Privacy Policy

What changed in this revision

The previous version of this policy was written on May 13, 2026. The practice kept building after that date and the policy did not keep up. This section exists so you do not have to read eighteen sections to find out what moved. Every item below is a change in what we actually do, not a change in wording.

• Two processors were never disclosed, and one was disclosed after it stopped. Web3Forms has delivered the public contact form on KinetiqAF.com (including your message) since before this policy was first written, and appeared nowhere in it. ipify, USDA FoodData Central and Open Food Facts arrived with the food diary and the barcode scanner. Meanwhile §5 still named Google Apps Script for a contact-form auto-reply that moved to Resend months ago; that row is gone, and so is the code behind it. The processor table in §5 is now generated from the application’s own source, and a build-time check fails if the code calls a service the table does not name.
• A care team can now sign in. A guardian or a support person can have their own account with their own scope (seeing only what you agreed they should see) and every entry in your record says who made it. You can withdraw a grant at any time. See §5b.
• The AI features have an off switch, and it is in the app. Settings › Privacy & data carries a per-account toggle; with it off, nothing about you reaches a language-model API. See §13.
• You can take everything with you, and you can ask us to delete it, from inside the app. Export produces a file with your profile, health form, agreements, sessions, notes, habits, food diary, messages, invoices and photos. Deletion is a real deletion of everything we are not legally required to keep, and the modal tells you exactly what stays and for how long. See §9 and §10.
• The app now works without a signal, which means it keeps things on your phone. Your current workout and anything you log while offline are held in your browser’s own storage and sent when you reconnect. Signing out clears it. See §8a.
• New kinds of information exist because new features do. Voice notes (audio you record instead of typing), a food diary that now lives in the database rather than only in your browser, functional-test results and the progress letter written from them, and readiness check-ins. Each is listed in §3 with how long we keep it in §9.
• Signing is recorded more completely. A form can now be filled in by somebody other than the person signing it (a parent, an aide, the trainer reading it aloud) and the record says who did which. See §8b.
• There is a written plan for the day something leaks. §8c says, in plain words, what we will do and when, and the internal runbook it refers to names every vendor whose keys would have to be rotated, checked against the list in §5 on every change.
• And this policy is in Spanish. The whole document, not a summary. Where the two versions conflict the English governs, and the page says so in Spanish.
• A note on test accounts. The practice runs a small number of accounts that belong to nobody. They exist so the software can be tested before a change reaches you. They contain invented data. If you are reading this, your account is not one of them.

Back to contents

1. Notice at collection (summary)

This summary is provided at or before the point of collection, as required by Cal. Civ. Code § 1798.100(a) and 11 CCR § 7012:

• Categories collected: Identifiers, customer records, protected classification information, commercial information, internet/network activity, general geolocation, sensitive personal information (health data), and professional/funding information (Adaptive / SDP clients only). See §3 below for detail.
• Purposes: To respond to inquiries, deliver training services, schedule sessions, process payments, comply with legal obligations, and improve safety. See §4 below.
• Retention: Each category is retained only for as long as needed for its purpose, with maximums set out in §9 below.
• Sale or sharing for cross-context behavioural advertising: We do not sell your personal information and we do not share it for cross-context behavioural advertising. There is nothing to opt out of.
• Sensitive personal information: We use sensitive personal information (your health data from the PAR-Q) only for the services you requested and the additional purposes permitted by 11 CCR § 7027(m), and never to infer characteristics about you.

Back to contents

2. Who we are

KinetiqAF is the trade name of James Kennedy & Associates LLC, a California limited liability company operating an adaptive fitness and personal training practice in San Diego. The business is a sole-operator practice owned and run by James Kennedy.

We can be reached at:

• Email: james@kinetiqaf.com
• Phone: 442-375-5090
• Address: San Diego, California

We are the data controller for the information we collect about you.

Back to contents

3. Information we collect

We collect only what we need to run our practice and provide training services. The categories below match the categories defined in California Civil Code § 1798.140.

We do not collect:

• Bank account numbers, full credit card numbers, or social security numbers (Stripe handles payment data directly: we never see your card number).
• Biometric identifiers (fingerprints, voiceprints, face geometry).
• Precise GPS location.
• Information about your political affiliations, religious beliefs, or sexual orientation.
• Information from any third-party data broker.

Back to contents

4. How we use information

We use the information we collect only for these purposes:

• To respond to inquiries. When you submit the contact form on KinetiqAF.com, we use your name, email, phone, and message to reply with a consultation invitation or referral.
• To design and deliver training. Your PAR-Q, intake responses, and progress logs let us tailor a safe program to your goals and medical context.
• To schedule and confirm sessions. Calendar reminders, session confirmations, and rescheduling notifications.
• To process payments and issue invoices. For private-pay clients, we generate invoices and accept payment via Stripe. For SDP / FMS-funded clients, we generate the documentation your FMS provider requires for reimbursement.
• To send service-related communications. Account messages, agreement reminders, PAR-Q renewal prompts, schedule updates.
• To comply with legal obligations. Records retention for signed health screenings and service agreements as required by California professional standards and the IRS for business records.
• To improve safety. Reviewing incident notes, regulatory reporting for adaptive clients where mandated by §54327, internal quality review.

We do not use your information for advertising, profiling, automated decision-making, or any purpose unrelated to providing training services.

Back to contents

5. When we share information

We share information only as needed to run the practice. We do not sell information, and we do not share it for cross-context behavioural advertising. Specifically:

The table below is generated from the application’s own source code. Every service our software contacts is in it, including the ones that receive nothing about you, like the font and video services, because leaving those out would mean the list was curated rather than complete. A build-time check compares the two on every change and refuses to publish a version of this page that omits a service the code calls, or names one it no longer calls.

Three recipients are not vendors and so are not in the generated table: your Regional Center or Financial Management Services provider, to whom we send the documentation your funding requires and which you authorize when you sign your service agreement; government or law enforcement, where a valid subpoena, court order or a mandated-reporting law (Cal. Welf. & Inst. Code § 15630, suspected abuse or neglect of a vulnerable adult) requires it; and our insurance carrier, limited to the minimum needed to process a claim after an incident at a session.

We sign Data Processing Agreements (or equivalent) with our service providers. We do not give them permission to use your information for their own purposes.

5a. Wearable-device sub-processors

If you connect a wearable device (a fitness tracker, smartwatch, or sleep ring) to your KinetiqAF account, the device’s manufacturer becomes a sub-processor of your health data. Your data flows through their systems before reaching ours; their own privacy terms apply on their side. The first-use consent screen in the Client Portal covers this before any connection happens.

The table below lists every wearable provider KinetiqAF can connect to. Each row is marked Not active until the integration is enabled for the practice; we update this table before we turn on each provider, so the public list always matches what is actually live. If you connect a device, the row for that provider applies to you; if you don’t, no data flows to that provider on your behalf.

You can disconnect any wearable at any time from the Client Portal (Preferences → Connected devices). Disconnecting stops new data from flowing; data already received is retained subject to §8 below, and can be deleted with the rest of your data using Delete my data under Privacy & data.

5b. Your care team: who else can see your record

Many of the people we train have somebody helping them: a parent, a spouse, an adult child, a paid support worker, a Regional Center service coordinator. Until 2026 that help happened by sharing a password, which is the worst possible arrangement: it gives the helper everything and records nothing. A care team is the replacement.

Each member of your care team signs in as themselves, with their own password, and sees only the part of your record you agreed to. The scopes are deliberately coarse, because a permission nobody understands is a permission nobody is really giving: someone may be limited to the schedule, or the schedule plus billing, or the schedule plus your training and progress, or (if you choose it) everything including your health screening.

Every entry in your record carries the name of whoever made it, so “who wrote this” is never a guess. Members of your care team can act on your behalf where you allowed it; they cannot change what your trainer wrote, and they cannot grant access to anybody else.

You can withdraw a grant at any time, in Settings › Privacy & data, without asking anybody and without explaining. Access stops immediately. The fact that the grant existed, and when it ended, stays on the record. That is the audit trail, and deleting it would defeat the point of having one. If the client is a minor or has a conservator, the guardian’s access is part of the legal arrangement rather than a grant the minor can withdraw; §7 covers that.

