The short version
What this amounts to in practice
I collect health information from you in stages, and only as much as I need to decide whether I can work with you safely and then to program for you. I do not sell it. I do not share it for advertising. There are no advertising or analytics trackers on this website. The people who can see your data are me, and the software vendors I use to run the practice, who are contractually limited to processing it on my instructions.
You can ask me what I hold, ask for a copy, withdraw your consent, and tell me to delete it. Deletion is real deletion, including from backups, and I will pass the instruction to any vendor holding a copy. The rest of this page is the detail behind those sentences.
Scope
Who and what this covers
This policy applies to consumer health data that Peak Load Institute LLC collects about Washington consumers and about anyone else who inquires about or receives services from this practice. Peak Load Institute LLC is the regulated entity that determines why and how this data is collected.
I am not a HIPAA-covered entity. I am not a physician, dietitian, or licensed healthcare provider, and nothing here is medical care. Because HIPAA does not apply, the Washington My Health My Data Act does, and this policy exists under that act rather than alongside it.
"Consumer health data" is defined broadly by Washington law. It includes information that identifies your past, present or future physical or mental health status. In this practice that means things like body measurements, health conditions, medications, injuries, and bodily functions — and it can also include the simple fact that you sought health-related services from me at all.
Collection
What I collect, and why
Collection is staged deliberately, so that health information is only gathered once we are both seriously considering working together, and never at first contact. Each stage has its own purpose.
1. When you first get in touch
Categories: name, email address, and whatever you choose to write in your message. I do not ask health questions at this stage, and you are asked not to include health or medical details. What you send may still qualify as consumer health data, because it indicates that you are seeking health-related services.
Purpose and use: to answer your question, and to decide whether to take it further.
2. Screening, if we are both minded to proceed
Categories: your answers to a pre-exercise health screening, covering heart-related symptoms, your current level of exercise, and diagnosed heart, metabolic and kidney conditions, including diabetes and blood-sugar medication; whether a doctor has restricted your exercise; any history of eating disorders or bariatric surgery; anything else you choose to tell me about your health; and, where your screening indicates it, documentation of clearance from your physician.
Purpose and use: to determine whether it is safe and appropriate for me to work with you, and to identify anything that belongs with your physician or a registered dietitian instead of, or alongside, me. This stage is preceded by a separate consent request, and nothing is charged at any point before an engagement begins.
3. When we meet
Categories: we go through the screening answers you have already given, and anything you add or correct in the course of that conversation. At this meeting, or at your first session if we go ahead, I also ask about your medications and supplements, surgeries, injuries, and whether you are pregnant or have recently given birth. The meeting is not recorded. I note down your answers and anything that changes my understanding of your screening, and they are held with the rest of your screening record under the consent you have already given.
Purpose and use: to review your health history with you face to face before any training is planned, and for us both to decide whether to work together.
4. During an engagement
Categories: body weight and body measurements; body composition results such as DEXA scans you obtain and share with me; training logs and performance data; dietary intake information; data from wearables, continuous glucose monitors or apps that you choose to share; laboratory results you choose to share; and my own notes on your program, your progress, and the reasoning behind changes I make.
Purpose and use: to design and adjust your training program and the nutrition guidance that goes with it, to track whether it is working, to communicate with you about it, and to keep a professional record of the advice I gave and why I gave it.
Sources
Where the data comes from
- Directly from you — forms, messages, calls, uploads and conversation. This is the overwhelming majority of it.
- From your physician or other clinician, where you have asked them to send me clearance or a recommendation, or have authorised me to ask.
- From devices, apps or laboratories you choose to connect or share with me. I do not connect to anything on your behalf without you asking.
I do not buy health data, and I do not collect it from data brokers, advertising networks, or any other third-party source.
Sharing
What I share, and with whom
Categories of consumer health data shared: any of the categories listed above may be processed by the vendors below in the course of running the practice. I do not otherwise disclose your health data to anyone.
