Privacy Policy

Last updated 28 October 2026

This policy explains what personal information Champions Performance (“we”, “us”) collects through the Champions Performance coaching app, why, who sees it, how long we keep it and the choices you have. A separate Consumer Health Data Privacy Policy covers health data under US state health-privacy laws (Washington, Nevada, Connecticut and similar).

Who we are

[Fill in: Legal business name], [Fill in: Entity type and state of formation], trading as Champions Performance
[Fill in: Mailing address]
Email: [Fill in: Privacy and support email]
Phone: [Fill in: Phone number]

Person responsible for privacy: [Fill in: Person responsible for privacy].

What we collect

• Account and contact details: name, email address, phone number (optional), country and time zone. Your coach creates your account with these.
• Optional profile details: mailing address and social media usernames, only if you add them.
• Body and health information (we treat all of it as sensitive health data):
  • Height, weight, body fat, gender (set by your coach).
  • Your answers to the pre-exercise health questions, and injuries, pain or surgeries you tell us about.
  • Readiness answers before workouts, and morning readings such as heart rate variability (HRV), resting heart rate and sleep.
  • If you turn it on: menstrual cycle days and symptoms.
  • Documents you upload, such as DEXA scans, blood work, medical clearance or physio reports.
  • Progress photos you upload.
• Training, nutrition and lifestyle logs: workouts, sets, effort ratings, sessions, schedule, food diary, water, supplements, habits and your fight record.
• Communications: weekly check-ins, messages with your coach, and the notes and tags your coach keeps about your coaching.
• Wearable data, only if you connect a device: from the device makers you connect (such as WHOOP, Garmin or Oura), or from Apple Health or Android Health Connect through the Open Wearables phone app, we receive sleep (duration, stages, naps), HRV, resting heart rate and recovery, and also workouts, activity and body measurements where your device sends them. We show you and your coach sleep, HRV, resting heart rate and recovery. Device data is kept on our own Open Wearables server (open-source software we run ourselves).
• Technical data: a sign-in cookie and a few settings saved in your browser (see Cookies & Storage). Our hosting providers also log requests (including IP address, browser type and time) for security and to fix problems.

We don’t use analytics, advertising or tracking tools, and we don’t buy data about you from anyone.

Where it comes from

From you, from your coach, and, if you connect one, from your wearable’s maker or your phone’s health app, through our own Open Wearables server.

Why we use it

• To provide coaching: programs, nutrition targets, progress tracking, check-ins and messages.
• To keep training safe, for example following up on health-check answers.
• To send reminders and service messages you’ve set up.
• To run, secure and fix the app.
• To handle payments and comply with the law.

We never use your information for advertising, never sell it, and don’t use it to train artificial intelligence models.

Legal bases (EU/UK):

• Performing our contract with you (your account and coaching).
• Your explicit consent for health data, wearable connections and cycle tracking. You can withdraw consent at any time.
• Our legitimate interests in keeping the service secure.
• Legal obligations.

Automatic calculations

The app calculates things like training load, readiness flags and nutrition targets to help you and your coach. They’re information, not medical judgements. No decision with legal or similarly significant effects is made about you automatically; your coach reviews everything.

Who we share it with

• Your coach and our coaching staff, who are bound by confidentiality. Your cycle data is visible to your coach only if you switch on sharing.
• Service providers that run the app for us, under contract and only on our instructions:
  • Hosting: [Fill in: Hosting providers and countries].
  • Backups: [Fill in: Backups].
  • Invites and messages: [Fill in: Provider that sends invite emails or texts].
  • Payments: [Fill in: Payment processor].
  • Client management: [Fill in: Client-management (CRM) provider and what it receives].
• Device makers you connect, such as WHOOP, Garmin or Oura. You sign in on their site and they send us data under their own privacy policy. We send them nothing about your other data. Apple Health and Android Health Connect data reaches us only through the Open Wearables phone app, which you install and allow yourself.
• Open Food Facts, when you scan or type a barcode the app doesn’t know yet: our server looks the product up and sends only the barcode number.
• YouTube, for exercise videos: thumbnails load from YouTube’s image server, which receives your IP address but not your coaching data, and a video opens on YouTube’s own site.
• Authorities or others, when the law requires it, to protect someone’s safety, or in a business sale (you’d be told).

We don’t sell personal information or share it for cross-context behavioural advertising, as those terms are used in US state laws. We respect Global Privacy Control signals, though we have nothing to opt you out of.

International transfers

Our servers are with [Fill in: Hosting providers and countries]. If your information moves between countries (for example from the EU, UK, Canada or Australia to the United States), we use legally recognised safeguards such as the European Commission’s Standard Contractual Clauses or the UK’s transfer addendum, and require the same protection from our providers.

How long we keep it

• Your information is kept while your account is open.
• When you or your coach close the account, we delete it within 30 days.
• Backups ([Fill in: Backups]) are replaced on a rolling schedule, so deleted information drops out of them as they expire.
• If a backup ever has to be restored, we re-apply every deletion made since it was taken. To do that we keep a short record of the deletion (account ID, data type and date), but not the deleted data.
• Server logs are kept for up to [Fill in: Days server logs are kept] days.
• Payment records are kept as long as tax law requires.

Security

Connections are encrypted (HTTPS), and our hosting provider encrypts the information it stores. Database rules mean each athlete can reach only their own information, and only their coach can see it. Progress photos and documents are kept in private storage and shown only through links that expire after an hour. No system is perfectly secure. If a breach affects you, we’ll notify you and the authorities as the law requires, including under the US Federal Trade Commission’s Health Breach Notification Rule and the GDPR.

Your rights

Depending on where you live, you can:

• Ask what we hold about you and get a copy.
• Have it corrected or deleted.
• Take it elsewhere.
• Object to or restrict some uses.
• Withdraw consent.
• Appeal a decision we make about your request.

You can do most of this yourself in the app, under Settings:

• Download my data gives you a machine-readable copy.
• Request account deletion deletes your account.
• The privacy and consent settings withdraw individual consents.
• Disconnecting a device stops wearable data, and Delete imported data removes what was already imported (Settings → Connected devices).

For anything else, email [Fill in: Privacy and support email]. We’ll confirm who you are before acting and answer within 30 days (45 days where US state law allows, and we’ll tell you if we need longer). An authorised agent may ask on your behalf where the law allows. We won’t treat you differently for using your rights.

If you’re unhappy with our answer you can appeal by replying to it, and you can complain to:

• your data protection authority (EU or UK ICO);
• the Office of the Privacy Commissioner of Canada, or the Commission d’accès à l’information in Quebec;
• the Office of the Australian Information Commissioner;
• your state Attorney General (US).

Representatives: EU: [Fill in: EU representative (GDPR Art. 27)]. UK: [Fill in: UK representative (UK GDPR Art. 27)].

Age

The app is only for adults (18 or older). We don’t knowingly collect information from anyone younger and will delete it if we learn we have.

Changes

We’ll post changes here with a new date. If a change affects how we use your health data or your rights, we’ll ask you to review and agree in the app before it applies to you.