Privacy Policy
koach.ca
Version 2.0 — Effective date: October 15, 2026
For accounts opened before October 15, 2026, this version takes effect on November 14, 2026. Until then, the previous version applies; it stays available at koach.ca/privacy-policy/?version=1.0.
1. Who we are and how to reach us
koach.ca is an online personal training platform operated by Koach Fitness, a sole proprietorship based in the Province of Quebec, Canada.
For any question about this Privacy Policy or about your personal information, contact our Privacy Officer:
- Privacy Officer: Alec Baltadjian
- Email: hello@koach.ca
- Service area: Quebec, Canada (services delivered online across Canada)
We respond to privacy-related requests within 10 business days of receipt.
In this policy, "we," "us," "our," and "koach" refer to koach.ca. "You" and "your" refer to any person visiting our website or using our services.
2. The personal information we collect
We collect only the personal information we need to deliver our services, keep your account secure, and meet our legal obligations. The categories below describe what we collect.
2.1 Account information
- Full name
- Email address
- Phone number (if you provide one)
- Mailing or billing address (for payment processing and tax records)
- Password (stored as a one-way hash; we never see your plain password)
- Profile photo (optional)
2.2 Health and fitness information
Before you can begin any training program, you complete a Physical Activity Readiness Questionnaire (PAR-Q+) and a Health and Lifestyle Questionnaire (HLQ). These collect:
- Medical history relevant to exercise participation
- Current medications
- Physical limitations, injuries, and surgical history
- Pregnancy status, where relevant
- Current activity level and training history
- Fitness goals
You also provide, during the client lifecycle:
- Body measurements (height, weight, circumferences) — metric and imperial
- Assessment results (strength, cardiovascular, mobility)
- Weekly check-in responses (subjective wellness, adherence, progress)
This information is health-sensitive and is handled with the highest level of care. We collect and use it only with your express consent, which you give when you sign the Assumption of Risk and Informed Consent during onboarding.
2.3 Payment information
When you purchase a subscription or a session, our payment processor (Stripe) collects your card details directly. Your card number never touches our servers. We store only:
- A secure token returned by Stripe
- Billing name and address
- Subscription status and history
- Transaction amounts and dates
2.4 Session and program data
- Session bookings (date, time, service type, notes you or your koach add)
- Program cards, exercise assignments, koach cues
- Your koach's notes about your sessions
- Milestones you achieve on the platform
- Media you upload (assessment videos and photos; progress photos, if applicable)
2.5 Communications
- Email correspondence with us
- Support requests and their resolution history
- Any message sent through site contact forms
2.6 Technical information
- IP address
- Browser type and version
- Operating system and device type
- Pages requested, as recorded in our hosting provider's server logs
- Form submissions you make on the site
- How you found koach (for example a search or a link) and the first page you landed on — recorded only if you accept marketing cookies, and stored with your order
2.7 Cookies and tracking technologies
See Section 11 below, and refer to our separate Cookie Policy at /cookie-policy/ for full detail on each cookie, its purpose, and its retention period.
2.8 Wearable device data (coming soon)
koach does not yet connect to wearable devices. When this feature is released, connecting a device will be optional, and it will work as follows:
- What we read: only the readings you authorize when you connect a device or its service — steps and active energy, resting heart rate, heart-rate variability and sleep, and body weight.
- Why: to show these readings beside your training and nutrition, so you and your koach can see your activity, recovery and progress. Wearable readings never change your program or your targets automatically.
- Consent: you connect each device or service yourself and approve what it shares, one service at a time.
- Withdrawal: you can disconnect a device at any time. We stop receiving new readings from that moment, and you can ask us to delete readings we already received.
- Retention: readings are kept on the same schedule as your other health and fitness information (Section 7).
We will update this section before the first device connection is offered.
