Privacy Policy

She Haven Fitness ("we", "us", or "our") operates a client portal that stores sensitive health, nutrition, body measurement, and progress photo information. This Privacy Policy explains how we collect, use, store, and protect your personal and health-related data.

By creating an account and using our services, you consent to the practices described in this policy. If you do not agree with this policy, please do not use the portal.

Account Information: Name, email address, phone number, role (client, trainer, admin), and authentication credentials managed by our platform provider.

Health & Fitness Data: Weight, body measurements, body fat percentage, workout logs, exercise performance, habit tracking (water, sleep, steps), and daily health metrics.

Nutrition Data: Food logs, meal entries, macronutrient tracking, food photos, and calculated nutrition targets.

Progress Photos: Body progress photos uploaded by you, stored in private file storage with time-limited access URLs only.

Check-In Data: Weekly check-in responses including energy levels, stress, sleep quality, hunger, workout performance, and health changes you report.

Consent Records: Records of your consent choices for marketing, progress photo usage, data sharing, and health data processing.

We use your data to:

• Provide personalized fitness coaching, nutrition guidance, and progress tracking
• Enable your assigned trainer to review your progress and provide feedback
• Process appointments, enrollments, and payments
• Send you check-in responses, workout assignments, and announcements
• Improve our services and develop new features
• Comply with legal obligations

Your health and fitness data is shared only with your assigned trainer and authorized administrators. We do not sell your data to third parties.

We may share data with:

• Your assigned trainer, for coaching purposes
• Platform infrastructure providers (hosting, database, authentication)
• Payment processors (Stripe), for billing purposes only
• Legal authorities, if required by law

We never share your progress photos or body measurements for marketing purposes without your explicit, per-photo consent.

Your data is stored on our platform provider's infrastructure with encryption in transit (TLS) and at rest. Access to your data is controlled through role-based access control (RBAC) and row-level security (RLS) policies that ensure:

• You can only access your own health, nutrition, and progress data
• Trainers can only access data for clients assigned to them
• Administrators have access for account management and support
• One client cannot view, query, edit, or download another client's records

Progress photos are stored in private file storage. Access is granted only through time-limited signed URLs that expire automatically. Private image URLs are never exposed in public pages, page source, analytics, notifications, or search results.

You have the right to:

• Access: View your personal and health data through the portal
• Export: Request a complete export of your data through the Data Privacy section of your portal
• Correction: Update or correct your profile and health information
• Deletion: Request deletion of your account and associated data
• Consent Management: Grant or revoke consent for marketing, media usage, and data sharing at any time

To exercise these rights, use the Data Privacy section in your client portal or contact us at hello@shehavenfitness.com.

We use cookies and similar technologies for authentication, session management, and analytics. Analytics data is aggregated and does not include your personal health information.

We retain your data for as long as your account is active. If you request account deletion, we will process your request within 30 days, except where legal or contractual obligations require longer retention of certain records (such as signed waivers and payment records).

She Haven Fitness is a fitness and wellness service, not a medical provider. We are not a covered entity or business associate under the Health Insurance Portability and Accountability Act (HIPAA). While we implement security measures to protect your health-related data, this portal is not HIPAA-compliant and should not be used to store protected health information (PHI) as defined by HIPAA. If you are a healthcare provider or have specific HIPAA requirements, please consult with us before using the portal.

Our services are intended for individuals 18 years of age or older. We do not knowingly collect data from minors. If you believe a minor has provided us with personal information, please contact us.

We may update this Privacy Policy from time to time. We will notify you of material changes through the portal or via email. Your continued use of the service after changes take effect constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or your data, please contact us at hello@shehavenfitness.com.