Privacy Policy

1. About this Policy

This Policy explains how AYA FITNESS INC. (“AYA,” “we,” “us,” or “our”) collects, uses, shares, and protects personal information. We are a corporation existing under the Canada Business Corporations Act, located and operated from Ottawa, Ontario.

It applies to:

• Our website at www.ayafitness.com and any other sites we operate,
• Our applications, including our iOS and iPadOS app, and any other apps we release, and
• The AYA platform that trainers, gyms, and their clients use to run strength assessments and view results.

Collectively, the “Platform”.

The Platform is intended for use in Canada, excluding Quebec, (the “Territory”) and is directed at customers and users in the Territory. If you access it from outside the Territory you do so on your own initiative and are responsible for compliance with local laws.

This Policy should be read together with any consent form, waiver, or other agreement you enter into in connection with a session, as well as any agreement between AYA and your gym, club, trainer, or other service provider. In the event of any inconsistency between this Policy and a consent you have provided, the more specific and more recent consent will govern with respect to the personal information and processing activities it addresses.

2. How AYA works, and who does what

AYA is a strength data analytics platform. We give trainers, gyms, and coaches objective data on how their clients and athletes are actually progressing, so they can coach on evidence instead of guesswork. We provide the software. We do not run your session, supervise your training, or give you health/medical guidance.

That means two different parties usually handle your information, and it helps to know which is which:

• Your trainer, gym, or club has the direct relationship with you. They screen you for readiness, run your assessment, decide what to test, and are responsible for getting your consent before your data is collected. In many cases they decide how your results are used to coach you.
• AYA provides the Platform that captures, calculates, stores, and analyzes fitness information. In providing the Platform, AYA collects and processes information that identifies, or can reasonably be associated with, an individual user, including account information and assessment results linked to that user (collectively, "Account Data"). Account Data is used solely to provide the Platform and related services to you and the professional working with you. AYA also creates and uses information that has been aggregated and de-identified so that it cannot reasonably be used to identify any individual (the "Derived Data," as described in Section 6). Derived Data is used to develop, improve, validate, and enhance AYA's products, services, scientific research, benchmarks, analytics, and models.

If you got access to AYA through a gym, club, school, or trainer, that organization is responsible for obtaining the consents required to share your data with us. If you have questions about how your specific results are used in your training, start with them. If you have questions about how AYA handles your data, come to us using the contact details in Section 16.

Depending on the circumstances, AYA may act as a service provider processing information on behalf of a gym, trainer, school, or club, or may act as an organization with its own responsibilities under applicable privacy laws for certain operational, security, analytics, research, and product improvement activities described in this Policy.

3. Information we collect

We collect information by category, not by a fixed list of fields. We add new sensor types over time, and when we do we collect new kinds of data that fit the categories below. We do not need every category for every person.

• Information you or your trainer provide to set up an account or session. This includes identifying details such as name, email address, sex or gender, height, and weight, along with the session date and location. Your trainer may enter some of this on your behalf.
• Strength and performance data from your session. This is the core of what the Platform does. It includes raw signals captured by connected sensors during an assessment, such as force, time, and range of motion, and additional signals as we add new sensor types. Some of this data is linked to you as a named individual, and some of it is not.
• Performance metrics we calculate. We compute metrics from the raw session data, such as estimated one-rep max, rate of force development, and other strength and performance indicators. Once these are tied to your identifying information, they become personal to you.
• Account and usage data. Login and account details, settings, the views you access, features you use, and a record of completed sessions.
• Device and technical data. Information generated by the app and the sensors during a session, plus standard technical data from your device and our website, such as device type, app version, IP address, and basic analytics about how the Platform is used.
• Communications data. If you contact us for support, sign up for updates, or otherwise reach out, we keep a record of that exchange and your contact details.

We do not collect fingerprints, face scans, retina or iris scans, voiceprints, or hand geometry, and we do not use cameras or computer vision to identify you. If that ever changes, we will update this Policy and get any additional consent the law requires before we do it.

4. Why we collect it

We use your information for clear, stated purposes:

• To deliver the Platform. To run your assessment, generate your results, and make them available to you and to the professional working with you.
• To support coaching and progress over time. To power personalized programming, track progress across sessions, and give trainers the analytics they use to coach.
• To operate, secure, and support the service. To manage accounts, provide customer support, keep the Platform running and safe, prevent misuse, and meet our legal and record-keeping obligations.
• To improve the science and the product. To make our assessments, calculations, benchmarks, and analytics more accurate and more useful. Where we use your information to improve the Platform for everyone, we work with Derived Data (as described in Section 6).
• To communicate with you. To respond to your questions, send service messages, and, where you have opted in, send updates about AYA. You can unsubscribe from marketing messages at any time.

