Privacy Policy

The rest of this page is the detail behind that. If you would rather just ask a person, email carleigh@calibratedbycarleigh.com and you will get a straight answer.

When you take the Calibrated Assessment™. Your first and last name, email address, age range, and your answers across every section — primary and secondary goals, training experience and history, strength and cardio frequency, daily movement, injuries or physical restrictions and where you feel pain, life-stage circumstances, nutrition habits including dietary restrictions and allergies, sleep, water intake, stress and habit patterns, what has been hard to sustain, what support you feel you need, and anything you type into the open-text boxes. We also store the scores calculated from those answers, including your Foundation Score, the five pillar scores, your Confidence and Capacity scores, and your top bottleneck.

When you buy something. Your name and email, what you bought, the amount, the currency, and identifiers that let us match the purchase to your Stripe record. For memberships we also store the status, the current period end date, and whether it is set to cancel. For training packs we store a running ledger of sessions bought and sessions delivered, with the date and any note attached to each one.

When you sign in. Your email address, and a one-time sign-in token that is stored only as an irreversible hash — the link we email you is not recoverable from our database. We also record the IP address of sign-in requests, purely to limit how often the same source can request links and stop the form being used to send unwanted email to other people.

When you join a waitlist or contact us. Your name, email, a phone number if you choose to give us one, which offer you were interested in or what your message is about, and whatever you write to us. As with sign-in, we record the IP address a contact-form message came from, purely to limit how many can be sent from one source.

If you link a second email address. Both addresses, so that a purchase made with one shows up when you sign in with the other.

Some of what the assessment asks is health information. That includes injuries, physical restrictions, where you experience pain, dietary restrictions and allergies, and life-stage circumstances such as pregnancy, postpartum, fertility, perimenopause and menopause. Under Virginia law this is sensitive data, and it gets treated accordingly.

• You choose what to share. The life-stage question includes a “None” option, and every open-text box can be left brief. By submitting the assessment you consent to us processing what you have chosen to enter, for the purposes described in this policy.
• It is used to coach you, not to categorise you. We use it to build your roadmap, to program safely around an injury or a life stage, and to know what to ask about when we talk. We do not use it for advertising, and we do not use it to make automated decisions that produce legal or similarly significant effects.
• It is never sold or shared with data brokers, insurers, employers, or advertising networks.
• You can have it deleted at any time — see Your rights and choices.

We are a coaching practice, not a healthcare provider, so we are not a “covered entity” under HIPAA and this information is not protected health information in that legal sense. We hold it to the standard set out in this policy regardless.

• To produce and send your Calibrated Roadmap™. The PDF is generated fresh from your answers each time it is requested and is not stored anywhere as a file.
• To coach you. Carleigh reads your assessment before recommending a next step, and refers back to it when programming your training.
• To deliver what you bought — giving you access, tracking training sessions bought and delivered, and keeping your account accurate.
• To take payment and keep records of it, including for tax and accounting obligations.
• To send you email — your roadmap, receipts, sign-in links, and the coaching follow-ups described below.
• To keep the site working and secure, including limiting sign-in attempts and preventing abuse of our forms.
• To understand the business in aggregate — how many people train each month, which bottlenecks come up most often, how many assessments lead to coaching. This is looked at as totals and patterns, to decide what to build and write next.

We use a small number of established companies to run this business. They process data on our instructions, for us, and are not permitted to use it for their own purposes. We share only what each one needs.

• Stripe — payments, subscriptions and the billing portal. Receives your name, email and purchase details, and handles your card details directly (see below).
• Resend — sends our email. Receives your name, email address, and the contents of the messages we send you, including your roadmap PDF as an attachment.
• Railway — hosts the website and the database where everything above is stored.
• Google — only if you choose “Continue with Google” to sign in. We receive your verified email address from Google; Google learns that you signed in to this site. If you never use that button, no data goes to Google.
• Calendly — only if you book a session through your account. Receives your name and email to prefill the booking.

Beyond those, we share personal information only when we are legally required to, when it is necessary to establish or defend a legal claim, or if the business is ever sold or transferred — in which case the buyer would be bound by this policy and you would be told before anything changed.

No advertising networks. No data brokers. No selling. We do not share your information for cross-context behavioural advertising, and we do not engage in “targeted advertising” or profiling as those terms are defined under Virginia law.

We never see or store your card number. Card details are entered on Stripe's own payment page and go straight to Stripe, which is certified to PCI DSS Level 1 — the highest level in the card industry's security standard. What comes back to us is a record that a payment succeeded, the amount, and identifiers we can use to look the payment up.

Stripe handles your payment information under its own privacy policy, which you can read at stripe.com/privacy.

This site sets two cookies, both strictly necessary, and no others. There is no cookie banner because there is nothing here to consent to beyond what is required to sign you in.

• cbc_session — keeps you signed in to your account for 30 days. It contains your email address and an expiry, signed so it cannot be altered, and it is marked HttpOnly so scripts in the browser cannot read it.
• cbc_oauth — set only during a “Continue with Google” sign-in, lasts a few minutes, and exists solely to verify that the sign-in that comes back is the one you started.

We use no analytics, no advertising or retargeting pixels, and no session-recording tools. Our fonts are served from our own domain rather than a third-party font service, so simply loading a page does not tell anyone else that you visited.

Because we do not track you across sites, there is nothing for a Global Privacy Control or “Do Not Track” signal to switch off — there is no targeted advertising or sale of data to opt out of in the first place.

Transactional email — your roadmap, purchase receipts, sign-in links and booking confirmations. These are part of the service and are sent whether or not you are subscribed to anything.

Coaching follow-ups and newsletters — a short sequence of follow-up emails after your assessment or program, and occasional coaching emails. Every one of these has an unsubscribe link, and unsubscribing takes effect immediately. It does not affect anything you have paid for.

• Assessments, purchases, memberships and training records — kept while you are a client and afterwards, so we can compare a re-test against your first assessment and answer questions about past sessions. Purchase records are kept at least seven years to meet tax and accounting requirements. Ask us to delete the rest at any time.
• Sign-in links and their records — deleted automatically after seven days by a scheduled cleanup.
• Sign-in IP records — deleted automatically after seven days.
• Payment event records — deleted automatically after 90 days. The underlying payment records stay in Stripe under their retention rules.
• Your roadmap PDF — never stored. It is rebuilt from your answers each time you or we request it.

Virginia's Consumer Data Protection Act gives residents of Virginia specific rights, and other states give similar ones. Rather than work out where you live, we extend all of the following to everyone who contacts us:

• Know and access — ask what we hold about you and get a copy.
• Correct — have anything inaccurate fixed.
• Delete — have your personal data erased, subject only to records we are legally required to keep, such as proof of a payment.
• Take it with you — receive your data in a portable, machine-readable format.
• Withdraw consent — including consent to our processing of the health information described above.
• Be treated the same either way — we will not charge you a different price or give you a worse service for exercising any of these rights.

To make a request, email carleigh@calibratedbycarleigh.com from the address you use with us, or from any address if you tell us which one to look up. We will confirm we received it and respond within 45 days. If a request is genuinely complicated we may take up to 45 days more, and we will tell you before that happens. There is no charge.

If you are asking on someone else's behalf, we will need to be reasonably satisfied you are authorised before we release anything.

If we decline a request, we will tell you why in writing. You can appeal by replying to that message, or by emailing carleigh@calibratedbycarleigh.com with “Appeal” in the subject line. A person will review it and respond within 60 days, explaining the outcome and the reasoning.

If you are still not satisfied, you may contact the Virginia Attorney General's office to submit a complaint, or the equivalent authority in your own state.

• The site is served entirely over HTTPS, and the database is not reachable from the public internet.
• There are no passwords to steal. Signing in works by a one-time link sent to your email address, or through Google. Those links are stored only as irreversible hashes, expire in 20 minutes, and can be used once.
• Card details never reach our systems. Payment pages are hosted by Stripe.
• Access to client records is limited to Carleigh and anyone she explicitly authorises, controlled by a list of approved email addresses that is checked on every single request.
• Changes to your training-session balance are recorded as an append-only history rather than by overwriting a number, so any disputed count can be reconstructed.

No system is perfectly secure, and we will not pretend otherwise. If a breach ever affects your personal information, we will notify you and the relevant authorities as required by law, and tell you plainly what happened and what to do about it.

This service is intended for adults. It is not directed at children, we do not knowingly collect personal information from anyone under 18, and we do not knowingly sell or share the personal information of anyone under 16. If you believe a child has given us information, email carleigh@calibratedbycarleigh.com and we will delete it promptly.

Coaching a minor is arranged directly with a parent or guardian, in person, and never through an account created on this site.

If this policy changes, the “last updated” date at the top changes with it. If a change materially affects how we use information we already hold about you, we will email you before it takes effect rather than relying on you to re-read this page.

This site is operated from the United States and your information is stored and processed there.

Calibrated by Carleigh™ — Leesburg, Virginia
Email: carleigh@calibratedbycarleigh.com

For the rules covering purchases, cancellations and refunds, see our Terms of Service.