Privacy Policy

L4 Performance is a strength-and-conditioning platform operated by Legacy Four Holdings, based in Ontario, Canada ("L4", "we", "us"). This policy explains what information the platform handles, how it is used, and the choices and rights you have.

The platform serves two groups. Training facilities and their coaches use it to record and review athlete training (a business-to-business service). Parents, guardians, and older athletes use the invite-only family portal to follow that training. There is no open public sign-up: a family account can only be created from an invitation issued by the athlete's facility.

The platform handles the following categories of information:

• Coach account information - the email address and display name a coach or administrator uses to sign in.
• Family account information - the email address, name, and stated relationship to the athlete (parent, guardian, or the athlete themself) provided when an invited person sets up a portal account.
• Consent records - when consent is given or withdrawn in the portal, we keep a record of the exact wording agreed to, the policy version, the date and time, and technical details of the request (such as network address and browser type). We keep this as legal evidence of consent, which Canadian privacy law expects us to be able to demonstrate.
• Athlete identifying information - first and last name, birth year (year only; we do not collect a full date of birth), and team, sport, or league affiliation, entered by the facility's coaches.
• Performance information - test scores, training-session records, lifts, repetitions, and personal records associated with an athlete.
• Optional health and biometric information - some optional modules can record wellness check-ins, injury notes, growth measurements, or recruiting details (such as height, weight, and contact information). These modules are off by default and are only used if a facility explicitly turns them on for its athletes.
• Messages - if a facility enables messaging, messages exchanged between a family account and the facility's coaches are stored so both sides can read the conversation. Reported messages are retained for safety review.
• Bookings - if a facility uses session booking, the sessions reserved for an athlete and the related attendance records.
• Payment references - subscriptions (facility plans, and family premium subscriptions where offered) are billed by our payment processor (Stripe), which stores the card details. We never receive or store full card numbers. We keep only Stripe's customer and subscription reference identifiers and the plan, status, and billing dates.

We do not collect government identifiers, health-card numbers, precise location, or full payment card data.

We use the information above to:

• provide the platform to facilities and coaches (storing and displaying athlete progress);
• provide the family portal (showing a linked athlete's training to their own parent or guardian);
• calculate benchmarks, rankings, and progress over time;
• send service emails you ask for or need (such as account invitations and booking confirmations);
• operate, secure, support, and improve the service;
• process subscription payments through our payment processor; and
• meet our legal and accounting obligations.

We do not sell personal information, and we do not use athlete information for advertising.

Many athletes on the platform are minors, and we treat their information accordingly. Consent works on two levels. The training facility is responsible for having appropriate consent before its coaches enter a minor's information into the platform, and confirms this when it begins using the service. Separately, before any family portal account can see an athlete's information, the parent or guardian gives their own explicit consent inside the portal when they accept the facility's invitation, and we keep a record of that consent (section 2).

An athlete the facility confirms is at least 16 may be invited directly and consent for themself. Optional features that share anything beyond the family's own view - such as anonymous benchmark sharing - are off until the consenting parent, guardian, or eligible athlete turns them on, and can be turned off at any time.

We share information only as needed to run the service:

• Within a facility - a facility's coaches and administrators can see the athletes belonging to that facility. By default, facilities never see each other's athletes; the only exception is the optional cross-facility comparison described below, which a family must turn on.
• Cross-facility comparison (optional, off by default) - if a family turns this on for their athlete, coaches at other L4 Performance facilities may see that athlete's exact test result and birth year as a single anonymous entry on a ranking board, to compare against their own athletes. The entry never shows the athlete's name or which facility they belong to. Receiving coaches agree not to attempt to identify the athlete. A family can turn this off at any time, which stops all future cross-facility sharing of that athlete's results. This is separate from, and in addition to, the anonymous benchmark pool in section 6.
• With the athlete's own family - a parent, guardian, or eligible athlete who accepted a facility invitation and gave consent can see that athlete's information in the portal - and only that athlete's. A family account never sees other athletes, and access ends if the link is removed or consent is withdrawn.
• Service providers - we use established cloud infrastructure providers to host the platform and its database (with athlete data stored in Canada), an email delivery provider to send the service emails described above, an error-monitoring service that receives technical crash reports with personal identifiers removed, and Stripe for payment processing. These providers handle data only on our behalf, under their own security and confidentiality obligations.
• Legal reasons - if required by law or to protect the safety and rights of users.

We do not sell, rent, or trade personal information to third parties.

Our public site can show pooled benchmark statistics grouped by broad age band (for example, typical score ranges for ages 13 to 14). These are anonymized: they contain no names, no birth dates, no test dates, no facility, and no individual records, only group counts and score ranges. A statistic is only shown when it is based on a large enough group of athletes that no individual can be identified. An athlete's results join the pool only where the required sharing consent has been given (section 4).

Because these statistics are anonymous, an athlete's contribution to them cannot be traced back to the athlete. When an athlete is removed or stops sharing, or a facility later leaves or opts out, the related personal records are deleted (see section 7), but any results already combined into the anonymous age-based benchmarks remain, because they no longer identify anyone and so cannot be individually removed. An athlete can be excluded from future benchmark sharing at any time.

The optional cross-facility comparison in section 5 is a separate, consent-based feature. Unlike these anonymous benchmarks, it shows an athlete's exact result with a birth year (still without name or facility) to coaches at other facilities. Because it is read live from current data, turning it off removes the athlete's entry from other facilities' ranking boards going forward.

We keep information for as long as the related account is active and as needed to provide the service. When a facility ends its subscription, or when a valid deletion request is made, we delete or anonymize the associated athlete information within a reasonable period, except where we are required to retain certain records (such as billing records, or consent and deletion records themselves) by law.

The main exception is the training record itself. Where an athlete trains under the direction of a regulated health professional, the facility is required to keep that record for a set number of years - in Ontario, 10 years for physiotherapy and 7 years for chiropractic, and if the athlete was under 18, that period starts on their 18th birthday rather than their last session. So a deletion request erases the athlete's photo, check-ins, goals, cards, messages and their contact and medical details, but the facility keeps their logged workout sessions, along with the name, birth year and sport or team context attached to them. A deletion request cannot remove a record that is still within its required retention period.

Anonymous benchmark statistics (described in section 6) are not personal information, because they cannot be linked back to any athlete. We keep these anonymous statistics permanently to maintain age-based fitness benchmarks; they are not removed by a deletion request.

Subject to applicable Canadian privacy law, you (or a parent or guardian on behalf of a minor) may request to:

• access the information we hold about an athlete;
• correct information that is inaccurate;
• delete an athlete's information, subject to the retention limits in section 7; and
• withdraw consent for ongoing collection or use.

Portal account holders can exercise these rights directly from the portal's Data & Privacy page at any time: download a copy of the athlete's information, stop sharing immediately, or file a deletion request with the facility. These tools are always free and never depend on having a paid subscription. You can also contact us at the email below, or ask the athlete's facility. We will respond within a reasonable time. Withdrawing consent or deleting data may mean the platform can no longer be used for that athlete.

Access to athlete information is restricted through layered, database-level security rules: coaches are limited to their own facility's athletes, and family accounts are limited to the specific athlete they hold a consented link to. Data is encrypted in transit, stored with reputable hosting infrastructure in Canada, and access is limited to what is needed to operate the service. No system is perfectly secure, but we take measures appropriate to the sensitivity of the information, including information about minors.

Athlete and account information is stored on servers located in Canada. Payment processing is handled by Stripe, and service emails are sent through an email delivery provider; each may process the limited information involved (such as payment details or an email address) outside Canada in accordance with its own policies.

We may update this policy as the service evolves or as the law requires. When we make a material change, we will update the date and version at the top of this page. Continued use of the platform after an update means the updated policy applies.

For any privacy question or to exercise a right described above, contact Legacy Four Holdings at admin@l4performance.ca.