in-app features already use.

    AI output is assistive and may be wrong; your coach reviews it.

    5. Who else sees your data

    • Your coach, and administrators of the coaching organisation you belong to.
    • Other coaching organisations on the Platform: never. Data is scoped per organisation, and that isolation is verified.
    • Service providers and sub-processors who process data on our instructions. Section 6 names every one of them, what it receives, and where it is.
    • Authorities, where we are legally required to disclose.

    We do not sell your personal information, and we do not share it for advertising. No advertising network receives your data.

    6. Sub-processors — who processes your data for us, and where

    We use the providers below to operate the Platform. Each processes personal information only on our instructions and only for the purpose named. This list is the customer-facing version of a register we maintain internally; we keep it current, and adding a provider means updating this section.

    • Vercel — hosting, application servers, and request logging. Receives everything that passes through the Platform, including your IP address. United States.
    • Neon — the database. Holds all account and coaching data. United States (Virginia).
    • Vercel Blob — private file storage. Holds progress photographs, food photographs, voice notes, attachments, and documents you upload. United States.
    • Anthropic — AI processing, both for in-app coaching features and for our internal AI assistants described in section 4. Receives the coaching context sent with each request, and photographs when an image feature is used. United States.
    • OpenAI — voice-note transcription, movement-form analysis, and speech synthesis, where your coach has enabled them. Receives audio of voice notes, video frames submitted for form analysis, and text sent for speech. United States.
    • Apple, Google, and Mozilla push services — delivering push notifications to your device or browser. Receive a device push token and the contents of the notification. Which of the three is used is decided by your device and browser, not by us. United States.
    • Our email provider — sending invitations, password resets, and notifications, once outbound email is switched on. Receives your email address, your name, and the contents of the message. We will name the provider here before it sends anything. United States.
    • USDA FoodData Central and Open Food Facts — food and barcode lookup for nutrition logging. Receive the search term or barcode only; these requests are made by our servers and carry no identifier for you. United States; France.
    • YouTube (Google) — exercise demonstration videos. Receives search terms from our servers. Where a video is embedded in a page, your browser contacts YouTube directly and YouTube receives your IP address; we use YouTube's no-cookie player for embeds. United States.

    Some further providers appear in our internal register but are not enabled and receive nothing today — SMS delivery, voice synthesis, product analytics, and our coach-onboarding integration. If we turn one on, this section changes first.

    Our internal AI assistants can also write coaching material into third-party tools we use to run the business, such as document, email and messaging services. Those tools are operated from the United States. We are tightening which of them are permitted to hold identifiable client information; if you would like to know the current position for your own data, ask the Privacy Officer named in section 7.

    7. Where data is stored

    Data is stored on infrastructure located in the United States, in the regions named in section 6. If you are in Canada, the EU/EEA, or the UK, your information is transferred and processed there under appropriate safeguards, including standard contractual clauses where required.

    Because our providers are outside Canada, your information is subject to the laws of the country it is stored in, including lawful access by that country's courts and authorities.

    Service providers outside Canada — what Alberta law requires us to tell you

    Every provider in section 6 is outside Canada. Alberta's Personal Information Protection Act ("PIPA") requires four specific things of us when that is the case. Each is answered here rather than left to a request.

    1. The countries involved. Collection, use, disclosure and storage of your information occur, or may occur, in the United States and in France (Open Food Facts). Section 6 names the country beside each provider. Adding a provider in any other country means changing that section first.
    2. What each provider is authorised to do. Section 6 states the purpose each provider is authorised for, and that purpose is the limit. None of them is permitted to use your information for its own purposes, and none of them is permitted to sell it.
    3. How to obtain the written information. Sections 6 and 7 are our written information about our policies and practices for service providers outside Canada, and they are published here, without an account and without asking us. If you would rather have a copy sent to you, or want the fuller internal register that section 6 is drawn from, ask the Privacy Officer below and we will send it in writing within 30 days.
    4. Who can answer your questions about it. The Privacy Officer, 2110 Fitness is the person able to answer, on our behalf, your questions about the collection, use, disclosure and storage of your personal information by service providers outside Canada. That is a designated position, not a shared support queue: reach it at chris@theathleticyou.com, addressed to the Privacy Officer, and it reaches the individual who holds the role.

    8. Retention

    We keep your data while your account is active. After account deletion we remove personal data within 30 days, except where retention is legally required. Backups are retained on a rolling basis and expire automatically.

    9. Your rights

    You may request access to your data, correction, deletion, a portable export, restriction of processing, or withdrawal of consent. Coaches can export client data directly in the Platform; anyone can email us. We respond within 30 days.

    Where GDPR applies you may also lodge a complaint with your supervisory authority. If you are in Canada, you may contact the Office of the Privacy Commissioner.

    10. Security

    Passwords are hashed; traffic is encrypted in transit; progress photographs and file attachments are stored privately and served only to authorised viewers; access is scoped per coaching organisation and enforced server-side; API rate limiting and audit logging are in place. No system is perfectly secure, but we treat health and body-image data as sensitive by default.

    11. Cookies and analytics

    We use cookies strictly necessary for signing you in and keeping you signed in. Product analytics run only where you have consented, and can be declined without losing functionality.

    12. Children

    The Platform is not intended for children under 16. If you believe a child has provided us personal information, contact us and we will delete it.

    13. Changes

    We will post material changes here and, where they meaningfully affect you, notify you in the Platform or by email before they take effect.

    14. Contact

    Privacy questions, or to exercise any right above: chris@theathleticyou.com

    The individual responsible for our compliance with Alberta's Personal Information Protection Act, and the person who answers questions about service providers outside Canada, holds the position of Privacy Officer, 2110 Fitness. Address anything of that kind to the Privacy Officer at the same address.