Privacy Policy

1. Scope of This Privacy Policy

This WorkoutLabs Train Privacy Policy (“Privacy Policy”) describes how WorkoutLabs LLC (“WorkoutLabs,” “we,” “us” or “our”) handles personal information in connection with:

• The WorkoutLabs Train platform and account interfaces
• Train websites, signup pages and public marketing pages
• Exercise programs, care plans and related content delivered through Train
• Customer support, sales inquiries and other Train communications
• Train integrations, APIs and connected services

Train may be used by healthcare professionals, fitness professionals, coaches, organizations, patients, clients and other authorized users.

For purposes of this Privacy Policy, “personal information” means information that identifies, relates to, describes or can reasonably be linked with a person. It may also include information treated as personal data, sensitive data or consumer health data under applicable law.

2. Our Role and the Role of Organizations

How WorkoutLabs handles personal information depends on how Train is provided and used.

Information controlled by WorkoutLabs

WorkoutLabs generally determines how personal information is used when we process information for our own purposes, such as:

• Managing direct subscriptions and billing
• Operating Train accounts
• Providing customer support
• Securing and maintaining the Services
• Managing our websites, sales and business communications
• Complying with legal obligations

Information controlled by an Organization

When a hospital, clinic, fitness business, employer, educational institution or other organization provides or manages a Train account, that Organization generally determines why and how information associated with its staff, patients, clients or members is used.

In those circumstances, WorkoutLabs generally processes that information on the Organization’s behalf and according to its instructions, subject to our independent processing for security, billing, fraud prevention, legal compliance and operation of the Services.

Users of an Organization-managed account should review the Organization’s own privacy notices and contact the Organization with questions about its privacy practices.

3. Information We Collect

The information we collect depends on the account configuration, the features used and the information submitted by Users or Organizations.

Account and profile information

• Name
• Email address
• Password and authentication information
• Organization, role and account permissions
• Professional title, profile details or credentials provided by the User
• Communication preferences

Organization and professional information

• Organization name and contact details
• Staff lists, roles and administrative permissions
• Subscription, plan and account configuration information
• Organization branding, logos and account settings
• Information submitted during sales, onboarding or support interactions

Patient and client information

Where patient or client accounts are enabled, or where an Organization or Professional User submits such information, Train may process:

• Name and email address
• Account status and authentication information
• Assigned workouts, exercise programs and care plans
• Workout schedules and program availability
• Workout access, completion and activity records
• Exercise preferences and settings, such as illustration preferences
• Progress entries and goals submitted by a User or Organization
• Messages, feedback and communications within Train

Exercise, progress and health-related information

Depending on how Train is configured and used, Users or Organizations may submit exercise and progress information. This may include:

• Exercise selections, prescriptions, sets, repetitions, duration and resistance
• Workout completion and performance information
• Body measurements, body weight or waist measurements
• Blood pressure, steps, sleep or similar progress metrics
• Medication or other health-related tracking information entered by a User
• Symptoms, limitations, notes or other information included in Customer Content

WorkoutLabs does not require every category listed above. Users and Organizations control much of the information they choose to submit.

Customer Content

• User-created workouts and exercise programs
• Custom exercises, images, instructions and uploaded files
• Notes, messages and feedback
• Content imported through an integration
• Other material submitted through Train

Billing and transaction information

• Billing name and address
• Subscription plan and billing cycle
• Transaction identifiers, payment status and payment history
• Limited payment-method information provided by our payment processor, such as card brand and the last four digits

WorkoutLabs does not store complete bank-account or payment-card numbers on its servers.

Technical, device and usage information

• Internet Protocol address
• Browser, device and operating-system information
• Login dates, session information and authentication events
• Pages, features and content accessed
• Referral URLs and interaction information
• Error reports, security logs and diagnostic information
• Cookie and similar technology identifiers

Support, sales and communications information

• Contact information
• Support messages and correspondence
• Call, meeting or demo details
• Information submitted through forms or inquiries
• Consent records and communication preferences

4. Sources of Information

We collect personal information from:

• Users directly when they register, create content, complete workouts, enter progress information, contact us or otherwise use Train
• Organizations and Professional Users when they create or manage accounts, invite Users, assign programs or submit information on another person’s behalf
• Authorized integrations when an Organization or User connects Train with another service
• Devices and browsers through logs, cookies and similar technologies
• Service providers such as payment processors, communications providers and security services
• Business contacts and public sources in connection with sales, partnerships and account administration

5. How We Use Personal Information

We may use personal information to:

