Privacy Policy

1. Scope

This Privacy Policy explains what information AssessFlow ("AssessFlow", "we", "us") collects when you use our web application, why we collect it, and the choices and rights you have. It applies to coaches and instructors who create an AssessFlow account ("Users") and to the client data Users enter into the product.

2. Information we collect

We collect the following categories of information:

• Account information — your email address and any profile details you add (instructor name, studio name), collected via Supabase Authentication.
• Client intake data — the client details, movement screening findings, notes, and AI-generated assessment reports you create in your account.
• Billing information — subscription and payment status. Card and payment details are collected and processed directly by our payment processor (Paddle); AssessFlow does not store full card numbers.
• Usage data — basic technical data (device, browser, general log data) generated automatically as you use the app, used only to operate and secure the service.

3. How we use information

We use your information solely to: operate your account (authentication, subscription and billing status); generate and store the movement assessments and plans you create for your clients; provide customer support; and maintain the security and reliability of the service. We do not use client intake data for advertising, and we never sell personal information — see Section 6.

4. AI processing

Movement screening findings you submit are sent to our AI provider (Anthropic) to generate the assessment summary, red flags, and a suggested movement plan. This data is processed to fulfill your request and is not used by our AI provider to train third-party models.

5. Data storage & security

Account and client data is stored using Supabase (PostgreSQL), with access controlled by row-level security tied to your account. We use industry-standard encryption in transit (HTTPS/TLS) and rely on our infrastructure providers' encryption at rest. No method of transmission or storage is 100% secure, but we take reasonable technical and organizational measures to protect your data.

6. We do not sell your data

AssessFlow does not sell, rent, or trade personal information — yours or your clients' — to third parties, and we do not share it for cross-context behavioral advertising. We only share data with the service providers necessary to operate AssessFlow (hosting, authentication and database via Supabase, AI processing via Anthropic, payments via Paddle), each bound to use it solely to provide their service to us.

7. Your rights (GDPR & CCPA)

Depending on where you live, you may have the right to: access the personal information we hold about you; correct inaccurate information; request deletion of your data ("right to be forgotten"); export your data in a portable format; object to or restrict certain processing; and, under the CCPA, know what categories of information we collect and confirm that we do not sell it. To exercise any of these rights, contact us at support@getassessflow.com — we will respond within the time required by applicable law.

8. Data retention

We retain account and client data for as long as your account is active, or as needed to provide the service. If you close your account, we delete or anonymize your data within a reasonable period, except where retention is required to comply with a legal obligation or resolve disputes.

9. Children's privacy

AssessFlow is a business tool intended for use by adult fitness and movement professionals. It is not directed at, and we do not knowingly collect personal information from, children under 16.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above, and significant changes may be communicated by email.

11. Contact

Questions about this policy or your data? support@getassessflow.com