Privacy Policy

This Privacy Policy explains how we collect, use, share, and protect your personal information, and the choices and rights you have. Please read it carefully. By using our websites, apps, and services, you agree to the practices described here. Where the law requires your consent, we will ask for it.
‍

Privacy at a glance

We collect account and contact details, health and wellness information, website/technical data, and payment information (handled by Stripe). We collect health information only with your express consent.

We use it to run the Service, deliver coaching and content, keep you secure, and — only if you opt in — send you marketing from GFIT and affiliated brands such as Healthy Sips.

We do not sell your information, and we do not use it to train AI models without your consent.

You control your marketing choices in our preference centre, and you can access, correct, or delete your information at any time (Sections 15–16).

This is a convenience summary. The numbered sections below are the full policy and govern if there is any difference.

‍

1.  Who we are and who this policy covers

"GFIT," "we," "us," and "our" refer to Team G-FIT Corp. and GFIT Corporate Wellness.

The "GFIT Family of Brands" means GFIT together with our affiliated brands and related companies that offer health, wellness, nutrition, fitness, or healthy-living products and services — including Healthy Sips, and other brands we may launch or acquire in the future. Some of these brands are separate legal companies. When that is the case, we treat any sharing of your personal information between them as a disclosure that requires your consent, as described in Sections 6 and 7.

This policy applies to our websites, portals, microsites, mobile and web applications, and to our online and offline services — including webinars, recipes, exercise and nutrition plans, videos, blog posts, coaching with registered professionals and wellness coaches, and corporate wellness programs (together, the "Service").

2.  Key terms

• Personal information — information about an identifiable individual. It does not include aggregated or de-identified information that can no longer be linked to you.
• Sensitive information — information that carries a higher risk if misused, such as health information. We give it extra protection and generally rely on your express consent to collect it.
• Consent — your agreement to a specific use of your information. It can be express (a clear opt-in) or, where the law allows, implied. You can withdraw it (see Section 16).
• Affiliated brand — a brand or company in the GFIT Family of Brands, such as Healthy Sips.
• Service provider — a company we engage to process information on our behalf and under our instructions (for example, hosting or email delivery).
• Commercial electronic message (CEM) — an email or other electronic message that promotes a product, service, or brand.

‍

3.  Personal information we collect

Information you give us

• Identity and contact details: name, company name, date of birth, email address, mailing address, phone number, country/province of residence, and social media handle.
• Account details: username, and login credentials for your GFIT account(s).
• Correspondence: questions, comments, coaching messages, support requests, and job applications you send us.
• Content you submit: comments, photos, videos, and other material you post or upload to the Service.
  ‍

Health and wellness information

Because we provide health and wellness services, we may collect health-related information — which is sensitive and handled with extra care (Section 12). Depending on the services you use, this can include:

• weight, body measurements, and progress photos;
• nutrition records and food logs;
• workout and activity history;
• health history and current physical or mental-health information;
• wellness and mental-wellness goals; and
• coaching notes created while providing services to you.

Because health information is sensitive, we rely on your express consent to collect and use it, and we collect only what is reasonably needed to provide a service you have asked for. You can withdraw that consent at any time (Section 15).

Payment information

We do not collect or store full payment card numbers. Payments are handled by third-party processors such as Stripe, whose own privacy terms apply to that transaction.

Technical information collected automatically

When you visit our websites we automatically collect technical information such as your IP address, browser type, operating system, screen resolution, approximate location, browser language, and the site or search terms that referred you. We use this mainly in aggregate to measure and improve the Service (see Sections 10 and 11).
‍

4.  How we use your information

We use your personal information for the following purposes, and only as reasonably needed:

• to create and manage your account and provide the Service you request;
• to deliver coaching, wellness content, recipes, plans, webinars, events, and surveys;
• to verify your identity when you submit content;
• to respond to your questions, requests, applications, and complaints;
• to collect amounts owed to us, where applicable;
• to send you service notifications and, with your consent, marketing and educational communications from GFIT and — where you have opted in — affiliated brands (Sections 6 and 7);
• to understand and improve how the Service is used, including through analytics;
• to develop de-identified and aggregated insights, and to give Subscribing Organizations reports about overall program usage that do not identify individual users;
• to operate our business responsibly, including security, fraud prevention, and record-keeping; and
• to meet our legal and regulatory obligations.

If we ever want to use your information for a new purpose that is not compatible with the one we collected it for, we will tell you and obtain your consent, unless the law allows otherwise.
‍

5.  Artificial intelligence and automated processing

We may use artificial-intelligence tools to help us operate the Service more efficiently — for example, to assist with customer support, scheduling, administration, content creation, and coaching support. Our use of these tools complies with applicable privacy law, and staff review outputs where appropriate.

If we ever use automated processing to make a decision that produces a significant effect about you — without meaningful human involvement — we will tell you, explain the main factors involved, and give you the opportunity to have the decision reviewed by a person and to make representations, as required by Quebec’s Law 25.

We do not use your personal information — including health information — to train our own or third parties’ general-purpose AI models without your consent. Where we use AI service providers, we require them by contract to process your information only on our instructions and not to use it to train their models.

‍

6.  Marketing communications and your choices

With your consent, we send commercial electronic messages such as newsletters, educational content, promotions, product announcements, and event invitations. We follow Canada’s Anti-Spam Legislation (CASL).

How we get your consent

• Express consent: when you opt in — for example, by ticking an unchecked box when you sign up. Our opt-in identifies who is asking, names any affiliated brand the consent covers (such as Healthy Sips), states the purpose, and tells you that you can withdraw at any time.
• Implied consent: in limited cases the law allows, such as for a period after you buy a product or service from GFIT, or where you have an existing relationship with us. Implied consent applies only to messages from GFIT and expires over time.

Your preference centre

You choose what you receive. Our preference centre lets you turn categories on or off individually — for example, coaching updates, recipes and educational content, promotions, events, and each brand such as Healthy Sips. You can change your choices, or unsubscribe from all marketing, at any time using the link in any marketing email or by contacting us (Section 20). Even after you unsubscribe from marketing, we may still send you essential service messages, such as billing or security notices.
‍

7.  Affiliated brands and cross-brand marketing

From time to time we launch, acquire, or operate affiliated brands offering health, wellness, nutrition, fitness, or healthy-living products and services. Healthy Sips is one such brand.

Because some affiliated brands are separate legal companies, we will only share your personal information with them, or send you their marketing, where you have given consent — normally by opting in through our preference centre (Section 6). We do not add you to a separate brand’s marketing simply because you are a GFIT client.

When a message is sent on behalf of GFIT together with an affiliated brand, the message will identify each business that is materially responsible for it, and the unsubscribe option will let you stop receiving messages from some or all of them.

As we launch new brands, we will add them to the preference centre so you can decide whether to hear from them, rather than assuming your consent in advance.
‍

8.  When we share your information

We do not sell your personal information. We share it only as described here:

• Service providers: companies that process information on our behalf and under contract, only as needed to run the Service (Section 9).
• Professionals you engage: a coach or registered professional you have chosen to work with, or someone acting as your authorized agent.
• Affiliated brands: where you have consented, as described in Section 7.
• Corporate wellness partners: where you participate in a program through your employer, we may share information with that Subscribing Organization, and with benefit providers, insurers, or healthcare practitioners, as needed to run the program and as permitted by law. Reports we give employers about overall usage do not identify individual users.
• Legal and safety: where required or permitted by law, to comply with legal process, enforce our agreements, or protect the rights, safety, or property of you, us, or others.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, provided the recipient continues to protect your information consistent with this policy.
  ‍

9.  Our service providers

We engage reputable service providers and hold them to contractual confidentiality and security obligations. Categories we use include:

• customer relationship and marketing platforms (for example, HubSpot);
• payment processing (for example, Stripe);
• scheduling and booking tools (for example, Acuity Scheduling);
• video and meeting tools (for example, Google Meet);
• cloud hosting and storage providers;
• analytics providers;
• email delivery providers;
• customer-support platforms; and
• secure document-management providers.

‍

10.  Cookies and similar technologies

We use cookies and similar technologies (such as pixels and tracking tags) to run our sites, remember your preferences, understand usage, and — where you allow it — support advertising. Cookies fall into a few groups:

• Strictly necessary cookies, which are required for the site to work. These cannot be switched off.
• Functional cookies, which remember your choices and personalize your experience.
• Analytics/performance cookies, which help us understand and improve the site.
• Advertising/targeting cookies, which support interest-based advertising.

Depending on your consent, our sites may use tools such as Google Analytics (GA4), Google Ads, the Meta (Facebook) Pixel, and the LinkedIn Insight Tag [CONFIRM which are deployed]. Where required, we ask for your consent through a cookie banner before setting non-essential cookies, and you can change your choices at any time. You can also control cookies through your browser settings; disabling some cookies may affect how the site works.

Non-essential cookies stay off until you allow them (privacy by default), and we honour recognized browser privacy controls such as Global Privacy Control (GPC) and Do Not Track where the law requires.
‍

11.  Analytics and advertising

We use analytics services, including Google Analytics, to understand how the Service is used and to improve it. These services may set cookies and process technical information, which may be stored on servers outside Canada (Section 13). We do not try to link this information to your identity.

We may work with advertising partners to show you relevant ads on our sites and elsewhere. You can opt out of many interest-based ads through your browser and device settings and through industry tools such as the Digital Advertising Alliance of Canada (youradchoices.ca) and the Network Advertising Initiative.
‍

12.  How we protect your information

We use administrative, technical, and physical safeguards designed to protect your information against loss, theft, and unauthorized access, use, or disclosure. These include:

• encryption of data in transit and at rest;
• access controls and multi-factor authentication for systems holding personal information;
• secure, reputable cloud environments;
• security testing, monitoring, and vulnerability management;
• security and privacy assessments of key vendors;
• staff privacy and security training, and need-to-know access; and
• secure disposal of information we no longer need.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a security incident occurs, we will respond as described in Section 17.
‍

13.  Where your information is processed

We and our service providers may store and process your information in Canada, the United States, and other countries where our approved providers operate. When your information is in another country, it is subject to that country’s laws, which may allow access by courts, law enforcement, or regulators (for example, US law).

Wherever your information is processed, we require appropriate contractual and security protections. For information subject to Quebec’s Law 25, we conduct a privacy assessment before transferring it outside Quebec, as the law requires.
‍

14.  How long we keep your information

We keep personal information only as long as reasonably necessary for the purposes in this policy and to meet legal and regulatory obligations. How long that is depends on the type of information.

• coaching and program records — kept for the length of your engagement and a defined period afterward;
• health information — kept only as long as needed for the service and applicable professional or legal requirements;
• invoices and financial records — kept as required by tax and accounting law;
• marketing preferences and consent records — kept while you are a contact and as needed to prove compliance; and
• information under legal hold — kept until the matter is resolved.

When information is no longer needed, we securely delete or anonymize it so it can no longer be linked to you.

‍

15.  Your privacy rights

Subject to the law, you have the right to:

• Access — ask for a copy of the personal information we hold about you, and an account of how it has been used and disclosed. We respond within 30 days where PIPEDA applies, at little or no cost.
• Correct — ask us to fix inaccurate or incomplete information. Where appropriate, we pass corrections to third parties who received the information.
• Withdraw consent — change your mind about a use of your information, subject to legal or contractual limits. This may affect our ability to provide some parts of the Service.
• Delete — ask us to delete your personal information (Section 16).
• Portability and de-indexing — where Quebec’s Law 25 applies, ask for a copy of certain information in a structured, commonly used format, and, in some cases, ask us to stop distributing information or de-index a link.

In some cases we may not be able to give full access — for example, where doing so would reveal another person’s information, our confidential information, or information protected by legal privilege. If we deny a request, we explain why. To exercise any right, contact us using Section 20.

We handle rights requests at little or no cost, verify your identity first to protect your information, aim to respond within 30 days, and will not treat you differently for exercising a right. If you are not satisfied with our response, you can ask our Privacy Officer to review it before escalating to a regulator (Section 20).
‍

16.  Deleting your information

You can ask us to delete your personal information, including health data, at any time by contacting us (Section 20). After we verify your identity, we take reasonable steps to delete it from our active systems, usually within a reasonable period, and we ask service providers and any affiliated brands who received it (where applicable) to do the same.

Some information may remain for a limited time — for example, in secure backups until they cycle out, or where we must keep it to meet a legal obligation, resolve a dispute, or enforce our agreements. We delete or anonymize it once those reasons no longer apply.
‍

17.  If there is a data breach

We maintain a breach-response process. If a breach of security safeguards creates a real risk of significant harm to you, we will notify you and report to the Office of the Privacy Commissioner of Canada, as PIPEDA requires, and we will meet any additional reporting obligations under Quebec’s Law 25 and other applicable laws. We keep a register of confidentiality incidents, as Quebec’s Law 25 requires, assess each incident for the risk of serious injury to affected individuals, and keep records of security breaches as required.
‍

18.  Children and minors

The Service is intended for a general audience and is not directed to children under 16 and under 14 in Quebec. We do not knowingly collect personal information from children under this age. If we learn we have, we will delete it. If you believe a child has given us personal information, please contact us (Section 20).
‍

19.  Changes to this policy

We may update this policy to reflect changes in our services, technology, or the law. If we make a significant change — such as using your information for a new purpose or sharing it with a new category of third party — we will give you at least 30 days’ notice through the Service or by other means, and obtain your consent where required, before the change takes effect. 
‍

20.  Contact us, and how to complain

To ask a question, exercise a right, withdraw consent, or make a complaint, contact us at the following:

GFIT Privacy Officer

217 Bonaventure Dr E, Winnipeg, MB R3X 0N1

Telephone: 431-441-8662

Email: support@gfitwellness.ca