3. Why we collect this information (purposes)
Quebec Law 25 requires us to state a specific purpose for each category of personal information. We do not collect information "just in case."
| Category | Purpose |
|---|---|
| Account information | Create and manage your account; authenticate you at login; deliver our services to you personally |
| Health and fitness information | Screen for safe participation in exercise (PAR-Q+); design a training program appropriate for your goals, medical history, and current capacity; track your progress safely; decide when to refer you to a medical professional |
| Body measurements and assessment results | Design and adjust your training program; track progress against your goals |
| Payment information | Process your purchase; manage recurring subscriptions; comply with Canadian and Quebec tax record-keeping obligations |
| Session and program data | Deliver coaching; keep a record of your training history; support program continuity if your koach changes |
| Weekly check-ins | Adjust your program in response to how you are feeling and progressing |
| Communications | Answer your questions; provide support; keep a record of commitments made in either direction |
| Technical information | Keep the site secure, prevent fraud, diagnose technical issues |
| Cookies and tracking | Remember your choices, keep you signed in, keep your cart, and — only if you accept — show us how you found koach so we can measure our marketing |
| Wearable readings (when available) | Show your activity, recovery and progress beside your training; never to change your program automatically |
We do not sell your personal information. We do not use your personal information to train artificial intelligence models. We do not share your information with advertising networks.
4. Legal basis and consent
Quebec Law 25 is built on consent. We collect, use and share your personal information on these grounds:
- Your consent. You give this consent when you create an account, when you submit a form, or when you choose Accept (or switch a category on) in the cookie banner. Consent is manifest, free, and informed, and is requested for specific purposes — we do not use pre-ticked boxes and we do not bundle unrelated consents.
- Providing the service you asked for. Once you have given us information, Law 25 lets us use it without asking again where that is necessary to deliver the service you requested (for example, we need your email to send you your program card), or for a purpose consistent with the one you gave it for.
- Preventing fraud and securing the platform. Law 25 lets us use information where that is necessary to prevent and detect fraud or to assess and improve our security (for example, IP logging to detect brute-force login attempts).
- Legal obligation. We keep the records the law requires us to keep (for example, tax records for seven years under Canadian and Quebec tax law).
You may withdraw consent at any time for any category that is not legally required (see Section 8). Withdrawing consent may make it impossible for us to continue providing services.
5. Third parties who process your information on our behalf
We work with a small number of specialized service providers. Each one handles your information for the purpose shown below, under its own published data-processing terms. We do not sell your information to any of these providers.
| Provider | Role | Data they receive | Where |
|---|---|---|---|
| Hostinger International Ltd. (and its affiliated Hostinger companies) | Hosts our website, database, uploaded files and the hello@koach.ca mailbox; keeps its own platform backups | All information stored on the platform | Our server and its backups are in the United States (Massachusetts). Hostinger's companies are based in Cyprus and Lithuania. |
| Stripe, Inc. (and Stripe Payments Canada, Ltd.) | Processes payments and subscriptions | Name, email, billing address, card details (collected directly by Stripe), transaction records | United States. Stripe states that it transfers the data of Canadian residents, including Quebec residents, to data centres in the United States. |
| Brevo (Sendinblue SAS) | Sends our emails: account and booking messages, reminders, health-screening confirmations and newsletters | Your name and email address, and the content of each email we send you, which can include the outcome of your health screening | France (European Union). Brevo states that data may also be transferred to the United States and India. |
| Google LLC | Google Meet video calls for live training sessions, with the calendar entry that carries the meeting link; Google Drive, where our daily database backups are stored | For live sessions: the session date and time, the meeting link, and your audio and video during the call. For backups: a full copy of our database, which includes account, health and program information. | United States and other Google locations |
| Anthropic PBC | Generates draft exercise coaching briefs for our exercise library (administrative tool) | No client personal information is sent to Anthropic. Only exercise names, muscle groups, and training framework text. | United States |
| Bunny CDN (BunnyWay d.o.o.) | Delivers exercise demonstration videos to your browser | Your IP address and browser user-agent when a video plays | Global delivery network; the company is based in Slovenia (European Union) |
| Complianz (the Complianz plugin, by Complianz B.V.) | Records your cookie consent choices | Consent record and timestamp | Stored in our own database on our server (see Hostinger above); not sent to Complianz |
We may add new service providers in the future. When we do, we will update this list, update our Cookie Policy if relevant, and, for any new category of processing that materially affects you, request renewed consent through the cookie banner or by email.
6. Transfers of your information outside Quebec
koach.ca is hosted in the United States. This means your personal information, including your health information, is stored outside Quebec and outside Canada. Some of the providers in Section 5 also operate in the European Union and in other countries, and your information may be processed there as part of normal service delivery.
Each provider processes your information under its own published data-processing terms, and we choose providers that publish their security and privacy commitments.
You have the right to know specifically where your information is transferred. Contact our Privacy Officer and we will tell you.
7. How long we keep your information
We keep your information only as long as we need it. The table below is our standard retention schedule.
| Information | How long we keep it |
|---|---|
| Account profile (name, email, contact info) | While your account is open, and up to 2 years after your last activity on the platform. |
| Health and fitness information (PAR-Q+, HLQ, assessments, body measurements, check-ins) | Up to 4 years after your last activity. We keep it this long so that, if a question or a claim about your training ever arises, the record of your screening and of what was prescribed still exists. Quebec law allows three years to bring such a claim; the fourth year is a margin. It is also useful for program continuity if you return to training. |
| Assessment videos and photos you upload (movement-screen clips, postural photos) | 45 days from the date you submit them, then permanently deleted by an automated daily process. Your assessment results — measurements, scores, training level, koach notes — are kept under the health and fitness information row above. The clips themselves are working material for building your program and are not kept beyond that window. |
| Wearable readings (when available) | Same as health and fitness information. Disconnecting a device stops collection, and you can ask us to delete readings already received. |
| Session and program data, training logs, koach notes, milestones | Same as health and fitness information — up to 4 years after your last activity, for the same reason. |
| Billing and transaction records | 7 years (required by Canadian Revenue Agency and Revenu Québec tax law). |
| Your signed Assumption of Risk and Informed Consent, your contract, and your consent records | 7 years (Quebec Civil Code prescription periods for bodily-injury-related claims, with discoverability margin). |
| Email marketing list | Until you unsubscribe or ask us to remove you. |
| Email delivery logs (technical) | 14 days. These logs hold a copy of each email we send you, and are deleted automatically. |
| Backups | Daily database backups: the 7 most recent are kept, so information we delete can remain in a backup for about a week. Backups of site files, which can include uploaded media, are taken before site updates; the 3 most recent are kept. Our hosting provider also keeps its own backups. |
| Website server logs | Kept by our hosting provider under its own log-retention settings (security and diagnostic purposes). |
| Cookie consent records | 3 years (so we can show consent was given if asked by the Commission d'accès à l'information). |
Assessment videos and photos are deleted by an automated daily process 45 days after you submit them, regardless of account activity. Email delivery logs are deleted automatically after 14 days. Other information is deleted by us at the end of its retention period, and you can ask us to delete your information earlier (see Section 8 for what we delete on request and what we keep).
If a claim or complaint is raised. If you or anyone else notifies us of a claim or a complaint about your training, we keep the records that concern it until it is resolved, even if that goes beyond the periods above.
8. Your rights under Quebec Law 25
You have the following rights over your personal information. To exercise any of them, email our Privacy Officer at hello@koach.ca. We respond within 10 business days and complete the request within 30 days, which is the Law 25 deadline.
- Right of access. Ask us what information we hold about you. We will send you a copy in a structured, commonly used format (PDF or JSON, as you prefer).
- Right of rectification. Ask us to correct any information that is inaccurate, incomplete, or out-of-date.
- Right to withdraw consent. Withdraw consent for any purpose that is not legally required. This may mean we can no longer provide some or all of our services to you.
- Right of deletion. Ask us to delete your information. On request we delete what we no longer need: your marketing contact details, your journal entries, your progress photos, and anything else that is not needed to show what was screened and prescribed. We keep, until the end of the periods in Section 7, the records we may need to answer a question or a claim about your training — your health screening, assessments, programs and training logs, your signed waiver and your contract — and the billing records the tax laws require. We tell you in writing exactly what was deleted, what was kept, why, and until when.
- Right to data portability. Ask us for the computerized information we collected from you in a structured, commonly used technological format. At your request, we will also send it to another person or organization that is authorized by law to collect it.
- Automated decisions. Your program and all coaching decisions are made by a certified koach. One step is automatic: when you complete the PAR-Q+ health screening, the platform applies the questionnaire's rules and, where they call for it, pauses your start until you obtain medical clearance. Your koach reviews every such result. You can ask us what information was used and the reasons for the result, have any incorrect information corrected, and present your observations to a person who can review the decision.
- Right to lodge a complaint. If you believe we are mishandling your information, you can complain to the Commission d'accès à l'information du Québec at cai.gouv.qc.ca or, for federally regulated aspects, to the Office of the Privacy Commissioner of Canada at priv.gc.ca.
Access to your information is free. If you ask for a copy, a transcription or a transmission that carries a real cost, we may ask for a reasonable charge, and we will tell you the approximate amount before we go ahead.
