Petra Health Privacy Policy

Version: 1.0 · Effective: October 21, 2026

Applies to: the Petra Health app, website and in-person services

Scope: Petra Health offers in-person classes and coaching in Ottawa, open to everyone. Online (phone or video) coaching is offered only to clients located in Ontario. This policy is governed by the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Ontario law.

Who we are

Petra Health is the operating name of 1000308885 ONTARIO INC., an Ontario corporation, 29 Carlyle Ave, Ottawa ON K1S 4Y2 ("Petra Health", "we", "us"). We provide group fitness classes, personal training and nutrition coaching in Ottawa, Ontario. Petra Health is a coaching business, not a medical clinic. Our coaches are not physicians and do not provide medical care.

Privacy Officer: Pete Shaw, info@petrahealth.ca, 29 Carlyle Ave, Ottawa ON K1S 4Y2. He is accountable for our compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA).

What we collect

Account details: name, email, mobile phone, date of birth (to confirm you are 18 or older), password (stored only as a secure hash by our sign-in provider).
Waivers: your signed waiver(s), each acknowledgement and when you ticked it, your typed name, device and time spent on the form (to show the signature was informed). When you sign a waiver, the PAR-Q+ or a purchase agreement, we record your account, the date and time, your IP address and a fingerprint of the signed document to prove the signature is yours.
Doctor clearance: we ask for this only if your PAR-Q+ has a Yes answer. Then we ask you to confirm that your own doctor or nurse practitioner has cleared you, and to give the date of that clearance and, if you choose, their name. We don't ask for any medical details, such as a diagnosis or condition, for this. If you give us your clearance on paper or by uploading it in the app instead, we record only that it's on file, its date and, if it's shown, the clinician's name. We keep this with your waiver records.
PAR-Q+ record: before your first booking or purchase, you complete the official PAR-Q+: on paper, as a PDF you upload, or by filling in the official PAR-Q+ form itself in the app. If you complete it in the app, the completed official PAR-Q+ PDF is stored in private storage, and only Pete, Petra Health's owner, can see it. The app doesn't ask the questions in screens of its own. The app's records show only that your PAR-Q+ is on file, its date, the overall result and the follow-up status. If you upload your signed form or a doctor's clearance, it's kept in private storage that only Pete can open. In detail, the app records: the PAR-Q+ version, the completion date, whether every answer was No or one or more were Yes (follow-up needed), the follow-up status and date when needed, who recorded it and when, and the next-due date (12 months, or sooner if your health changes). You can give Pete the signed form on paper (mail it or drop it off at 29 Carlyle Ave, Ottawa ON K1S 4Y2) or upload it in the app.
Uploaded forms: if you upload your signed PAR-Q+ or a doctor clearance (PDF or photo, up to 10 MB), it's kept in private storage that only Pete can open. Coaches can't see it, and it's never shared by link. The app doesn't read or extract anything from the file: Pete reads it and records the result by hand. We keep it for as long as your waiver, then delete it. Paper forms stay in a locked file; never in shared inboxes or chat threads.
Health information (only with your separate consent): medical conditions, medications, injuries or pregnancy you choose to tell us so we can coach you safely, and the program you pick (some programs, such as Health + Weight Loss, can reveal health information).
Goals and coaching information: goals you share, attendance and bookings, and notes our coaches write about your training, including notes flagged as health or injury notes. You can ask to see them.
Payments: what you bought, amounts, HST and payment status. Card details are entered directly into Stripe; we never see or store your full card number. We store the card brand, last 4 digits and expiry so you can manage saved cards.
Communications: in-app messages with your coach, copies of emails we send you (kept 12 months), notification and email preferences, and photo/video consent. Please don't send health details in chat.
Technical information: essential cookies to keep you signed in, push-notification tokens if you turn them on, and basic security logs.

We don't sell your personal information, and we don't use advertising trackers in the app.

Why we use it (purposes)

To create and run your account, bookings, credits and memberships.
To deliver safe coaching: waivers, the PAR-Q+ and coach notes.
To take payments, issue receipts and keep the financial records the law requires.
To contact you about your bookings and account, and (only if you opt in) about offers and news.
To protect our services, prevent fraud and meet legal obligations.
To understand how the business is doing, using aggregated or de-identified reports.
To verify sign-ups and prevent free-trial misuse (we check email and phone, but do not use device fingerprinting).

We never use health information for marketing, and we never sell it.

Consent

We ask for separate choices, and we record what you agreed to, the wording version and the time:

Account (required): your account, bookings, payments and waivers. You confirm you are 18 or older and agree to this policy when you sign up.
Health information (separate express consent, asked before your first waiver or intake): you can decline, but then we can't offer coached sessions safely. Future features that let you record health markers you choose to share (for example, results from your own doctor), or share them with your coach, will each ask for their own separate consent. Petra Health doesn't do its own medical testing.
Marketing emails (optional, off unless you opt in). Every promotional email identifies us, gives our mailing address and has a working unsubscribe link; unsubscribes take effect right away (always within 10 business days).
Photo/video (optional).

You can withdraw any of them at any time in Me › Privacy (or Me › Email preferences, or the unsubscribe link) or by writing to us. If you withdraw health consent, we stop collecting it straight away and, if you ask us to, delete it within 30 days, except records we must keep by law or to defend legal claims (signed waivers, payments, coaching notes; see "How long we keep it").

Who we share it with

Only service providers who help us run Petra Health, under contracts that require them to protect it and use it only to provide their service to us:

Supabase (database, sign-in and file storage): stored in Canada (AWS ca-central-1, Montréal); Supabase support staff may access it from other countries.
Cloudflare (website and app hosting and security, Cloudflare Workers, and forwarding of email sent to our @petrahealth.ca addresses): requests pass through Cloudflare's worldwide network. Our nightly encrypted backups are kept in Cloudflare R2 in North America, which may be in the United States (the decryption key is held only by Petra Health, off-platform).
Stripe (card payments): United States and elsewhere. Stripe also uses some data for its own fraud-prevention and legal purposes under its own privacy policy (stripe.com/privacy).
Resend (account and booking emails, and email we send from our @petrahealth.ca addresses): United States. We don't put health information in emails; signed waivers are sent as a secure, expiring link that needs you to sign in, never as an attachment.
Google (calendar for consultation bookings, and Gmail, which holds the email we receive): United States.
Google Sheets (training logs): We use Google Sheets to keep training logs for some online programs. Google may store and process this information outside Canada, including in the United States, where courts and government authorities may be able to access it under local law.
Web push services (Apple, Google or Mozilla, only if you turn on notifications).

Email sent to our @petrahealth.ca addresses is forwarded by Cloudflare Email Routing, which doesn't keep a mailbox or store the messages. Google (Gmail) holds the email we receive: mail to info@petrahealth.ca lands in a Gmail account used only for Petra Health. Messages sent to jen@petrahealth.ca are forwarded to Jen's personal email account, which is hosted by Google. Email we send from our @petrahealth.ca addresses, and the app's account and booking emails, are sent through Resend in the United States. We read email with the help of an AI assistant service that drafts replies for our staff to review. These providers may store or process information outside Canada, including in the United States.

If you email us at info@petrahealth.ca, your message is stored with our email provider, Google, which may store it outside Canada. Please don't send health information or your PAR-Q+ by email; use the app instead.

When information is stored or processed outside Canada (mainly the United States), it is subject to those countries' laws and may be accessible to their courts, law enforcement and national security authorities.

Only people who need your information for their role can see it, and they must keep it confidential. Health-flagged coaching notes are visible only to the owner, the coach who wrote them and coaches who are actually working with you. We do not share your information with any doctor or clinic, or put it in any medical record, unless you ask us to in writing. We may disclose information when the law requires it.

How long we keep it

Account data: while active plus 2 years of inactivity, then anonymized.
Health information you enter: deleted within 30 days of account deletion or withdrawal (if you ask), and after 2 years of inactivity.
Coaching notes, signed waivers, doctor clearance confirmations and PAR-Q+ records: 7 years after your last session, so we can respond to any legal claim about our services. We then delete them. Signed PAR-Q+ forms and doctor clearances, on paper or uploaded, are kept for as long as the waiver and deleted with it.
Payment records: 6 years after the end of the tax year they relate to (our tax year ends August 31), as Canada Revenue Agency rules require, then de-identified.
Chat and email copies: 12 months.
Consent records: for the life of your account plus 3 years (kept in minimal form even after you delete your account, as proof of what you agreed to).
Marketing preferences and unsubscribe records: as long as needed to respect your choice.
Deleted data can stay in our encrypted backups for up to 30 days (35 days at the very most for database backups) before those backups age out and are deleted. Backup copies of deleted files, such as signed waivers, are removed by our nightly backup job within 30 days. If we ever have to restore a backup, we first re-apply every deletion made since that backup was taken, so deleted information is not brought back.

Retention runs automatically every night. When you delete your account, we remove or anonymize your profile right away, except records we must keep by law.

How we protect it

Encryption in transit (HTTPS) and at rest; encrypted backups with an offline key; access controls so each person sees only what their role allows (enforced in the database); two-step sign-in required for admin accounts and for any staff access to health notes; a log of who viewed health notes; owner-only approval for sensitive actions; audit logs; and card data handled only by Stripe. No method is perfectly secure. If a breach creates a real risk of significant harm, we'll notify you and the Office of the Privacy Commissioner of Canada as soon as feasible.

Your rights

Send requests in writing (email is fine). You can ask to access or correct your personal information, ask how it has been used or disclosed, withdraw consent, or delete your account (Me › Delete account). We reply within 30 days; if we need more time (up to 30 more days), we'll tell you why and that you can complain to the OPC. Contact our Privacy Officer at info@petrahealth.ca. If you're not satisfied, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

Children

Petra Health is only for adults 18 and older. You must give your date of birth and confirm you are 18+ to create an account. If we learn an account belongs to someone under 18, we will close it and delete its data, except records we must keep.

Cookies and tracking

The app uses only essential cookies (to keep you signed in) and no advertising or analytics trackers. If that changes, we'll ask first.

Changes

We'll post any update here with a new version date. We'll notify you in the app or by email before significant changes take effect, and ask for your consent before using information for a new purpose or sharing it with a new kind of third party.