Who pays decides what the billing screens show. If a parent, a guardian or an FMS provider is the payer, they see the invoices; if you pay for yourself, nobody else does.

Back to contents

6. Health information

We collect health information through the Physical Activity Readiness Questionnaire (PAR-Q) and intake forms because a fitness practice that does not know your medical history cannot keep you safe.

We are not a HIPAA-covered entity: we are a personal training business, not a healthcare provider, and we do not bill insurance for medical services. HIPAA does not apply to us. Because of the sensitivity of the information, we voluntarily apply strong safeguards to protect it:

• Health information is stored only in our Supabase database, encrypted in transit (TLS) and at rest.
• Access is restricted by Row-Level Security to your trainer and the practice owner.
• We do not discuss your health information with anyone outside the practice except as you authorize, as required by law, or as needed to process an emergency.
• You can download your full PAR-Q at any time from the Client Portal (Documents → PAR-Q → Download).
• You can request deletion of your health information at any time, subject to the records-retention requirements in §9 below.

If you are uncomfortable disclosing certain medical conditions, we would rather know about a gap than have incomplete information. Please tell us, and we will work with you to design around it.

Back to contents

7. Children and minors

We work with clients of all ages, including minors. When the client is a minor:

• A parent, legal guardian, or authorized representative must complete the PAR-Q and sign the service agreement on the minor's behalf.
• The minor's Client Portal account, if any, is operated by the parent or guardian until the client turns 18.
• We do not knowingly collect personal information directly from any child under 13 without verifiable parental consent (COPPA).
• Parents and guardians can review, request changes to, or delete a minor child's information at any time by contacting us.
• Where the client is under 18 at the public intake, we require a guardian’s consent before the submission can be sent, and that consent becomes a dated record when the account is approved: who gave it, what text they agreed to, and when. It is kept as proof for as long as we keep the agreement itself.
• A guardian’s access to a minor’s record is part of that legal arrangement, not a care-team grant the minor can withdraw. When the client turns 18, the account becomes theirs: the guardian’s standing access ends, and continues only if the now-adult client grants it as a care-team member under §5b.

Back to contents

8. How we store and protect information

Our security posture:

• Encryption in transit: All connections to KinetiqAF.com and the Client Portal use HTTPS (TLS 1.2+). Our database connections to Supabase use TLS.
• Encryption at rest: Supabase encrypts data at rest with AES-256.
• Access controls: Authentication uses Supabase Auth. Database access is limited by Row-Level Security policies: the trainer only sees their own clients, and clients only see their own data.
• Audit trail: Signed agreements record the signing IP address and a timestamp per California UETA § 1633.7 for legal-record purposes.
• Account security: You are responsible for keeping your Client Portal password confidential. Tell us immediately if you believe your account has been accessed without your permission.
• Backups: Supabase performs automated backups. Backups are encrypted and access-controlled.

8a. Offline storage on your device

The Client Portal is designed to work in a garage, a park or a building with bad reception, which means some of your information is kept on your own device rather than only on our server. Specifically: the workout you are currently doing and the sets you log while offline, your language and display preferences, a cached copy of your own profile so the app can open before the network answers, and a queue of anything you logged while disconnected, which is sent as soon as you reconnect and deleted once it is.

This storage is in your browser, on your device, and we cannot read it remotely. Signing out clears the cached profile and the session; clearing your browser’s site data clears all of it. On a shared or borrowed device, sign out rather than closing the tab.

8b. Electronic signatures and signed documents

When you sign something in the app (a service agreement, a health screening, a consent), we keep the signature image you drew, the exact text you signed (by version, so we can always reproduce the document as it read on that day), the date and time, and the IP address the signature came from, as California’s Uniform Electronic Transactions Act (Cal. Civ. Code § 1633.7) expects of an electronic record.

A form can be completed by one person and signed by another: a parent filling in a child’s screening, an aide writing down what a client says, the trainer reading the questions aloud at a kitchen table. The record says who filled it in and who signed it, separately, because a signature that implies its signer typed every word is a record that is quietly wrong.

