Privacy Policy

1.Who we are

VO2Peak is a sports science lab and training facility at 787 Lorne Street, Sudbury, Ontario P3C 4R5, Canada. In this policy, "VO2Peak", "we" and "us" mean VO2 Peak, the business that operates VO2Peak. "You" means anyone who visits this website, contacts us, or uses our services, including parents and guardians acting for an athlete.

We're responsible for the personal information we control. Our Privacy Officer, Troy Beauregard, is accountable for how we handle it. You'll find his contact details at the end of this policy.

2.What this policy covers

This policy covers personal information we collect through this website, by phone, email, text and social media, and in person at the lab. It covers testing, coaching, training, programming and nutrition guidance.

We follow Canada's federal privacy law for businesses (the Personal Information Protection and Electronic Documents Act, or PIPEDA) and Canada's Anti-Spam Legislation (CASL). Where we serve people from other places, we also respect the privacy laws that protect them, including Quebec's Act respecting the protection of personal information in the private sector (Law 25), the EU and UK General Data Protection Regulation (GDPR) and US state privacy laws. Section 14 explains the extra rights those laws give you.

3.What we collect

We collect only what we need for the purposes in section 4.

Contact and identity

Name, email, phone number, date of birth, and emergency contact. For athletes under 18, a parent or guardian's name and contact details.

Booking and account

Appointments, packages, attendance, and notes about what you're training for.

Payment

What you bought, amounts and dates. Card payments are handled by our payment processor. We don't store your full card number.

Health and screening

Answers to pre-test health screening, injuries, conditions or medications you choose to tell us about, and any clearance from your physician.

Test and training data

Measurements such as height, body mass, heart rate, oxygen uptake (VO2), breathing, muscle oxygen, force, power, speed, sprint splits and movement data, plus the reports and programs we build from them.

Photos and video

Video we record during a session to analyse technique. We only use photos or video of you in our marketing with your separate permission.

Messages

What you send us by email, text, phone, social media or our contact forms.

Website data

Essential storage that remembers your cookie choice. If you allow it, analytics and marketing tools also collect details such as the pages you visit, your device and browser, and roughly where you are (city level). See section 13 and our cookie policy.

We collect this information from you, from a parent or guardian, from the testing equipment we use during your session, and from people you ask us to work with, such as your coach or physician.

4.How we use it

• To check it's safe for you to test and train, and to respond to emergencies.
• To run your tests, explain your results, and build and adjust your program.
• To book and manage appointments and send reminders.
• To take payment, issue receipts and keep financial records.
• To answer your questions and give you customer service.
• To send you news and offers, only if you've agreed (see section 12).
• To understand how our website is used and measure our advertising, only if you've allowed it (see section 13).
• To improve our testing and coaching. When we look at results across many athletes, for example to build benchmarks, we use data that has been de-identified and combined so it can't be linked back to you.
• To meet our legal obligations, protect our rights, and prevent fraud or misuse.

We don't sell personal information. We don't use it to make automated decisions that have legal or similarly significant effects on you.

5.Consent

We ask for your consent before we collect, use or share your personal information, unless the law allows otherwise. How we ask depends on how sensitive the information is. For health, screening and test data, we ask for your express consent, usually in writing before your first session.

Where GDPR applies, we rely on your consent, on what's needed to deliver the service you asked for, on our legal obligations, or on our legitimate interests in running and improving our business when those don't override your rights. Health data is only processed with your explicit consent.

You can withdraw consent at any time, subject to legal or contractual limits. Tell our Privacy Officer. If you withdraw consent to screening or test data, we may not be able to test or train you safely, and we'll explain what that means before you decide.

6.Health and performance data

We treat screening answers, medical information and test results as sensitive. Access is limited to the staff who need it to work with you. We don't share it with a coach, team, school, scout, employer or insurer unless you ask us to, or the law requires it.

Our testing and results are for performance and training. They aren't medical tests and aren't a diagnosis. If something in your results concerns us, we'll tell you and suggest you see a health professional.

7.Athletes under 18

A parent or guardian must book for an athlete under 18 and give consent on their behalf. We share an athlete's results with that parent or guardian, and we also explain them to the athlete in a way that fits their age. In Quebec, a parent or guardian consents for athletes under 14.

This website isn't aimed at children. We don't knowingly collect personal information online from children under 13. If you think a child has sent us information, contact our Privacy Officer and we'll delete it.

8.Who we share it with

We share personal information only as this policy describes, and only as much as each purpose needs:

• Service providers who work for us and must protect your information: our online booking system, payment processor, email and text messaging platform, secure cloud storage and athlete data software, website host, and, if you allow them, analytics and advertising tools. They may only use your information to provide their service to us. Our Privacy Officer can give you a current list.
• People you choose, such as your coach, team staff, physician or physiotherapist, when you ask us to share your results with them.
• Professional advisors such as our accountant, lawyer and insurer, under confidentiality.
• Authorities, when the law requires it, to respond to an emergency that threatens someone's life, health or safety, or to protect our legal rights.
• A buyer or successor, if VO2Peak is sold or reorganized, under an agreement to protect your information as this policy does.

9.Where it's stored

Some of our service providers store or process information outside Ontario, and in some cases outside Canada, including in the United States. While it's there, it's subject to that country's laws, and courts, police or government agencies there may be able to access it. Before we send personal information outside Canada, or outside Quebec for Quebec residents, we check that it will be protected to the standard this policy sets.

10.How long we keep it

We keep personal information only as long as we need it for the purposes in this policy, or as long as the law requires. Then we securely destroy it or make it anonymous.

Client files

Screening, test results, reports, programs and session video: 7 years after your last session. For athletes who train with us before they turn 18: until 7 years after their 18th birthday, if that's later. Ontario's time limits for legal claims don't start running for a minor until they turn 18.

Payment and tax records

6 years from the end of the tax year they relate to, as the Canada Revenue Agency requires.

Consent to marketing emails

As long as we send you messages, and 3 years after you unsubscribe, so we can show we had your permission.

Messages from people who don't become clients

2 years.

Your cookie choice

12 months, then we ask again.

Analytics data

If we use analytics, no more than 14 months.

If you've asked to see your information, or there's a legal claim or investigation, we keep what's needed until it's resolved, even if that's longer.

11.How we protect it

We use physical, organizational and technical safeguards that fit how sensitive the information is. These include limiting access to the people who need it, password-protected systems, encrypted connections when data travels over the internet, and locked storage for any paper files. Anyone who handles your information for us is expected to keep it confidential. No system is perfectly secure, so if you think your information has been put at risk, tell us right away.

12.Email and text messages

We send news, offers and program updates only to people who've agreed to get them, or where Canada's anti-spam law otherwise allows it, for example for a limited time after you've bought from us. Every message identifies VO2Peak, gives our mailing address, and has a simple way to unsubscribe. We act on unsubscribe requests within 10 business days. Messages about your bookings, payments or safety aren't marketing, so you'll still get those.

13.Cookies and similar tools

This website uses essential storage to remember your cookie choice. We don't currently use advertising tools. If we add analytics or advertising tools, they only run if you switch them on, and they're off until you do. You can change your choice any time with Cookie settings. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of marketing and advertising tools. The cookie policy has the details.

14.Your rights

Everyone

You can ask to see the personal information we hold about you, ask how we've used it and who we've shared it with, and ask us to correct it if it's wrong or incomplete. You can also withdraw consent, as section 5 explains. We'll answer within 30 days, which meets the deadlines in Canada, Quebec, the EU and UK, and US states. If we need more time, or can't give you something (for example because it includes another person's information), we'll tell you why. Access is free.

Quebec residents

You can also ask for your information in a structured, commonly used technology format, ask us to stop sharing it or to de-index it where the law allows, and ask to be told when technology that can identify, locate or profile you is in use. Our analytics and marketing tools are off by default.

People in the European Economic Area or the United Kingdom

You can also ask us to erase your information, limit how we use it, or send it to you or another organization in a portable format, and you can object to processing based on our legitimate interests. You can complain to your local data protection authority.

People in US states with privacy laws

Depending on where you live, including California, you can also ask to know, delete or correct your information and opt out of the "sale" or "sharing" of personal information for targeted advertising. We don't sell personal information. Advertising tools only run if you switch them on, and you can switch them off at any time with Cookie settings. We honour Global Privacy Control signals. We won't treat you differently for using your rights.

How to ask

Contact our Privacy Officer (section 17). We may need to confirm your identity before we act. A parent, guardian or someone with your written authorization can ask on your behalf.

15.Privacy breaches

If a breach of security puts your personal information at real risk of significant harm, we'll tell you as soon as we can, report it to the Office of the Privacy Commissioner of Canada, and tell anyone else who can help reduce the harm. We keep a record of every breach for at least two years.

16.Changes to this policy

We'll update this policy when our practices or the law change, including if Canada's proposed new federal privacy law comes into force. The date at the top shows when it last changed. If a change affects how we use information we already have, we'll tell you before it takes effect and ask for consent where it's needed.

17.Contact our Privacy Officer

If you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376. Quebec residents can also contact the Commission d'accès à l'information du Québec at cai.gouv.qc.ca. People in the EEA or UK can contact their local data protection authority.