Service providers who process data on my instructions
Each of these is bound by contract to process your data only as I direct, and not for their own purposes:
- Tally (tally.so) — intake, screening and agreement forms
- Google Workspace — email correspondence with you (Gmail), storage of records and documents (Google Drive), video calls (Google Meet), and booking sessions (Google Calendar)
- Stripe — billing. This vendor receives payment information and the fact of an engagement, not your health records.
- Amazon Web Services — hosting of this website
Other recipients
- Your own physician or dietitian, but only at your direction or with your authorisation. Referring you out is common in this practice; sending your records is not, and does not happen unless you ask.
- Legal and professional advisers, and where I am compelled by law, legal process, or the need to establish or defend a legal claim.
- A successor, if the practice is transferred. You would be notified, and this policy would continue to apply until you were told otherwise.
Limits
What I never do
- I do not sell your consumer health data. Washington law would require a separate, specific, signed authorisation from you before any sale could occur. I do not seek one and do not intend to.
- I do not share it for advertising or marketing, mine or anyone else's.
- I do not run advertising or analytics trackers on this website. This site loads no third-party scripts, fonts, pixels or embeds of any kind.
- I do not use geofencing around any health care facility, and Washington law prohibits it.
- I do not collect categories beyond those described above without asking you first.
Retention
How long I keep it
- If you inquire and we do not proceed: deleted within 60 days of the point it becomes clear we are not working together.
- If you become a client: retained for the duration of the engagement and for six years afterwards, so that there is a professional record of the advice given and the basis for it.
- If a legal claim or dispute is pending or reasonably anticipated: the records relevant to it are kept until that is resolved.
- If you ask me to delete it sooner, I will — except where I am permitted to retain something in order to establish or defend a legal claim. See your rights below.
Data held by the vendors listed above is deleted on the same schedule, and deletion instructions are passed to them.
Your rights
What you can require of me
Under the Washington My Health My Data Act you have the right to:
- Confirm whether I am collecting, sharing or selling your consumer health data.
- Access that data, together with a list of all third parties and affiliates with whom I have shared it, and an active means of contacting each of them.
- Withdraw your consent to collection and sharing, at any time.
- Have it deleted, from my records and from those of my service providers, including archived and backup systems.
- Appeal if I refuse a request.
Exercising these rights costs nothing and I will not treat you differently for it. Withdrawing consent or deleting your screening data does mean I can no longer safely program for you, so in practice it ends an active engagement — I would rather say that plainly than surprise you with it.
One limit on deletion: where the law permits me to keep records in order to establish or defend a legal claim, I may retain that narrow set, and I will tell you what I kept and why.
How to make a request
Email privacy@peakloadinstitute.com with what you want. You do not need any particular form of words. I may need to confirm you are who you say you are before I act, which for existing clients usually means nothing more than replying from the address I already have for you.
I will respond within 45 days. If a request is genuinely complex I may extend once by a further 45 days, and I will tell you why within the first 45.
If I say no
I will tell you why, and how to appeal. Appeals go to the same address, are reviewed by me, and are answered within 45 days. If I deny your appeal, I will give you a way to complain to the Washington State Attorney General, and you can do so at atg.wa.gov/file-complaint.
Security
How it is held
Access is limited to me. Records are kept in access-controlled accounts protected by strong, unique credentials and multi-factor authentication, and health records are kept separate from general business records. No system is perfect, and I will not claim otherwise, but the practice is deliberately small and the number of people who can reach your data is one.
Changes & contact
Updates, and how to reach me
If this policy changes, the updated version will be posted here with a new "last updated" date. If a change would materially affect how your data is used, I will contact clients directly rather than relying on you to re-read this page, and where the law requires fresh consent I will ask for it before the change applies to data already collected.
Questions, requests and appeals: privacy@peakloadinstitute.com
Peak Load Institute LLC · Bellevue, Washington