Privacy Policy

1. Who We Are

Take Control Training Inc. (Ontario Corporation No. 1001644756), operating as TCT Gym ("we", "us", "our"), operates the website tctgym.com and the TCT mobile application. Our facility is located at Unit 108, 1077 Boundary Road, Oshawa, Ontario, Canada. For privacy-related inquiries, contact us at trevor@takecontroltraining.com.

2. Information We Collect

We collect the following types of personal information:

Account information: First name, last name, email address, phone number, and date of birth when you create an account.

Profile data: Training preferences, class attendance history, program enrollment, booking records, and check-in records.

Health and fitness data: Daily check-in entries (mood, energy, soreness, sleep), body and fitness measurements (such as weight, body-fat percentage, and resting heart rate) that you or our equipment record, workout and exercise history, run and walk activity, and training goals. In the mobile app this can also include activity data you choose to import from Apple Health or Health Connect. We treat all of this as sensitive personal information. Section 3 explains it in full.

Location data: If you use run tracking in the mobile app, we collect precise GPS location to draw your route and calculate distance, pace, and elevation. With your separate permission this continues while the app is in the background so a run keeps recording with your screen locked. Location is collected only during an activity you start, and never in the background at any other time.

Photos and videos: Optional profile photos and, if you use AI Form Check, short exercise videos you record or select.

Payment information: When you make a purchase, payment is processed securely through Stripe. We do not store credit card numbers on our servers. Card data is entered directly into Stripe's secure iframe or on Stripe's hosted checkout page and transmitted only to Stripe.

Communications: Email address and name when you subscribe to our newsletter or lead magnets.

Usage data: Pages visited, features used, device type, browser information, and referring sources. This is collected automatically for analytics purposes (see Section 4).

Cookies: We use essential cookies to keep you signed in (Supabase Auth session cookies) and functional cookies for site preferences. We also use analytics cookies set by our analytics provider (see Section 4). We do not use third-party advertising or retargeting cookies.

3. Health and Fitness Data

The TCT mobile app is a training app, so it handles health and fitness information. This section explains exactly what we access, why we access it, how long we keep it, and how you remove it. Everything below applies to the mobile app. The tctgym.com website does not access health data.

What we collect directly in the app

Daily check-in entries such as mood, energy, soreness, and sleep. Body and fitness measurements such as weight, body-fat percentage, and resting heart rate, where you enter them or where they are recorded on our gym equipment. Your workout history and exercise performance, including sets, reps, and loads. Runs and walks you track in the app, including GPS route, distance, pace, elevation, and step count. Your stated training goals.

What we read from Apple Health (iOS)

If you turn on the Apple Health connection, and only after you grant permission in the iOS Health permission screen, the app reads: workouts, workout routes, heart rate recorded during those workouts, walking and running distance, and step count. We use this to import your Apple Watch and iPhone runs so they appear in the app and count toward your training progression. If you ask us to, the app can also write workouts you log in TCT back to Apple Health. We do not read any other Apple Health category. We never use Apple Health data for advertising, and we never share it with third parties.

What we read from Health Connect (Android)

If you turn on the Health Connect connection, and only after you grant permission in Health Connect, the app reads exactly two data types:

Exercise (READ_EXERCISE): your exercise sessions, so the app can identify your runs and their start time, end time, and distance.
Exercise routes (READ_EXERCISE_ROUTES): the GPS route recorded with a run, so the app can draw the map and calculate splits.

Those two permissions are the minimum needed for the one feature that uses Health Connect: importing your runs so they show up in the app with a map and credit your progression. We do not request heart rate, sleep, nutrition, body measurements, or any other Health Connect data type on Android. We do not write any data to Health Connect. We do not read Health Connect data in the background: a read happens only when you open the app and sync.

How we use health and fitness data

We use it only to deliver features you can see: showing your runs, workouts, and check-ins back to you; tracking progress, streaks, levels, and achievements; personalizing training recommendations and reminders; and letting your coach support your training. We do not use health or fitness data for advertising or marketing profiling. We do not sell it. We do not use it to train third-party AI models. We do not transfer it to data brokers.

How it is stored and secured

Health and fitness data is stored in our Supabase database, encrypted in transit (HTTPS/TLS 1.2+) and at rest, and protected by row-level security so your records are readable only by your account and by TCT staff who need them to support you. Data imported from Apple Health or Health Connect is read on your device, converted to a run record, and stored the same way. Sensitive credentials on your device are held in the operating system secure store.

Who it is shared with

We do not share your health or fitness data with third parties for their own purposes. It is processed only by the service providers listed in Section 7 that we use to run the app, principally Supabase (database and authentication) and Sentry (crash diagnostics, with personal information scrubbed). Each acts on our instructions under contract. Data derived from Apple Health or Health Connect is never shared with any third party, never used for advertising, and never sold.

How long we keep it and how you delete it

We keep your health and fitness data for as long as your account is active, because it is your training history. You can delete individual runs, workouts, and check-ins in the app at any time. To remove all of it, delete your account in the app under Settings, then Delete Account, or use tctgym.com/delete-account. Deleting your account permanently erases your health and fitness data, including everything imported from Apple Health and Health Connect, within 30 days. Health data is not retained for any legal or tax purpose, so no health records survive account deletion.

You can withdraw access at any time without deleting your account. On Android, open the Health Connect app, then App permissions, then TCT Gym, and revoke access. On iOS, open Settings, then Health, then Data Access & Devices, then TCT Gym. Revoking access stops all further reads immediately. Anything already imported stays in your TCT training history until you delete it in the app or delete your account.

4. Analytics

We use Ahrefs Web Analytics (provided by Ahrefs Pte. Ltd.) to understand how visitors use our website. Ahrefs collects anonymized or pseudonymized data about page views, referrers, device type, and general browsing behavior. This helps us improve our content and user experience. Ahrefs' privacy practices are available at ahrefs.com/privacy.

If you are located in the European Union or the United Kingdom and wish to opt out of analytics, you may use your browser's "Do Not Track" setting, block third-party cookies, or contact us at trevor@takecontroltraining.com to request exclusion.

5. How We Use Your Information

We use personal information to:

Provide and maintain your account and memberships; process bookings and class registrations; process purchases and manage shipping; send transactional emails (booking confirmations, password resets, purchase receipts); send marketing emails if you have opted in (training tips, promotions, class announcements, and news); track training progress and program completion; improve our website, app, and services; comply with legal obligations.

6. Email Marketing

We send marketing emails only to users who have opted in, either by checking the marketing consent box during account creation, subscribing through our newsletter popup, or submitting a lead magnet form. Every marketing email includes an unsubscribe link. You can also manage your email preferences in your account settings at any time.

7. How We Share Your Information

We do not sell your personal information. We share data only with:

Service providers: Supabase Inc. (database and authentication), Stripe Inc. (payment processing), RevenueCat, Inc. (mobile subscription management), Resend (email delivery), Twilio (SMS reminders, where you opt in), Functional Software, Inc. dba Sentry (crash and error diagnostics, with personal information scrubbed), Lovable.dev (website hosting and deployment), Cloudflare, Inc. (edge CDN, DDoS protection, and bot and spam protection on our sign-up and login forms via Cloudflare Turnstile), and Ahrefs Pte. Ltd. (web analytics, website only). Each is bound by their own privacy policies and data-processing terms, and each acts only on our instructions.

Health and fitness data is not shared. We do not share health or fitness data, including anything read from Apple Health or Health Connect, with any third party for that party's own purposes. It is never sold, never used for advertising, never transferred to data brokers, and never used to train third-party AI models. It is processed only by Supabase, which stores it, and Sentry, which may incidentally receive diagnostic context with personal information scrubbed. Ahrefs receives no app data and no health data of any kind.

Legal requirements: We may disclose information if required by law, court order, or governmental request.

Your profile display name may be visible to other TCT members if you choose to make your profile public. You can control your profile visibility in account settings.

8. Data Retention

We retain your account data for as long as your account is active. If you request account deletion, we will remove your personal information within 30 days, except where retention is required by law (e.g., transaction records for tax purposes). Newsletter subscriber data is retained until you unsubscribe.

Health and fitness data. Your health and fitness data, including runs, workouts, check-ins, body measurements, and anything imported from Apple Health or Health Connect, is kept only while your account is active. You can delete individual records in the app at any time. Deleting your account erases all of it permanently within 30 days. No legal or tax exception applies to health data, so none of it is retained after deletion. You can delete your account in the app under Settings, then Delete Account, or at tctgym.com/delete-account.