• Create, authenticate and manage accounts
• Provide, operate and maintain Train
• Enable Organizations and Professional Users to build, assign and deliver exercise programs
• Display assigned programs, schedules, progress and account activity
• Support messaging and other authorized communications
• Process subscriptions, payments and invoices
• Provide onboarding, support and troubleshooting
• Configure Organization accounts and user permissions
• Personalize settings and permitted content presentation
• Monitor reliability, performance and feature usage
• Detect, investigate and prevent fraud, misuse and security incidents
• Develop, test and improve Train
• Communicate about service changes, account activity and support matters
• Send marketing communications where permitted and subject to opt-out rights
• Enforce our agreements and protect our rights, Users and Services
• Comply with applicable law, legal process and regulatory requirements

Where consent is required by law, we rely on consent for the relevant processing. Where permitted, we may also process information as necessary to perform a contract, comply with law or pursue legitimate interests such as operating, improving and securing Train.

6. Exercise and Health-Related Information

Train is designed to support exercise-program creation and delivery. The sensitivity of information processed through Train depends on how an Organization or User configures and uses the platform.

Train may be used in a clinician-only exercise-prescription configuration without patient accounts or patient-identifying information. In other configurations, authorized Users may create patient or client accounts and submit exercise, activity or progress information.

Organizations and Users are responsible for deciding what information is appropriate to submit, obtaining required permissions and using Train in accordance with applicable law and their own policies.

We do not use patient or client workout content, progress entries, messages or health-related information for targeted advertising.

7. Protected Health Information and HIPAA

Unless WorkoutLabs expressly authorizes such use in a separate written agreement signed by WorkoutLabs, Train is not intended to create, receive, maintain or transmit protected health information on behalf of a covered entity or business associate as those terms are defined under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (“HIPAA”).

Healthcare Organizations and their Users must not submit, upload, store or transmit protected health information through Train unless WorkoutLabs has expressly authorized that use in a separate signed agreement.

WorkoutLabs does not require healthcare Users to enter patient diagnoses, medical record numbers, dates of birth, clinical notes or other patient-identifying health information to use Train’s exercise-prescription functionality.

If we reasonably believe information was submitted contrary to this section, we may restrict access, remove the information, suspend affected features or contact the applicable Organization.

Additional requirements are described in the WorkoutLabs Train Terms of Use.

8. How We Disclose Personal Information

We may disclose personal information in the following circumstances.

Organizations, administrators and authorized Users

Information associated with an Organization-managed account may be available to the Organization, its administrators, authorized staff and Professional Users according to their roles and permissions.

Patient or Client Users should understand that their responsible Organization or Professional User may access assigned programs, completion information, progress entries, messages and other information associated with the Organization-managed account.

Service providers

We may disclose information to vendors and contractors that support hosting, infrastructure, communications, analytics, customer support, security, payment processing and other business functions. They may use information only to provide services to us or as otherwise permitted by their agreements and applicable law.

Integrations and third-party services

When an Organization or User authorizes an integration, we may disclose information to or receive information from the connected service as necessary to provide that integration.

Legal, safety and enforcement purposes

We may disclose information when we reasonably believe disclosure is necessary to:

• Comply with law, legal process or a valid governmental request
• Protect the rights, property or safety of WorkoutLabs, Users or others
• Detect, investigate or prevent fraud, abuse or security incidents
• Enforce our agreements and policies
• Establish, exercise or defend legal claims

Business transfers

Information may be disclosed or transferred in connection with a financing, merger, acquisition, restructuring, sale of assets, bankruptcy or similar transaction, subject to applicable law.

At your direction or with consent

We may disclose information when an authorized User or Organization directs us to do so or where the person concerned has provided appropriate consent.

Aggregated or de-identified information

We may use and disclose information that has been aggregated or de-identified so that it cannot reasonably be linked to a person. We will not attempt to re-identify such information except as permitted by law to test our de-identification methods.

9. Sale, Sharing and Targeted Advertising

WorkoutLabs does not sell personal information for money.

We do not sell patient or client exercise-program information, progress entries, messages or health-related information. We do not use that information for targeted advertising.

Public Train marketing pages may use optional analytics or advertising technologies. Depending on applicable law, allowing an advertising or analytics provider to collect identifiers and browsing activity may be treated as “sharing,” “targeted advertising” or a similar regulated activity.

Where required, Users may manage optional cookies through the cookie preference controls available on the website. Browser settings may also be used to block or delete cookies, although doing so may affect site functionality.

