CORE ASCENT

PRIVACY POLICY

Effective Date: August 5, 2026

This Privacy Policy describes how Core Ascent (Cole Carter, sole proprietor), 2045 66th Avenue South, St. Petersburg, FL 33712 (“Core Ascent,” “we,” “us”), collects, uses, stores, discloses, and protects personal information through our website at coreascent.co (the “Site”), our fitness tracking application (the “App”), and our communications with you. If you are a client receiving services, your signed Client Services Agreement and the Notice of Privacy Practices provided with it additionally govern your health information and control over this Policy with respect to the services.

1. INFORMATION WE COLLECT

Information you provide: name, email address, phone number, and address; messages and form submissions on the Site; scheduling information; health, medication, and lifestyle information you provide as a client through intake questionnaires, sessions, and follow-ups; App account information and the fitness data you log in the App (for example, workouts, exercises, dates, times, and progress); and payment transaction details. Sensitive payment card data is handled by our payment processors and is not stored on our servers.

Information collected automatically: IP address, browser and device information, referring pages, approximate location, usage data, server logs, and data collected through cookies and similar technologies as described in our Cookies Policy.

Information from third parties: transaction confirmations from payment processors and data from the integrated services listed in Section 3.

2. HOW WE USE INFORMATION

We use personal information to provide and improve the Site, the App, and our services; to schedule and deliver sessions; to process payments; to respond to inquiries; to send transactional emails such as confirmations and reminders; to send newsletters and marketing communications where permitted, always with the ability to unsubscribe; to analyze usage and improve performance; to protect against fraud and maintain security; and to comply with legal obligations. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

3. WHERE YOUR DATA LIVES (SERVICE PROVIDERS)

We use a small set of service providers, each processing data as needed to run the business: Namecheap (website hosting); WordPress with Elementor Pro (site platform and forms); Google Workspace, including Gmail, Meet, Forms, Sheets, Drive, Calendar, and eSignature (client communications, session delivery, scheduling, records, and contracts), with client health information handled under a Business Associate Agreement with Google; Google Analytics (site usage statistics); PayPal (payments; additional processors such as Stripe may be added, and the processor in use is always identified at the time of payment); Vercel (App hosting); Supabase (App database holding account and fitness data); and Resend, which delivers email over Amazon SES infrastructure (transactional and marketing email). Each provider processes data under its own terms and safeguards, and we select providers with security practices appropriate to the data involved.

4. HEALTH INFORMATION

Core Ascent provides nutrition and fitness services, including Medical Nutrition Therapy delivered by licensed registered dietitians. We do not bill insurance and are generally not a HIPAA covered entity; nevertheless, we apply precautionary HIPAA-style safeguards to client health information, including the Business Associate Agreement with Google Workspace described above. Clients receive a Notice of Privacy Practices with their Client Services Agreement. Fitness data logged in the App is stored in Supabase with authentication and access controls.

5. SHARING

We share personal information only with the service providers described above, when required by law or legal process, to protect our rights or the safety of any person, or in connection with a business transfer such as a sale of the business, in which case this Policy continues to apply until updated. We never sell personal information.

6. SECURITY

We use reasonable administrative, technical, and physical safeguards, including TLS encryption in transit, access controls, authenticated access to the App, and BAA-covered platforms for client health information. No system is perfectly secure, and we cannot guarantee absolute security; we will notify affected individuals of a breach as required by law.

7. RETENTION

Client service records are retained for at least 7 years, consistent with professional requirements for registered dietitians. App account and fitness data are retained while your account is active and deleted or anonymized on verified request, subject to legal retention obligations. Analytics data is retained per Google Analytics settings. Other data is kept only as long as needed for the purposes described here.

8. YOUR RIGHTS

Depending on your location, you may have the right to access, correct, delete, or receive a copy of your personal information, to object to or restrict processing, and to withdraw consent where processing is based on consent. California residents have the rights provided by the CCPA; we do not sell or share personal information as those terms are defined there. If you are located outside the United States, including in Mexico, you consent to the transfer, storage, and processing of your information in the United States. To exercise any right, email cartercbus@gmail.com; we verify and respond to requests within the timeframe required by applicable law.

9. CHILDREN

The Site, App, and services are not directed to individuals under 18, and we do not knowingly collect their information, with one exception: where a parent or legal guardian has co-signed a Client Services Agreement and Informed Consent for a minor client, we collect and handle that minor’s information under the guardian’s consent with the same safeguards described in this Policy, and the guardian may exercise the rights in Section 8 on the minor’s behalf. Any other information from a minor that comes to our attention is deleted promptly.

10. COOKIES; LINKS; CHANGES; CONTACT

Cookies and similar technologies are described in our Cookies Policy. The Site may link to or embed third-party content; their privacy practices are their own. We may update this Policy and will post revisions with a new effective date, notifying you of material changes by email or Site notice where feasible. Questions: Core Ascent, cartercbus@gmail.com.