Privacy policy.
How your data is collected, stored, and protected.
1. Information We Collect
Personal Information: When you create an account, we collect your name, email address, phone number, and basic demographic information necessary for providing our fitness services.
Health & Fitness Data: We collect information about your fitness goals, medical conditions, workout history, body measurements, and progress photos that you choose to share. This category is treated as sensitive personal data; see the Sensitive Personal Data section below.
Payment Information: We securely process payment information through Stripe. We do not store your complete credit card information on our servers.
Usage Data: We collect information about how you use our platform, including login times, pages visited, and features used to improve our services.
2. Sensitive Personal Data
Some of what you share with us, including your date of birth, emergency contact, medical conditions, body measurements, and progress photos, is sensitive personal data. We collect it only because it is necessary to build a safe, individualized training program, and access to it is limited to you and your assigned trainer.
ResolveChange is not a HIPAA covered entity and does not bill insurance. Health and fitness information you provide here is not protected health information under HIPAA. We still handle it carefully: it is covered by the same access restrictions, security practices, and deletion and export rights described elsewhere in this policy.
3. How We Use Your Information
- Provide personalized training and nutrition services
- Match you with qualified trainers based on your goals and preferences
- Track your fitness progress and provide performance analytics
- Process payments and manage your subscription
- Send important account updates and appointment reminders
- Improve our platform and develop new features
- Ensure platform security and prevent fraud
4. Information Sharing
With Your Trainer: We share relevant fitness and health information with your assigned trainer to provide effective coaching services.
Service Providers: We work with trusted third-party services including Stripe (payments), Google (OAuth and Calendar), and OpenAI (AI features). These providers are bound by strict privacy agreements.
Legal Requirements: We may disclose information when required by law or to protect the safety of our users and staff.
We never sell your personal information to third parties.
5. Google Calendar Data & Limited Use
If you connect Google Calendar, we request access to view and manage events on your calendar. We use this access only to schedule, reschedule, and manage your training sessions.
Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google Calendar data for advertising, we do not sell it, and we do not share it with anyone except as needed to provide the scheduling features described in this policy.
You can revoke ResolveChange's access to your Google account at any time from your Google Account security settings.
6. Data Security
- All traffic to and from the platform is encrypted in transit using TLS.
- The production database itself is a standard SQLite file that is not separately encrypted by the application. Passwords are hashed with bcrypt and never stored in plain text, and Google OAuth tokens are encrypted at the application level before they are stored.
- We use secure authentication methods including OAuth 2.0 for Google sign-in.
- Every change to the platform runs through an automated check in our deployment pipeline that verifies one client cannot access another client's or trainer's data (an IDOR check).
- Restricted access to personal information on a need-to-know basis.
- Secure payment processing through PCI-compliant systems (Stripe); we do not store your complete credit card information on our servers.
7. Your Rights
- Access: View and download your personal information
- Correction: Update or correct inaccurate information
- Deletion: Request deletion of your account and associated data
- Portability: Export your fitness data in a standard format
- Opt-out: Unsubscribe from marketing communications at any time
You can exercise the Access, Correction, Deletion, and Portability rights yourself from your account profile page, where you can view, update, or export your information, or request deletion.
For anything the profile page does not cover, or if you would rather we handle it directly, email miles@resolvechange.com. We aim to respond within 30 days.
8. State & Region-Specific Rights
Texas residents: the Texas Data Privacy and Security Act (TDPSA) gives you the rights described in this policy, including access, correction, deletion, and portability.
California residents: under the CCPA/CPRA, you have the same rights, and we confirm that we do not sell or share your personal information for cross-context behavioral advertising.
Outside the United States: ResolveChange operates in the United States, and any information you provide is processed and stored here.
Appeals: if we deny a privacy request, you can appeal by emailing miles@resolvechange.com with "privacy appeal" in the subject line. We will respond to appeals within 30 days.
For any privacy request or appeal, contact miles@resolvechange.com.
9. Cookies & Tracking
We use essential cookies to maintain your login session and remember your preferences.
We also run Google Analytics and Google Ads conversion tracking on the site. Google Analytics helps us understand how visitors use the site, such as pages viewed and general traffic patterns. Google Ads conversion tracking tells us when a visitor who clicked one of our ads went on to book an assessment, so we know which advertising is working. We do not run any other third-party advertising trackers.
You can opt out of Google Analytics using Google's browser add-on, opt out of personalized Google Ads through Google's Ads Settings, or block cookies generally through your browser settings. Disabling cookies may affect platform functionality such as staying logged in.
10. Data Retention
We keep your information for as long as your account is active. When you ask us to delete your account, we remove your identifying details, your progress photos and your profile picture, and we revoke every login and connected account.
We keep records of payments and of sessions you booked or attended, with your identifying details already removed. Those are business and tax records, and we keep them for as long as tax and accounting rules require. We do not currently run an automated purge on a fixed schedule, so we are not going to claim a specific number of years here; if you want to know exactly what we still hold about you, email miles@resolvechange.com and ask.
11. Children's Privacy
Our services are not intended for children under 18. We do not knowingly collect personal information from children. If we become aware of such collection, we will take steps to delete the information promptly.
12. Policy Updates
We may update this privacy policy to reflect changes in our practices or legal requirements. When a change is material, you will be asked to review and accept the updated policy the next time you sign in, and you will not be able to continue until you do.
10. Contact Us
If you have questions about this privacy policy or want to exercise your rights, please contact us:
Questions About Your Privacy?
We're committed to transparency and protecting your personal information. Contact us with any privacy concerns.
Contact Us