Privacy Policy

About this policy

Rubicon Performance LLC (Rubicon, we, us, or our) provides training, coaching, education, and related digital services. This Privacy Policy explains how we handle personal information through our website, athlete app, coaching platform, scheduling tools, and our delivery of those services (the Services).

Our Terms of Service explain the rules for using the Services. Your signed fitness services agreement governs your individual coaching arrangement. Connecting a wearable is optional and requires your authorization; accepting general service terms alone does not authorize a wearable connection.

For privacy questions or requests, contact Support@rubicon-performance.com.

Information we collect

The information we collect depends on the Services you use and the information you or an authorized parent, guardian, or coach provide:

• Account and contact information: name, email address, phone number, date of birth or age information, account credentials, preferences, and parent or guardian details where applicable.
• Training and health information: physical measurements, playing level, goals, training history, injuries and limitations, assessments, workout results, recovery check-ins, nutrition entries, and progress records. This may include sensitive personal information or consumer health data.
• Communications and uploads: messages, coaching notes, support requests, and photos, videos, or documents you choose to provide.
• Coaching and payment records: selected services, appointments, signed agreements and signature verification records, invoices, payment status, and billing references. Payment providers process payment details through their payment interfaces.
• Connected wearable information: the categories described in Connected wearables and health data, only when you authorize a connection.
• Technical information: IP address, browser and device information, timestamps, referring pages, session identifiers, and service or error logs generated when you use the Services.

Sources include you, your authorized parent or guardian, coaches providing your services, connected providers you authorize, payment and scheduling providers, and your interactions with the Services. Please provide only information relevant to your account or coaching.

Personal information means information that identifies you or can reasonably be linked to you or your household. Health information and credentials that allow access to an account can receive additional protection as sensitive information. Information does not lose those protections merely because it is contained in a training record or used to create a recovery summary.

How we use information

We use personal information to create and secure accounts; arrange and deliver coaching; develop and adjust training programs; display progress and recovery information; communicate with athletes and guardians; schedule appointments; process payments and agreements; respond to support requests; and maintain and troubleshoot the Services.

We also use information as necessary to prevent misuse, resolve disputes, maintain required business records, and comply with applicable law. Health and wearable information is used for the training and recovery services you request, subject to your permissions. We do not use that information for targeted advertising.

We may send service messages about your account, appointments, or billing. You can unsubscribe from promotional emails without stopping necessary service messages.

We do not use personal information for automated profiling that makes decisions with legal or similarly significant effects, such as eligibility for employment, lending, housing, or insurance. Training and recovery summaries support coaching; they are not those kinds of eligibility decisions.

Who can access information

• Your coaching team: coaches and authorized staff receive information relevant to providing your coaching, managing your account, and supporting you. Authorized parents or guardians may receive information about a minor participant. Wearable sharing requires the authorization described below.
• Service providers: providers of hosting, databases, authentication, communications, file storage, scheduling, and payment processing handle information needed to perform those functions for us. Providers processing information on our behalf must protect it and are restricted by contract to authorized purposes, subject to applicable law. Payment processors receive billing information; they do not need your wearable recovery summaries to process a payment.
• Recipients you authorize: we may share information at your direction or with your permission for a specified purpose. Private training records and messages are not public posts. These terms do not authorize publishing your health information or using your name, photo, or testimonial for promotion without separate permission.
• Legal and business needs: we may disclose information where legally required, to protect rights and safety, or in connection with a business transaction, subject to applicable law, confidentiality protections, and restrictions that apply to connected-provider data.

We do not sell personal information or share it for cross-context behavioral or targeted advertising. This includes athlete information, children's information, and health and wearable data.

Connected wearables and health data

Connecting Oura, WHOOP, or Apple Health is optional. You authorize the provider or device to share supported information with Rubicon. The provider's own policy also applies to its handling of your information.

Oura

When you connect Oura, we receive your Oura account identifier and authorized daily readiness and sleep information. We use the identifier to associate updates with your connection. We retain compact daily summaries, including available readiness and sleep scores, sleep duration, and heart-rate-variability and resting-heart-rate status indicators, to support recovery review and training decisions with your assigned coaching team.

