Privacy Policy

This policy explains how your personal and health information is handled when you train in person with Pentagon Strength (our "Personal Training" service). It is the policy you accept when you complete your invitation. It is separate from the Pentagon Strength app policy and the online-coaching policy.

1. Who we are

The Personal Training service is provided by Nerio Cedeno, doing business as Pentagon Strength, based in Florida, United States.

For any privacy question, contact us at nerio023@gmail.com — subject line: Privacy Question - Personal Training. We respond within 7 business days.

2. What we collect

When you accept your invitation and while we work together, we collect:

• Contact details — your name, email address, and (optionally) phone number, so your coach can reach you and set up your account.
• Health information — any injury, medical condition, or health note you choose to share at signup or during training, and your training goal.
• Body measurements — the weight, body-fat percentage, and muscle mass your coach records at your check-ins.
• Training data — the sets, reps, weights, and effort recorded during your sessions.
• Consent records — the date, time, and IP address captured when you accept the Personal Training Agreement and this Privacy Policy, kept for legal compliance.

3. How we use your information

We use your data exclusively to:

• Design and adjust your personal training program.
• Track your progress toward your goal and prepare your progress reports.
• Communicate with you about your training.
• Comply with our legal obligations (consent records).

We do not use your data for advertising, we do not use it to train machine-learning models, and we do not send you marketing without your consent. The one exception: if you opt in to the photo/video release at booking, we may use that footage in our own marketing and promotional content — that use happens only with your explicit, revocable consent, never with a third-party advertiser.

4. We do not sell your data

We do not sell your personal information or your health data, and we do not share it for advertising or with data brokers.

If Pentagon Strength is ever sold, merged, or transferred to a new owner, your data may transfer as part of that transaction. We will notify you beforehand, and the new owner will remain bound by this Privacy Policy.

5. Who we share your data with

Your data is stored and processed by the following service, solely so the service can operate:

• Render — hosting and database infrastructure, located in the United States (render.com/privacy).

Your coach (Nerio Cedeno) is the only person with access to your health information. We do not share your data with anyone else unless the law requires it.

6. Security

• All data sent between your device and our servers is encrypted in transit via HTTPS (TLS).
• Your health notes are encrypted at rest, so they are unreadable in the raw database.
• Passwords are stored as a one-way cryptographic hash (PBKDF2). We cannot read your password.
• Access to your health data is restricted to your coach.

No method of transmission or storage is 100% secure, but we take reasonable measures to protect your information. If a breach affects your rights, we will notify you as required by law.

7. How long we keep your data

We keep your data for as long as we are working together. When the coaching relationship ends — or if you ask us to delete it — we delete your personal and health data. Records of your consent to this policy and the Personal Training Agreement may be retained where the law requires.

8. Your rights

You have the right to access, correct, delete, and obtain a copy of your personal data, and to withdraw your consent to the processing of your health data at any time. To exercise any of these rights, email nerio023@gmail.com. We respond within 45 days.

If you are a California resident, you have rights under the CCPA/CPRA, including the right to know, delete, and correct, and the right to opt out of the sale or sharing of your data — which we do not do. If you are in the European Union or the United Kingdom, you have rights under the GDPR/UK GDPR, and the legal basis for processing your health data is your explicit consent.

9. International data transfers

Your data is stored on servers in the United States. If you access the service from outside the United States, your data will be transferred to and processed in the United States, which may not offer the same level of data protection as your home country.

10. Minimum age

The Personal Training service is for people aged 18 and older. We do not knowingly collect data from anyone under 18.

11. Changes to this policy

We may update this policy as the service evolves or as the law changes. The "Last updated" date at the top reflects the most recent revision, and we will notify you of material changes.

12. Contact

nerio023@gmail.com — Subject line: Privacy Question - Personal Training. Response time: within 7 business days.