Privacy Policy

Medtra Inc. (hereinafter "we", "our", or "MedFitness") is a technology company registered in Quebec, Canada, headquartered in Montreal, QC. We operate the MedFitness platform (website, mobile application, and related services).

This Privacy Policy describes how we collect, use, disclose, retain, and protect your personal information when you use our services.

By using MedFitness, you consent to the practices described in this policy. If you do not agree with this policy, please do not use our services.

MedFitness fully complies with An Act to modernize legislative provisions as regards the protection of personal information (Law 25, formerly Bill 64), which came into force progressively since September 2022.

Person Responsible for the Protection of Personal Information (PRPPI):

• Name: Medelya Claude
• Title: President & PRPPI, Medtra Inc.
• Email: [email protected]
• Phone: +1 514 558-3084
• Address: Montreal, QC, Canada

In compliance with Law 25, we commit to:

• Designating a person responsible for the protection of personal information
• Conducting Privacy Impact Assessments (PIAs) before any new project involving personal information
• Maintaining a privacy incident register
• Notifying the Commission d'accès à l'information (CAI) and affected individuals in case of incidents presenting a serious risk of harm
• Obtaining manifest, free, and informed consent for the collection of sensitive information
• Ensuring data portability upon request
• Destroying or anonymizing information when the purpose of collection is fulfilled

As a Canadian company, MedFitness complies with the Personal Information Protection and Electronic Documents Act (PIPEDA) and its 10 fair information principles:

• Accountability: We are responsible for personal information under our control.
• Identifying Purposes: We identify the purposes for collection before or at the time of collection.
• Consent: Collection, use, and disclosure are done with your informed consent.
• Limiting Collection: We collect only information necessary for identified purposes.
• Limiting Use, Disclosure, and Retention: Information is used only for the purposes for which it was collected.
• Accuracy: We keep information as accurate and up-to-date as necessary.
• Safeguards: We protect information with measures appropriate to its sensitivity.
• Openness: Our policies are readily available.
• Individual Access: You can request access to your personal information.
• Challenging Compliance: You can challenge our compliance with our PRPPI.

We collect the following categories of personal information:

a) Account Information

• Full name, first name
• Email address
• Phone number (optional)
• Profile photo (optional)
• Date of birth
• Sex/gender

b) Health & Fitness Data

• Weight, height, BMI
• Body measurements (chest, waist, hips, arms, thighs, shoulders)
• Workout history (exercises, sets, reps, loads)
• Personal fitness goals
• Declared medical conditions (injuries, limitations)
• Heart rate and smartwatch data (Apple Watch, Samsung Watch)

c) Hormonal Tracking Data

• Menstrual cycle data (for users who activate this feature)
• Cycle phase (follicular, ovulation, luteal, menstruation)
• Associated symptoms

d) Nutrition Data

• Logged meals
• Calories and macronutrients (protein, carbs, fat)
• Dietary preferences and restrictions

e) Photos & Body Images

• Progress photos (front, side, back)
• Before/after photos

f) Device & Usage Data

• Device type, operating system, app version
• IP address
• Pages viewed, features used
• Interaction timestamps

g) Location Data

• Approximate location (timezone, country)
• Precise location (only if you explicitly allow it, e.g., to find a nearby gym)

h) Payment Information

• Payments are processed by Stripe. We never store your full credit card number.
• We retain: card type (last 4 digits), expiration date, billing history.

i) Coach-Client Communications

• Text messages exchanged within the platform
• Audio messages
• Coach notes on your progress
• Weekly check-ins

We use your personal information for the following purposes:

• Provide services: Create and manage your account, generate personalized training programs, track your progress.
• Personalization: Adapt exercise, nutrition, and recovery recommendations to your profile and goals.
• Hormonal tracking: Adjust your training programs based on your menstrual cycle (if enabled).
• Communication: Send notifications, workout reminders, motivational messages, and coach-client communications.
• Billing: Process payments, manage subscriptions, issue receipts.
• Service improvement: Analyze aggregated usage to improve our features and user experience.
• Security: Prevent fraud, detect abuse, and ensure platform security.
• Legal obligations: Comply with our legal and regulatory obligations.
• Research & development: Develop new features (anonymized/aggregated data only).

Depending on the nature of the processing, we rely on the following legal bases:

• Consent: For the collection of health data, body photos, hormonal data, and marketing communications. You can withdraw consent at any time.
• Contract performance: For providing our services (account creation, program generation, workout tracking).
• Legitimate interest: For platform security, fraud prevention, and service improvement (aggregated data).
• Legal obligation: For compliance with our tax and regulatory obligations.

We never sell your personal data.

We share your information only with the following service providers, strictly necessary for platform operation:

Provider	Service	Data Shared	Location
Supabase	Database & authentication	All account and usage data	United States
Stripe	Payment processing	Billing information	United States
Resend	Email delivery	Email address, first name	United States
Twilio	SMS delivery	Phone number	United States

Each provider is bound by contractual agreements ensuring an adequate level of protection for your information.

We may also disclose your information if required by law (court order, government request).

If you use the Coaching plan, your personal coach will have access to the following data:

What your coach CAN see:

• Your profile (name, age, sex, goals)
• Your training data (workout history, loads, progression)
• Your measurements and weight
• Your progress photos (if you authorize sharing)
• Your weekly check-ins
• Your nutrition data
• Your declared fatigue and stress levels
• Your hormonal data (if you enable sharing)

What your coach CANNOT see:

• Your personal email address
• Your phone number
• Your payment information
• Your physical address
• Your communications with other users
• Your location data

You can modify your coach's access permissions at any time in your privacy settings.

