United States | Version CF-PP-US-2026-09-v1 | Effective date: September 22nd 2026 | Replaces the policy dated July 24, 2025
This policy explains, in plain language, how Cortex Flex Inc. ("Cortex Flex" or "we") collects, uses, discloses, retains and protects your personal information when you use the Cortex Flex AMPLIFY application (the "Application") and our website in the United States. It complies with the Children's Online Privacy Protection Act (COPPA) and other applicable U.S. law.
This policy is an information document. It is not a consent. Your consents are collected separately, in your Participation Form. The Terms of Service and their Schedule D supplement this policy.
Key points
- We collect only the information needed for the AMPLIFY training program.
- Information about injuries, health and psychological readiness is collected only with your express, separate consent.
- We never sell your information. We do not use it for targeted advertising, research or training artificial intelligence models.
- Optional features and tracking technologies are off by default.
- Under 13, we obtain your verifiable consent through a two-step process before we collect any information from your child. Athletes 13 and older consent for themselves — no separate parent or guardian consent is required for that age range.
- You can access your information, have it corrected, get a copy and withdraw your consent by writing to our Privacy Officer.
1. Who we are and how to reach us
- Company: Cortex Flex Inc., 6 Blvd Terrace, Allston, MA 02134, United States
- Privacy Officer: Ashton Gillett, Ashton@cortexflex.org.
- Support and safety: admin@cortexflex.org
- Telephone: (724) 993-5710
2. Who this policy applies to
This policy applies to athletes, their parents or guardians ("Representatives"), people who buy individual access ("Purchasers"), coaches and mentors who use the Application, and visitors to our website, in the United States.
If you participate through a school, school district or club (a "Partner"), some of your information is entrusted to us by that Partner. We then process it only according to the Partner's instructions and our signed agreement with it (Schedule B of the platform services agreement). The Partner remains responsible for its own practices, including any obligations it has under FERPA for school-collected records.
3. Information we collect and why
The following table corresponds to Schedule D3 of the Terms of Service. Each row's code also appears in your Participation Form.
| Code | Category | Information | Purpose | Status |
|---|---|---|---|---|
| D3a | Account and access | First name, last name, date of birth, team or program, email, encrypted password; for the Representative: name, capacity, email, telephone | Create and administer the account, verify age and authority, communicate with you | Essential |
| D3b | Participation tracking | Completed modules, dates, streaks, points; responses to non-health training questionnaires | Track participation and progress | Essential |
| D3c | Physical personalization | Reported injuries (body area, date of onset, pain from 0 to 10, restrictions) | Adapt or remove exercises | Optional; sensitive |
| D3d | Psychological readiness | Daily confidence and readiness ratings (1 to 5) | Adapt readiness support, without diagnosis | Optional; sensitive |
| D3e | Non-clinical nutrition guidance | Partner's coaching staff decision-based nutrition guidelines | General guidance, without regulated treatment | Optional |
| D3g | Group chat | Announcements, messages, display name | Team communication | Optional |
| D3h | Rankings | Points, streaks, alias or name | Gamification | Optional |
Other information needed to operate the service:
- Age and consent evidence: age bracket, form version, choices made, date and verification method.
- Technical and security logs: login dates, IP address, device type, failed login attempts and support requests.
- Payment (individual purchase): Purchaser's name, amounts and dates. Card numbers are processed by our payment processor, not by Cortex Flex.
- Coaches and mentors: name, email, role, team and, for mentors, the result of the criminal background check.
- Website visitors: technical data (IP address, browser) needed to operate the site.
We never collect: biometric identification, precise location, complete school or medical records, or information from your social networks. We use your information only for the purposes listed above. We never use it for sale, targeted advertising, research, promotion, training artificial intelligence models or secondary product improvement, and never for behavioral advertising directed at children. A new purpose would require your consent, except in the limited cases where the law allows a compatible use, for example to keep the service secure or prevent fraud.
4. How we collect your information
- Directly from you or your parent/guardian, when you enroll and use the Application.
- Automatically, through the Application, for participation tracking and security.
- From your Partner, only to confirm that you are on the team roster.
When we collect information, we tell you the purposes, the means used, your rights, and who will have access to the information.
5. Your consent
- No box is pre-checked. Sensitive information (D3c and D3d) requires express consent — named distinctly in the consent text rather than folded into a general statement — given as part of the same single action that covers the other optional features listed in section 3.
- You can refuse the optional features (including the sensitive ones) without losing the essential service (D3a and D3b).
- Your consent is valid only for the stated purposes and for the time needed to achieve them.
- A parent may withdraw consent at any time for the future (see section 13), which stops further collection and lets the parent request deletion of previously collected information.
- Simply using the Application is not consent.
6. Who has access to your information and to whom we disclose it
Within Cortex Flex, only the people who need it for their duties have access: Nate Roy (account administration), Ashton Gillett (Privacy Officer) and Samuel Ren (software developer, logged technical access). These people have signed a confidentiality undertaking. Coaches, mentors and parents. They have access only to the information permitted by their role, their authority and the law. Mentors never have access to sensitive information. A parent does not automatically have access to a teenager's entire account. Partners. Your Partner receives only the information authorized in your Participation Form. If you enrolled independently, no school or coach has access to your information unless you separately authorize it. Service providers. We use the following providers, who may use your information only to provide their services to us, under a written contract, and never to build a profile of a child for their own purposes:
| Provider | Function | Country |
|---|---|---|
| Google Cloud | Hosting, database and backups | Canada (Toronto, northamerica-northeast2) |
| Postmark (noreply@cortexflex.org) | Transactional email | United States |
| Stripe | Payments (individual purchases) | United States |
| Apple App Store and Google Play | Application distribution, under their own policies | United States |
Disclosures permitted by law without consent. In certain cases provided by law, we may disclose information without your consent, for example to a child protection agency, to prevent an act of violence where there is a serious risk, or to comply with a court order or lawful subpoena. We then limit the disclosure to what is strictly necessary. Business transaction. If our business is sold or merged, only the necessary information may be disclosed, under an agreement that protects its confidentiality and limits its use to the purposes of the transaction. Your information remains protected under the same rules. We never sell your information.
7. Cookies and tracking technologies
The Application and our website use only the technologies essential to their operation and security, for example to keep you signed in. Any technology that can identify you, locate you or build a profile of you is off by default. We inform you about it, and it is activated only with your consent. We use no tracking technology for advertising purposes, and none directed at children under 13.
8. Personalization and automated decisions
The AM Primer and PM Adaptor modules adapt your exercises based on your responses. Any personalization based on health information is off by default and is activated only with your express consent. The Application's settings provide the highest level of privacy by default. If a decision about you is made exclusively through automated processing, we inform you no later than when we communicate it to you. On request, we explain the information used, the reasons and the principal factors and parameters behind the decision, let you have your information corrected, and let you submit observations to a person who can review the decision: Ashton Gillett and Nate Roy.
9. Hosting
Your information is primarily hosted in Canada (see Schedule D4), by our hosting provider Google Cloud. Some of your information is also processed in the United States by other service providers, such as our email and payment providers. We take reasonable steps to ensure your information receives comparable protection wherever it is processed.
10. Retention and destruction
| Information | Destruction |
|---|---|
| Age and consent evidence | 4 years after the account is deactivated; access restricted to the Privacy Officer. This period is enforced automatically. |
| D3a, D3b, D3e, D3g and D3h | Kept only as long as needed for the stated purposes; destroyed or anonymized when the account is closed or the relevant consent is withdrawn, as part of our regular review of information retention |
| D3c and D3d | Same principle as above, applied with heightened care given its sensitivity |
| Technical and security logs | Kept only as long as needed for security and technical support, then destroyed as part of our regular review |
| Payment information | Kept for the period required by applicable tax law |
We keep information only as long as reasonably necessary to fulfill the purpose it was collected for, consistent with COPPA's retention-limitation requirement. We never keep a deleted account indefinitely. For information entrusted by a Partner, the periods in our signed agreement with that Partner apply.
11. Security and confidentiality incidents
We protect your information with measures suited to its sensitivity: encryption in transit and at rest, multi-factor authentication for administrative access, role-based access limits, separation of data by team, access logging and annual staff training. If a confidentiality incident occurs, we promptly take measures to reduce the risk of harm and notify affected individuals and any regulator as required by applicable law. We keep a register of all incidents.
12. Children and teenagers
- Under 13: the Children's Online Privacy Protection Act (COPPA) requires us to obtain verifiable parental consent before we collect, use or disclose any personal information from a child. We meet this requirement through the FTC's "email-plus" method: a parent or guardian first receives an email describing what information will be collected and why, and reviews and signs the Terms of Service and participation waiver on the child's behalf; we then send a second, separate email that the parent or guardian must also confirm before the account is activated or any further information is collected. A parent or guardian may review, correct, delete, or refuse further collection of their child's information at any time by writing to our Privacy Officer (see section 13). If we learn that an account was created for a child under 13 without this process being completed, we close it and destroy the child's information.
- 13 and older: the teenager may use the Application under the account terms that apply generally; we do not require additional parental consent beyond what is described in this policy, unless another applicable law requires it.
- We do not direct any commercial advertising or behavioral advertising at children under 13.
- A parent's access to a teenager's (13+) information depends on the parent's authority and any applicable law.
13. Your rights
At any time, you (or, for a child under 13, the child's parent) may:
- access the information we hold;
- have it corrected if it is inaccurate, incomplete or ambiguous;
- get a copy of the information in a structured, commonly used format;
- direct us to delete the information and refuse further collection;
- be informed of an automated decision and have it reviewed (section 8);
- file a complaint (section 14).
How to make a request. Write to the Privacy Officer (section 1). We verify your identity and authority proportionately and respond in writing within 30 days of receiving your request. Access is free; reasonable transcription or reproduction fees may apply, and we tell you in advance.
14. Complaints
For any complaint about the protection of your information, write to the Privacy Officer. We acknowledge your complaint within 7 business days, review it and respond in writing within 30 days. If you are not satisfied, you may contact the Federal Trade Commission (FTC) at reportfraud.ftc.gov, or your state Attorney General's office.
15. Communications and commercial prospecting
We send you the messages needed for your account, its security and your transactions. We send promotional messages only with your consent. Each promotional message identifies us and provides a working way to unsubscribe, honored within the time required by the CAN-SPAM Act. You may ask us at any time to stop using your information for prospecting purposes.
16. Governance
The Privacy Officer ensures compliance with this policy, approves our practices, handles requests and complaints, keeps the incident register, and takes part in internal privacy reviews before any information system project involving personal information. Every staff member with access to information is trained and bound by a confidentiality undertaking. Our retention periods are those in section 10. This policy was approved by Nate Roy, Chief Executive Officer.
17. Changes to this policy
We notify you of any significant change before it takes effect, in the Application or by email. A change never allows us to use your information for a new purpose without your consent, and simply continuing to use the Application is not consent. Previous versions are kept and available on request.
18. Language
This policy is published in English.