Privacy Policy

1. Categories of Information We Collect & Process

Depending on which MesoMicro features your Coaching Organization enables and uses, we collect and process the following broad categories of information:

• Organization, Branding & Staff Data: Organization and sub-organization names, custom organization/team logos, branding assets, coach/administrator usernames, display names, professional credentials, email addresses, profile photos, password hashes, and tenant configuration settings.
• Athlete Profile & Demographic Information: Athlete names, year of birth or full date of birth, age, academic/class year, sport(s), position(s), roster/group assignments, athlete profile photographs, and competitive event or milestone schedules.
• Biometric, Anthropometric & Wellness Data: Bodyweight, height, body composition, physical or physiological measurements, readiness check-ins (such as sleep, hydration, or soreness ratings), and injury, movement restriction, or coaching notes.
• Performance, Testing & Training Data: Strength and conditioning training blocks, exercise prescriptions, 1RM/submaximal strength metrics, speed/power/combine or athletic test statistics, logged workout actuals, tonnage/volume analytics, athlete goals, and progress reports.
• Ephemeral Media & Coaching Communications: Photos of handwritten workout cards submitted for optical character recognition (OCR), form-check lifting videos, and asynchronous program review messages exchanged between Athletes and Coaches.
• Device, Security & Notification Metadata: Functional browser storage and cookies (including `MesoVault` `localStorage` tokens, signed session cookies, Trust-On-First-Use (TOFU) device-lock identifiers, and Weight Room Kiosk pairing tokens), IP addresses used for security rate-limiting, and optional Web Push notification endpoints.
• Other Voluntarily Provided Data (Catch-All): Any other information, custom statistics, notes, images, logos, files, or content that Coaches, Organization Administrators, or Athletes voluntarily upload, input, or choose to provide while using MesoMicro.

2. How We Use Information & AI Processing

Information stored in MesoMicro is used to provide, secure, maintain, and improve the coaching and athlete training portals:

• Authoring, calculating, printing, and delivering individualized or group strength and conditioning programs.
• Tracking longitudinal athletic performance, tonnage analytics, biometrics, and progress reports.
• Third-Party AI Processing & No Public Model Training: When a Coach or Athlete initiates an AI-powered action (such as AI program drafting, progress report drafting, or OCR transcription of a photographed workout card), relevant training context or card images are securely transmitted to our third-party commercial AI API provider(s) solely to generate the requested output. Under the commercial API terms governing our integration with our AI provider(s), your Organization's data, prompts, and uploaded images are not used by the third-party AI provider to train or improve their public foundation models.
• Internal Product & Service Improvement: We use platform data, operational telemetry, and usage patterns internally to operate, maintain, debug, and improve MesoMicro's features, accuracy, performance, and services (including developing new features and enhancing our automated tools).
• No Sale of Data or Third-Party Advertising: MesoMicro never sells Coach or Athlete personal or organizational data to third parties and never uses Athlete data for third-party behavioral advertising.

3. Data Retention, Ephemeral Media & Organizational Lifecycle

MesoMicro is not a permanent video hosting service, photo archive, or messaging platform:

• Limited Retention of Videos, Card Scans & Review Messages: Form-check videos, physical workout card scan images, and program review feedback messages are retained only for a limited period of time as temporary coaching aids and are automatically purged on a rolling retention schedule (for example, 14 days for card scans, 90 days for form-check videos, and 90 days for review messages, or as configured by the system/organization policy). Users should save local copies on their own devices of any videos or notes they wish to keep.
• Organizational Disputes & Account Deactivation: Organizational and payment disputes may result in write access being revoked (Read-Only Mode). Continued disputes or non-payment will result in the Organization and its portals being deactivated and hidden.
• Deletion Upon Request & 90-Day Post-Termination Policy: Organization data is deletable upon verified written request from an Organization Administrator. Following an Organization leaving the MesoMicro ecosystem, subscription termination, or extended deactivation, MesoMicro has no obligation to retain Organization data and may, in its sole discretion, permanently delete the Organization's data within or after 90 days of leaving the MesoMicro ecosystem.

4. Youth Athletes, Minors & COPPA Compliance

MesoMicro does not allow children under 13 (or any athlete) to self-register or create public user profiles. All Athlete profiles are created, approved, and controlled by the Athlete's Coaching Organization (including when an Athlete submits intake information via a coach-issued /join/:token onboarding link into the Coach Approval Staging Queue).

• Coach Responsibility for Parental Consent: It is the Coach's and Organization's sole responsibility to obtain verifiable parental or legal guardian permission before creating an athlete profile or collecting personal, biometric, or video data for any child under the COPPA age threshold (under 13) or any minor under applicable state, federal, or school privacy laws.
• Parental Access & Deletion Requests: A parent or legal guardian of a minor Athlete may request to review, export, or permanently delete their child's profile and training records at any time by contacting their child's Coach/Organization Administrator directly, or by contacting us via the email below.

5. Cookies, Local Storage & Device Locking

MesoMicro uses strictly necessary functional cookies and browser `localStorage` (`MesoVault`)—never third-party advertising or cross-site tracking cookies:

• Coach Portal: Uses cryptographically signed `HttpOnly` session cookies to authenticate Coaches and enforce organization/sub-organization permissions.
• Athlete Portal & Kiosks: Uses `localStorage` and `HttpOnly` device-lock tokens to remember an Athlete's active training card QR links, prevent unauthorized phones from accessing a locked Athlete's card, and authorize Coach-paired Weight Room Scan-Out Kiosks. Athletes can unlink and clear their browser at any time from the Athlete Portal Hub.

6. Cybersecurity & Data Protection Disclaimer

We implement administrative and technical safeguards designed to protect data in MesoMicro, including Argon2id password hashing, multi-tenant database isolation (`org_id` and `sub_org_id` scoping), capability token validation, and automated request rate-limiting.

No Guarantee of Absolute Security: Despite these safeguards, no method of transmission over the internet or electronic storage is 100% secure against sophisticated cyberattacks, zero-day exploits, or unauthorized access. While we make every effort to protect your information and ensure reliable service, MesoMicro cannot guarantee absolute security, and we strongly suggest making regular organizational backups of your MesoMicro data.

7. Contact Us & Data Rights

If you are an Athlete or parent/guardian seeking to access, correct, or delete Athlete profile data, please contact your Coaching Organization first, as they manage your roster records directly.

For privacy inquiries, organizational data deletion requests, or security questions, please contact your Organization Administrator or the MesoMicro system operator.