The Company recognizes the confidential nature of the Personal Information in its care and is accountable for the compliance of itself and its directors, officers, management, employees, representatives and agents including consultants and independent contractors (the Staff) in protecting this Personal Information.
Personal Information includes but is not limited to name, home address, home phone number, email address, identity verification information, Social Security Number, credit card or other disclosed financial information, physical description, age, gender, salary, education, personal hobbies and activities, medical history, injuries, propensities of character that impact administration of fitness techniques and emergency contact information.
The Company and the Staff will at all times respect the confidentiality of the Personal Information placed in its care. The Company will endeavor to ensure that the policies affecting the collection, storage and disclosure of Personal Information reflect the confidential nature of the information.
The Company will comply with all applicable privacy legislation and regulations in force now and in the future related to protecting the confidentiality of Personal Information.
Purposes for which Personal Information is Collected
Personal Information will be collected, used and disclosed for purposes discussing solutions for personal fitness goals. It may be used for proposing services, events, activities, and challenges.
The purposes for collecting Personal Information will be documented by the Company. Personal Information will only be used for the stated purpose or purposes for which it was originally collected. The purposes for which Personal Information is being collected will be identified orally or in writing to the Individual before it is collected. The person collecting the information will be able to explain the purpose at the time that the information is collected.
The Company may use Personal Information for a purpose other than the originally stated purpose where the new purpose is required by law or where the Company has obtained consent in writing from the affected Individual for each new purpose.
Knowledge and Consent
Consent will not be obtained through deception or misrepresentation.
Any use or disclosure of Personal Information will be within the reasonable expectations of the Individual.
Subject to legal and contractual obligations, an Individual may withdraw their consent on reasonable notice.
Legislation and Regulation
Where the Company has Individuals living and working in different jurisdictions the specific rights and obligations of Individuals may vary between jurisdictions.
Scope and Application
Collection of Personal Information
The type and amount of Personal Information collected by the Company will be limited to the minimum necessary to accomplish reasonable business purposes. Personal Information will not be collected maliciously, indiscriminately or without a reasonable business purpose.
Personal Information will be collected using fair and lawful means.
Access by Authorized Company Representatives
All Personal Information will be released internally only on a need-to-know basis. In the course of normal and reasonable business practices it is the policy of the Company to grant designated Company representatives access to Personal Information files. This access will not exceed that necessary to accomplish the specific business function of the Company representative nor the purpose for which the information was originally collected.
Accuracy of Personal Information
The Company will endeavor to ensure that all Personal Information collected is accurate and validated using reasonable business practices and procedures. The Company is also committed to ensuring that the Personal Information remains accurate for the purpose for which it was collected.
Rights of Access and Correction
The Company will make reasonable efforts to ensure that Personal Information is at all times complete and accurate for its stated purpose.
The majority of information that the Company will use is kept on an online database called MindBody, which can easily be accessed and managed by an individual through their account. However, other information may be kept on a variety of other platforms which are entirely internal to the Company but will be produced upon the request of the individual to whom that Personal Information belongs.
The Company will also provide a specific summary of how the Personal Information has been used and to whom it has been disclosed. Where a detailed account of disclosure is not available, the Company will provide a list of organizations to which the Personal Information may have been disclosed.
The Personal Information disclosed to an Individual must be in a form that is reasonable and understandable. Where the meaning of information is not clear then translations and explanations will be provided without additional cost.
Where an Individual suspects that an error exists in their Personal Information, the Individual may submit a request in writing or email for correction. This request should include any relevant information substantiating the error and should describe the correction to be made. The Company will make all reasonable efforts to address any request for correction.
Where the Individual successfully demonstrates an error in their Personal Information the Company will make appropriate corrections. Any modifications, additions or deletions to the Individual's Personal Information will be made only by an authorized personnel officer.
Where a request for correction is not successful, the details and substantiating evidence of the request will be recorded and retained by the Company.
The Company will endeavor to respond promptly to any reasonable request for disclosure and correction made by an Individual to ensure the continued accuracy of Personal Information.
In some instances the Company may be required to limit access to Personal Information because of statutory or regulatory requirements. In all instances however the Company will make all reasonable efforts to comply with the Individual's request for access and correction to the extent of what is allowed by statute or regulation.
The Company may refuse access to portions of the Personal Information of an Individual where it is found to contain Personal Information pertaining to another Individual.
Use and Disclosure of Personal Information
The Company and the Staff will keep confidential all Personal Information in its control except where one or more of the following conditions apply:
where the Individual who is the subject of disclosure has provided written consent;
where the disclosure is in accord with the purposes for which the Personal Information was originally collected;
where the Company is permitted or required to do so by applicable legislation or regulation;
where the disclosure is directed to health benefit providers and where the purpose of the disclosure is in accord with the purposes for which the Personal Information was originally collected;
where the disclosure is required by authorized government representatives who are acting to enforce any federal or state law or carrying out an investigation relating to the enforcement of any federal or state law or gathering information for the purpose of enforcing any federal or state law;
where the Company is required to comply with valid court orders, warrants or subpoenas or other valid legal processes and
in an emergency to protect the physical safety of any person or group of persons.
Where Medical Information is collected pertaining to an Individual, the Company will store and secure all Medical Information with a greater level of protection and in a separate location from Personal Information. Access to Medical Information will be restricted to Company personnel (the Medical Information Personnel) specifically selected for this task. The Company will take all reasonable care in selecting the Medical Information Personnel recognizing the extreme sensitivity and confidentiality of all Medical Information.
In all cases, any disclosure of Medical Information by the Company to any third party or agency will require the written consent of the affected Individual for each instance.
Ownership of Personal Information
Retention and Disposal of Personal Information
Any Personal Information collected by the Company will be retained by the Company during the period of active membership of the Individual as well as during the post-membership period only as long as the Personal Information is required to serve its original purpose or as directed by applicable legislation or regulation.
Personal Information that is no longer needed for its stated purpose will be destroyed, erased or made anonymous.
The Company will ensure that all practices and procedures relating to the disposal of Personal Information will respect the fundamental policy of confidentiality. All Personal Information disposal procedures, including the disposal of computerized data storage devices, will ensure the complete destruction of Personal Information so that there will be no risk of subsequent unauthorized disclosure of Personal Information.
The rights and protections of the Company's Privacy Policies will extend to deceased Individuals.
The Company will take and enforce all reasonable security measures appropriate for the sensitivity of the information to ensure that all Personal Information for every Individual is protected against any form of unauthorized use including but not limited to accidental or malicious disclosure, unauthorized access, unauthorized modification, unauthorized duplication or theft.
Methods of security will include but not be limited to the following:
physical security including locked filing cabinets and secure-access offices;
organizational security including security clearances and access limited on a need-to-know basis and
technological security including passwords and encryption.
Knowledge of Unauthorized Disclosure
Responsibility for the security of Personal Information is a responsibility that the Company holds in very serious regard. Any Staff having knowledge of an impending unauthorized disclosure, whether intentional or unintentional, and who fail to act to prevent the unauthorized breach will be subject to sanction as described in the Enforcement section of this document including the immediate dismissal of the offending Staff.
Mediation and Arbitration
If the dispute is not resolved within a reasonable period then any or all outstanding issues may be submitted to mediation in accordance with any statutory rules of mediation. If mediation is not successful in resolving the entire dispute or is unavailable, any outstanding issues will be submitted to final and binding arbitration in accordance with the laws of the State of Indiana. The arbitrator's award will be final, and judgment may be entered upon it by any court having jurisdiction within the State of Indiana.