We do not use your personal information to make decisions about you that produce legal or similarly significant effects without a human involved.

5. Consent and your choices

AYA collects, uses, and discloses personal information in accordance with applicable privacy laws. Where required by law, we obtain your consent before collecting, using, or disclosing your personal information. Depending on the nature of the information and the applicable legal requirements, consent may be express or implied.

Certain strength, performance, physical assessment, or related information collected through the Platform may be considered sensitive personal information under some privacy laws. Where required, we obtain express consent and apply safeguards appropriate to the sensitivity of the information. Consent may be obtained through waivers, consent forms, onboarding processes, in-app notices, or other methods appropriate to the circumstances.

You may withdraw your consent to certain collections, uses, or disclosures of your personal information, subject to legal, contractual, technical, and operational limitations and reasonable notice. If you withdraw consent, we will cease the collection, use, or disclosure of the information to which the withdrawal relates, except where we are permitted or required by law to continue processing or retaining the information. Withdrawal of consent may affect our ability to provide certain features, assessments, recommendations, progress tracking, or other functionality of the Platform.

Derived Data (as described in Section 6) may no longer be capable of being linked to an identifiable individual and may continue to be used, retained, or disclosed to the extent permitted by law.

We may also collect, use, disclose, retain, or otherwise process personal information without consent where permitted or required by applicable law, including for legal, security, fraud prevention, compliance, service administration, or other authorized purposes.

6. Aggregated and de-identified data

This section matters, so we are stating it plainly rather than burying it.

AYA creates aggregated and de-identified data from the information collected through the Platform. De-identification is a process that removes, obscures, or transforms identifiers and reduces the risk that information can reasonably be associated with a particular individual. We apply technical, administrative, and organizational measures designed to reduce the likelihood of re-identification. We refer to this aggregated and de-identified information as “Derived Data”.

Subject to applicable law, AYA may use Derived Data on an ongoing basis for its legitimate business purposes, including research, analytics, benchmarking, product improvement, and scientific development. That may include:

• Building strength and performance benchmarks and normative reference ranges,
• Research and analysis on strength and training, and
• Developing, testing, training, validating, and improving our algorithms, models, scoring methods, analytics, and products.

Two commitments come with this:

• We do not try to re-identify you from Derived Data. Once information has been aggregated and de-identified such that it is no longer personal information under applicable law, it may no longer be possible to identify and remove a particular individual's information from that dataset. Accordingly, access, correction, deletion, portability, and withdrawal rights may not apply to such information to the extent permitted by law.
• We do not sell your personal information.

7. How we share information

We share personal information only as described here.

• With your trainer, gym, club, or coach. The professional and organization working with you can see the data and results tied to their clients and athletes. That is the point of the Platform.
• With service providers. We use trusted third parties to host and run the Platform, provide infrastructure and security, support analytics, and help us deliver the service. They may only use the information to perform services for us, under contract and under confidentiality and security obligations. A current list of the categories of service providers we use, and the main providers, is available on request using the contact details in Section 16. For individuals located in Quebec, before disclosing personal information to a service provider outside Quebec, AYA evaluates whether the information will receive protection consistent with applicable privacy laws and implements contractual safeguards where appropriate.
• For legal and safety reasons. Where we are required to by law, or where it is reasonably necessary to comply with a legal process, enforce our terms, protect the rights, safety, or property of AYA or others, or investigate misuse.
• In a business transfer. If AYA is involved in a financing, merger, acquisition, or sale of assets, information may be shared or transferred as part of that transaction, subject to appropriate confidentiality protections. We will require any successor to honour this Policy or give you notice and choices where the law requires it.

We do not sell your personal information, and we do not share it with third parties for their own marketing.

8. Where your information is stored and processed

AYA is based in Canada. We primarily store and process personal information in Canada, including through infrastructure hosted in Canadian data centres. We also engage trusted third-party service providers to help us operate, maintain, secure, and improve our services.

In the course of providing our services, personal information may be collected, used, processed, stored, or made accessible by service providers located in Canada, the United States, or other jurisdictions. In some cases, personal information hosted in Canada may be processed or accessed by service providers that are headquartered or operate in other countries and are therefore subject to the laws of those jurisdictions. As a result, personal information may be transferred to, processed in, or accessed from countries whose privacy and data protection laws differ from those of Canada. Personal information may also be subject to lawful access requirements, court orders, regulatory requirements, or other legal processes in those jurisdictions.

Where the GDPR applies, we rely on legally recognized transfer mechanisms and appropriate safeguards for international transfers of personal data, including contractual protections where required by law.

You may contact our Privacy Officer for additional information regarding the service providers we use, the jurisdictions in which personal information may be processed or stored, and the safeguards implemented for cross-border transfers of personal information.

9. How long we keep your information

We keep personal information only as long as we need it for the purposes in this Policy, or as long as the law requires.

