Privacy Policy

This policy applies to:

• Visitors to northperformance.ca
• Individuals who submit a coaching application through our portal
• Active and former coaching clients of North Performance, including anyone with an account on our client portal

North Performance is based in Ontario, Canada, and operated by Devin Owen.

We collect only the information reasonably necessary to evaluate applications, deliver coaching services, and operate our business. This falls into the following categories:

We collect and use personal information only for the following purposes:

• To evaluate coaching applications and determine fit for a program
• To design, deliver, and adjust individualized coaching, nutrition, and training programs
• To prepare draft nutrition, supplement, and workout plans with the assistance of an AI service (OpenAI), using the health, goal, and check-in information described in Section 7. Every draft is reviewed and edited by Devin Owen before it is shared with you.
• To create and secure your portal account and verify your identity when you sign in
• To process subscription payments and manage your subscription
• To communicate with you about your application or your program, including automated service emails such as portal invitations and weekly check-in reminders, and to help you schedule calls
• To maintain accurate records of our coaching relationship, including your agreement to our terms, for our own accountability and, where relevant, legal protection
• To improve our programs and services
• To meet legal, accounting, or regulatory obligations

We do not use your information for any purpose beyond what is reasonably related to these activities, and we do not use client health information for marketing without your separate, explicit consent.

By submitting an application, you consent to North Performance collecting and using your information as described in this policy for the purpose of evaluating your application. If you become a client, we will rely on your ongoing consent — implied by your continued participation — to collect and use the additional health and progress information necessary to deliver coaching services.

Sending your health and goal information to an AI service operated by a company in the United States is a use that goes beyond what you might otherwise expect, and health information is sensitive. For that reason we do not rely on general or implied consent for it. We describe this use specifically in Section 3 and Section 7, including exactly what is sent, who receives it, and how long it is kept. You may ask us at any time not to use your information for AI-assisted plan drafting; if you do, we will prepare your plans without sending your information to OpenAI, and this will not affect the coaching services you receive.

You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent may limit or end our ability to provide coaching services to you. To withdraw consent, contact us using the details in Section 13.

• Application and client information, plans, check-ins, notes, and agreement records are stored in a database hosted by Supabase on Amazon Web Services infrastructure in Oregon, USA (the us-west-2 region). Access is restricted through account-based access controls, so that clients can view only their own records.
• Our website and client portal are hosted by Vercel. Sign-in is handled by Clerk. Payments are handled by Stripe. These providers are described in Section 7.
• We limit access to your personal information to Devin Owen and, in the future, any coaching staff directly involved in delivering your program. Our service providers (Section 7) also have technical access to the information they host or process for us, solely to provide their services to us. We do not sell, rent, or trade your personal information to third parties.
• We take reasonable steps to protect your information against loss, theft, unauthorized access, disclosure, or misuse, appropriate to the sensitivity of the information involved.

No method of storage or transmission is perfectly secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and any required authorities as required by law.

• If your application is not accepted, we retain your application information for a limited period (up to 12 months) in case you apply again, unless you ask us to delete it sooner.
• If you become a client, we retain your coaching records for the duration of our working relationship and for a reasonable period afterward, to meet potential legal, insurance, or accountability needs.
• Information sent to OpenAI for plan drafting is retained by OpenAI for up to 30 days for abuse-monitoring purposes and then deleted, unless OpenAI is legally required to keep it longer. See Section 7.
• Stripe, Clerk, Resend, Supabase, Vercel, and Calendly each keep the information they hold in accordance with their own terms and privacy policies (linked in Section 7). We do not control their retention periods. Stripe, in particular, may be required by financial regulations to keep transaction records even after an account is closed.
• Our internal activity log (Section 2g) is an audit trail and is kept even after a client record is deleted. Entries that relate to a deleted client may still contain that client's name and email address.
• You may request deletion of your information at any time, as described in Section 9, subject to any legal obligation we may have to retain certain records. When we delete your client record, we delete the plans, check-ins, notes, and agreement records linked to it, and we will also arrange for your sign-in account at Clerk and your customer record at Stripe to be deleted or closed, to the extent permitted by law.

