Privacy Policy

1.1Two relationships, not one

Most privacy policies describe one relationship. Ours describes two, and which one you are in determines who you ask for what.

• If you are a Practice or a Practitioner — a trainer, clinic, gym or studio holding an account with us — Spero decides how your account, billing, support and usage information is handled. We are the organization in control of it, and this policy tells you what we do with it.
• If you are a Client — an individual invited onto the Platform by a Practice — your Practice decides what is collected about you and why. Spero processes that information on the Practice's behalf and under its instructions. Your Practice is who you ask to see, correct or delete it, and your Practice's own privacy notice governs the relationship.

1.2Where Spero acts for itself

There are two places where Spero acts on its own behalf even for Client information: keeping the Platform secure and available, and the de-identified research use described in Section 6. Everything else a Practice puts on the Platform, we handle for that Practice.

2.1Information given to us directly

Depending on who you are, this can include:

• Identity and contact information — name, email address, and for a Practice, its business name, subdomain and branding.
• Health and movement information — training goals, injury history, movement assessment scores and the observations behind them, assessment videos and photographs, body composition figures, exercise logs, reported pain, discomfort and perceived effort, and anything else a Client or Practitioner records. This is sensitive personal information under PIPA and PIPEDA. It is collected by the Practice, from its Client, with that Client's express consent, and held under heightened safeguards.
• Practitioner judgment — whether a proposed finding or program element was accepted, edited or rejected, and the reason given.
• Consultation recordings and their transcripts and summaries, where a Practice uses the video consultation features.
• Billing information — handled by our payment processor. We do not store complete card numbers.
• Messages and support correspondence.
• Parent or guardian consent information, where a Client is under 18.

2.2Information collected automatically

Sign-in events, IP address, approximate location derived from it, browser and device type, pages visited, and errors encountered. We use this to keep accounts secure, to diagnose faults, and to understand which parts of the Platform are used.

2.3Information we do not want

Do not put payment card numbers, government identification numbers, or a third party's personal information into free-text notes or uploaded files. The Platform has proper places for the information it needs, and anything typed into a note is harder for us to find and remove later.

3.1Purposes

We use personal information to:

• run the Platform — authenticate you, show a Practice its own data, produce assessments and programs, deliver consultations and messages;
• bill a Practice and manage its subscription and seats;
• provide support, and investigate and fix faults;
• keep the Platform secure — detect abuse, prevent fraudulent signups, and investigate suspected unauthorized access;
• improve the Platform and the assessment rules, and conduct research, in the de-identified form described in Section 6;
• meet legal obligations and enforce our Terms.

3.2Automated processing

The assessment engine applies documented rules to observations a Practitioner enters, and proposes findings. Some summaries and drafts are produced with the help of a third-party language model. Neither makes a decision about anyone on its own: a Practitioner reviews and may accept, edit or reject every output before it reaches a Client. No decision with a legal or similarly significant effect is made about you by automated means alone.

4.1Express consent for sensitive information

Health and movement information requires express, opt-in consent. Where that information belongs to a Client, the Practice obtains that consent at intake, before the Client is put on the Platform. We publish wording a Practice may use; the obligation stays with the Practice, which is set out in Section 5.2 of the Terms.

Express consent is also required before your name, image, testimonial or story is used in anything public-facing, and it can be withdrawn.

4.2Implied consent

For information whose purpose would be obvious to a reasonable person — a Practice's contact details given at signup, or security logging — we may rely on implied consent.

4.3Withdrawing consent

You may withdraw consent at any time, subject to legal and contractual limits and to reasonable notice. A Client withdraws through their Practice; a Practice withdraws by writing to info@sperokinetics.com. We will tell you what withdrawal means in practice, which will usually include our no longer being able to provide some or all of the Platform.

Withdrawal does not reach data already de-identified under Section 6 — see Section 6.4 for why.

5.1We do not sell personal information

We do not sell, rent or trade personal information, and we do not disclose one Practice's identifiable Client data to another Practice.

5.2Service providers

We use the following providers to run the Platform. Each is bound to use the information only to provide its service to us.

• Supabase — application database, file storage and authentication. Our primary database is hosted in Canada (ca-central-1).
• Vercel — application hosting and content delivery.
• Stripe — payment processing and subscription billing.
• Resend — transactional email, including invitations and password resets.
• Anthropic — language-model processing for drafting summaries and notes. Content sent for this purpose is not used by the provider to train its models.
• Deepgram — speech-to-text for consultation recordings a Practice chooses to record.
• Cloudflare — bot protection on signup, and the relay service that carries video-call media.
• Google — sign-in with Google where a user chooses it, and calendar scheduling where a Practice connects it.
• Notion — our internal client and operations records for Practices we serve directly.

5.3Other disclosures

We may disclose information where the law requires it, where it is needed to establish or defend a legal claim, or to protect the safety of a person. In a merger, acquisition or sale of assets, information may transfer as part of that transaction; we will tell you if that happens.

6.1What we do

Spero uses assessment scores, Practitioner corrections, program and execution data, symptom reports, re-assessment results and coarse demographic categories — in pseudonymized or de-identified form — to improve the Platform, revise the assessment rules, review safety and bias, and conduct research. Section 6.3 of the Terms is the licence that permits this and lists the categories exactly.

This is the point of the product: there is no existing dataset linking an assessment to an interpretation, to an intervention, to what actually happened next, and it cannot be assembled after the fact.

6.2What de-identified means

Direct identifiers are removed or replaced with a random identifier before the data is used this way — name, email, telephone, address, full date of birth, account identifiers, and any free-text note or media file not reviewed and cleared of identifying content. We do not attempt to re-identify it, do not combine it with other data in order to, and require the same of anyone we permit to work with it.

6.3Publication

We may publish results from this data in aggregated form that identifies no Client, Practitioner or Practice. Naming anyone, publishing an individual case study, or using a testimonial needs that party's separate written consent, which can be withheld or withdrawn.

6.4Why de-identification is one-way

Once a record can no longer be connected to an individual, it can no longer be found on that individual's behalf. A request to delete personal information therefore reaches the identifiable record and not the de-identified copy already incorporated into research or into the Platform's rules. We state this here rather than promise a reversal we cannot perform.

6.5A Practice's business data is separate

A Practice's revenue, pricing, client counts, retention and Practitioner time are not part of the above and are not collected by default. They are collected only under a separate written pilot or measurement agreement, which a Practice may decline while continuing to use the Platform.

7.1Residency

Spero operates from Canada and our primary database is hosted in Canada. Some providers in Section 5.2 store or process data in other countries, including the United States, where it may be accessible to the courts and law enforcement of those countries.

Where information is transferred outside Canada we rely on contractual protections with those providers. A Practice with a data-residency requirement should raise it with us before putting Client data on the Platform, so we can tell you honestly whether we can meet it.

8.1Retention

A Practice's Client records, assessments and programs are kept for as long as the account is active. After termination they can be exported for 30 days and are then deleted or de-identified within 90 days, unless we must keep them longer to meet a legal obligation, resolve a dispute, or enforce our Terms.

Billing records are kept as long as tax and corporate law requires. Security and access logs are kept for a limited period and then discarded.

A Practice may ask us to delete a Client's records sooner, and we will.

9.1Safeguards

We use administrative, technical and physical safeguards appropriate to the sensitivity of what is on the Platform: access control separating one Practice from another, encryption in transit, restricted administrative access, and logging of administrative action. Health and movement information is subject to heightened measures.

No system is perfectly secure and we do not claim otherwise.

9.2Breach notification

If a breach of our security safeguards creates a real risk of significant harm, we will notify affected individuals and the relevant Practice as soon as feasible, describing what happened, what information was involved, and what we are doing about it; report it to the Office of the Information and Privacy Commissioner for British Columbia and the Office of the Privacy Commissioner of Canada as applicable; and keep a record of every breach whether or not notification was required.

10.1What you can ask for

Under PIPA and PIPEDA you may:

• access the personal information held about you;
• have inaccurate or incomplete information corrected;
• withdraw consent, subject to legal and contractual limits;
• ask for deletion, subject to our retention obligations;
• complain to the Office of the Information and Privacy Commissioner for British Columbia, or to the Office of the Privacy Commissioner of Canada.

10.2Who to ask

A Client asks their Practice, which controls their information. If a request reaches us directly we will pass it to the Practice and help that Practice answer it.

A Practice or Practitioner asks us at info@sperokinetics.com. We respond within 30 days.

11.1What we set

The Platform sets cookies and uses browser storage to keep you signed in and to remember interface preferences such as light or dark mode. These are necessary for it to work and cannot be turned off while you use it.

Our public website may use analytics to understand which pages are visited. We do not use advertising trackers and we do not build advertising profiles.

11.2Do Not Track and Global Privacy Control

We do not respond to Do Not Track signals, which have no agreed standard. We treat a Global Privacy Control signal as a valid request to opt out of any sale or sharing of personal information, to the extent that applies where you are — noting that we do not sell or share personal information in that sense.

12.1

The Platform is for people aged 18 or over. A Practice may serve a Client under 18 only with verifiable consent from a parent or legal guardian, who accepts the Terms on the minor's behalf and provides ongoing express consent for health and movement information, and only where the Practice may lawfully serve minors.

A parent or guardian may review, correct or request deletion of their child's information through the Practice.

13.1CASL

By holding an account you consent to receive electronic messages from us about your account, billing, security and service changes. This consent is given under Canada's Anti-Spam Legislation.

You may unsubscribe from non-essential commercial messages at any time using the link in the message or by writing to info@sperokinetics.com. Transactional messages — billing, security notices, invitations — cannot be turned off while your account is active, because they are how the Platform tells you things you need to know.

14.1Changes

We may update this policy. For a material change we will publish a new version with a new effective date and notify account holders by email or in the Platform. Continued use after the effective date is acceptance.

14.2Contact

Questions, requests and complaints: Spero Kinetics Ltd., Vancouver, British Columbia, Canada — info@sperokinetics.com.