A signed document is never edited. If something has to change, the document is superseded by a new version which is signed again, and both remain on file. You can download any document you signed, at any time, from the Client Portal.

8c. If there is a breach

No system is perfectly secure, and a policy that only says so is not telling you anything. Here is what we have committed to, in plain words.

• We will tell you. If unencrypted personal information about you is taken or exposed, we will notify you in the most expedient time possible and without unreasonable delay, as Cal. Civ. Code § 1798.82 requires, and in no case later than 60 days after we discover it. The notice will say what kind of information was involved, when it happened as best we can establish, what we have done, and what we recommend you do. It will be in English and in Spanish.
• We will tell the regulators the law names. The California Attorney General if more than 500 California residents are affected, and the Federal Trade Commission under the Health Breach Notification Rule if health information is involved. That rule reaches us precisely because we are not a HIPAA-covered entity.
• We have written down what to do beforehand. There is an internal runbook covering the first thirty minutes: revoke sessions, rotate the key, work out what was exposed, notify. It names every vendor in §5 that holds information about a person, so that nobody has to remember which keys exist while the clock is running, and an automated check compares that list against §5 on every change to either one.

Back to contents

9. How long we keep information

We keep different categories of information for different periods, based on the purposes for which we collected them:

• Contact form submissions (leads who did not become clients): 18 months from submission, then deleted.
• Active client account data: For as long as you are an active client, plus the periods below after our relationship ends.
• Signed service agreements and signed PAR-Qs: 7 years after the agreement ends (California professional records-retention standard).
• Invoices and payment records: 7 years (California Revenue and Taxation Code and IRS recordkeeping).
• Session notes and progress logs: 5 years after your last session, then deleted.
• Messages exchanged through the Client Portal: 3 years after your last session, then deleted.
• Web analytics and server logs: 90 days, then automatically purged.
• Voice notes and their transcripts: With the note they belong to: 5 years after your last session for a session note, and deleted with the habit or goal otherwise. Deleting the note deletes the audio.
• The food diary: 2 years from each entry, then deleted. You can delete any entry yourself at any time, and it goes immediately.
• Progress photos: Until you delete them, or 5 years after your last session, whichever comes first. They are never used for anything but your own comparison unless you separately consented to a photo release, which you can withdraw.
• Functional test results and progress documents: 5 years after your last session. A progress letter sent to a provider you named is also kept for that period, as proof of what was sent and when.
• Readiness check-ins and habit logs: 3 years after your last session, then deleted.
• Care-team grants: The grant itself ends when you withdraw it. The record that it existed, and its dates, is kept for 7 years. It is the answer to “who could see this, and when”, which is a question a withdrawn grant does not stop somebody asking.
• Guardian consent records for minors: 7 years after the agreement ends, with the agreement itself.
• Your acknowledgement of a policy notice: 7 years. It records that you were shown a change and when: the evidence that the notice in §17 was actually given.
• Anything held on your own device: Not retained by us at all. See §8a. It is in your browser, it is cleared when you sign out or clear your site data, and we cannot reach it.
• Anything subject to a legal hold or active dispute: Held until the matter is resolved, then deleted on the schedule above.

When you ask us to delete your data, we delete it: your health answers, progress, photos, diary, notes and messages go, and your name and contact details are scrubbed from the rows we must keep. What survives is the short list the law requires us to keep: signed agreements and health screenings, invoices and payment records, and anything documenting a safety incident, on the schedules above. The app tells you this before you confirm, not afterwards.

You may request earlier deletion at any time. See your rights below. Note that signed legal records (agreements, PAR-Qs) may be retained even after a deletion request to the extent required to defend a legal claim, comply with tax law, or meet a records-retention obligation.

