Privacy Policy

PhysicAll is a fitness platform connecting personal trainers and clients. We are incorporated in Canada and operate under applicable Canadian privacy law, including PIPEDA.

We collect information you provide directly, including:

• Account registration details (name, email, role)
• Trainer profile information (bio, certifications, rates)
• Health and fitness data you choose to log (workouts, nutrition, progress photos)
• Payment information (processed securely via Stripe — we do not store card numbers)
• Communications between trainers and clients via in-app chat

We use your information to:

• Provide and improve the PhysicAll platform
• Facilitate bookings, payments, and trainer-client connections
• Send transactional and service notifications
• Comply with legal obligations

We do not sell your personal information to third parties.

Progress photos, workout logs, nutrition data, and body metrics are sensitive health information. This data is visible only to you and any trainer you are actively connected with. We apply strict row-level security controls at the database level.

PhysicAll collects health and fitness data including workout logs, body measurements, nutrition data, and progress photos. This data is classified as sensitive personal information under PIPEDA and is used solely to provide the PhysicAll service.

We retain different categories of data for different periods, in line with Canadian tax and privacy law. Retention is enforced by automated purges (analytics after 24 months, deleted messages after 2 years, photos, logs and emergency contacts 6 months after you deactivate your account, health screening answers and injury notes after 5 years). See the table below.

Deactivating your account (Settings → Delete account) blocks sign-in and makes your profile invisible, but does not erase your data straight away: training, health, and financial records are retained as required by law and to preserve your trainer's coaching history. After you deactivate, your progress photos, logs and emergency contacts are permanently deleted after 6 months, and your health screening answers and injury notes after 5 years; payment records and signed waivers are kept. To request permanent erasure of your personal data — including health data, progress photos, and chat history — contact privacy@physicall.ca. We review erasure requests against our legal retention obligations (e.g. 7-year payment records under Canadian tax law).

We use a small set of cookies to operate the platform, process payments, and measure aggregate performance. Analytics cookies (Vercel) load only after you explicitly accept them via the consent banner — you can decline without affecting the service. Payments and essential functions don't require consent.

• __stripe_mid, __stripe_sid — Stripe payment processing (persistent)
• _vercel_* — Vercel Analytics and performance metrics — loaded only after you accept analytics
• analytics_consent — PhysicAll, records your analytics consent choice (accepted or rejected) (persistent)

PhysicAll shares data with the following third-party services to operate the platform:

• Supabase — database, authentication, and file storage
• Stripe — payment processing and trainer payouts
• Apple App Store — in-app purchase processing (iOS)
• Google Play — in-app purchase processing (Android)
• Apple Sign-In — account sign-in (iOS)
• Google Sign-In — account sign-in
• Resend — transactional email delivery
• Vercel — hosting, analytics, and performance metrics (loads only after you accept analytics)
• Expo — mobile app builds, updates, and developer tooling
• PowerSync — offline sync of your workout, nutrition, and chat data to your devices
• FatSecret — nutrition data (see attribution below)
• Edamam — recipe and nutrition search
• ExerciseDB — exercise library data
• Google Maps — trainer location maps (server-proxied)
• Mapbox — interactive trainer discovery map
• Sentry — error tracking and crash reporting (text content masked)
• Upstash Redis — rate limiting (no personal data stored)

Each provider handles data under their own privacy policy. We share only the minimum data required for each service to function.

Nutrition data is powered by the FatSecret Platform API. PhysicAll does not own or claim any rights to this nutritional data.

You have the right to access, correct, or delete your personal information, and to withdraw your consent to health-data processing at any time:

• Access / portability: download a machine-readable copy of your data from Settings → Export my data (one export per 24 hours).
• Withdraw health-data consent: Settings → Health data consent. Withdrawal stops new health-data processing and blocks booking until you re-consent; it does not delete existing records.
• Deactivate your account: Settings → Delete account (see Section 5a — deactivation, not erasure).
• Erase your data: email privacy@physicall.ca with your erasure request; we respond within 30 days.

For privacy-related inquiries, contact us at privacy@physicall.ca.