Health and fitness data are considered sensitive information. We apply enhanced protective measures:

• Encryption: All health data is encrypted at rest (AES-256) and in transit (TLS 1.3).
• Restricted access: Only strictly necessary personnel have access to health data, with access logging.
• Explicit consent: Health data collection requires separate, explicit consent.
• Segregation: Sensitive health data is stored separately from general account data.
• Anonymization: Data used for analytical purposes is anonymized before processing.
• Auditing: Regular security audits are conducted on systems containing health data.

Progress photos are particularly sensitive data. Here's how we protect them:

• Encrypted storage: All photos are encrypted at rest with military-grade encryption (AES-256).
• Restricted access: Your photos are only visible to yourself and your coach (if you explicitly authorize it).
• No public sharing: Progress photos are never shared publicly unless you voluntarily choose to post them in the community.
• Deletion: You can delete your photos at any time. Deletion is permanent and irreversible.
• No commercial use: We never use your photos for advertising or commercial purposes without your explicit written consent.
• Metadata: EXIF metadata (GPS location, device info) is automatically stripped upon upload.

Hormonal tracking data (menstrual cycle) is classified under the maximum sensitivity category:

• Separate consent: Activating hormonal tracking requires separate, specific consent.
• Controlled visibility: By default, this data is NOT shared with your coach. You must explicitly enable sharing.
• Limited purpose: This data is used solely to adapt your training and recovery programs to your cycle.
• No profiling: Hormonal data is never used for advertising or commercial profiling purposes.
• Easy deletion: You can delete all your hormonal data with a single click in your settings.
• Compliance: Processing of this data meets the strictest requirements of Law 25 regarding medical-nature information.

We retain your information for the following periods:

Data Type	Retention Period
Account data	Duration of subscription + 30 days after account deletion
Training data	Duration of subscription + 30 days
Progress photos	Until deleted by user or 30 days after account closure
Hormonal data	Until deleted by user or account closure
Payment data	7 years (Canadian tax obligations)
Coach-client communications	Duration of coaching relationship + 90 days
Connection logs	12 months
Anonymized/aggregated data	Indefinitely (no identification possible)

Upon expiration of these periods, data is securely deleted or irreversibly anonymized.

As a Quebec resident, you have the following rights:

• Right of access: You can request a copy of all personal information we hold about you. We will respond within 30 days.
• Right to rectification: You can request correction of any inaccurate or incomplete information.
• Right to erasure (right to be forgotten): You can request deletion of your personal information, subject to our legal retention obligations.
• Right to portability: You can request to receive your information in a structured, commonly used technological format (JSON, CSV).
• Right to withdraw consent: You can withdraw your consent at any time for any consent-based processing. Withdrawal does not affect the lawfulness of processing done before withdrawal.
• Right to de-indexation: You can request that links associated with your information be de-indexed.
• Right to complain to CAI: You have the right to file a complaint with the Commission d'accès à l'information du Québec (CAI): www.cai.gouv.qc.ca

To exercise your rights, email [email protected] with the subject "Rights Request — Law 25". We will respond within 30 calendar days.

As a Canadian citizen, you also have the following rights under PIPEDA:

• Right of access: You can request access to your personal information held by MedFitness.
• Right to correction: You can request correction of inaccurate or incomplete information.
• Right to challenge compliance: If you believe we are not complying with PIPEDA, you can file a complaint with the Office of the Privacy Commissioner of Canada: www.priv.gc.ca
• Right to withdraw consent: You can withdraw consent subject to legal or contractual restrictions, with reasonable notice.

MedFitness is not intended for children under 14 years of age. In compliance with Quebec's Law 25:

• We do not knowingly collect personal information from persons under 14 years of age.
• For minors aged 14 to 17, parental or guardian consent is required for account creation.
• Parental consent is required for the collection of health data from minors.
• If we discover that we have collected information from a child under 14 without parental consent, we will delete that data immediately.

If you are a parent and believe your child has provided us with information without your consent, contact us at [email protected].

We use cookies and similar technologies. For full details, see our Cookie Policy.

Essential cookies:

• Supabase authentication cookie (required for login)
• Theme preference (light/dark)
• Language preference (fr/en)

How to opt out:

• Via your browser settings
• Via our cookie banner on your first visit
• Note: disabling essential cookies may prevent the service from functioning

Some of your data may be processed outside Canada, notably in the United States, by our service providers (Supabase, Stripe, Resend, Twilio).

In compliance with Law 25 and PIPEDA:

• We conduct a Privacy Impact Assessment before any international transfer.
• Our providers are bound by contractual clauses ensuring a level of protection equivalent to that of Quebec/Canada.
• We verify that destination jurisdictions offer an adequate level of protection or that additional safeguards are in place.
• You can obtain information about our providers' privacy policies upon request.

In compliance with Law 25 (s. 3.5), in the event of a privacy incident presenting a serious risk of harm:

• We will notify the Commission d'accès à l'information (CAI) as soon as possible.
• We will notify affected individuals within 72 hours of discovering the incident.
• The notification will include: the nature of the incident, the data involved, measures taken, and recommendations for protection.
• We will maintain a register of all privacy incidents for at least 5 years.

We may modify this privacy policy from time to time. In case of substantial changes:

• We will notify you by email at least 30 days before the changes take effect.
• A notice will be displayed in the application and on the website.
• The "last updated" date will be changed at the top of this page.
• For changes affecting the processing of sensitive data (health, photos, hormones), new consent will be requested.

Your continued use of the services after the effective date constitutes your acceptance of the modifications.

For any questions regarding this policy or to exercise your rights:

Regulatory bodies:

• Commission d'accès à l'information du Québec (CAI): www.cai.gouv.qc.ca
• Office of the Privacy Commissioner of Canada: www.priv.gc.ca