Privacy Policy
The short version: we collect only what we need to coach you, we do not sell your information, we run no advertising or analytics trackers of any kind, and you can ask us to delete your data at any time.
Who we are
This site and the client portal are operated by Upstate Workflows LLC, a South Carolina limited liability company doing business as Triple Strand Nutrition. When this policy says “we” or “us,” it means Upstate Workflows LLC. You can reach us at brett@upstateworkflows.com.
What we collect
Information you give us
- Account details — your name, email address and username. Passwords are hashed by our authentication provider; we never see or store them in readable form.
- Intake answers — your goals, activity level, training week, how you eat now, and anything you tell us to plan around.
- Coaching records — progress numbers you choose to log, goals, nutrition plans and programs built for you, appointment requests, messages you exchange with your coach, and any documents you upload.
What we ask you NOT to send
This is coaching, not health care. Please leave out full medical histories, diagnoses, medication lists, lab reports and insurance details. The portal is not built to be a medical record and we ask you not to use it as one. If you send clinical information anyway, we will treat it carefully, but the right home for it is your physician’s office.
Payment information
This site does not take payments at all. There is no checkout, no card field and no payment processor connected to it. Billing is handled by your club, and we settle with them directly, so we never receive or store your card number or bank details.
Information collected automatically
Our hosting provider keeps standard server logs, which include IP addresses and browser information, for security and reliability. When you are signed in we set a session cookie so the portal knows it is you.
We run no analytics, no advertising, no tracking pixels and no third-party cookies. There is no Google Analytics, no Meta pixel and no advertising network on this site. Our fonts are served from our own domain rather than from Google, so simply loading a page sends your visit to nobody. Third-party code loads only when you actively use a feature that needs it: the scheduler when you open a booking calendar.
How we use your information
- To build and adjust your coaching plan
- To schedule and hold your sessions
- To send you messages about your account, your bookings and your coaching
- To keep the service secure and to meet our legal obligations
We do not sell your personal information, and we do not share it for advertising.
Who we share it with
We share information only with the service providers who run parts of this business for us, and only as much as each one needs:
- Supabase — Database, authentication and file storage. Processes data in the United States.
- Vercel — Website and application hosting. Processes data in the United States.
- Calendly — Appointment scheduling, when you book a call through the site. Processes data in the United States.
- Resend — Transactional email, such as account and booking messages. Processes data in the United States.
- Cloudflare — Domain name service. Processes data in the United States.
We may also disclose information if the law requires it, or to protect our rights or someone’s safety. If the business is ever sold or merged, your information may transfer with it, and this policy travels with it too.
How we protect it
Every table in our database enforces row-level security, so one client’s records are not reachable from another client’s account. Traffic is encrypted in transit and data is encrypted at rest by our hosting providers. Session cookies are set HTTP-only, secure and same-site. Two-factor authentication is available on accounts and is required for staff.
No system is perfectly secure, and we do not claim otherwise. If we ever learn of a breach affecting your information, we will tell you.
How long we keep it
We keep your coaching records for as long as your account is active, and afterwards only as long as we need to for tax, accounting and legal reasons. Ask us to delete your account and we will remove your personal information, apart from what we are legally required to retain, such as payment records.
Your choices
Email brett@upstateworkflows.com and we will:
- Tell you what information we hold about you
- Correct anything that is wrong
- Delete your account and your data
- Send you a copy of what you have given us
Depending on where you live you may have additional rights under your local law. We honour those requests regardless of where you are; you do not need to cite a statute to ask.
Children
These services are intended for adults. We do not knowingly collect information from anyone under 18 without a parent or guardian involved, and we do not knowingly collect information from children under 13 at all. If you believe a child has given us information, email us and we will delete it.
A note on HIPAA
We are a nutrition coaching business, not a health care provider, and we do not bill insurance. That means we are not a HIPAA covered entity and this portal is not a HIPAA-compliant medical record system. It is one of the reasons we ask you to keep clinical information out of it.
Changes to this policy
If we change this policy we will update the effective date above, and we will tell account holders directly when the change is significant.
Contact
Upstate Workflows LLC d/b/a Triple Strand Nutrition
Upstate South Carolina
brett@upstateworkflows.com