Privacy policy.

This page explains what data peak/performance collects, why we collect it, who we share it with, and the rights you have over your information.

1. Who we are

peak/performance ("we", "us", "our") provides an integrated coaching operating system for personal trainers, online coaches, studios, gyms, and corporate wellness providers. This policy applies to our website, our web application, and our Android mobile application (package name com.peakperformance.fzc) — together, the "Service".

peak/performance is operated by Peak Performance FZC, registered in Sharjah, United Arab Emirates.

The Service has two kinds of user:

• Coaches — fitness professionals who run their coaching business on the platform.
• Clients — individuals coached by a Coach on the platform.

For any privacy-related question or request, contact info@peakperformance.to.

2. Health and fitness data (Android Health Connect)

This is the most sensitive category of data we handle, and we treat it separately from everything else. The Health Connect integration is entirely optional. The Service is fully usable without it.

2.1 What we read

With your explicit, revocable, on-device permission, our Android app reads the following data types from Android Health Connect:

2.2 We do not write to Health Connect

Our access to Health Connect is read-only. The app does not write, modify, or delete any data in Health Connect — not steps, not heart rate, not sleep, not workouts, not anything. We request read permissions only.

2.3 Why we use it

Health data is used solely to deliver the coaching service to you:

• To show you your own activity, recovery, and training history in the app.
• To allow your assigned Coach — and only your assigned Coach — to review your progress and adjust your programme.
• To produce summaries of your own trends, for you and your Coach.

2.4 What we will never do with your health data

We make these commitments explicitly and without qualification:

• We never sell health data. To anyone, for any purpose, at any price.
• We never use health data for advertising, ad targeting, or ad measurement.
• We never transmit health data to OpenAI or to any other third-party AI or large-language-model provider. Our AI features do not receive Health Connect data. Health Connect data is stored in our own database and is not sent to any AI service.
• We never share health data with data brokers, insurers, or employers.
• We do not use health data for automated decision-making that produces legal or similarly significant effects.

2.5 Who can see your health data

Only two parties: you, and the Coach you are assigned to. A Coach cannot see the health data of anyone who is not their own Client. This restriction is enforced by row-level security policies in our database, not merely hidden in the interface.

2.6 Granting and revoking permission

The app requests Health Connect permission explicitly, and you may decline. You can revoke it at any time through Android Settings → Health Connect → App permissions, or from within the app. Revoking permission immediately stops all further reading.

Revoking permission does not by itself delete data already synced. To delete that, see Section 8.

2.7 Retention

Health data is retained while your account is active. When your account is deleted, all associated health records are permanently deleted within 30 days.

3. Other data we collect

• Account data: name, email address, password (stored only as a salted hash), role, and profile details you provide.
• Payment data: billing details processed by Stripe. We never see or store full card numbers — only a token, the last four digits, and the card brand.
• Coaching data: content you or your Coach upload — workouts, programmes, check-ins, progress photos, messages, nutrition information, body metrics, and notes.
• Usage data: device, browser, IP address, pages visited, feature usage, and diagnostic logs, used to operate and secure the Service.
• Communications: messages you send us by email, form, or in-app support.

4. How we use your data

• Provide, maintain, and secure the Service.
• Authenticate users and enforce access controls.
• Process payments and manage subscriptions.
• Send transactional email (account, billing, security, and product updates you opted into).
• Detect, prevent, and respond to fraud, abuse, and security incidents.
• Comply with legal obligations and enforce our terms.
• Improve product quality through aggregated, de-identified analytics.

We do not sell your personal data.

5. AI features

The Service includes AI-assisted features that help Coaches draft programmes, generate content, and summarise information. These features are powered by OpenAI.

Health Connect data is never sent to OpenAI. The data a Coach chooses to send to an AI feature is limited to coaching content — such as programme text or notes — and excludes the health and fitness data described in Section 2.

We do not permit our AI provider to use your data to train their models.

6. Sub-processors

Each sub-processor is bound by a data processing agreement and handles personal data only on our documented instructions.

7. Legal bases

Where the UAE Personal Data Protection Law, the EU or UK GDPR, or South Africa's POPIA applies, we rely on:

• Performance of a contract — to provide the Service you signed up for.
• Explicit consent — for health and fitness data. Freely given, and withdrawable at any time without losing access to the rest of the Service.
• Legitimate interests — security, fraud prevention, and product improvement, balanced against your rights.
• Legal obligation — tax, accounting, and lawful requests.

Where a Coach uploads or manages information about a Client, the Coach acts as an independent controller of that information and is responsible for having a lawful basis to process it. peak/performance acts as a processor on the Coach's behalf.

8. Your rights, and how to delete your account

You have the right to access, correct, delete, export, object to, or restrict the processing of your personal data, to withdraw consent, and to complain to your data protection authority.

Deleting your account

You can request deletion of your account and all associated data — including all health data — at any time, in either of two ways:

• In the app: Settings → Account → Delete account.
• On the web, without installing the app: https://peakperformance.to/delete-account

We action deletion requests within 30 days. We will delete your account data, your coaching data, and all Health Connect data we hold.

We retain a minimal set of billing records where we are legally required to (typically up to seven years for tax and accounting purposes). These records do not include health data. Residual copies in encrypted backup snapshots are purged on a rolling schedule.

9. Data retention

We keep personal data only as long as needed for the purposes above. Account data is retained while your account is active. After deletion, we remove personal data within 30 days, except for records we must retain for legal, tax, or accounting reasons.

10. Security

• All data is encrypted in transit (TLS) and at rest.
• Access is restricted per-user and per-Coach by row-level security policies enforced at the database layer.
• Progress photographs are served through short-lived signed URLs that expire after one hour.
• Multi-factor authentication (MFA) is available to all users and is required for coach accounts.
• AI endpoints are authenticated and rate-limited per user.
• We monitor for brute-force attempts and abuse.

No system is perfectly secure, and we do not claim otherwise. If you believe your account has been compromised, contact us immediately. Where a breach affects your personal data, we will notify you and the relevant regulator where the law requires it.

11. Cookies

We use essential cookies to keep you signed in and remember your preferences, and limited analytics cookies to understand product usage in aggregate. We do not use advertising or cross-site tracking cookies. You can control cookies through your browser; disabling essential cookies may break parts of the Service.

12. International transfers

Our sub-processors may process data outside your country of residence. Our primary data infrastructure is hosted in AWS eu-west-1 (Ireland). Where required, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

13. Children

The Service is for adults. It is not directed to anyone under 18, and Coaches may not take on Clients under 18 through the platform. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

14. Changes to this policy

We may update this policy as the Service evolves. Material changes — particularly any affecting health data — will be communicated by email or in-app notice before they take effect, and where required we will ask for fresh consent.

15. Contact

Peak Performance FZC
Sharjah, United Arab Emirates
info@peakperformance.to