Legal
Last updated · 5 days ago
Ascension holds health and performance data, which is the most sensitive kind of record a coaching business keeps. This page sets out exactly what is collected, where it lives, who can read it, and who else touches it — in plain terms, matching the software as deployed.
Coach accounts: your name, business name, email address, timezone, bio, the focus areas you selected at signup, and your notification preferences.
Athlete accounts: an email address and a password for each athlete you invite, plus the record of when they last opened their portal.
Coaching data you and your athletes enter: wearable metrics (sleep, HRV, resting heart rate, strain, weight), nutrition entries and macro targets, training sessions and set logs, protocol checklists, check-ins, messages, blood-marker values, and any lab documents uploaded to the vault.
Enquiries: if you use the contact form, we store the name, email address and message you send.
Sign-in records: a hash of your IP address is stored briefly when you sign in or sign up, so that repeated failed attempts can be counted and blocked. The hash exists to make the counter work without keeping a log of which addresses visited; it cannot be reversed back to an address by reading the database.
Passkeys, if you enrol one: the public half of the key, a label you choose, and when it was last used. The private key never leaves your device and we never see it.
Site analytics, only if you agree: if you accept the cookie prompt we load Google Analytics, which records pages viewed, approximate location from your IP address, and device type. Decline and nothing is loaded and no request is made to Google.
This service is hosted, and running it means involving a small number of processors. They are listed here rather than described vaguely, because "we may share your data" tells a reader nothing:
Nothing is sold, and no advertising network is involved. The AI gateway is not trained on what it is sent under our agreement with it; the data goes out to answer one question and is not retained by us there.
Because two of those processors operate outside the UK, some data is transferred internationally. Neon's Frankfurt region keeps the database inside the EU, which the UK recognises as adequate; the transfers to the AI gateway and the analytics provider rely on the standard contractual clauses in their terms.
For an athlete's coaching record, the coach is the data controller — they decide what is collected about their athlete and why — and Ascension acts as their processor, handling it on their instructions. For the coach's own account, the contact form, and the site's own analytics, Ascension is the controller.
Ascension Fitness is operated by Ascension Fitness LLC.
Business address: 659 Danforth Street, Apartment 233, Carmel, Indiana 46032
To ask for a copy of your data, to correct it, to delete it, or to object to how it is used, use the contact form on the home page — it writes a record we can act on. You can also email contact@ascensioncoaching.com, though that domain currently refuses mail, so the contact form is the reliable route while we fix it. If you are in the UK you may also complain to the Information Commissioner's Office (ico.org.uk). If you are an athlete, your coach is the first person to ask: the record is theirs to hold.
Passwords are stored as scrypt hashes with a unique random salt for every account. The plaintext password is never written to disk and cannot be recovered from the hash — not by us, and not by anyone who reads the database file.
Signing in sets a single httpOnly session cookie which lasts fourteen days — or thirty if you tick "keep me signed in". Only a hash of the session token is stored, so the database cannot be replayed as a login. Changing your password immediately invalidates every existing session, including the current one.
A coach sees the athletes on their own roster and nobody else's. An athlete sees their own record and their own coach — never another athlete's. Both rules are enforced server-side on every request, not just hidden in the interface.
Automated reasoning (RIS) reads your metrics to detect physiological patterns. Its recommendations are held for coach approval before they take effect; it does not message anyone and it does not change a plan on its own.
The record of an athlete is health data, which the law treats as a special category and will not let anyone process on the basis of a general agreement alone. Each purpose rests on something specific:
2026-10-08 — so there is a definite answer to what you consented to.Data is kept for as long as the account is open, and an export or a full deletion of an account and its coaching records can be requested at any time through the contact form on the home page — which writes a record that can be acted on — and it will be actioned without a retention argument.
Within the app, a coach can delete the individual records they own: progress photographs, food entries, vitals, logged sets, a form question. Those are removed from the database rather than hidden.
A message cannot currently be deleted from the interface. An uploaded lab document can now be deleted together with its stored file in object storage — the file is removed, not just the database row — although there is not yet a control for it on the page, so ask through the contact form and it will be actioned. A full deletion of an account and its coaching records is still a request through the same route, and it does not depend on the record being deletable in the UI.
Policy version 2026-10-08.
Ascension is coaching software. It does not diagnose, treat or prevent disease, and it is not a substitute for a clinician. Blood markers and biometrics are shown so that you and your coach can act on them with proper context.
Questions about any of this, or a request we have not covered? Email contact@ascensioncoaching.com.