10. Service Providers and Integrations

We use service providers to support the operation of Train. Categories of providers may include:

• Cloud hosting, databases and storage
• Application monitoring, security and fraud prevention
• Email, support and communications
• Analytics and performance measurement
• Payment processing and billing
• Professional advisers, including legal and accounting providers

Payment-card transactions are processed by third-party payment providers such as Stripe. Payment providers process payment information under their own privacy notices and security obligations.

Third-party integrations are governed by the privacy terms of the connected service. Organizations and Users should review those terms before enabling an integration.

11. Cookies and Similar Technologies

Train websites and account interfaces may use cookies, local storage, pixels, software development kits and similar technologies.

Essential technologies

Essential technologies support authentication, security, session management, preferences and core platform functions. Disabling them may prevent Train from operating correctly.

Analytics and performance technologies

Analytics technologies help us understand how websites and product features are used, identify errors and improve performance.

Advertising technologies on public pages

Public Train marketing pages may use optional advertising or measurement technologies where permitted. These technologies are not intended to use patient or client workout content, progress information or messages for advertising.

Your choices

You may use available cookie preference controls or change browser settings to restrict cookies. Cookie duration varies based on purpose and provider. Some settings are stored only for a session while others remain until they expire or are deleted.

12. Email, SMS and Other Communications

We may send service-related communications concerning:

• Account activation and authentication
• Security and account activity
• Subscription, billing and renewal
• Service changes and maintenance
• Support and administrative matters

We may also send product information or marketing communications where permitted. Marketing emails may be unsubscribed from using the link in the message. Opting out of marketing does not prevent necessary service communications.

If you separately opt in to receive SMS messages, we may process your phone number, consent record and related delivery information. You may opt out using the instructions in the message or by contacting us.

13. Payments

Payment information is submitted directly to our payment provider. WorkoutLabs does not store complete payment-card or bank-account numbers on its servers.

We may receive and retain limited billing and transaction information, including:

• Billing name and address
• Payment status and date
• Subscription and invoice information
• Transaction identifiers
• Card brand, expiration information and the last four digits where provided by the processor

Payment providers handle information according to their own terms and privacy notices.

14. Consumer Health Data Privacy Notice

This section also serves as our consumer health data privacy notice where applicable law requires one.

“Consumer health data” may include personal information that identifies or may be used to infer a person’s physical or health status. Depending on how Train is used, this may include exercise prescriptions, assigned programs, workout activity, progress entries, body measurements, blood pressure, sleep, steps, medication tracking, symptoms, limitations or similar information submitted through Train.

Sources of consumer health data

We may receive consumer health data from:

• The individual concerned
• An Organization, Professional User or authorized administrator
• An authorized integration or connected service
• Use of Train features, such as completion and progress tracking

Why we collect and use consumer health data

We may collect and use consumer health data to:

• Provide requested Train features
• Deliver assigned exercise programs
• Display schedules, progress and completion information
• Support communications between authorized Users
• Maintain, secure and troubleshoot the Services
• Comply with law and enforce our agreements

Who may receive consumer health data

Consumer health data may be disclosed to:

• The Organization that manages the account
• Authorized administrators, professionals and other permitted Users
• Service providers that process information to operate Train
• Connected services authorized by the Organization or User
• Government authorities or other parties where disclosure is legally required
• A successor or transaction participant in a permitted business transfer

We do not sell consumer health data. We do not use consumer health data for targeted advertising.

Consumer health data rights

Depending on applicable law, a person may have the right to:

• Confirm whether we collect, use or disclose consumer health data
• Access consumer health data
• Request deletion of consumer health data
• Withdraw consent for certain collection or disclosure
• Receive information about third parties that received consumer health data
• Appeal the denial of a request

Requests may be sent to [email protected] with the subject line “Consumer Health Data Request.” Where an Organization controls the information, we may direct the request to that Organization or assist it in responding.

15. Children and Minors

Train is not intended for independent registration or use by children under 13.

A minor may use Train only through an account or exercise program appropriately authorized and managed by an Organization, Professional User, parent or legal guardian.

An Organization or Professional User that provides Train access to a minor is responsible for obtaining any parental or guardian consent, authorization or notice required by applicable law.

We do not knowingly sell or use the personal information of minors for targeted advertising.

If you believe a child’s personal information was submitted without appropriate authorization, contact us at [email protected]. We may verify the request, contact the responsible Organization and delete or restrict the information as appropriate.

16. Data Retention and Account Deletion

We retain personal information for as long as reasonably necessary to provide Train, maintain accounts, fulfill the purposes described in this Privacy Policy and satisfy legal, security and business requirements.

Active accounts

Information is generally retained while an account or subscription remains active.

Cancelled or expired accounts

Following cancellation or expiration, WorkoutLabs generally retains the account and associated Customer Content for 90 days so that an authorized User or Organization may request restoration.

After the 90-day period, we may delete the account and associated Customer Content from active systems.

Immediate deletion

An authorized User or Organization may request deletion before the 90-day period ends by emailing [email protected]. We may need to verify identity and authority before acting on the request.

Information retained for longer periods

Some information may be retained for longer where reasonably necessary for:

• Billing, tax and financial records
• Security, fraud prevention and abuse investigation
• Legal obligations, litigation and dispute resolution
• Enforcement of agreements
• Backups and business continuity

Deleted information may remain temporarily in encrypted backups or logs and will not ordinarily be restored to active use.

Where an Organization controls an account, the Organization may determine applicable retention periods and may instruct WorkoutLabs to retain or delete information subject to the parties’ agreement and applicable law.

17. Information Security

WorkoutLabs uses administrative, technical and organizational safeguards designed to protect personal information against unauthorized access, alteration, loss and disclosure.

Safeguards may include:

• Encrypted connections
• Access controls and account permissions
• Password and authentication protections
• System monitoring and logging
• Backups and recovery procedures
• Secure software-development and testing practices

No system can be guaranteed to be completely secure. Users are responsible for protecting their credentials, maintaining secure devices and promptly reporting suspected unauthorized access.

If a security incident affects personal information, we will investigate and provide notices where required by applicable law.

18. International Users and Data Transfers

WorkoutLabs is based in the United States. Personal information may be processed and stored in the United States or another country where we or our service providers operate.

Privacy laws in those locations may differ from the laws where a User lives. Where applicable law requires a recognized transfer mechanism or other safeguards, we will use an appropriate mechanism.

For Users in the European Economic Area, United Kingdom or another jurisdiction with similar requirements, our legal bases may include:

• Performance of a contract
• Compliance with legal obligations
• Legitimate interests in operating, improving and securing Train
• Consent where required

19. Privacy Rights and Choices

Depending on location and applicable law, a person may have the right to:

• Request access to personal information
• Request correction of inaccurate information
• Request deletion of information
• Request a portable copy of information
• Restrict or object to certain processing
• Withdraw consent where processing relies on consent
• Opt out of targeted advertising or certain forms of sharing
• Appeal a decision concerning a privacy request
• Complain to an applicable privacy regulator

To submit a request, email [email protected]. Please describe the request and identify the relevant Train account or Organization.

We may take reasonable steps to verify identity, authority and the scope of the request. An authorized agent may submit a request where permitted by law, but we may require proof of authorization.

We will not discriminate against a person for exercising a privacy right. We do not ordinarily charge for privacy requests, although a reasonable fee may be permitted for requests that are excessive, repetitive or manifestly unfounded.

A custom, manual or specially formatted data export that is not required as part of a legal privacy right may be subject to a reasonable technical or administrative fee disclosed in advance.

20. Requests Concerning Organization-Managed Accounts

If an account is provided or managed by an Organization, the Organization may control the relevant personal information.

In that case:

• The User may need to contact the Organization directly
• WorkoutLabs may refer the request to the Organization
• WorkoutLabs may assist the Organization in responding
• The Organization’s instructions may determine access, correction, export or deletion

WorkoutLabs may decline to act directly where doing so would conflict with the lawful instructions of the Organization that controls the information.

21. Additional United States Privacy Disclosures

Where applicable state privacy laws apply, the categories of personal information we may collect include:

• Identifiers, such as name, email address, account identifiers and Internet Protocol address
• Customer-record information, such as contact and billing information
• Commercial information, such as subscription and transaction history
• Internet or electronic activity, such as usage, device and log information
• Professional information, such as organization, role or credentials
• Sensitive information, such as account credentials and health-related information submitted through Train
• Communications and Customer Content

We collect these categories from the sources described in Section 4, use them for the purposes described in Section 5 and disclose them to the categories of recipients described in Sections 8 and 10.

We do not sell personal information for money. Optional advertising technologies used on public marketing pages may be treated as targeted advertising or sharing under some state laws. We do not knowingly sell or share personal information belonging to anyone under 16 for targeted advertising.

State-specific rights may be exercised as described in Section 19.

22. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to Train, our practices or applicable requirements.

The updated Privacy Policy will state its revision date. If a change is material, we may provide notice through email, Train, the website or another appropriate method.

Where an Organization has a separate written agreement with WorkoutLabs, changes to that agreement are governed by its terms.

23. Contact Us

Questions, concerns and privacy requests may be sent to: