CLUBS HQ PRIVACY POLICY

Version 2.4.0 | Effective August 24, 2026

This Privacy Policy explains how Clubs HQ LLC ("Clubs HQ," "we," "us") collects, uses, shares, and protects personal information when you use our website, applications, and services (the "Platform").

Health and fitness data. Data from wearables, workouts, heart rate, and GPS routes is subject to a separate Consumer Health Data Privacy Policy and requires your separate consent under the Health, Fitness and Location Data Consent. This Privacy Policy covers everything else and provides general context.

---

1. Quick Summary

---

2. Information We Collect

2.1 Information You Provide

• Account and profile: name, email, password, date of birth, username, avatar, bio, role (athlete, coach, organizer, venue), club affiliations.
• Contact and emergency information: phone number, emergency contact name and phone (collected for in-person activity safety).
• Payment information: billing name, address, and transaction history. We do not store full payment card numbers; card data is collected and processed directly by our payment processor.
• Identity and tax information (coaches, organizers, venues receiving payouts): legal name, business name, tax identification number, bank account details — collected and held primarily by our payment processor. See the Marketplace and Payment Terms.
• Content you create: posts, messages, club and event descriptions, uploaded images and logos, coaching plans.
• Communications: support tickets, feedback, survey responses.

2.2 Health, Fitness, and Location Information

Described in detail in the Consumer Health Data Privacy Policy. Summarized: workouts, distance, pace, duration, heart rate, cadence, elevation, and GPS routes — recorded in the Clubs HQ app, entered manually, or synced from a device platform you connect (currently Garmin Connect and COROS). Collected only with your separate opt-in consent.

2.3 Information Collected Automatically

• Device and technical: IP address, device identifiers, browser and OS, language, time zone, crash logs.
• Usage: pages viewed, features used, links clicked, session timing, referring URLs.
• Approximate location derived from IP address (city/region level) for security, fraud prevention, and localized content. This is distinct from precise location, which requires consent.
• Cookies and similar technologies: see Section 7.

2.4 Information From Third Parties

• Device platforms you connect — currently Garmin Connect and COROS — where you authorize the connection through that platform's own login and permission flow.
• Payment processor, for transaction status, payout status, and dispute information.
• Clubs and organizers, who may add you to a roster or record your attendance.
• Public sources, for business/venue verification.

2.5 What We Do Not Collect

We do not knowingly collect: information from anyone under 13; government-issued identification from athletes; genetic data; biometric identifiers used to identify you (such as facial geometry or fingerprints); or precise location when you have not enabled it.

---

3. How We Use Information

3.1 What We Never Do

• We do not sell personal information.
• We do not share personal information for cross-context behavioral advertising.
• We do not use health, fitness, or location data for advertising, marketing, or use-based data mining, and we do not disclose it to data brokers. This restriction is required by our integration agreements with wearable platforms and by law, and we apply it universally.

3.2 Automated Decision-Making and AI

We use automated processing to generate training suggestions, surface relevant clubs and events, and detect abuse. The AI Coach feature processes your prompts and, where you permit, your fitness data to generate responses — see the AI Coach Terms and Health Disclaimer. We do not use your personal information to train third-party foundation models, and we do not make decisions producing legal or similarly significant effects about you through solely automated means. You may request human review of any automated enforcement decision at info@clubshq.us (subject: Appeal).

---

4. How We Share Information

We share personal information only as described here.

4.1 Service providers. Vendors performing services for us under contract restricting their use of the data to those services: cloud hosting and database infrastructure, payment processing, email delivery, customer support tooling, analytics, and security services. Each is contractually bound as a service provider/processor and may not sell your data or use it for their own purposes.

4.2 Clubs, organizers, and coaches. When you join a club, register for an event, or engage a coach, we share the information necessary for them to administer your participation: your name, profile, email, club membership status, event registration, waiver status, and emergency contact. Health and location data is shared with a coach only with your separate consent, and you can revoke it. Clubs and coaches are independent parties responsible for their own handling of your information.

4.3 Other users. Your profile, posts, and club participation are visible according to your privacy settings. Leaderboard and route information is visible only if you opt in.

4.4 Venues. We share only aggregate or de-identified information with venues unless you affirmatively redeem a perk, in which case we share what is needed to honor it.

4.5 Payment processor. Transaction and, for payees, identity and tax information, in order to process payments and meet financial-regulatory obligations.

4.6 Legal and safety. When required by law, subpoena, court order, or governmental request; to enforce our agreements; or where we believe in good faith that disclosure is necessary to prevent imminent physical harm, investigate fraud, or protect the rights, property, or safety of Clubs HQ, our users, or the public.

4.7 Business transfers. In connection with a merger, acquisition, financing, reorganization, or sale of assets. We will give notice before your information becomes subject to a materially different privacy policy.

4.8 With your direction. Anywhere else you explicitly ask us to send it.

---

5. Data Retention

Longer retention applies where required by law or where reasonably necessary to resolve a dispute or enforce our agreements.

How account deletion works. When you delete your account, we remove or irreversibly anonymize the information that identifies you — name, email, phone, avatar, date of birth, and addresses — within 90 days. We retain, in anonymized or legally required form, the records we are obligated to keep: signed waivers and consent records (which by their nature must remain attributable, and which retain a snapshot of the name and email you used at the time you signed), payment and tax records, and records needed to resolve an open dispute. We do not retain your account for any other purpose, and an anonymized record cannot be used to re-identify or contact you.

---

6. Data Security

We use administrative, technical, and physical safeguards including encryption in transit and at rest, access controls and least-privilege permissions, logging and monitoring, vendor security review, and a written information security program. No system is completely secure, and we cannot guarantee absolute security. If a breach affecting your personal information occurs, we will notify you and regulators as required by applicable law, including — because we handle consumer health data — the FTC Health Breach Notification Rule (16 C.F.R. Part 318) where it applies.

---

7. Cookies and Tracking Technologies

7.1 What we use.

• Strictly necessary: authentication, session management, security, load balancing. Always on.
• Functional: remembering preferences and settings.
• Analytics: understanding feature usage and diagnosing errors.
• We do not use advertising or cross-site tracking cookies.

7.2 Your controls. A cookie preference center is available in the Platform footer and in account settings. You can also control cookies through your browser. Disabling strictly necessary cookies will break core functionality.

7.3 Global Privacy Control. We honor the Global Privacy Control (GPC) and similar opt-out preference signals as a valid request to opt out of sale/sharing where applicable law requires.

7.4 Do Not Track. Browsers' DNT signals are not standardized; we respond to GPC instead.

---

8. Location and Public Visibility

Because we are a running platform, location deserves specific treatment.

• Precise location is off by default. It is collected only after you enable it and provide the separate Health, Fitness and Location Data Consent.
• Privacy zones are on by default when you enable location. A privacy zone hides your route within a radius you set around addresses you designate (home, work, school). We recommend a minimum radius of 1/8 mile (approximately 200 metres).
• Public leaderboards and route maps are opt-in. Nothing is published publicly unless you choose it.
• Withdrawal: you may turn off location collection and delete stored location history at any time in account settings.
• We do not operate geofences around healthcare facilities, and we do not use location to infer or target health conditions.

---

9. Your Privacy Rights

9.1 Rights available to everyone

Regardless of where you live, you may: access a copy of your information; correct inaccurate information; delete your account and information; opt out of marketing communications; withdraw any consent you have given; and object to or restrict certain processing.

Fitness and health data portability. We do not provide a data export. ClubsHQ is not the source of your workout, heart-rate, or GPS data — it is collected by your watch or fitness account (Garmin, COROS, and the like) and mirrored here. Export it from that provider, who holds the original record.

Exercise these through Account Settings → Privacy and Data, or by emailing info@clubshq.us (subject: Privacy Request). We respond within 45 days, extendable once by 45 days with notice.

9.2 United States — state privacy rights

If you are a resident of California, Colorado, Connecticut, Virginia, Texas, Oregon, Montana, Delaware, Maryland, Minnesota, New Jersey, Nebraska, New Hampshire, Rhode Island, Indiana, Kentucky, Iowa, Tennessee, Utah, or another state with a comprehensive privacy law, you have rights to know, access, correct, delete, and opt out of targeted advertising, sale, and certain profiling.

• We do not sell or share personal information, so there is nothing to opt out of on that front, but a "Do Not Sell or Share My Personal Information" link is maintained in our footer for transparency.
• Sensitive personal information. We treat health data and precise geolocation as sensitive and collect it only with your opt-in consent. We use it only to provide the features you requested. A "Limit the Use of My Sensitive Personal Information" control is available in account settings.
• Appeals. If we deny a request, you may appeal to info@clubshq.us (subject: Privacy Appeal). We will respond within 45 days with a written explanation. If we deny your appeal, you may contact your state Attorney General.
• Non-discrimination. We will not deny service, charge different prices, or provide a different quality of service because you exercised a privacy right.
• Authorized agents. You may use an authorized agent to submit requests; we will require proof of authorization and may require you to verify your identity directly.
• California "Shine the Light." We do not disclose personal information to third parties for their own direct marketing.

9.3 Verification

To protect your information, we verify requests using your account credentials and, for sensitive requests, additional confirmation. We may decline a request we cannot verify.

9.4 EEA/UK residents

Where the GDPR or UK GDPR applies, you additionally have the right to lodge a complaint with your supervisory authority, and the right not to be subject to solely automated decisions with legal or similarly significant effects. Our legal bases are identified in Section 3.

---

10. Children and Young Members

The Platform is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. Registration requires a date of birth, and users who indicate they are under 13 are blocked from creating an account.

If we learn we have collected personal information from a child under 13, we will delete it promptly and terminate the account. Parents who believe we may hold information about a child under 13 should contact info@clubshq.us (subject: Child Under 13) immediately.

For members 13 to 17, parental or guardian consent is not required to hold an account, and the account is not restricted by age — the same features, settings and privacy controls apply as for any other member. The commitments in Section 3.1 apply to everyone regardless of age. A parent or guardian may request access to, correction of, or deletion of their child's information at any time. See Age and Young Members.

---

11. International Data Transfers

We are based in the United States and process information there. If you access the Platform from outside the United States, you understand your information will be transferred to and processed in the United States, which may have different data-protection laws than your country. Where required, we use appropriate transfer mechanisms such as the European Commission's Standard Contractual Clauses.

---

12. Third-Party Links and Services

The Platform links to and integrates with third-party services. Their privacy practices are their own. Review their policies before connecting an account or following a link.

---

13. Changes to This Policy

We may update this Policy. For material changes, we will provide at least 30 days' notice by email and in-Platform notice before the change takes effect, and where the change involves a new use of sensitive data, we will obtain fresh consent rather than relying on notice. The version and effective date above identify the operative version. Prior versions are available at clubshq.us/legal/archive.

---

14. Contact Us

Privacy inquiries: info@clubshq.us (subject: Privacy Request) Privacy appeals: info@clubshq.us (subject: Privacy Appeal) Postal: Clubs HQ LLC, 10820 Alico Pass, New Port Richey, Florida 34655 Data Protection contact: info@clubshq.us