9. Your Rights

Under Canadian privacy law (PIPEDA) and applicable provincial legislation, you have the right to:

Access the personal information we hold about you; request correction of inaccurate information; request deletion of your account and personal data; withdraw consent for marketing communications at any time; request a copy of your data in a portable format.

To exercise any of these rights, email trevor@takecontroltraining.com.

10. Data Security

We use industry-standard security measures including encrypted connections (HTTPS/TLS 1.2+), secure authentication through Supabase Auth, row-level security on our database, and PCI-compliant payment processing through Stripe. While no system is 100% secure, we take reasonable steps to protect your information.

To protect our sign-up, login, and password-reset forms from automated abuse, we use Cloudflare Turnstile. Turnstile runs a silent verification check in your browser to confirm you are a real person. It requires no interaction and does not use tracking cookies. This processing is governed by Cloudflare's Turnstile Privacy Addendum.

11. Children's Privacy

TCT Gym serves athletes ages 12 and up. Accounts for athletes under 18 must be created with parental or guardian consent, which we collect during signup. We do not knowingly collect information from children under 12.

If a parent or guardian becomes aware that their child under 18 created an account without their consent, they may contact us at trevor@takecontroltraining.com to have the account and associated data removed.

12. International Data Transfers

Some of our service providers are located outside Canada, including in the United States (Stripe, Supabase, Resend, Cloudflare, Lovable.dev) and Singapore (Ahrefs Pte. Ltd.). By using our services, you acknowledge that your personal information may be transferred to and processed in these jurisdictions. We work only with providers who contractually commit to privacy protections comparable to those required under PIPEDA, and where applicable, under the EU Standard Contractual Clauses or equivalent safeguards.

13. Rights for Residents of the European Union and United Kingdom

If you are located in the EU or UK, the General Data Protection Regulation (GDPR) grants you additional rights:

Right to access the personal data we hold about you; right to rectification of inaccurate or incomplete data; right to erasure ("right to be forgotten"); right to restrict processing in certain circumstances; right to data portability (to receive your data in a machine-readable format); right to object to processing based on legitimate interests or direct marketing; right to withdraw consent at any time; right to lodge a complaint with your local data protection authority.

Lawful bases for processing: We process your data on the basis of (a) contract performance (to provide the services you sign up for), (b) consent (for marketing emails and analytics), and (c) legitimate interests (to secure and improve our services).

To exercise any GDPR right, email trevor@takecontroltraining.com. We will respond within 30 days.

14. Rights for Residents of the United States

If you live in the United States, the health and fitness data described in Section 3 is "consumer health data" under state laws such as the Washington My Health My Data Act, and comparable laws in Nevada and Connecticut. We are not a HIPAA covered entity, so HIPAA does not govern this data; the state laws above and the FTC Health Breach Notification Rule do.

Consent: We collect and use your health and fitness data only with your consent, given when you enable the relevant feature in the app (check-ins, body measurements, Apple Health or Health Connect import). We do not sell consumer health data, and we do not share it for advertising. You can withdraw consent at any time by turning the feature off or revoking the health permission on your device, as described in Section 3.

Your rights: You may confirm whether we collect your consumer health data, access it, request a list of the third parties we have shared it with (Section 7), withdraw consent, and have it deleted. Deleting your account erases all of it within 30 days, including from our backups and from any service provider that holds it on our behalf. We do not discriminate against you for exercising these rights.

Breach notice: If your unsecured health or fitness data is disclosed without authorization, we will notify you by email without unreasonable delay and within 60 days of discovery, and will notify the Federal Trade Commission and any state regulator that requires it.

To exercise any of these rights, email trevor@takecontroltraining.com. We will respond within 45 days. If we deny your request, you may appeal by replying to our response, and we will answer the appeal within 45 days.

15. Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of our services after changes constitutes acceptance of the updated policy.

16. Contact Us

If you have questions about this privacy policy or your personal data, contact us at:
trevor@takecontroltraining.com
TCT Gym, Unit 108, 1077 Boundary Road, Oshawa, Ontario, Canada