Back to contents

10. Your privacy rights

If you are a California resident, you have the following rights under the CCPA / CPRA:

• Right to know. You can ask what personal information we have about you, where it came from, how we use it, and who we share it with, going back at least 12 months.
• Right to access. You can request a copy of the information we have about you, in a portable format.
• Right to correct. If something we have is wrong, you can ask us to fix it.
• Right to delete. You can ask us to delete information, subject to the records-retention obligations described in §9 above.
• Right to limit use of sensitive personal information. You can ask us to use your health information only for the services you specifically requested. Because that is already how we use it, this right rarely changes anything in practice, but you can still exercise it.
• Right to opt out of sale or sharing. We do not sell or share your information for cross-context behavioural advertising. There is no opt-out to exercise because there is nothing to opt out of.
• Right to non-discrimination. We will not deny you services, charge you a different price, or provide a different level of service because you exercised any of these rights.
• Right to data portability. Where technically feasible, we will provide your information in a structured, commonly used, machine-readable format.
• "Shine the Light" right (Cal. Civ. Code § 1798.83). California residents may request, once per calendar year and free of charge, a list of any personal information we disclosed to third parties for those third parties' direct-marketing purposes in the prior calendar year. We do not share personal information for third-party direct-marketing purposes, so this list would be empty, but you may still submit a request to confirm that.

How to make a request

Submit any privacy request by emailing james@kinetiqaf.com with the subject line "Privacy request." We will verify your identity by confirming the email matches one we already have on file, or by asking a question only the account holder could answer.

We will respond within 45 days as required by Cal. Civ. Code § 1798.130(a)(2). If we need an additional 45 days (allowed by the statute), we will notify you within the first 45 days and explain why.

An authorized agent may submit a request on your behalf. We will require proof that you authorized them (a signed letter is sufficient) and may still ask you to verify directly.

Back to contents

11. Communications and opt-out

We send three kinds of email or text messages, and you have the right to control each:

• Service messages: session confirmations, schedule changes, invoice notifications, password resets, account-security alerts. These are necessary to deliver the service you signed up for. They are not marketing under CAN-SPAM and we will keep sending them as long as you are an active client. If you do not want service messages, the only option is to close your account.
• Transactional auto-replies: the single confirmation email sent when you submit the contact form. You cannot opt out of this one message because it confirms receipt of your inquiry, but we will not send you anything else from that submission unless you reply or become a client.
• Marketing or promotional messages: we do not currently send any. If we ever do, every message will include a one-click unsubscribe link as required by the CAN-SPAM Act (15 U.S.C. § 7704), and any SMS marketing would honour STOP, END, CANCEL, UNSUBSCRIBE, QUIT, or OPT-OUT replies as required by the Telephone Consumer Protection Act (47 U.S.C. § 227) and CTIA guidelines.

You may also email james@kinetiqaf.com at any time to update your communication preferences.

Back to contents

12. Cookies, tracking, and Global Privacy Control

KinetiqAF.com and the Client Portal use no advertising or analytics cookies at all. What they do use is browser storage, and this is the actual list, not a category, the keys themselves:

• Your sign-in session, set by Supabase Auth and held in your browser’s local storage rather than a cookie. It is what keeps you signed in, and it is cleared when you sign out.
• Two language keys, deliberately separate. One remembers the language chosen on the public pages (the marketing site, the intake, this policy). The other is your account’s own language, which comes from your profile. They are kept apart so that a stranger switching this page to Spanish on a shared computer cannot change the language of the next person who signs in.
• Your display preferences: light or dark theme, the simplified-interface mode, whether the sidebar is open, and which optional sections you have expanded.
• What you have already seen or dismissed: which notifications and messages you have read, whether you dismissed the “install this app” prompt, and whether you answered this week’s questions, so the app does not ask you the same thing twice.
• The offline working copy described in §8a: the workout in progress and anything logged without a signal.

We do not use:

• Advertising or tracking cookies.
• Social-media tracking pixels.
• Cross-site analytics like Google Analytics.
• Heatmap, session-replay, or behavioural-analytics services.

Because we don't track you, there is no "Do Not Sell or Share My Personal Information" link on our site: there is nothing to opt out of.

Global Privacy Control (GPC) and Do Not Track (DNT). Our site does not sell or share personal information for cross-context behavioural advertising, so there is no opt-out signal to honour. However, if your browser sends a GPC signal (per 11 CCR § 7025) or a legacy DNT header, we will continue to refrain from any such selling or sharing. The GPC signal will never cause us to increase data collection or be ignored.

Aggregated and de-identified data. We may produce aggregated or de-identified statistics (for example, total number of sessions delivered in a month) for internal planning. Once data is aggregated or de-identified per CCPA § 1798.140(h) and (m), it is no longer "personal information" and is not covered by this Privacy Policy. We will not attempt to re-identify it and will require contractually that any recipient also not attempt to re-identify it.

Back to contents

13. AI features, automated decision-making and profiling

We do not use automated decision-making technology (ADMT) as defined by the CPRA regulations (11 CCR § 7200 et seq.) to make decisions about you. We do not profile, score, rank, sort, or evaluate you using software. Every decision about your training program, scheduling, or service eligibility is made by a human (James Kennedy) based on a direct conversation with you. Because we do not use ADMT, the related rights to access and opt out of ADMT do not arise in our practice.

The product uses a language model in two places, and neither of them decides anything about you. The first reads paper: a photographed health screening or agreement is sent to Anthropic’s API so the text can be lifted out of it instead of retyped by hand. The second is an optional assistant that can answer a question about your own program. It is off unless it has been switched on for your account, and switching it on requires your consent first.

You can turn it off, in the app, yourself. Settings › Privacy & data carries the switch. With it off, nothing about you is sent to a language-model API for the assistant. Document reading only happens when a paper form is filed, so if you would rather no photograph of your paperwork be sent at all, tell us and we will type it in.

We use zero-data-retention mode, so the provider does not keep what we send after the call returns, and we do not allow anything we send to be used to train a model. Anything the assistant produces is a suggestion to a human: your trainer reviews it, and nothing goes into your program because software proposed it.

Back to contents

14. Accessibility of this policy

We want this Privacy Policy to be understandable by everyone we serve, including clients with cognitive disabilities, low vision, or limited English proficiency. If any part of this policy is unclear, you may contact us and we will explain it in plain language, read it aloud, translate it, or provide it in a larger font or alternative format at no cost. The site itself is designed to meet WCAG 2.1 Level AA where reasonably achievable for a small-business website, and the Client Portal includes a dedicated accessibility mode.

Back to contents

15. Residents of other U.S. states

This policy is primarily written for California residents. We serve clients only in San Diego County, California, so almost all data subjects are California residents. If you are a resident of another U.S. state with a comprehensive privacy law (e.g., Colorado, Connecticut, Virginia, Utah, Texas, Oregon, or Montana) and you interact with us, we will honour the equivalent rights that state's law grants you (access, correction, deletion, portability, opt-out of sale/targeted advertising, opt-out of profiling). Submit any such request using the contact information in §18 and we will treat it as a privacy request under your state's law.

Back to contents

16. International users

KinetiqAF.com is operated from California, United States. Our services are intended for California residents. If you access our site from outside the United States, you understand that your information will be processed in the United States, which may have different data-protection laws than your jurisdiction. We do not offer services to residents of the European Economic Area or the United Kingdom from this website.

Back to contents

17. Changes to this policy

We update this Privacy Policy when our practices change or the law requires it. The “Last updated” and “Effective” dates at the top tell you when the current version was written and when it starts to apply, and the “What changed” section at the top of the page lists the substantive differences from the previous version.

Material changes get thirty days’ notice, and the notice reaches you where you actually are. A revision is published with an effective date at least thirty days out. From publication, the Client Portal shows you a notice on the Today screen the first time you open it and carries a row in Settings › Privacy & data with the effective date and a link straight to the “What changed” section. When you acknowledge it, we record that you were shown it and when. That record is what makes the promise in this section checkable rather than merely stated. Your trainer also sends the notice by email; no email is sent automatically in his name.

A change that only corrects a typo, a broken link or a section number does not restart the thirty days, and we will not pretend it does by dressing it up as a revision. Prior versions are kept on file and you can ask for any of them at any time.

Prior versions of this Privacy Policy are kept on file. You can request a copy of any prior version at any time.

Back to contents

18. How to contact us

Back to contents