Your authorization permits that team to view the resulting recovery summaries. We store connection credentials on our servers and do not ask for your Oura password. We do not keep a full raw wearable export as your coaching record. We do not sell Oura data, use it for advertising, or send it to AI models.

Other supported connections

WHOOP can provide authorized recovery, sleep, and activity information. Apple Health access is controlled through your iPhone permissions and can provide supported daily health and recovery measurements. The information available depends on your permissions, provider, and device. We use supported summaries for your requested coaching and progress features.

Your control

You can disconnect Oura or WHOOP in the athlete app's wearable settings, or revoke access through the provider. Apple Health permissions can be changed on your iPhone. You can also contact us to withdraw permission, stop coach sharing, or request access to or deletion of connected data. Disconnecting a wearable does not cancel your coaching agreement.

See Retention and deletion for what happens to stored information. If you need help, email Support@rubicon-performance.com from your account email address.

Cookies and browser storage

The Services use session cookies or similar browser storage for sign-in, security, preferences, and preserving information while you complete forms. Our infrastructure also produces technical logs for service delivery and troubleshooting.

Cookies are small records stored by your browser. Similar browser storage can remember a session or an unfinished form. A session identifier or technical log may be associated with your account when you sign in. These records can therefore be personal information even when they do not contain your name.

You can control cookies and stored website data in your browser. Blocking or clearing them may sign you out or affect saved preferences and unfinished forms. Links to external websites, social networks, and payment providers take you to services with their own privacy practices.

We do not use personal information for targeted advertising or sell it, including when a browser sends an opt-out preference signal such as Global Privacy Control.

Retention and deletion

We keep account, coaching, communication, and training records for the time needed to provide your services and address support, safety, or account matters. Financial records and signed agreements may be retained where needed for legal, tax, accounting, or dispute-resolution purposes. Retention depends on the record's purpose and applicable requirements; keeping a signed agreement does not require keeping wearable data.

Oura-derived daily summaries have a rolling 60-day retention period. Disconnecting Oura in the athlete app disables coach access to the connection and deletes its stored daily summaries. Disconnecting does not itself erase every connection record: records of the connection and revoked credentials can remain until separately deleted. To request deletion of all Oura-related information, contact us using the address below.

Oura's requirements include stopping processing when you withdraw permission, deleting your Oura data within 72 hours of a deletion request, and deleting it when your applicable subscription ends. A billing cancellation does not currently trigger complete Oura-data deletion automatically; contact us to coordinate disconnection and deletion when ending your subscription. This does not extend the deletion deadline or authorize continued processing after withdrawal. A general business-record retention reason does not extend permitted retention of Oura data.

To request deletion of an account or other personal information, email Support@rubicon-performance.com. We may verify your identity or your authority to act for the account holder. We explain any legally permitted limitation on a request and require relevant service providers to carry out applicable deletion obligations. Deleting information needed for coaching can limit the services we can provide.

Where applicable law permits an exception, limited information may need to be retained to complete a service you requested, address fraud or security issues, correct technical errors, meet a legal obligation, or establish or defend legal claims. We explain the applicable reason, retain only the information needed for it, and do not treat an exception as permission for unrelated uses. We notify service providers, contractors, and other recipients of deletion requests when required by law and direct them to carry out their applicable obligations. More protective health-data or provider-specific rules still apply.

Your choices and privacy requests

You can review and update supported profile information in the app and contact us about other corrections. You may request access to your information, a copy in a portable format where available, correction, or deletion. You may also withdraw consent to optional health-data collection or sharing and unsubscribe from promotional messages.

Send requests to Support@rubicon-performance.com or by mail to Rubicon Performance LLC at the address below. Identify your account and the request, but do not email passwords, payment-card numbers, or unnecessary medical records. An authorized representative can contact us on your behalf; we may request proof of authority and appropriate identity verification. Contact us if you need this policy or help making a request in an accessible format.

Verification and authorized representatives

For requests that expose, change, or delete account information, we ordinarily match your name and account email with our records and may ask you to confirm control of the account. If more information is reasonably necessary, we explain what is needed and provide an appropriate way to supply it. Information collected for verification is used only to verify the request or the representative's authority. We do not require you to open a new account to exercise a privacy right.

