Privacy Policy

Helix Athletic provides training-programming and athlete-management software to gyms and athletic training facilities. When you train at a gym that uses Helix, your gym’s coaches and physiotherapists enter, review, and act on your information inside Helix. Helix operates the software; your gym runs the training relationship.

Helix is not a healthcare provider, a health plan, or a healthcare clearinghouse, and it does not operate as a HIPAA covered entity. Nothing on this page should be read as a claim that HIPAA governs your information here. The laws we do operate under are described below.

We collect the following categories of information:

• Account information — your name, email address, password (stored only as a one-way hash), and, if you sign in with Google or Apple, the account identifier that provider returns.
• Profile and contact information — preferred and legal name, phone number, date of birth, mailing address, profile photo, and emergency-contact details you or your gym provide.
• Health and fitness information — physiotherapy assessments, movement screens, injury history, medical considerations, medications, training programs, completed workouts, loads and repetitions, personal records, and coaching notes about your training.
• Billing information — membership status, invoices, charges, refunds, and payment-method metadata (card brand and last four digits). Full card numbers are entered directly into our payment processor and never reach Helix servers.
• Agreements you sign — liability waivers and other e-signed documents, including the signed document itself and the signing metadata.
• Usage and security information — sign-in events, IP address, device and browser information, and access logs recording which staff account viewed which records.
• Scheduling information — bookings, attendance, and, if you connect a calendar, the calendar events Helix creates for your sessions.

We use your information to generate and deliver your training programs, to let your coaches and physiotherapists do their work, to run your membership and billing, to schedule and record sessions, to keep the service secure, and to meet legal and tax obligations.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined by the California Consumer Privacy Act. We do not use your health or fitness information for advertising of any kind.

Assessments, injuries, medical considerations, and medications are the most sensitive information Helix holds. Medical considerations and medications are encrypted at rest with AES-256-GCM, and every staff read of a record containing health information is logged.

We treat this information as medical information under California’s Confidentiality of Medical Information Act (Cal. Civ. Code § 56.06), which applies to businesses that offer software to consumers for managing medical information. We do not disclose it without your authorization except as that law permits.

Helix is also a health app subject to the FTC Health Breach Notification Rule. If health information is acquired without your authorization, we will notify you, the Federal Trade Commission, and — where the Rule requires it — the media, within the timelines the Rule sets.

Not medical advice. Helix generates training programs from assessment data. It does not diagnose, treat, cure, or prevent any disease or injury, and it is not a substitute for professional medical care. Consult a physician before beginning any training program. Training carries inherent risk of injury. The full disclaimer is in our Terms of Service.

Your gym. Staff at the gym you train with — coaches, physiotherapists, front-desk staff, and administrators — can see the records their role permits. Your information is scoped to your gym; staff at other organizations using Helix cannot see it.

Service providers. We use vendors to run the service, each with access limited to what their function requires: Stripe (payments), Amazon Web Services (hosting, storage, and email delivery), and Google (calendar sync and email intake, only where your gym has connected them).

Helix support staff. A small number of Helix platform administrators can enter an organization to provide support. Those sessions are time-limited and logged.

Legal. We may disclose information when required by law, to enforce our agreements, or to protect the rights and safety of our users.

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the rights to:

• Know and access — what personal information we collect, the sources, the purposes, and who we disclose it to, and to receive a copy in a portable format.
• Delete — request deletion of the personal information we hold about you, subject to the legal-obligation exceptions described in the next section.
• Correct — ask us to fix inaccurate personal information.
• Opt out of sale or sharing — we do not sell or share personal information, so there is nothing to opt out of; we will tell you here if that ever changes.
• Limit the use of sensitive personal information — we use sensitive information, including health information, only to provide the service you asked for.
• Non-discrimination — we will not deny service, charge a different price, or provide a lower quality of service because you exercised a privacy right.

Under the Confidentiality of Medical Information Act you may also request a copy of the medical information we maintain about you.

To exercise any of these rights, email support@helixathletic.com. We will verify your identity against your account before we act on a request, and you may use an authorized agent. Deletion can also be done yourself, in the app — see Account deletion.

Deleting your account does not erase every record. Some categories are kept because a law, a tax rule, or a legal-evidence obligation requires it. This is what happens to each category when your account is deleted:

• Sign-in credentials and sessions — deleted. Your password hash, connected Google/Apple accounts, and all active sessions are destroyed.
• Your identity on your profile — erased. Names, email address, phone number, date of birth, mailing address, profile photo, and emergency contacts are removed or replaced with placeholders.
• Medical considerations and medications — deleted.
• Personal preferences — deleted. Favorites, notification settings, interface preferences, and any connected calendar are removed.
• Training, assessment, and injury records — retained as the gym’s business record, identity-reduced. The workouts, assessments, injuries, needs analyses, programs, and personal records stay in your gym’s data set, with your identity severed from them. We do not describe these records as de-identified or anonymized: free-text coaching notes, assessment dates, and performance patterns can carry residual identifying detail, and calling them anonymous would be an overclaim.
• Signed waivers and agreements — retained as legal records, including the signed PDF. A waiver is the gym’s evidence of the agreement you made; it survives the account it was signed under.
• Financial and billing records — retained. Invoices, charges, refunds, and membership history are kept to meet tax and accounting obligations. Stripe, our payment processor, also retains its own customer record — including the name and email address on file with Stripe — under the same legal-obligation carve-out. Deleting your Helix account does not delete Stripe’s record.
• Audit and access logs — retained. Records of who accessed what, and when, are security and forensic evidence; deleting them on request would defeat their purpose.

You can request deletion of your account at any time, and we will delete it. Self-serve in-app deletion — at Profile → Security → Delete account — is rolling out; until it reaches your app, email support@helixathletic.com from your account address and we will verify the request and delete the account for you. Either way deletion is irreversible: there is no grace period and no undo.

Deleting your account does not cancel your gym membership or stop billing. Contact your gym to end a membership.

Step-by-step instructions, and the full list of what is deleted versus retained, are on the Account deletion page.

Data is encrypted in transit with TLS and at rest. Medical considerations and medications carry an additional application-layer AES-256-GCM encryption. Staff accounts are protected by role-based access controls and multi-factor authentication where enrolled, and reads of health information are recorded in an audit log. No system is perfectly secure, but these are the controls we run.

Helix is not directed to children under 13, and we do not knowingly collect their information. Athletes under 18 are enrolled by a gym with a parent or guardian, who signs the waiver and manages billing. If you believe a child’s information has been provided to us without the right authorization, contact us and we will remove it.

When we change this policy we update the “Last updated” date at the top of this page. Material changes will also be announced in the app.

Questions, requests, and complaints about this policy go to support@helixathletic.com.