Privacy Policy

1. Information We Collect

TBAfit collects the following information when you use our Platform:

• Account Information: name, email address, password (hashed), and account type (Practitioner or Individual) provided during registration.
• Assessment Data: movement scores, bilateral readings (left/right), joint group evaluations, and assessment metadata (date, mode, duration) submitted during a Move-IQ Assessment.
• Program Data: BluePrint training programs created by or for your account, including exercise selections, sets/reps, and ordering.
• Usage Data: pages visited, feature interactions, session timestamps, and device/browser metadata collected via standard server logs.
• Payment Information: processed via Stripe. TBAfit does not store credit card numbers; Stripe token references are stored.

2. How We Use Your Information

We use your information to: deliver Move-IQ Assessments and results; generate ATLAS insights and BluePrint programs; send renewal reminder emails and subscription expiry banners; maintain account security; and improve the TBAfit platform.

We use anonymized, aggregated assessment outcomes to improve ATLAS's movement intelligence model. This data is anonymized and cannot be re-identified to a specific individual.

3. Data Sharing

We do not sell your personal data. We share data only with:

• Stripe (payment processing) — subject to Stripe's privacy policy
• Google Gemini (ATLAS AI generation) — used to generate insights; Gemini does not retain your data for training purposes
• Polsia infrastructure (hosting provider) — bound by our data processing agreement
• Legal obligations — when required by law, court order, or to protect rights/safety

We do not share your movement data with third parties for marketing or advertising.

4. Data Retention

• Account data: retained until you delete your account or request deletion
• Assessment data: retained until account deletion or explicit deletion request
• Payment records: retained per financial regulatory requirements (minimum 7 years)
• Log data: retained for 90 days per standard server log policy

5. Your Rights

You have the right to: request access to your personal data; request correction of inaccurate data; request deletion of your data (subject to legal retention requirements); export your data in a portable format; and opt out of non-essential data uses where applicable.

To exercise any of these rights, contact support@tbafit.polsia.app.

6. Children's Privacy

TBAfit is not intended for users under 18 years of age. We do not knowingly collect personal information from minors under 18. If we learn that data from a minor under 18 has been collected, we will delete that data immediately.

7. Data Security

All data is encrypted in transit (TLS/HTTPS) and at rest (AES-256 at the database level). Access to production systems is restricted to authorized personnel via role-based access controls. API endpoints require JWT authentication. Payment data is handled exclusively by Stripe per PCI-DSS requirements.

8. Cookies

TBAfit uses minimal cookies: session cookies (required for authentication, expires when you close the browser); optional analytics cookies (anonymized, used to understand platform usage). You can disable cookies in your browser; doing so may impair platform functionality.

9. Third-Party Services

Our platform integrates with: Stripe (payment processing, privacy policy at stripe.com); Google Gemini (AI generation, Google's privacy policy applies to data sent to Gemini); and Polsia (infrastructure hosting, data processing agreement in place).

10. International Data Transfers

TBAfit operates primarily from the United States. If you are located outside the US, your data may be transferred to and processed in the US, which may have different data protection laws than your country. By using TBAfit, you consent to such transfers.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to the registered account address with 30 days' notice. Continued use of the platform after the notice period constitutes acceptance.

12. Contact

Questions or concerns? Email support@tbafit.polsia.app