9. How to exercise your rights
Email hello@koach.ca with:
- Your full name and the email address on your koach.ca account
- A clear description of which right you want to exercise
- Any supporting information (for example, which specific record you want corrected)
We may ask you to confirm your identity before acting on the request (for example, by signing in to your account and sending the request from inside the dashboard). This is to protect you from someone else trying to impersonate you.
We will acknowledge your request within 10 business days and answer it in writing within 30 days of receiving it, which is the Law 25 deadline. If we cannot grant a request, we will tell you why and explain how you can ask the Commission d'accès à l'information to review our answer.
Complaints. If you are unhappy with how we handle your personal information, write to our Privacy Officer at hello@koach.ca. We will look into it and answer you within 30 days.
10. Security and data breach notification
We protect your information with industry-standard safeguards:
- Encrypted connections (HTTPS/TLS) for every page on the site and every form submission
- One-way password hashing (we cannot see your password and cannot recover it; we can only reset it)
- Role-based access control inside the platform
- Tokenized payments (your card number never touches our servers)
- Regular software updates and security patches
- Daily database backups
- Limited access — only your koach, the Privacy Officer and essential technical staff can access your personal information
No system is perfectly secure. If a confidentiality incident ever occurs and creates a risk of serious harm to you, we will:
- Notify the Commission d'accès à l'information du Québec promptly, as Law 25 requires
- Notify you directly and promptly, by email
- Tell you what happened, what information was affected, what we are doing, and what you can do to protect yourself
11. Cookies and tracking technologies
We use a small number of cookies and similar technologies:
- Functional cookies — needed for the site to work: signing in, your cart and checkout, security, and remembering your cookie choice. These are always on and do not require consent.
- Marketing cookies — these record how you found koach (for example a search or a link) and attach that to your order, so we can see which marketing works. They are off until you accept them in the cookie banner. Two further marketing cookies are set only in specific situations — when you click a link in one of our emails, or when you check out — so that the email or the order can be matched to your contact record.
We do not currently use analytics or advertising tools such as Google Analytics or Google Ads, and the site does not load Google reCAPTCHA or Google Fonts.
Your consent choices are recorded by our cookie consent tool (Complianz) and you can change them at any time from the Cookie choices link in our website footer, or in your account menu when you are signed in.
For a complete, current list of cookies — name, purpose, provider, and retention period — see our Cookie Policy at koach.ca/cookie-policy/.
We plan to add website analytics (Google Analytics 4, through the MonsterInsights plugin), and we may add advertising measurement (for example Google Ads conversion tracking, or social media pixels such as Meta Pixel or LinkedIn Insight Tag). Before any such tool begins operating on the site, we will update this Privacy Policy and our Cookie Policy, and the tool will run only after you accept it in the cookie banner.
12. Children's data (under 18)
koach.ca is an adult fitness platform. You must be at least 18 years of age to create an account or use our services.
When you register, you warrant that you are 18 or older. We do not knowingly collect personal information from anyone under 18.
If we become aware that someone under 18 has created an account — including where this comes to light through a PAR-Q+ age entry or any other channel — we will:
- Lock the account immediately
- Delete the personal information collected, unless we are legally required to retain specific records
- Notify the parent or legal guardian if we have contact information for them
If you are a parent or guardian and believe your child has registered on koach.ca, contact us at hello@koach.ca and we will act on the account the same business day.
13. Changes to this policy
We may update this Privacy Policy as our services, our technology, or the law evolves.
- For minor changes (clarifications, corrections, formatting), we update the effective date at the top of the policy.
- For material changes (new categories of information, new purposes, new service providers that materially affect processing), we notify you by email at least 30 days before the change takes effect, and we post a prominent notice on the site.
- You can always see the previous version — we keep versioned copies of this policy.
Continued use of the service after the effective date of a material change means you accept the new terms. If you do not agree, you may close your account as described in Section 8.
14. Contact
Privacy Officer: Alec Baltadjian
Email: hello@koach.ca
Service area: Quebec, Canada
If we are unable to resolve a concern, you may contact:
- Commission d'accès à l'information du Québec — cai.gouv.qc.ca
- Office of the Privacy Commissioner of Canada — priv.gc.ca
Effective date: October 15, 2026 (November 14, 2026 for accounts opened before October 15, 2026)
Version: 2.0
Last updated: October 15, 2026