An authorized representative should identify the person represented and the right being exercised and provide evidence of permission where required. We may ask you to verify your identity directly or confirm that you authorized the representative, subject to applicable exceptions such as a valid power of attorney. A parent or guardian may act for an eligible child.

We do not require identity verification for an opt-out where the law prohibits it. For example, a Connecticut opt-out does not require authentication; if we have a reasonable, documented basis to believe it is fraudulent, we explain why we cannot comply. You or an authorized agent may use an applicable browser-based opt-out signal, including Global Privacy Control. Because we do not sell information or use it for targeted advertising, that choice already applies to all users, including across their browser, account, and offline dealings with Rubicon.

Timing, costs, and protection from retaliation

We respond within the time required by applicable law. For covered access, correction, and deletion requests under the state laws discussed below, this is generally 45 days after receipt, with an additional 45 days only where permitted and necessary. We explain an extension and its reason within the original response period. Shorter deadlines, including the Oura deletion requirement above, take priority.

Requests are free unless applicable law permits a reasonable cost-based fee for a repeated, excessive, or manifestly unfounded request. We explain any proposed fee or refusal and its legal basis. A limit on free copies is not a blanket limit on your ability to exercise other privacy rights. If we cannot fulfill a request, we explain the reason and any available appeal.

We do not retaliate against you for exercising privacy rights, including by denying services, imposing a penalty, charging an unlawful different price, or reducing service quality because you made a request. This also includes applicable employment-related protections. If you withdraw information genuinely necessary for a feature, that feature may no longer work; we explain the practical effect.

Privacy appeals and complaints

If we decline your privacy request, you may ask us to review that decision by replying to our response or emailing Support@rubicon-performance.com with the subject “Privacy appeal.” Include the original request or decision and why you believe it should be reconsidered. We accept appeals submitted within 90 days of our decision, and later where required by applicable law. This filing period is separate from our deadline to respond.

Where the relevant state law applies, we provide a written decision and explanation within 45 days for Colorado and Oregon appeals, or 60 days for Connecticut, Texas, and Virginia appeals. Colorado permits a further 60 days when reasonably necessary; if used, we explain the extension within the initial 45 days. Other applicable appeal deadlines control when they provide different protections.

If an appeal is denied, our response includes the applicable regulator's complaint method. You may also contact a regulator directly; this policy does not require you to give up other available remedies. These official pages provide privacy information and complaint routes:

• California Attorney General
• Colorado Attorney General
• Connecticut Attorney General
• Oregon Department of Justice
• Texas Attorney General
• Utah Division of Consumer Protection
• Virginia Attorney General

Children and parent or guardian consent

Rubicon permits participation by children under 13 only with verified parent or legal guardian consent. Before collecting personal information through an under-13 athlete account, we require notice to the parent or guardian and verification of their consent. A child cannot provide that consent on the parent's behalf. A wearable connection also remains subject to the provider's age and eligibility rules.

For an authorized child account, we collect information needed for the account and coaching, such as contact and guardian information, age, training and health information, communications, and authorized uploads or connected data, as described above. We use it to provide and support the child's services and share it with authorized coaching personnel and service providers performing those functions. We do not sell children's information or use it for targeted advertising.

A parent or guardian may review the child's information, request correction or deletion, withdraw consent, or refuse further collection by contacting Support@rubicon-performance.com. We verify the requester's authority. Refusing information necessary to provide a particular service may prevent the child from using that service; we do not require more information than reasonably necessary for participation.

A parent may consent to collection and internal use without consenting to disclosure to third parties that is not integral to the child's requested service. Any such non-integral disclosure requires separate verified parental consent. General acceptance of these policies does not replace that consent. Before a material change to a child's information practices, we provide the required direct notice to the parent and obtain any new consent required.

We retain a child's account, training, and communications information only as long as reasonably necessary for the specific service purpose for which it was collected, and securely delete it when that purpose ends. Limited consent or transaction records may be retained for a specific legal obligation, but this does not justify indefinite retention of the child's training or health information. Optional connected data is also subject to the shorter provider-specific limits above.

If we discover that we collected a child's information without the required consent, we stop the unauthorized collection and delete the information. Please contact us if you believe this has occurred.

If a child provides unnecessary personal information beyond what we request, we delete that excess information when we become aware of it. Rubicon Performance LLC is the operator responsible for this notice; use the contact details below for questions about children's information or parental consent.

Security and processing location

We use access controls, authenticated connections, and other administrative and technical measures to protect information. Wearable access credentials are handled on the backend with encryption at rest. Coaches and staff should access only information appropriate to their role. No internet service can guarantee absolute security.

The Services are operated from the United States. Service providers may process information in the United States or other locations where they operate, subject to applicable protections. If a security incident requires notification, we provide the notices required by applicable law.

Additional state privacy rights

Depending on where you live and whether a law applies to Rubicon, you may have additional rights concerning personal information and consumer health data. These may include knowing the categories and specific information collected; learning its sources, purposes, and recipients; obtaining a copy; correcting or deleting information; withdrawing health-data consent; limiting certain sensitive-information uses; and opting out of sale, targeted advertising, or certain consequential profiling.

For California residents, the categories of information, sources, business purposes, recipients, and retention practices are described in the sections above. Health information and account credentials may be sensitive personal information. We use such information to provide requested services and for the permitted account, security, and legal purposes described in this policy. We do not sell personal information or share it for cross-context behavioral advertising.

California categories and rights

The following categories explain how the information described above maps to California's privacy terminology. A category applies only when you use a feature or provide the corresponding information. The sources are listed under Information we collect; retention periods and criteria are under Retention and deletion.

On narrow screens, scroll the table sideways to read both columns.

Disclosures for a legal requirement, a permitted business transaction, or your specific direction are described in Who can access information. Ordinary service-provider processing is different from selling information or sharing it for cross-context behavioral advertising; we do neither, including for people under 16.

If the California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies, you may request the categories and specific pieces of information collected about you, sources, collection purposes, and recipient categories; request correction or deletion, subject to applicable exceptions; and receive information in a portable format. You have applicable rights to opt out of sale or cross-context behavioral sharing and to limit uses or disclosures of sensitive information outside legally permitted purposes. Our stated uses of sensitive information are for requested services, account security, and other permitted purposes; this does not authorize unrelated use. Contact us to exercise a right or question a use.

California requests for information are free up to twice in a 12-month period, subject to lawful exceptions for manifestly unfounded or excessive requests. We do not require you to provide government identification as a default: the verification and authorized-agent process above applies. California's protection against retaliation also extends to covered job applicants, employees, and independent contractors.

Other state rights

Where applicable, the Colorado Privacy Act, Connecticut Data Privacy Act, Oregon Consumer Privacy Act, Texas Data Privacy and Security Act, Utah Consumer Privacy Act, Virginia Consumer Data Protection Act, and other state laws provide rights described in this policy. Coverage, definitions, and exceptions vary; this list does not limit rights under another applicable law. Our no-sale and no-targeted-advertising policy also applies to Florida residents.

Oregon residents covered by its law may request a list of the specific third parties to which we disclosed personal data, as provided by that law, rather than only categories of recipients. Colorado, Connecticut, Oregon, Texas, and Virginia provide applicable opt-out rights for profiling used for legally or similarly significant decisions; we do not conduct that type of profiling. Utah's statutory access, copy, deletion, and opt-out rights have a different scope from some other states; you can still contact us about corrections under this policy.

Colorado, Connecticut, and Oregon generally provide at least one free information response per 12-month period, while Texas and Virginia provide up to two annually, subject to the applicable exceptions. We apply any lawful fee exception to the particular request; we do not treat those numbers as a blanket prohibition on further requests.

For residents with consumer-health privacy rights, our health-data categories include training and injury information, physical measurements, recovery entries, connected wearable summaries, and inferences used in coaching. Sources are you, your authorized representatives and coaches, and providers you connect. Collection and sharing serve the requested coaching and recovery purposes described above. Recipients are your authorized coaching team, authorized guardians where applicable, and service providers supporting those services. We do not sell consumer health data.

Use the contact methods in Your choices and privacy requests to exercise applicable rights, request information about recipients, or appeal a decision.

Updates and contact

We update this policy when our practices or applicable requirements change and display the revised date above. We provide additional notice of material changes and seek any consent required before using previously collected information for a new purpose.

Contact Rubicon Performance LLC at Support@rubicon-performance.com, or write to: