Legal
Privacy Policy
1 · Overview
This policy covers kalospt.ca, the Kalos client and trainer portal (web and the KALOS iOS app), and any data we collect when you book a consultation, create an account, train with us, or otherwise interact with Kalos Personal Training Studio (“Kalos”, “we”, “us”).
We are a small, appointment-only personal training studio in Richmond, BC. We collect only the data we need to run your training relationship — booking sessions, tracking your progress, and billing your packages — and we don’t sell your data or use it for advertising.
We aim to comply with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia’s Personal Information Protection Act (PIPA).
2 · What we collect
What we collect depends on how you use Kalos. A visitor to kalospt.ca who hasn’t booked a consultation gives us almost nothing; an active client training with us gives us the most, because that data is what makes your coaching work.
Account & contact info
- Name, email address, and phone number — collected when you book a free consultation or create an account. Used to identify you, contact you, and run your account.
Training & health data
- Session logs — exercises, sets, reps, and weights your trainer records during (or you record after) a session.
- Personal records & 1RMs, body weight, macro/food logs, and daily tracking (training phase, satiety, diet review) your trainer opts you into.
- Apple Health data (steps & distance) — only if you turn this on in the KALOS iOS app. This is read-only: we read your step count and distance to show alongside your manually logged activity. We never write anything to Apple Health, and this only works on the app, not the website.
- Progress photos — if you choose to upload them for tracking your transformation.
Purchase & account activity
- Package purchase history — which packages you’ve bought, session balance, and expiry date. See Section 7 for how the payment itself is handled.
- Booking history — sessions booked, attended, rescheduled, or cancelled.
- App & portal usage — when you use the KALOS app or client portal, which screens you visit, and actions like logging a day or booking a session. This is measured entirely first-party — it stays in our own database, is used only to run and improve the service, is never shared or sold, and raw usage events are automatically deleted after 180 days.
Other content you provide
- Anything else you type into the platform — session notes, goals, program details, and messages to your trainer.
3 · What we don’t collect
To be equally clear about what we don’t do:
- We don’t collect your location (GPS or otherwise).
- We don’t access your contacts, photo library beyond what you choose to upload, browsing history, or search history.
- We don’t run third-party advertising or analytics SDKs in the app or on the website — no Google Analytics, no Meta Pixel, no ad networks, no cross-app tracking. The only usage measurement is our own first-party kind described in Section 2, and it never leaves our systems.
- We never see or store your full payment card or bank details — see Section 7.
- We don’t store SIN numbers or full banking details for anyone, including our trainers — see Section 11.
4 · How we use your data
Every use of your data falls under one purpose: running the service you signed up for. Specifically:
- Matching you with a trainer and letting you book, reschedule, or cancel sessions.
- Letting your trainer log and review your training, progress, and photos.
- Tracking your package balance and expiry, and billing packages you purchase.
- Operating and improving the studio — e.g. scheduling, payroll, and studio capacity.
- Responding to you when you contact us.
We do not use your data for targeted advertising, don’t sell it, and don’t share it with data brokers.
5 · Who can see your data
| Data | Who can see it |
|---|---|
| Training logs, PRs, progress tracking | You, your assigned trainer, and admin (Kit & Matt) |
| Progress photos | You, your assigned trainer, and admin only — stored in a private cloud bucket, never public |
| Chat messages & photos | The members of that conversation; admin can additionally view and remove messages for moderation |
| Package balance & purchase history, lifetime spend | You and admin only |
| Another trainer’s payroll rate or payout | Nobody but that trainer and admin — trainers never see each other’s rates |
Staff access is enforced by your account role and checked on every request — a trainer can only see their own assigned clients, never another trainer’s.
6 · Messaging & chat
The KALOS app and portal include in-app chat. There are two kinds of conversation:
- Group channels — rooms visible to studio members according to each room’s audience. Some rooms are staff-only.
- Direct messages — private one-to-one conversations between a client and their assigned trainer.
Who can see messages. The content of a conversation — text and any photos — is visible to the members of that conversation. Studio administrators (Kit & Matt) can additionally view conversations and remove messages for moderation.
Display names. In group channels you appear under a handle you choose — falling back to your first name and last initial if you haven’t set one. Direct messages use real names.
Photos. Photos you send in chat are stored in a private cloud bucket and served only through short-lived signed links — never a public URL, the same way progress photos are handled (see Section 8).
Retention. Chat messages and their photos are automatically deleted after 90 days. The conversation lists and threads themselves persist, but their content is removed once it passes 90 days. Chat data is also deleted when you delete your account (see Section 9).
Notifications. If you turn on push notifications, a chat notification on your device may show the sender’s name or handle and the message text. Notifications are delivered to your device through Apple’s and Expo’s push notification services.
7 · Payments
Package purchases are processed through Helcim, a PCI-compliant Canadian payment processor, using their hosted checkout. When you pay, your card details go directly to Helcim — they never pass through, or get stored on, Kalos servers or in the Kalos app. We only receive confirmation that a payment succeeded and the amount, which we record against your account.
Package purchases can currently only be made on the web portal, not the KALOS iOS app.
8 · Storage & security
- Account and training data is stored in MongoDB Atlas, hosted on Google Cloud.
- Progress photos are stored in a private Google Cloud Storage bucket, accessible only via short-lived signed links generated for you, your trainer, or admin — never a public URL.
- Sign-in is handled by Firebase Authentication (Google, Apple, or email/password).
- Data is encrypted in transit (HTTPS/TLS) and at rest.
- Every change to your session balance is logged with a reason, timestamp, and who made it, so purchase and package history stays auditable.
9 · Retention & deletion
You can deactivate your account at any time from the KALOS app (More → Delete account) or by emailing us. Deactivating:
- Locks your account and signs you out immediately.
- Cancels any upcoming sessions (your remaining session balance is preserved, not forfeited).
- Removes your account from client lists, search, and booking.
We keep your training history, progress data, and purchase records after deactivation rather than instantly erasing them — this is so we can honour accounting, tax, and legal obligations (for example, records tied to a package you paid for), and so a deactivation can be reversed if it was a mistake. If you want your data fully erased rather than deactivated, email hello@kalospt.ca and we’ll action it, subject to what we’re required to keep by law.
10 · Your rights
Under PIPEDA and BC’s PIPA, you can ask us to:
- Access the personal information we hold about you.
- Correct inaccurate information — most of this you can already edit yourself in the app (profile, tracking, records).
- Delete your account and data, per Section 9.
- Ask questions about how your data is used or withdraw consent for optional data (like Apple Health sync), which you can turn off any time in the app.
To exercise any of these, email hello@kalospt.ca. We’ll respond within a reasonable time.
11 · Trainers & staff
Trainers and admin staff are also platform users, and this policy covers their data too. In addition to the account/contact info above, trainer accounts store:
- Their own payroll rate, session volume, and payout history — visible only to that trainer and admin, never to other trainers.
- A CRA Business Number and a payment-method note, for contractors who invoice GST. We do not store SINs or full banking details — that’s handled by our accountant.
12 · Children
Kalos is not directed at children, and our online account-creation flow is intended for adults. If a minor trains at the studio, that’s arranged directly with us and covered by an in-person parent/guardian waiver, not through self-serve online signup.
14 · International data transfer
Our servers run on Google Cloud in the United States (Cloud Run, us-west1). This means your data is stored and processed outside Canada. Where it applies, we take reasonable steps to protect your data to a standard comparable to Canadian law, consistent with PIPEDA’s requirements for cross-border transfers.
15 · Changes to this policy
We may update this policy as the platform changes. We’ll update the “Last updated” date above, and for material changes, we’ll make a reasonable effort to let active clients know.
16 · Contact us
Questions about this policy or your data? Email hello@kalospt.ca.
See also our Client Agreement & Package Terms.