We use the following service providers to operate our business. Each is permitted to use your information only to provide its service to us:

• OpenAI (AI-assisted plan drafting). When Devin Owen chooses to generate a draft nutrition, supplement, or workout plan with AI assistance, we send OpenAI, through its business API, the following information about you: age, sex, height, current weight, your goals, your health notes, your current plan, your recent check-ins (dates, weights, mood, and your check-in notes), and, depending on the type of plan, your training experience, equipment access, sessions per week, and dietary pattern. We do not send your name, email address, phone number, city, emergency contact, or date of birth. OpenAI's output is a draft only: it is reviewed and edited by Devin Owen before anything is shared with you, and no decision about you is made automatically. Under OpenAI's standard API terms, data sent through the API is not used to train OpenAI's models by default, and is retained for up to 30 days for abuse-monitoring purposes and then deleted, unless OpenAI is legally required to keep it longer. We do not currently have a zero-data-retention agreement with OpenAI. See OpenAI's data controls and privacy policy.
• Stripe (payments). Processes your subscription payments and holds your payment card and billing details. Stripe's privacy policy.
• Clerk (sign-in and account security). Manages portal accounts, sign-in credentials, and sessions. Clerk's privacy policy.
• Supabase (database). Hosts the database that stores your application, client, plan, check-in, note, and agreement records, in Oregon, USA. Supabase's privacy policy.
• Vercel (website and portal hosting). Hosts northperformance.ca and the client portal, and may process technical information such as IP addresses in server logs. Vercel's privacy policy.
• Resend (email delivery). Delivers our service emails (portal invitations and weekly check-in reminders) to your email address. Resend's privacy policy.
• Calendly (call scheduling). If you use the scheduling option in the portal to book a call, the details you enter are provided to Calendly. Calendly's privacy policy.
• Google (email correspondence). We use Google's email service to correspond with you. Google's privacy policy.

Beyond these service providers, we do not disclose your personal information to third parties except:

• If required by law, regulation, subpoena, or court order
• To protect the rights, safety, or property of North Performance, our clients, or others
• With your explicit consent, for any other purpose

Apart from the service providers listed above, which handle information only on our behalf, we do not disclose client health or coaching information to any third party without your consent, except as required by law.

Our service providers — OpenAI, Stripe, Clerk, Vercel, Resend, and Supabase — operate in the United States and may process your information there or in other countries outside Canada. Our database is hosted in Oregon, USA. Your information may therefore be processed and stored outside Canada.

While your information is outside Canada, it is subject to the laws of the country where it is held, and courts, law enforcement, and other government authorities in those jurisdictions may be able to access it under those laws. We rely on our service providers' contractual and security commitments to protect it, but we cannot guarantee that foreign laws will offer the same protection as Canadian law. If you have questions about where your information is processed, contact us using the details in Section 13.

Under PIPEDA, you have the right to:

• Know what personal information we hold about you and why
• Access the personal information we hold about you
• Request correction of inaccurate or incomplete information
• Withdraw consent for our continued collection, use, or disclosure of your information (subject to legal and contractual limits), including asking us not to use your information for AI-assisted plan drafting
• Request deletion of your personal information, subject to our legal retention obligations
• Ask questions about our privacy practices or file a complaint

These rights extend to information held about you by the service providers we use in Section 7. To exercise any of them, email us at the address in Section 13. We may ask you to confirm your identity first. For a deletion request, we will delete your record from our database and will ask Clerk and Stripe to delete or close the records they hold for you, subject to the retention limits described in Section 6. We will respond within a reasonable time and in accordance with PIPEDA's requirements.

If you are not satisfied with our response, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca).

Our website may use cookies or similar technologies for basic functionality and to understand how visitors use our site. You can control or disable cookies through your browser settings; doing so may affect how parts of the site function.

Our client portal uses cookies set by Clerk to keep you signed in and to keep your account secure. These are required for the portal to work, and blocking them will prevent you from signing in. The scheduling and payment pages provided by Calendly and Stripe may also set their own cookies, which are governed by those providers' policies.

North Performance's coaching services and website are intended for adults. We do not knowingly collect personal information from individuals under the age of 18. If you believe we have inadvertently collected information from a minor, please contact us so we can remove it.

We may update this policy from time to time to reflect changes in our practices or legal requirements. The “Last updated” date at the top of this page will reflect the most recent revision. Material changes will be communicated to active clients directly.

If you have questions about this policy, want to access or correct your information, or wish to withdraw consent, contact us at: