1. About this policy

Home Team Fitness ("Home Team," "we," "us") is a personal training facility located in Calgary, Alberta. We collect and use personal information in the course of operating our gym, and this policy explains what we collect, why we collect it, who we share it with, and what rights you have over it.

We handle personal information in accordance with Alberta's Personal Information Protection Act (PIPA) and, where our messages to you are commercial electronic messages, Canada's Anti-Spam Legislation (CASL).

This policy applies to information we collect through our website, our booking and member management application, our advertising, and in person at our facility.

2. Who is responsible

We have designated a Privacy Officer who is accountable for our compliance with this policy and with PIPA.

Privacy Officer [NAME] Home Team Fitness 4712 16 Ave NW, Calgary, AB [POSTAL CODE] [EMAIL] [PHONE]

You can contact the Privacy Officer with any question, access request, correction request, or complaint described in this policy.

3. What we collect

3.1 If you visit our website

We collect limited technical information automatically, including your IP address, browser and device type, pages viewed, referring website, and the dates and times of your visit. This is collected through our website platform and through the analytics and advertising tools described in section 6.

3.2 If you submit an enquiry or book an intro session

Whether you contact us through our website, through a form on Facebook or Instagram, by phone, or in person, we collect:

• Your name, phone number, and email address

• What you have told us you would like to work on

• Your preferred training times and intended start timeframe

• The source of your enquiry (for example, which advertisement you responded to)

• Notes our staff make about our conversations with you

3.3 If you become a member

In addition to the above, we collect:

• Billing and payment information, including your payment card or banking details, processed through our payment provider

• Emergency contact information

• Your signed membership agreement and any waivers

• Attendance, booking, and cancellation history

• Session records, including the exercises performed, loads used, repetitions, and coach notes

• Progress measurements you agree to have recorded, which may include body measurements, strength benchmarks, and performance test results

3.4 Health information

Before you begin training with us, we ask about your health so that our coaches can program safely for you. This may include current and past injuries, surgeries, medical conditions, medications relevant to exercise, pain or mobility limitations, and any guidance you have received from a physician or physiotherapist.

We treat this as sensitive information. It is collected only for the purpose of designing and adjusting your training safely, it is accessible only to the coaching staff and administrators who need it for that purpose, and it is not used for marketing, not shared with our advertising platforms, and not disclosed to anyone outside Home Team without your consent, unless we are required to do so by law or it is necessary to respond to a medical emergency at our facility.

3.5 If you apply to work with us

We collect the information contained in your application, resume, references, and interview notes. If you are engaged as a contractor or employee, we collect the additional information necessary to administer that relationship, including certification and insurance documentation, banking details for payment, and identification required for tax reporting.

4. Why we collect it and our legal basis

Under PIPA, we may only collect, use, and disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances, and generally only with your consent.

We use personal information to:

• Respond to your enquiry and schedule your first session

• Design, deliver, and adjust your training program safely

• Administer your membership, bookings, and account

• Process payments and maintain financial records

• Communicate with you about your sessions, schedule changes, facility closures, and account matters

• Send you marketing about our programs and offers, where you have consented to receive it

• Operate the leaderboards and progress features described in section 7, where you have consented

• Understand which of our advertisements are effective, and improve them

• Maintain the safety and security of our facility

• Meet our legal, tax, insurance, and regulatory obligations

4.1 Consent

We collect your consent at or before the time we collect your information, and we identify the purpose at that time. In most cases your consent is express — you provide it by signing a membership agreement, ticking a consent box on a form, or verbally agreeing to a specific use.

Some uses are implied by the nature of the transaction. For example, if you book a session, we will use your contact information to confirm and remind you about that session.

You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. Contact our Privacy Officer to do so. Withdrawing consent for certain uses may mean we can no longer provide some or all of our services — for example, we cannot safely train you if you withdraw consent for us to hold your health information.

5. Commercial electronic messages (CASL)

We send marketing emails and text messages only to people who have given us express consent to receive them, or where we are permitted to rely on an existing business relationship under CASL.

Every commercial electronic message we send will identify Home Team Fitness, include our mailing address and contact information, and include a working unsubscribe mechanism. We will action unsubscribe requests within ten business days.

Withdrawing consent for marketing messages does not affect transactional messages about your bookings, your account, your payments, or facility operations. Those are not commercial electronic messages and will continue while you are a member.

6. Advertising, analytics, and tracking

6.1 Cookies and similar technologies

Our website uses cookies and similar technologies for basic site functionality, to remember your preferences, and to measure traffic. You can control cookies through your browser settings. Disabling cookies may affect how parts of our website work.

6.2 Meta (Facebook and Instagram)

We advertise on Facebook and Instagram, and we use Meta's advertising tools to measure whether those advertisements are working.

This involves two things you should be aware of:

On our website, we use the Meta Pixel, which records certain actions you take on hometeamcalgary.com and reports them to Meta. Meta may match this activity to your Facebook or Instagram account if you have one.

Through our advertising, we use Meta's Conversions API, which sends information about enquiries and bookings from our systems directly to Meta so that it can measure and improve advertisement delivery. Where contact information such as an email address or phone number is included, it is transformed into an irreversible coded value before transmission — Meta does not receive your email address or phone number in readable form through this channel.

We may also upload contact lists to Meta in the same coded form, in order to show advertisements to people who resemble our existing members, or to avoid showing advertisements to people who are already members.

We do not send health information, injury history, or training records to Meta or to any other advertising platform.

You can control how Meta uses your information for advertising through the Ad Preferences settings in your Facebook or Instagram account, and you can opt out of interest-based advertising more generally through the Digital Advertising Alliance of Canada at youradchoices.ca.

6.3 Analytics

We use website analytics tools to understand aggregate traffic patterns. These tools do not tell us the identity of individual visitors.

7. Leaderboards, progress tracking, and in-facility displays

Our member application includes leaderboards and progress features that may display your first name, last initial, and performance results — such as lifts, benchmark times, or attendance streaks — to other members of Home Team, either within the application or on displays inside the facility.

This is optional. We will ask for your consent before including you, and you can be removed at any time by contacting a staff member or the Privacy Officer. You may also choose to appear under a display name rather than your real name.

Leaderboard information is visible only to other Home Team members and staff. It is not public on the internet and is not shared outside Home Team.

8. Photographs and video

We photograph and film inside our facility for marketing, including for social media and paid advertising.

We will not use a photograph or video in which you are identifiable for marketing purposes without your written consent. If you have given consent and later change your mind, contact the Privacy Officer and we will stop using that material going forward. We may not be able to recall material that has already been published, distributed, or shared by third parties.

If you do not wish to be photographed, let any staff member know and we will accommodate you.

9. Who we share your information with

We do not sell your personal information.

We share personal information with:

Service providers who perform functions on our behalf, including our website platform, our member management and booking systems, our data storage and hosting provider, our payment processor, our email and text messaging providers, our accounting provider, and our advertising platforms. These providers are given only the information necessary to perform their function, and are required to protect it and to use it only for the purposes we specify.

Professional advisors, including our accountants, insurers, and legal counsel, where necessary.

Emergency responders, if there is a medical emergency at our facility and disclosure is necessary to protect your health or safety.

Other parties where required or permitted by law, including in response to a court order, subpoena, lawful demand from a public authority, or in connection with the sale or reorganization of our business.

9.1 Information stored and processed outside Canada

Several of the service providers we rely on are located in, or store data in, the United States. This includes our website platform, our cloud data storage and application infrastructure, our automation and messaging tools, and the advertising platforms described in section 6.

This means your personal information may be stored or processed outside Canada, and while it is there, it may be accessible to the courts, law enforcement agencies, and national security authorities of that jurisdiction under the laws that apply there.

We use contractual and technical measures to require our providers to protect your information, but we cannot exempt it from foreign legal process. You may contact our Privacy Officer for more information about our policies and practices regarding service providers outside Canada.

10. How long we keep it

We keep personal information only as long as necessary to fulfill the purposes we collected it for, or as required by law.

In general terms:

• Enquiries that do not become memberships are retained for up to two years, so that we can respond if you come back to us, and then deleted.

• Member records, including training and session history, are retained for the duration of your membership and for a period afterward, to allow you to return without starting over and to address any claim that may arise.

• Financial and tax records are retained for the period required by the Income Tax Act and related legislation, which is generally six years.

• Signed agreements, waivers, and health declarations are retained for the period recommended by our insurers and legal counsel, which is generally longer than the periods above, because they may be relevant to a future claim.

When information is no longer needed, we destroy, erase, or anonymize it.

11. How we protect it

We maintain physical, organizational, and technical safeguards appropriate to the sensitivity of the information, including access controls that limit staff access to what each role requires, password protection and authentication on our systems, encryption in transit, secured storage for paper records, and confidentiality obligations in our contracts with staff and contractors.

No system is completely secure, and we cannot guarantee absolute security. If a breach occurs that creates a real risk of significant harm, we will notify affected individuals and the Office of the Information and Privacy Commissioner of Alberta as required by PIPA.

12. Your rights

Under PIPA, you have the right to:

Access your information. You may request the personal information we hold about you, how we have used it, and who we have disclosed it to. Make the request in writing to our Privacy Officer. We will respond within 45 days, or explain why we need an extension. In limited circumstances the law requires or permits us to withhold certain information, and we will tell you if that applies and why.

Correct your information. If you believe information we hold is inaccurate or incomplete, tell us and we will correct it, or annotate the record with your requested correction if we disagree.

Withdraw your consent, as described in section 4.1.

Complain. If you are not satisfied with how we have handled your information or your request, contact our Privacy Officer first — we would like the chance to resolve it. You also have the right to complain directly to:

Office of the Information and Privacy Commissioner of Alberta 410, 9925 109 Street NW, Edmonton, AB T5K 2J8 Phone: 780-422-6860 · Toll free: 1-888-878-4044 oipc.ab.ca

We do not charge a fee for access requests from individuals about their own personal information, except where the law permits a reasonable fee for extensive requests, in which case we will provide an estimate before proceeding.

13. Minors

Our services are directed to adults. Where we provide training to a person under the age of 18, we require the consent of a parent or legal guardian, and that parent or guardian may exercise the rights in section 12 on the minor's behalf.

We do not knowingly collect personal information from children through our website, and we do not target advertising to people under 18.

14. Third-party links

Our website and communications may link to websites we do not operate. This policy does not apply to those sites, and we are not responsible for their privacy practices. We encourage you to read the privacy policy of any site you visit.

15. Changes to this policy

We may update this policy from time to time. The current version is always posted at hometeamcalgary.com/privacy-policy with the effective date at the top. If we make a change that materially affects how we use information we have already collected, we will notify affected individuals directly.

16. Contact us

Questions about this policy, or any request described in it:

Home Team Fitness 4712 16 Ave NW, Calgary, AB, T3B 0N1 - (403) 808-6510