Effective Date: May 8, 2026
Last Reviewed: May 8, 2026
Introduction
Welcome to Grant MMA & Boxing Gym (“Grant MMA,” “we,” “us,” or “our”). We respect your privacy and are committed to protecting the personal information you entrust to us. This Privacy Policy explains how we collect, use, disclose, retain, and protect your personal information, including health and fitness data, when you visit https://grantmma.ca, use any member portal or mobile application we provide, or interact with our gym, classes, coaches, or staff.
This Privacy Policy is governed by Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, by provincial private-sector privacy laws including Quebec’s Act respecting the protection of personal information in the private sector (Law 25). Marketing communications are governed by Canada’s Anti-Spam Legislation (CASL).
Grant MMA is the data controller for your personal information. Where we use third-party platforms to process information on our behalf, those providers generally act as data processors under our instructions, except where they also process information for their own purposes (in which case they may act as independent controllers, see Section 4).
1. Information We Collect
1.1 Personal Information
When you register for a membership, sign up for a class, register a child, or contact us, we may collect:
- Name
- Email address and phone number
- Mailing address
- Date of birth and gender
- Profile photo (if you choose to upload one)
- Emergency contact information
- Payment and billing information (payment card details are entered directly with our payment processor and are not stored on Grant MMA’s own systems)
1.2 Health and Fitness Data
To safely deliver boxing, MMA, Muay Thai, and fitness training, we may collect health and fitness information including:
- Health questionnaire responses, including Physical Activity Readiness Questionnaire (PAR-Q) answers, injury history, and existing health conditions relevant to safe participation
- Workout performance data such as exercise results, repetitions, weights, times, sparring records, and benchmark scores
- Class attendance and training history
- Body measurements (weight, body composition, physical measurements) if you choose to log them
- Heart rate data during workouts, if you connect a compatible device
- Nutrition information if you use any optional dietary tracking features
This is sensitive personal information and is treated with elevated safeguards. We do not use it for advertising or marketing of any kind, and we do not sell it.
1.3 Usage and Device Data
When you use our website or any member portal or app, we automatically collect:
- IP address and device identifiers
- Browser type, operating system, and device information
- Pages viewed and features used
- Date, time, and duration of access
- Referring website
1.4 Cookies and Similar Technologies
Our website uses cookies and similar tracking technologies to remember your preferences, analyze traffic, and improve our services. Where required by law, we will request your consent through a cookie banner before placing non-essential cookies (analytics, marketing). You can manage your preferences through that banner or your browser settings. Disabling some cookies may affect website functionality.
1.5 Video Surveillance
For member and staff safety, we operate video surveillance cameras on the premises. Notices are posted at the gym. Footage is retained for 30 days (longer if needed for an active incident investigation) and is accessed only for safety, security, or incident-investigation purposes.
2. How We Collect Your Information and the Basis for Processing
We collect personal information directly from you (sign-up forms, in-gym registration, waivers, member portal/app inputs) and automatically (cookies, device data when you use our site or app).
Under PIPEDA, we rely on the following bases for collecting and using your information:
- Express consent for sensitive information such as health and fitness data, and for promotional emails or text messages (as required by CASL).
- Implied consent for routine, expected uses such as managing your membership and contacting you about your account.
- Performance of a contract to deliver the services you have signed up for.
- Legal obligations, including tax and accounting record-keeping.
- Legitimate interests that are not overridden by your privacy rights, such as maintaining gym safety and improving our services.
You may withdraw consent at any time, subject to legal or contractual restrictions, by contacting our Privacy Officer (Section 11). Withdrawing consent for certain processing, for example, completion of a PAR-Q before sparring, may mean we cannot safely deliver some services to you.
3. How We Use Your Information
We use the information we collect to:
- Operate the gym and your membership: process registrations, schedule classes, run check-in, and process payments.
- Track fitness progress: log workouts, display optional leaderboards, and help you monitor your goals.
- Communicate with you: send class reminders, schedule changes, account confirmations, invoices, and other transactional messages, and, only with your express CASL consent, promotional emails or texts about events, programs, and offers.
- Ensure safety: review PAR-Q and health information so coaches can provide modifications and so we can reach an emergency contact in case of injury.
- Improve our services: analyze website and app usage, generally in aggregate or de-identified form.
- Comply with the law and protect rights: meet legal, tax, and audit obligations and protect the safety of members and staff.
We do not currently make decisions affecting you using solely automated processing or profiling. If that ever changes, we will update this policy and seek your consent where required.
4. Sharing and Disclosure
We share your personal information only as described below.
- Gym management platform: Wodify Technologies, LLC processes memberships, scheduling, performance tracking, and member communications on our behalf. Wodify’s privacy policy is available at https://www.wodify.com/privacy-policy. Where Wodify processes your data on our instructions, they act as our processor; where they use data for their own product analytics or service improvement, they may act as an independent controller.
- Payment processor: Stripe, Inc. processes payments. Card data is entered directly with Stripe and is handled under PCI-DSS standards. Stripe’s privacy policy is available at https://stripe.com/privacy.
- Email and SMS communications: transactional messages (class reminders, schedule changes, billing notices) and, with your consent, promotional messages, are sent through Wodify’s built-in messaging features. They are governed by the same Wodify processor relationship described above.
- Analytics: we do not use third-party analytics providers (such as Google Analytics) on our website. Wodify provides aggregate usage information through its own member-platform reporting, which we use only for operational purposes.
- Fellow members: if you opt in to social features such as class leaderboards or community challenges, your name and selected workout results may be visible to other Grant MMA members. You can opt out at any time.
- Legal and safety: we may disclose information when required by law, court order, or to protect the rights, property, or safety of any person.
- Business transfers: in the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity, which will be required to honour this Privacy Policy or notify you of any material changes.
We do not sell your personal information or your health and fitness data, and we do not allow third parties to use that data for their own advertising or marketing purposes. Health and fitness data will not be used for advertising, marketing, or use-based data mining; we use it only to deliver and improve the services you have signed up for.
Cross-Border Transfers
Several of the providers above are based in the United States or other countries. When your information is transferred outside of Canada, it may become subject to the laws of the country where it is processed, including lawful access by foreign authorities. We require contractual protections from our providers and select them based on their security programs and privacy commitments. If you would like more detail about the providers we use and where they process data, contact our Privacy Officer.
5. Data Retention
We keep your personal information only as long as we need it for the purposes described in this policy or as required by law.
- Active membership data: retained for the duration of your membership and for 24 months afterwards, to support reactivation and to respond to disputes.
- Workout and performance data: retained for 24 months after your last activity, unless you request earlier deletion. De-identified, aggregated statistics may be retained indefinitely.
- Health questionnaires (PAR-Q) and injury records: retained for 5 years after your last visit, to support potential incident investigation and as required by our liability insurer.
- Financial and payment records: retained for a minimum of 6 years from the end of the last tax year they relate to, as required by the Income Tax Act and the Canada Revenue Agency.
- Marketing consent records: retained for at least 3 years after consent is withdrawn, as required by CASL.
- Video surveillance footage: retained for 30 days unless needed for incident investigation.
- Deletion requests: once we have validated and processed your request, we delete or anonymize your data within 30 days, except where retention is required by law. If anything cannot be deleted, we will tell you what and why.
6. Your Rights
Under PIPEDA, and where applicable under Quebec Law 25, you have the right to:
- Access the personal information we hold about you and obtain a copy.
- Correct inaccurate or incomplete information.
- Withdraw consent where consent is the basis for processing (subject to legal or contractual limits).
- Request deletion of your information, subject to legal retention requirements.
- Receive a copy of the personal information you provided to us in a structured, commonly used electronic format (data portability).
- Object to processing that is based on our legitimate interests.
- Be informed about any automated decision-making that significantly affects you.
How to exercise your rights
Contact our Privacy Officer (Section 11). We will verify your identity before responding to protect against fraudulent requests, and we will reply within 30 days, as required by PIPEDA. If we cannot meet that deadline, we will tell you why and give you a new timeline. Access and correction requests are normally free of charge.
Right to complain
If you are not satisfied with how we have handled your privacy concern, you may file a complaint with the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca, 1-800-282-1376) or, where applicable, with your provincial privacy regulator, for example, the Commission d’accès à l’information du Québec for Quebec residents.
7. Security and Breach Notification
We use a combination of technical and organizational safeguards to protect your information, including:
- TLS encryption for data transmitted between your device and our website and member portal
- Access controls and role-based permissions for staff
- Selection of third-party providers with documented security programs
- Staff training on confidentiality and privacy
- Restricted access to health and fitness data
No system is perfectly secure. If we discover a breach of security safeguards involving a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada, and keep records of the breach, as required by PIPEDA’s Breach of Security Safeguards Regulations.
8. Children and Youth
We offer programs for youth and minors. If you are registering a person under the age of 18, you confirm that you are their parent or legal guardian and consent to the collection and use of their personal information as described in this policy. Parents and guardians may exercise the rights in Section 6 on behalf of their child.
We do not knowingly collect personal information directly from children under 13 through our website or app without parental consent. If you believe a child has provided information without parental consent, please contact our Privacy Officer immediately so we can delete it.
9. Marketing Communications
We will only send promotional emails or text messages about events, programs, or offers if you have given us express CASL consent at sign-up or through a separate opt-in. Every marketing message identifies the sender, includes our contact information, and provides a clear unsubscribe mechanism. You can also unsubscribe at any time by replying to a message, using the in-message link, updating your preferences in your account, or contacting our Privacy Officer.
Transactional messages, class reminders, schedule changes, billing notices, and account updates, are part of the service and will continue regardless of your marketing preferences.
10. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. The “Effective Date” at the top will reflect the date of the most recent version, and we will keep prior versions available on request. For material changes affecting how we use information we already hold, we will give you advance notice and, where required by law, seek fresh consent before applying the change. Continued use after a non-material update indicates acknowledgement of the update.
11. Contact Us, Privacy Officer
For any questions, requests, or complaints about this Privacy Policy or how we handle your personal information, please contact our designated Privacy Officer:
Privacy Officer: Ryan Grant
Email: info@grantmma.ca
Phone: (416) 736-7770
Address: Grant MMA & Boxing Gym, Unit 6, 4884 Dufferin Street, North York, ON M3H 5S8
We will acknowledge your request within 5 business days and substantively respond within 30 days, in accordance with PIPEDA.
This Privacy Policy was last reviewed on May 8, 2026. We commit to reviewing it at least annually and any time there is a material change in how we collect, use, or share personal information.
