Privacy Notice

Cerebral Physique LLC (trading as Cerebral Physique) is the data controller for personal data processed through cerebralphysique.com. Contact: admin@cerebralphysique.com.

• Account data — name, email, login credentials. Used to create and secure your account. Legal basis: performance of a contract.
• Profile & training data — body type, fitness level, goals, workout logs, journal entries, routines. Used to deliver the service and personalise coaching. Legal basis: contract.
• AI Coach conversations — messages and, if you use voice, transcribed audio. Used to generate responses, meter usage and improve safety. Legal basis: contract and legitimate interests.
• Support and booking messages — emails, intake answers, and a phone number if you opt into retainer texting. Used to respond to you and schedule sessions. Legal basis: contract and consent.
• Usage and device data — pages viewed, actions taken, approximate location from IP, browser and device identifiers. Used for security, fraud prevention and product improvement. Legal basis: legitimate interests.

Card and billing details are collected and processed by Stripe, not by us. We never see or store your full payment card data.

• Payment processor — Stripe handles checkout, subscription billing, payments, tax compliance, invoicing and refunds.
• Service providers / subprocessors — hosting and database infrastructure, email delivery, AI model providers (for AI Coach responses, text-to-speech and speech-to-text), and scheduling (Calendly) for booked sessions.
• Professional advisers — legal and accounting, where necessary.
• Authorities — where required by law.

We do not sell your personal data.

Our providers may process data in the United States and other countries. Where data leaves the UK/EEA, transfers rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.

We keep personal data only as long as we need it for the purpose it was collected. When the period ends, we delete or anonymise it. Here is the schedule by data type:

Why health records are kept longer. Your PAR-Q, injury history and medical-clearance answers are safety and liability records: they evidence the screening we carried out before training you. We hold them for 7 years after your last session in line with standard practice for coaching and personal training, then delete them. They are never used for marketing, profiling, or shared with anyone outside your coach except where the law requires it.

Delete your data anytime: email admin@cerebralphysique.com and we'll erase your records — no questions asked, beyond what tax or legal record-keeping legally requires. We act on deletion requests within 30 days.

Consent. Where we rely on your consent to process data (for example, optional retainer text messages), you can withdraw it at any time by emailing us. Withdrawing consent won't affect processing we've already done under a different legal basis, such as fulfilling your booking.

Depending on where you live, you may request access, correction, deletion, restriction, portability, or object to processing; withdraw consent at any time; and complain to your supervisory authority. Email admin@cerebralphysique.com and we'll respond within one month.

We use appropriate technical and organizational measures, including encryption in transit, row-level access controls on our database, and least-privilege access to production systems. No system is perfectly secure, so please use a strong, unique password.

How your account is protected. Every account record — profile, health screening answers, coaching notes, purchases and journal entries — is stored behind row-level security, so a signed-in member can only ever read or write their own rows. Payment card details never touch our servers: checkout runs inside Stripe's own hosted form, and we store only a payment reference. Passwords are salted and hashed by our authentication provider, and administrative actions such as refunds and testimonial approval require a separately granted admin role.

Health information you share with us. Cerebral Physique is a fitness education and wellness business, not a healthcare provider, health plan or healthcare clearinghouse. That means the information you give us — including PAR-Q answers, injuries and limitations — is not "protected health information" under HIPAA, and we are not a HIPAA covered entity or business associate. We still treat it as sensitive: it is access controlled, used only to personalize your training and safety guidance, never sold, never used for advertising, and never shared with insurers or employers. We do not diagnose, treat or provide medical clearance — always consult a qualified clinician for that. You can review, correct or delete these answers at any time from your profile, or by emailing admin@cerebralphysique.com.

We use two categories of storage. Essential cookies and local storage keep you signed in, remember your cookie choice, and hold app state such as your routine builder, player volume and saved music. Analytics is optional and off unless you accept it: it records anonymous, aggregated page and feature usage so we can see which programs and tools get used. We do not run advertising cookies, sell data, or track you across other sites.

Your consent choice is stored on your device for 180 days (about 6 months), after which we ask again. Analytics records are kept for up to 12 months, then aggregated or deleted. You can change your mind any time via cookie preferences, or clear storage in your browser settings — though parts of the site may stop working. The full list of cookies we set, with provider and retention for each, is in our cookie policy.

The service is not intended for anyone under 16, and we do not knowingly collect their data. If you believe a child has given us data, contact us and we'll delete it.