Privacy Policy
Effective 1 November 2026
The Performance Method is run by me, Jason Penner, from Winnipeg, Manitoba, as a sole proprietor. This policy explains what personal information I collect through the-performance-method.com and the client app at app.the-performance-method.com, why I collect it, who else touches it, and what you can ask me to do with it.
The short version: I collect what I need to coach you, I keep your health information inside the app, I don't sell anything about you to anyone, and you can ask to see, fix or delete your information at any time.
Who is responsible
I'm responsible for your personal information and I'm the person you contact about it.
Email: jason.penner.83@gmail.com
What I collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account and contact | Name, email, phone number, Google sign-in ID, profile photo (optional) | You, or Google when you sign in with Google |
| Profile | Date of birth, gender, address, the facility you train at, goals | You, or me during a consult |
| Health and screening | PAR-Q answers and clearance status, injuries or pain you report, program-fit answers, assessment results (e.g. strength and mobility tests, body measurements) | You, through forms in the app or on a consult |
| Training | Your programs, workouts, sets, reps, weights, notes you log, check-in answers, goal notes, messages with me, booked calls | You and me, through the app |
| Connected apps (optional) | Activities you choose to import from Strava | Strava, only if you connect it |
| Payment | What you bought, when, amount, billing status. Card details go straight to Stripe; I never see or store your full card number | Stripe |
| Marketing consent | Whether you agreed to email from me, the exact wording you agreed to, when, and technical details of that sign-up (IP address, browser type, the link you arrived from) | You, at sign-up or in your settings |
| Technical | Device and browser type, notification tokens for reminders, security signals that block automated sign-ups, error logs | Your device and the app |
| Consult bookings | Name and email you enter on the booking page | You, through Google Calendar |
The consult booking page only asks for your name and email. Please don't put health information there; I'll ask on the call or in the app.
Why I use it
- To coach you: design and adjust your program, review your check-ins, run calls, and track your progress.
- To keep training safe: the PAR-Q screening and program-fit check decide whether a program is a reasonable match and whether you need clearance first. For Monitored programs, the fit check is an automated, rules-based decision. If it says a program isn't a fit, you can book a consult and talk it through with me.
- To run the account: sign-in, billing, receipts, reminders and service messages about your program.
- To send marketing email, only with your consent: you can withdraw consent at any time through the unsubscribe link in any email or in your app settings. Withdrawing doesn't affect your coaching or service messages.
- To keep the app secure and working: prevent abuse, fix bugs, and keep costs sensible.
- To meet legal obligations: tax and accounting records, and responding to lawful requests.
I don't sell or rent your personal information, and I don't use it for third-party advertising.
How AI tools are used
I use AI tools (currently Google's Gemini, accessed through the app) to help me draft workouts and suggest program adjustments. When I do, the tool receives training details only, such as your age, workout history, exercise preferences and injury notes. It never receives your name, email, date of birth or anything else that identifies you. I review every suggestion myself. AI never decides your program, never interprets your screening, and never sends you anything on its own.
Outside the app (for example in planning documents or my own business tools), any health or personal information about you is stripped of anything that identifies you.
Who else handles your information
I use a small number of service providers. They process your information on my behalf, only for the purpose listed.
| Provider | What they do | Where data may be stored |
|---|---|---|
| Google (Firebase, Google Cloud) | Hosts the app, its database, file storage, sign-in, notifications and abuse protection | United States |
| Google (Calendar, Meet, Gemini) | Consult and check-in bookings, video calls, AI drafting help | United States and other Google locations |
| Stripe | Payments and billing | United States and other Stripe locations |
| Resend | Delivers emails from the app | United States |
| Squarespace | Hosts the marketing website | United States |
| Strava (only if you connect it) | Sends me the activities you choose to share | United States |
Because several of these providers are outside Canada, your information may be stored or processed in other countries and may be accessible to courts, law enforcement or national security authorities there. Where a reasonable Canadian option exists, I prefer it, and I review providers regularly.
I'll also share information if the law requires it, or if a client's safety is at real risk. If the business is ever sold or transferred, your information would move with it under this same policy, and I'd tell you first.
How long I keep it
| Information | How long |
|---|---|
| Account, training and check-in records | While your account is active, then 7 years after your last activity |
| Health screening (PAR-Q) and assessments | 7 years after your last program |
| Payment and tax records | 6 years after the end of the tax year (CRA requirement) |
| Marketing consent records | As long as needed to prove consent, then 2 years after you withdraw |
| Consult bookings | 6 months if you don't become a client |
When the period ends, I delete the information or remove anything that identifies you.
How I protect it
- Access in the app is controlled by roles checked on the server. You can see your own records; only I (and any trainer I explicitly authorize) can see client health information.
- Screening answers stay in the app. They're never sent by email, Slack, calendar invites or AI tools.
- Data is encrypted in transit and at rest by Google Cloud.
- I run a weekly security check of the app's code and access rules.
No system is perfect. If a breach creates a real risk of significant harm to you, I'll tell you and the Office of the Privacy Commissioner of Canada as the law requires.
Cookies and similar tools
The website (Squarespace) uses cookies for basic site function and visitor statistics; you can manage them in your browser. The app stores sign-in information in your browser so you stay logged in, and uses Google security tools to block automated sign-ups. Neither is used to show you ads.
Your choices and rights
You can ask me to:
- show you the personal information I hold about you
- correct anything that's wrong
- delete your account and information, except what I'm legally required to keep (such as tax records)
- stop sending marketing email (one click, any time)
- tell you who I've shared your information with
Email jason.penner.83@gmail.com. I'll answer within 30 days. If you're not satisfied with my answer, you can contact the Office of the Privacy Commissioner of Canada.
Age
The app and coaching are for adults 18 and over. I don't knowingly collect information from anyone younger.
Changes
If I change this policy, I'll update the date at the top. For meaningful changes, I'll tell you by email or in the app before they take effect.