Privacy Policy

1. Introduction & Data Controller

MotionLab operates the guided stretching and mobility platform available at motion-lab.io and associated mobile applications (collectively, the "Service"). For the purposes of data protection law, MotionLab acts as the data controller in respect of personal data collected through the Service. This means we determine the purposes and means by which your personal data is processed.

If you have any questions about how we handle your data, or wish to exercise any of your rights described in this policy, please contact our privacy team at legal@motion-lab.io.

2. Data We Collect

We collect the following categories of personal data:

Account Data

• Email address (required for account creation and login)
• Display name (chosen during registration)
• Password (stored as a hashed credential — we never store plain text passwords)
• Account creation date and last active timestamp

Usage Data

• Sessions completed, including date, duration, and type
• Exercises performed within each session and any skipped exercises
• Mobility assessment scores per joint and overall score, with timestamps
• Favourite exercises and personal notes where applicable

Device & Technical Data

• Browser type and version
• IP address (used for security, fraud detection, and approximate geolocation at country level only)
• Device type and operating system
• Session duration and page interaction data
• Error logs and crash reports

Voluntary Onboarding Data

• Primary sport or activity (e.g. running, weightlifting)
• Training goals (e.g. improve flexibility, reduce stiffness)
• Available equipment (e.g. foam roller, resistance band)
• Session frequency preference and available time per session

Providing onboarding data is optional but enables better personalisation. You can update or delete this data at any time through your account settings.

3. How We Use Your Data

We use your personal data for the following purposes:

• Providing the Service: to create and manage your account, authenticate you, deliver sessions, and enable all core platform features.
• Personalising your routines: to generate stretching sessions tailored to your mobility scores, goals, available time, and equipment.
• Improving the platform: to analyse aggregate usage patterns, identify areas for improvement, and develop new features.
• Communicating with you: to send account-related notifications, respond to support requests, and — where you have opted in — send product updates and tips.
• Complying with legal obligations: to fulfil our obligations under applicable law and respond to lawful requests from authorities.
• Detecting and preventing fraud: to monitor for suspicious activity, abuse of the Service, and security incidents.

4. Legal Basis for Processing

Under GDPR, we must have a lawful basis for processing your personal data. We rely on the following:

• Contract performance: processing necessary to create and maintain your account and deliver the Service you have signed up to receive.
• Legitimate interests: improving our platform, ensuring security, preventing fraud, and conducting analytics — where these interests are not overridden by your rights.
• Consent: where you have explicitly opted in, such as receiving marketing communications or enabling optional analytics cookies. You may withdraw consent at any time.
• Legal obligation: where we are required by law to process or retain certain data.

5. Data Storage & Security

Your data is stored using Supabase infrastructure (PostgreSQL on AWS), which provides industry-standard security controls. We implement the following measures to protect your data:

• Encryption at rest: all stored data is encrypted using AES-256 or equivalent standards.
• Encryption in transit: all data transmitted between your device and our servers is protected using TLS 1.2 or higher.
• Access controls: database access is restricted to authorised personnel and services only, governed by the principle of least privilege.
• Authentication security: we use Supabase Auth, which handles credential management securely and supports multi-factor authentication.

While we take appropriate technical and organisational measures to protect your data, no system is completely impenetrable. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority in accordance with our legal obligations.

6. Data Retention

We retain your personal data for as long as your account is active or as necessary to provide the Service. Specifically:

• Account and usage data is retained while your account remains active.
• Upon receipt of a valid account deletion request, we will delete or anonymise your personal data within 30 days, except where retention is required by law.
• Anonymised, aggregated analytics data (which cannot be used to identify you) may be retained indefinitely to support product improvement.
• Backup copies of data may persist for up to 90 days following deletion in encrypted backup systems before being permanently purged.

7. Third-Party Services

We use the following third-party services to operate the platform:

• Supabase Auth (Supabase Inc.): handles secure user login and account management.
• Supabase Database (Supabase Inc.): our primary database (PostgreSQL) for storing user accounts, session data, and preferences. Hosted on AWS infrastructure.

Supabase's privacy practices are described at supabase.com/privacy. We do not sell your data to any third party, and we only share data with service providers to the extent necessary for them to deliver the services described above, under contractual obligations to protect your data.

8. Your Rights

Under PIPEDA, applicable Canadian privacy law, and the EU GDPR where applicable, you have the following rights regarding your personal data:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: request correction of inaccurate or incomplete data.
• Right to erasure: request deletion of your personal data ("right to be forgotten"), subject to legal retention requirements.
• Right to data portability: request your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interests, including profiling.
• Right to withdraw consent: where processing is based on consent, withdraw it at any time without affecting prior processing.
• Right to restrict processing: request that we limit how we use your data in certain circumstances.

To exercise any of these rights, contact us at legal@motion-lab.io. We will respond within 30 days. You also have the right to lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca, or your relevant EU supervisory authority if you are based in the European Union.

9. Cookies

We use cookies and similar tracking technologies on the MotionLab platform. For full details on the types of cookies we use, how to manage them, and your opt-out options, please read our Cookie Policy.

10. Children's Privacy

The Service is not directed to children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe a child under 16 has provided us with personal data without parental consent, please contact us at legal@motion-lab.io and we will take prompt steps to delete that information.

11. International Transfers

Our infrastructure relies on Supabase (hosted on AWS), which may process and store your data on servers located in the United States or other jurisdictions outside Canada. Supabase relies on standard contractual clauses (SCCs) and other appropriate safeguards to ensure compliant international data transfers for users in the EU. Canadian users benefit from PIPEDA protections governing the cross-border transfer of personal information to service providers.

For further information on Supabase's data transfer practices, please refer to Supabase's privacy documentation at supabase.com/privacy.

12. Changes to this Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email or in-app notification at least 14 days before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the Service after changes become effective constitutes acceptance of the updated policy. If you disagree with the changes, you may close your account before they take effect.

13. Contact

For any privacy-related questions, data subject requests, or concerns, please contact:

Email: legal@motion-lab.io

We aim to acknowledge all privacy requests within 5 business days and resolve them within 30 days.