Privacy Policy

This Privacy Policy explains how Epitome PD (“we”, “us”, “our”) collects, uses, discloses, and protects your personal information when you use our website and services. We handle personal information in accordance with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial law. This policy works together with our Terms and Conditions, which include the consent you provide.

1. Who we are and who is accountable

Epitome PD is responsible for the personal information in our care. If you have questions, want to access or correct your information, or want to withdraw consent or request deletion, contact our privacy contact at epitomepd@gmail.com or by mail at:

5614 Burbank Rd SE
Calgary, AB T2H 1Z4
Canada

2. Who the Services are for — adults and minor athletes (14–17)

Accounts may be created by anyone 14 years of age and older. Adults 18 and older have full access. Athletes aged 14–17 may use the Services in one of two ways: through an account owned and managed by their parent or legal guardian, or through their own account, in which case their assessment answers are processed only after their parent or legal guardian consents by email (see below). Genetic testing for athletes aged 14–17 is available only through a guardian-managed account. We never knowingly collect personal information from a child under 14; if we learn that we have, we will delete it. The Services are currently not offered to residents of Quebec.

For an athlete aged 14–17 on a guardian-managed account:

• The guardian gives each consent on the athlete’s behalf at purchase, and attests to their parental authority or guardianship.
• Before starting the assessment, the athlete confirms a plain-language assent notice explaining what is asked, what happens with their answers, and that the guardian sees their results. We record this assent.
• The guardian sees all of the athlete’s data in the account: scores, reports, genetic results, and wellbeing indicators. If the athlete’s answers suggest a risk of self-harm, we notify the guardian directly, and we show youth crisis resources (including Kids Help Phone) on every report.
• Where we believe in good faith that a minor is at risk of serious harm, we may notify the guardian and, where the law requires it, the appropriate child-welfare authorities.
• The guardian may access, correct, and delete the athlete’s data at any time (see Section 10). When the athlete reaches the age of majority, they may request deletion or transfer of their data to their own account.

For an athlete aged 14–17 using their own account with emailed parental consent:

• Before submitting the assessment, the athlete provides their parent or legal guardian’s email address and confirms a plain-language assent notice (which we record) explaining what is asked, that nothing is scored without parental consent, and that the parent or guardian will be contacted.
• The athlete’s answers are stored securely but are not scored, analyzed, or turned into any report until the named parent or guardian grants consent through a secure emailed link, on a page where they attest to their parental authority. We record the consent evidence: the time of the grant, the terms version, and technical details (IP address and browser information).
• If consent is not granted after about 7 days we send one reminder (with a fresh link that replaces earlier ones). If consent is not granted within 14 days, the athlete’s answers are permanently deleted and are never scored. Each new attempt requires a fresh consent.
• If the athlete’s answers suggest a risk of self-harm, we send a wellbeing notice to the named parent or guardian immediately at submission, regardless of whether consent has been granted. This is disclosed to the athlete in their assent notice, and youth crisis resources are shown in the questionnaire and on every report.
• Once consent is granted, results are released to the athlete’s own account. The athlete may exercise the rights in Section 10 themselves.

3. What we collect

• Account information — your name, email address, phone number (if provided), and date of birth (used to confirm eligibility and to calibrate your report to your age). For each athlete aged 14–17 added to a guardian account: the athlete’s name, date of birth, and relationship to the account holder.
• Parental-consent information — for an athlete aged 14–17 using their own account: the parent or guardian email address the athlete provides, and, when consent is granted, the evidence of the grant (time, terms version, IP address, and browser information).
• Assessment responses and scores (health information) — the answers to the questionnaire and the derived scores for hockey attitude, anxiety, depression, general psychological performance, and overall mindset. Some questions ask about mental health and personal history; these responses are sensitive and we treat them accordingly. The most sensitive questions include an “I prefer not to answer” option, and declining them never blocks the assessment.
• Genetic information — if you purchase a genetic kit, the cheek-swab sample you return, the genotype results produced by our laboratory partner, and the report derived from them. Genetic information is sensitive and receives our highest level of protection.
• Purchase and shipping information — products purchased, and, for physical kits, the shipping name, address, and phone number. Payment card details are entered on our payment processor’s hosted page and are never seen or stored by us.
• Website usage (only if you accept analytics) — the pages you visit on our website, when you visit them, how you interact with those pages (how far you scroll, links you click that lead to other websites, files you download, and whether you start or submit a form, but never what you type into it), the site or search engine that referred you, your approximate region, and the type of browser and device you use, collected through Google Analytics as described in Section 8. This is not linked to your account or to any assessment or genetic information.

4. Why we collect it

• To create and manage your account and confirm eligibility (accounts 14+; a minor athlete’s assessment results are processed only with parental consent, via either path in Section 2).
• To contact the parent or guardian named by a self-account athlete aged 14–17 — to request their consent (with one reminder) and, where the athlete’s answers indicate a possible risk of self-harm, to send the wellbeing notice described in Section 2.
• To score the assessment and generate the personalized reports.
• To process the return of the genetic sample and produce the genetic report.
• To process payment and ship physical kits.
• To send you service-related email about your orders and reports.
• To notify the guardian of a minor athlete when the athlete’s answers indicate a possible risk of self-harm (a duty-of-care safeguard that is disclosed to the athlete before they begin).
• Only if you opt in — to maintain and improve our scoring models using responses in de-identified or aggregated form. This use is optional, declining it never affects the Services, and we never use identifiable genetic data for it.

5. Service providers and disclosure

We do not sell your personal information, and we do not disclose your individual results to insurers, employers, athletic organizations, or other third parties without your specific further consent, except where required by law. We do rely on trusted service providers to operate the Services, and share only what each needs for its function:

• Supabase — database, authentication, and file storage.
• Stripe — payment processing (card data is handled entirely by Stripe).
• SendGrid (Twilio) — sending service email.
• Google Firebase / Google Cloud — website and application hosting.
• Google Analytics — website usage measurement, only if you accept analytics on our banner (see Section 8). It receives pages viewed, visit times, page interactions such as scrolling, outbound link clicks, file downloads and form starts or submissions (never what you typed), and browser and device type; never your name, email, assessment, or genetic information.
• Google (Gemini API) — we use Google’s generative-AI service to turn your scores (and, for genetic reports, your genotype results) into the written narrative in your report. We do not send your name, email, or other direct identifiers to this service.
• Personalized Prescribing Inc. — our laboratory partner, which sequences and analyzes the genetic sample you return.

6. Processing outside Canada

Some of our service providers (including Google) process data on servers located in the United States. When personal information is processed in another country, it may be accessible to courts, law enforcement, and authorities in that country under its laws. By using the Services you acknowledge this cross-border processing; for a minor athlete, the guardian’s consent at purchase covers it.

7. How we protect your information

We use row-level security on our database, encryption of data in transit and at rest, private storage with short-lived access links for your reports and genetic files, and a hosted payment page so card data never reaches our servers. No method of storage or transmission is perfectly secure, but we work to protect your information with safeguards appropriate to its sensitivity.

8. Analytics and cookies

We do not use advertising cookies, advertising pixels, or cross-site tracking, and we never sell or share personal information for advertising.

With your consent, we use Google Analytics 4 to understand which pages of our website are visited and how visitors move through it, so we can improve the site. Google Analytics runs only after you press “Accept” on the analytics banner; if you decline, or do nothing, it does not load. When it runs, it sets first-party cookies in your browser and sends Google usage data such as the pages you view, the time of your visit, how far you scroll, links you click that lead to other websites, files you download, whether you start or submit a form on the site (never what you typed into it), the site or search engine that referred you, your approximate region (derived from your IP address, which Google Analytics does not log or store), and your browser and device type. We have turned off Google’s advertising features (Google Signals and ad personalization), the data is not linked to your account, it never includes your reports or the links to them, and Google retains it for 14 months. Google processes this data on our behalf as a service provider under its privacy policy, which may involve processing in the United States (see Section 6). Measurement covers only our public pages (such as the homepage, product, team, blog, legal and sign-in pages). It is switched off inside your account area (dashboard, questionnaire, results and checkout), on pages you open from links in our emails, and for signed-in administrators.

You can change your choice at any time with the “Cookie preferences” link in the site footer, by clearing cookies in your browser, or with Google’s opt-out browser add-on. Beyond analytics, we use only the cookies and browser storage needed to sign you in, to remember choices you make on the site (such as which version of the homepage you picked and your analytics choice), and to operate the Services.

9. How long we keep it

We keep your account information for as long as your account is active and as needed to provide the Services. Questionnaire responses (including individual answers) are kept for up to 3 years to deliver the Services (reports, retakes, and trends); retention for research and scoring-model improvement applies only where you opted in to that use. After the retention period, responses are deleted or de-identified. One exception is shorter: where a self-account athlete aged 14–17 submits the assessment and their parent or guardian does not consent within 14 days, the answers are permanently deleted at that point — they are never scored and never enter the 3-year retention. We keep only a minimal record that a consent request existed (with the parent’s email address removed and only a non-reversible technical fingerprint of the request retained). You may request deletion of your account and data at any time (see Section 10), and a guardian may delete a minor athlete’s data at any time from the dashboard; after a deletion request we remove the personal information, though de-identified or aggregated data already derived from it under an opt-in may be retained.

10. Your rights

You may ask us to access the personal information we hold about you, correct it, withdraw your consent, or delete your account and data. Guardians may exercise these rights on behalf of an athlete aged 14–17 enrolled under their account, and may delete the athlete’s data directly from the dashboard. An athlete aged 14–17 using their own account may exercise these rights themselves, and the parent or guardian they named may also contact us on their behalf. An athlete who reaches the age of majority may exercise these rights themselves, including requesting deletion or transfer of data collected while they were a minor. To make a request, email epitomepd@gmail.com. We will respond within a reasonable time. Withdrawing consent for essential processing may mean we can no longer provide parts of the Services.

11. Changes to this policy

We may update this policy from time to time. The effective date above shows when it was last revised. Material changes will be reflected here.

12. Contact

Questions or concerns about your privacy? Email epitomepd@gmail.com. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada.