Privacy Policy
This service is operated by 18072132 Canada Inc. ("we," "us"), a corporation incorporated under the Canada Business Corporations Act, based in Toronto, Ontario, Canada. We comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Health and fitness data is among the most sensitive personal information there is, and this policy describes exactly how we handle it.
What we collect
- Account information: your name, email address, and beta-application details you provide.
- Wearable and training data: activity, heart-rate, sleep, recovery, and related fitness metrics from your connected device — synced from your Garmin Connect account only after you explicitly authorize the connection. You choose what is shared and can revoke access at any time.
- Self-reported data: notes, effort ratings, goals, constraints, and training history you enter.
- Health documents you choose to upload: such as laboratory results or body-composition reports, if and only if you provide them. Uploaded files are not stored — each document is sent once to our AI provider to transcribe the values and is not retained; only the values you confirm are kept, and identifier-like fields (names, dates of birth, health-card numbers) are automatically discarded. Please don't upload documents showing your health card number — black it out first; a stray number is discarded, not stored.
- Technical data: basic logs (timestamps, error reports) needed to operate and secure the service. We use no analytics or third-party tracking, and our emails are transactional only.
How we use it
Your data is used for exactly one purpose: generating and adapting your coaching. That includes building your training plans, adjusting them to your recovery, applying safety guardrails, and presenting your own trends back to you. We do not sell your data, share it with advertisers or data brokers, or use it to train general-purpose AI models.
Consent
We collect and process your data only with your express consent, captured in-app at signup through a consent gate covering the Terms of Use, Privacy Policy, Health-Data Consent, and Medical Disclaimer. We do not use your health data to improve products or to train AI models; if we ever propose product-improvement use, we will ask for your separate, optional opt-in first. You may withdraw consent at any time by emailing privacy@cantaigalabs.com; withdrawal stops future processing of that data.
Storage and security
Your data is stored in Canada, encrypted in transit and at rest, with row-level isolation so users cannot see each other's data, and sensitive medical fields (lab values, medications, health flags) are additionally encrypted at the application level (AES-256-GCM), with the encryption key held by our server rather than by our database provider. AI processing is performed by Anthropic (Claude API) on servers in the United States, under commercial terms that prohibit the use of your data for model training; the context we send is designed to exclude your name and email. Our application and background-job hosting also runs on servers in the United States. While your information is processed outside Canada it is subject to the laws of that jurisdiction; we protect it by contract and by pseudonymization.
Service providers
We use a small number of processors, each only for its function: Supabase (database and authentication, stored in Canada, ca-central-1), Anthropic (AI plan generation, United States), our application-hosting providers (United States), and Open-Meteo (weather by approximate location; no account data is sent). They process data on our instructions only. We never sell or rent personal information to anyone.
Retention and deletion
We keep your data only while you use the service. If you leave the beta, or ask us to, we delete your personal data from active systems within 30 days, except minimal records we are legally required to keep. You can request deletion at any time by email.
Your rights
You may request access to the personal information we hold about you, ask us to correct it, withdraw consent, or request deletion — all by contacting us at the address below. We respond within 30 days. If you are unsatisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
Who can use the service
The beta is offered by invitation to adults aged 18 and over who are residents of Canada; it is not currently offered to Quebec residents. Age is confirmed at signup and under-18 dates of birth are blocked. We do not knowingly collect data from anyone under 18.
Not medical advice. This service provides coaching and education only. It does not provide medical advice, diagnosis, or treatment. Laboratory data is presented as values, reference ranges, and trends — never interpreted diagnostically. Consult a physician before beginning any exercise program and about any laboratory results.
Changes to this policy
If we make material changes, we will notify beta participants by email before they take effect and update the date at the top of this page.
Contact
Privacy questions or requests: privacy@cantaigalabs.com
18072132 Canada Inc., Toronto, Ontario, Canada.