Velta · Legal · POC

Privacy Policy

Version 1.3 POC · Effective 2026-05-28 · POC scope: Canada, including Quebec

POC scope notice. This Policy applies only to the Velta Proof of Concept: an Ontario-based sole proprietorship operating a fitness-coaching marketplace for Canadian residents, including residents of the Province of Quebec. The Quebec-specific privacy requirements that follow from that (notably Law 25, including any privacy impact assessment before transferring a Quebec resident's personal information outside Quebec) are not asserted as satisfied and remain subject to bilingual legal review.

Quebec residents are in scope. During the Proof of Concept, Velta accepts registrations from residents of the Province of Quebec. The account-closure practice previously applied to Quebec residents has been retired, and no account is closed, and no personal information is deleted, on the basis of residence in Quebec. Quebec Law 25 imposes additional obligations on Velta as controller (for example, a privacy impact assessment before transferring personal information outside Quebec) that have not been verified as met. This notice is not a representation of compliance with Quebec law.

1. Introduction

This Privacy Policy describes how Velta, a sole proprietorship of Cristiane Aparecida de Amorim Miranda registered in the Province of Ontario, Canada, operating from 213 Pineglen Crescent, Kitchener, Ontario N2R 0G2 (“Velta,” “we,” “us”) collects, uses, discloses, and protects personal information in connection with the velta.fit website and mobile applications (the “Platform”). Velta is a two-sided marketplace connecting members with independent fitness coaches, available to residents of Canada, including residents of Quebec.

We are committed to complying with the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and the substantially-similar provincial privacy laws that apply in Alberta and British Columbia to private-sector activity of their residents. This Policy is drafted to satisfy those regimes.

2. Privacy Officer — how to contact us

Our Privacy Officer oversees compliance with this Policy and applicable privacy law. You may contact the Privacy Officer with any question, access or correction request, or complaint:

Privacy Officer
Cristiane Aparecida de Amorim Miranda
Velta
213 Pineglen Crescent, Kitchener, ON, Canada N2R 0G2
Email: support@velta.fit (subject line: "Privacy")
Response target: within 30 days of your request

3. Personal information we collect

Category	Examples	Sensitivity
Account identifiers	Name, email, password hash, Google ID (if you sign in with Google), IP address, device identifiers	Standard
Eligibility data	Age confirmation (18+), province of residence (for account, billing, and provincial consumer-protection purposes)	Standard
Profile data	Training preferences, goals, language	Standard
Coach profile data	Coach biography, self-declared certifications, specialties, pricing tier, certificate of insurance	Standard
Health information	Injury history, medical flags declared in PAR-Q+, body measurements, weight history, progress photos	Sensitive
Exercise videos	Videos uploaded for coach form-review; may include image of your body and face (captured via Camera or Photo library — see §3.1)	Sensitive
Communications	Chat messages with your Coach, support tickets	May include sensitive information
Usage data	Workouts completed, set-by-set logging, feature usage, session timestamps	Standard
Payment data	Payment method tokens handled by Stripe. Velta does not store full card numbers.	Handled by processor
Application logs	Error traces, diagnostic metadata (no content of chats or videos)	Standard

3.1 Mobile-app permissions and how we use them

The Velta Android app requests sensitive permissions just-in-time — only when you tap the feature that needs them, never at app startup. The table below lists every permission declared in the app manifest, when we ask for it, why we use it, and what we do not do with it.

Permission	When we ask	Why we use it	What we do not do
`CAMERA`	The first time you tap "Record" on an exercise-video upload screen.	To let you record an exercise video for your coach to review.	We do not access the camera in the background, we do not record audio without an active capture, and we do not retain camera output that you cancel before saving.
`READ_MEDIA_IMAGES`	The first time you tap "Upload from gallery" on an exercise-video or progress-photo screen.	To let you choose an existing video or photo from your device's gallery via the system picker. Velta uses this permission only via user-initiated picker flows; we do not scan or enumerate your photo library.	We do not browse your photo library on our own, we do not index your photos, and we do not retain any image you do not explicitly select and upload.
`POST_NOTIFICATIONS`	The first time the app needs to deliver an actionable notification (e.g. a new message from your coach or a new feedback video).	To send transactional notifications about your account: new coach message, new video feedback, subscription billing events, and account-security alerts.	We do not send marketing push notifications during the POC. All push messages are transactional.
`VIBRATE`	Granted automatically (no runtime prompt; this is a normal-permission category on Android).	To accompany incoming-notification haptics on devices that support them.	We do not use vibration outside of notification haptics.
`INTERNET`	Granted automatically (no runtime prompt; this is a normal-permission category on Android).	Required for the app to communicate with Velta's servers (login, syncing workouts, uploading videos).	The app does not contact servers other than Velta's own API and the sub-processors listed in §8.

If a future version of the app introduces a new sensitive permission, we will update this table before that build ships. The Android manifest at app/android/app/src/main/AndroidManifest.xml is the source of truth; rows in this table must equal the <uses-permission> entries declared there.

4. Purposes for which we use personal information

We use personal information only for purposes identified at or before collection:

Service delivery: account creation, authentication, coach matching, workout assignment, video feedback, progress tracking, messaging.
Eligibility enforcement: verifying that account holders are 18+ and applying the correct provincial consumer-protection and tax rules for the province of residence on file.
Safety: health-risk screening through PAR-Q+; moderating prohibited conduct; detecting fraud.
Billing: processing subscription payments and managing renewals through Stripe; paying coach earnings via Stripe Connect.
Communications: transactional emails about your account and service updates. Marketing emails are sent only with your express opt-in consent, which you may withdraw at any time, consistent with Canada's Anti-Spam Legislation (CASL).
Legal and security: complying with legal obligations, responding to lawful requests, enforcing our Terms, and protecting rights and property.

5. No AI or automated decision-making during the POC

During the Proof of Concept, Velta does not use artificial intelligence or machine-learning systems to process Member Content (videos, photos, chat, PAR-Q+ answers). Coach matching, workout assignment, and feedback are carried out by humans. No decision about subscription pricing, account suspension, or billing is made exclusively by automated means.

If we introduce AI processing after the POC, we will update this Policy, notify you in advance, and obtain your express opt-in before any of your Member Content is processed by automated systems.

6. Legal basis — Consent

6.1 Meaningful consent

Under PIPEDA, we rely on your meaningful consent to collect, use, and disclose personal information. Where data is particularly sensitive, we obtain express opt-in consent, separate from the Terms of Service, and you can withdraw consent at any time.

6.2 Separate opt-ins you will see

During onboarding you will be asked to grant distinct consents for:

Collection of health and injury information through the PAR-Q+ and member intake.
Recording, upload, storage, and Coach review of exercise videos.
Transfer of personal information to service providers located in the United States (see Section 9).
Marketing communications (optional, may be withdrawn at any time).

6.3 Withdrawing consent

You may withdraw any consent at any time by emailing support@velta.fit (subject line "Privacy") or adjusting your privacy settings. Withdrawal is forward-looking and may prevent us from providing certain features.

7. Sensitive health data — enhanced handling

We treat injury history, PAR-Q+ responses, progress photos, body measurements, and exercise videos as sensitive information and apply enhanced safeguards:

Encryption at rest (AES-256) and in transit (TLS 1.2+).
Role-based access limited to your assigned Coach and essential Velta staff performing support or safety duties.
Access logging; administrative access requires multi-factor authentication.
Retention only as long as necessary (see Section 11).
No sale, rental, or trading of sensitive information under any circumstances.

8. Who we share personal information with

We share personal information only with the following categories of recipients, and only as necessary to provide the Service:

Recipient	Purpose	Location
Your Coach	Deliver coaching: view profile, health/injury flags, videos, chat, progress	Canada (including Quebec)
Stripe (Stripe Payments Canada, Ltd. / Stripe, Inc.)	Payment processing, marketplace facilitation, Coach payouts via Stripe Connect	Canada / US
Amazon Web Services, Inc.	Hosting (compute, storage, database, video storage) in AWS `us-east-1`	US
Google (Alphabet Inc.)	Optional Google Sign-In (OAuth identity provider) if you choose it at login	US
Google (Google Analytics 4)	Receives behavioral analytics events (page views, button clicks, signup completion, subscription completion) when you grant Analytics consent in our cookie banner. We do not send your email, phone, or other identifiers; only a Cognito user ID after you log in. See Google’s privacy policy at policies.google.com/privacy.	US
Meta Platforms, Inc. (Meta Pixel)	Receives behavioral conversion events (page views, signup, subscription) when you grant Marketing consent in our cookie banner, used to measure the effectiveness of our advertising on Facebook and Instagram. We do not send your email, phone, or other identifiers. See Meta’s privacy policy at facebook.com/privacy/policy.	US
Axiom	Application logging and error monitoring. No health data, video, or chat content is sent to Axiom.	US
Government and law enforcement	Where required by law or lawful court order	As applicable

Each service provider is bound by its published data-processing terms requiring PIPEDA-equivalent protection and use limited to the specified purpose. We do not sell your personal information.

9. Cross-border transfer to the United States

Most Velta infrastructure is hosted in the United States (primarily AWS us-east-1). Your personal information, including sensitive health data, will therefore be transferred to and processed in the United States. US authorities may, in specified circumstances, access data held in the United States under US law, including the US Foreign Intelligence Surveillance Act. We use contractual safeguards with US sub-processors and only transfer what is necessary for the Service.

10. Safeguards

Technical: TLS 1.2+ in transit; AES-256 encryption at rest for sensitive stores; hashed passwords; scoped pre-signed URLs for video uploads.
Administrative: role-based access; least-privilege IAM; mandatory multi-factor authentication for administrators; documented incident response procedure.
Physical: AWS data centres (SOC 2, ISO 27001 certified).
Vendor: executed sub-processor terms (AWS, Stripe, Google, Google Analytics 4, Meta Platforms, Axiom).

No system is perfectly secure. If a breach occurs, we will follow the procedures described in Section 13.

11. How long we retain personal information

Category	Retention
Account PII while active	For the life of the account
Account PII after cancellation	24 months, then purged (unless a longer retention is required by law, e.g., tax records)
Exercise videos — paid subscription	12 months from upload
Exercise videos — free trial	30 days from upload
Chat logs	24 months from last message, then archived or purged
Payment records	7 years (CRA record-retention obligation)
Security logs	12–24 months depending on log class

Retention periods are minimums tied to a legal or operational purpose; once the purpose ends, data is destroyed or anonymised.

12. Your rights

You have the right to:

Access the personal information we hold about you.
Correct inaccurate or incomplete personal information.
Withdraw consent (subject to service-delivery consequences).
Request deletion of your personal information, subject to retention obligations.
Port data — receive a copy in a structured, commonly used electronic format.
File a complaint with our Privacy Officer and, if unresolved, with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, if applicable, the Information and Privacy Commissioner in your province of residence (AB / BC).

To exercise any right, email support@velta.fit with subject line "Privacy." We will respond within 30 days. In exceptional cases where more time is needed we will notify you.

12.1 How to request deletion

You can request deletion of your personal information through any of the following channels:

In the app. Settings → Privacy & Data → Delete account (/account/delete-confirm).
Public web form. https://velta.fit/legal/delete-account (no sign-in required).
Email fallback. support@velta.fit with subject line “Privacy”.

12.2 What happens after a deletion request

Once we receive a verified deletion request, deletion is initiated immediately. We aim to complete the hard delete within 24 hours, and in any case within 30 days. We will email you a confirmation when the hard delete is complete.

Some categories of data are retained beyond deletion to meet legal, security, and fraud-prevention obligations. We do not restate the retention periods here; see Section 11 (How long we retain personal information) for the full table. The most common retained categories are payment records (CRA tax-record obligation) and security logs.

Data covered by an active legal hold or an unresolved dispute is retained until that matter is resolved, regardless of an earlier deletion request.

13. Breach notification

If a breach of security safeguards creates a real risk of significant harm to you, we will:

Notify the Office of the Privacy Commissioner of Canada as soon as feasible.
Notify affected individuals directly (by email) with information about the breach, the likely consequences, the steps taken, and recommended protective actions.
Maintain an internal record of the breach for at least 24 months.

14. Cookies and tracking

The Velta Platform uses first-party session cookies required to keep you signed in and to secure the application. We also use opt-in third-party analytics (Google Analytics 4) and marketing (Meta Pixel) tools, each gated on your consent choice in the cookie banner. For a full inventory of cookies and storage keys, see our Cookie Policy.

15. Children

The Platform is intended for users 18 years and older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, contact support@velta.fit and we will promptly delete the account.

16. Changes to this Policy

We may update this Policy from time to time. Material changes will be notified by email and by a prominent in-Platform notice at least 30 days before the effective date. The “Version” and date at the top of this Policy indicate the most recent update.

17. Contact

Questions, access requests, or complaints should be sent to the Privacy Officer at support@velta.fit (subject line "Privacy").