As a general rule:

• Account and session information is retained while your account remains active and for a limited period afterward to facilitate account closure activities, data export, migration, dispute resolution, and compliance with legal obligations.
• Customer support, communications, and transaction records are retained for a reasonable period to administer our services, respond to inquiries, establish or defend legal claims, and comply with legal, accounting, tax, and regulatory requirements.
• Retention periods vary depending on the nature of the information, the purposes for which it was collected, contractual obligations, applicable limitation periods, and legal requirements.
• When personal information is no longer required, we securely destroy, delete, or anonymize it in accordance with applicable law.

Derived Data may be retained for analytics, reporting, product improvement, research, and other legitimate business purposes. Specific retention periods may also depend on the type of data and our agreement with your gym, club, or trainer. You can ask us for more detail using the contact details in Section 16.

10. How we protect your information

We use administrative, technical, and physical safeguards designed to protect personal information against loss, theft, and unauthorized access, use, or disclosure. These include access controls that limit who can see your data to authorized AYA personnel and the professional working with you, secure storage, and encryption where appropriate. You may contact our Privacy Officer for additional information regarding how we protect personal information.

While we take reasonable steps to protect personal information, no method of transmission over the Internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.

If we become aware of a privacy breach or confidentiality incident involving personal information under our control, we will take reasonable steps to contain and investigate it. Where required by applicable law, we will notify affected individuals and applicable privacy regulators, including where a breach creates a real risk of significant harm or risk of serious injury.

11. Your privacy rights

Subject to applicable legal limits, you have the right to:

• Access the personal information we hold about you;
• Correct information that is inaccurate or incomplete;
• Delete your personal information;
• Withdraw consent to our collection and use of your personal information, as described in Section 5; and
• Ask questions about how your information is handled, and challenge our compliance with privacy law.

Where required by applicable law, you may request that certain computerized personal information be provided to you in a structured, commonly used technological format or transferred to another organization.

To exercise any of these rights, contact us using the details in Section 16. We may need to confirm your identity before we act. We will respond within the timeframes required by law. In most cases these rights are free to exercise, and we will tell you in advance if a request would carry a cost.

If your data was captured through a gym, club, school, or trainer, we may need to coordinate with that organization to act on your request, since they hold the direct relationship with you.

Remember that these rights apply to personal information. They do not reach Derived Data, which is no longer personal to you.

12. Children and minors

Some clients and athletes who use the Platform through schools, clubs, or gyms are minors. We take that seriously.

Where a client is a minor under the laws where they live, a parent or legal guardian must give consent before any data about that minor is collected, and the gym, club, school, or trainer running the session is responsible for obtaining and keeping records of that consent. We do not knowingly collect personal information from a minor without the required parental or guardian consent. If you believe a minor's information has been collected without proper consent, contact us and we will address it.

13. Additional information for Canadian residents

Quebec residents. The Services are not offered to, directed at, or intended for individuals located in the Province of Quebec. Individuals located in Quebec are not authorized to create an account, access, or use the Services. AYA FITNESS uses technical measures intended to restrict access to the Services from Quebec.

By accessing or using the Services, you represent and warrant that you are not located in Quebec at the time of access and are not otherwise using the Services from Quebec.

If we become aware that an individual located in Quebec has created an account or is using the Services, we reserve the right to suspend or terminate access to the Services and delete the associated account, subject to any applicable legal obligations.

Other Canadian provinces. Residents of provinces with their own private-sector privacy laws, including Alberta and British Columbia, have rights substantially similar to those in Section 11.

14. No medical or health claims

AYA is a strength data analytics platform. We do not diagnose, treat, cure, or prevent any injury, disease, or medical condition, and our results are not medical advice. Decisions about whether it is safe for you to train, and how you should train, rest with you and the qualified professional working with you. Always speak with your trainer or a healthcare provider about your readiness to participate in strength assessment or training.

15. Third-party links and services

The Platform may link to or work with third-party sites, apps, or hardware, including sensor devices from our hardware partners. Those third parties have their own privacy practices, and this Policy does not cover them. Review their policies to understand how they handle your information.

16. Changes to this Policy and how to contact us

Changes. We may update this Policy as our Platform, our data practices, or the law change. When we make a material change, we will update the effective date at the top and, where appropriate or required, give you notice. Your continued use of the Platform after an update means you accept the updated Policy, unless we need fresh consent, in which case we will ask for it.

Contact us. For any privacy question, request, or concern, or to reach the person responsible for the protection of personal information, contact:

AYA FITNESS INC.

Attention: Michael Stephenson, Privacy Officer

Email: privacy@ayafitness.com

If you are not satisfied with how we have handled your personal information, you may also contact the Office of the Privacy Commissioner of Canada, or the privacy regulator in your province.