Privacy Policy
Last updated: 4 June 2026 Effective date: 4 June 2026
This Privacy Policy describes how Jaspreet Sambee (“we”, “us”, “our”) handles personal information collected through the ELITEform iOS application (“the App”). By creating an account or using the App, you agree to the practices described here.
ELITEform is a coaching application that connects personal trainers (“coaches”) with their clients. It is not an open social network. Connections between coaches and clients are established only when a coach issues an invite code to a specific client, and the client redeems it.
1. Information we collect
We collect only what is needed to run the coaching service. We do not use advertising or analytics SDKs, and we do not track you across other apps or websites.
1.1 Account information
- Email address (for authentication)
- Display name and role (coach or client)
- Coach-client relationship records (which coach is linked to which client)
1.2 Coaching and fitness data you log in the App
- Body weight, height, water intake, sleep hours and quality, daily step counts
- Meals you log (name, kind, calories, macros)
- Workouts you complete (exercises, sets, reps, weight, RPE, duration)
- Weekly check-in measurements, weight, and notes
- Progress photos that you choose to upload
- Training programs that you or your coach create
1.3 Coach–client communications
- Chat messages between a client and their linked coach
- Reports filed against messages, photos, or users using the in-app “Report” feature
- Records of users you have blocked
1.4 Health data (Apple HealthKit) — optional
If you grant permission, the App reads the following from Apple Health on your device:
- Steps, body weight, resting heart rate
If you grant permission, the App may write the following back to Apple Health:
- Body weight values you enter manually
HealthKit data stays on your device, is not transmitted to our servers unless you log it through the App (e.g., the App auto-fills a weight log from HealthKit, which is then saved to our backend like any other log).
1.5 Technical data
- Push notification device tokens (Apple Push Notification service identifiers), so the App can deliver notifications
- Server timestamps for when records were created or updated
- Information you submit through the support contact form (Tally), including any text and email address you choose to provide there
We do not collect: precise location, contacts, IDFA, advertising identifiers, browsing history, microphone audio, or HealthKit data beyond what is listed above.
2. How we use information
We use the information described above only to:
- Operate the coaching service (sync data between your devices, deliver messages between you and your coach, calculate macros and targets)
- Send you push notifications you have opted into (workouts completed, plan updates, etc.)
- Respond to support requests
- Review reports of abuse or policy violations
- Protect the safety of users and the integrity of the service
- Comply with applicable law
We do not sell your personal information. We do not use it to train AI models. We do not use it for behavioural advertising.
3. Who has access to your data
3.1 Inside the App
- Your coach has read access to only the data you log as their client: weight logs, water logs, sleep logs, steps, meals, check-ins, workouts, progress photos, and chat messages between the two of you. Coaches do not see your account email or password.
- You have read access to only your own data and your linked coach’s profile and messages to you.
These boundaries are enforced by row-level security at the database layer, not by the App alone.
3.2 Service providers (processors)
We use the following third parties to operate the App. They access data only as needed to provide their services, and only for as long as needed.
- Supabase, Inc. — database, authentication, storage, and realtime messaging. Hosted on Amazon Web Services. See: https://supabase.com/privacy
- Cloudflare, Inc. — content delivery and DNS for the contact form and policy site
- Apple Inc. — push notifications (Apple Push Notification service). See: https://www.apple.com/legal/privacy/
- Tally Forms — receives the contents of the support contact form. See: https://tally.so/help/privacy
We do not share your information with advertisers, data brokers, or any third party for marketing purposes.
3.3 Legal disclosures
We may disclose information if required to do so by law, regulation, legal process, or governmental request, or to enforce our Community Guidelines.
4. International data transfers
Our backend is hosted on Supabase, which uses Amazon Web Services data centres. Depending on the region, this may mean your data is processed in the United States or other countries. By using the App you consent to this transfer.
For users in the European Economic Area, the United Kingdom, or Switzerland: we rely on Standard Contractual Clauses as the legal basis for cross-border transfers where required.
5. Data retention
We keep your information for as long as your account is active.
When you delete your account using the in-app Settings → Delete account flow, we:
- Permanently delete your profile, weight/water/sleep/steps logs, meals, workouts, check-ins, chat messages, supplements, cardio entries, and any progress photos you uploaded
- Remove your authentication record from Supabase
- Cascade-delete all linked rows referencing your user ID
The deletion is irreversible. Backups containing your data are overwritten on the provider’s standard rotation (typically 30 days at Supabase).
Support form submissions are retained for up to 12 months for support continuity, then deleted.
6. Your rights
Depending on where you live, you may have rights under privacy laws including the EU General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act (CCPA). These include:
- Access — request a copy of the personal data we hold about you
- Correction — ask us to fix inaccurate data (you can also edit profile data directly in the App)
- Deletion — delete your data, available immediately via Settings → Delete account
- Portability — receive a machine-readable copy of your data
- Objection / restriction — object to or restrict certain processing
- Withdraw consent — withdraw consent for optional processing (e.g., HealthKit, push notifications) at any time via iOS Settings
To exercise any of these rights, contact us through the form linked below. We will respond within 30 days.
California residents: we have not sold or shared personal information in the preceding 12 months. We do not have actual knowledge of selling or sharing the personal information of users under 16.
7. Children
ELITEform is not intended for use by anyone under 13 years of age (under 16 in the European Economic Area). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.
8. Security
We use industry-standard measures to protect your data, including:
- TLS for data in transit
- Row-level security on the database, so users can only read their own (and their linked coach/client’s) data
- Encrypted storage at rest at the cloud provider level
- Authentication via JSON Web Tokens with short-lived sessions
No system is perfectly secure. If we become aware of a data breach affecting your information, we will notify affected users without undue delay, consistent with applicable law.
9. Changes to this policy
We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date at the top, and where significant, by an in-app notice. Your continued use of the App after an update means you accept the updated policy.
10. Contact
For any privacy question, request, or concern, contact us via:
https://tally.so/r/Bzep9N
We aim to respond to privacy requests within 30 days.
11. Governing law
This policy is governed by the laws of Canada. Any dispute arising from the App or this policy shall be subject to the courts of Canada, without prejudice to mandatory consumer-protection rights you may have under your local law.