Privacy
Policy.

Last updated: November 2026 · Version 2026-08-c

This Privacy Policy explains how Ryse Athletic Club (“Ryse,” “we,” “us”) handles personal information when you visit our website, sign up for a membership or day pass, use our member portal, or use the Ryse mobile app. We have written it to describe what our systems actually do. If you find something here that does not match your experience, please tell us so we can correct it.

1. Information we collect

What we hold depends on how you interact with us.

Everyone who joins

• ▸Contact and account details: name, email, phone, and date of birth. Home address is optional and used for billing records.
• ▸Emergency contact: a name and phone number you give us so we can reach someone if you are hurt at the gym.
• ▸For members under 18: a parent or guardian's name, email, and phone.
• ▸Membership records: your tier, sign-up date, waiver, visit history, and door-access activity.
• ▸Consent records: whether you agreed to marketing email or texts, exactly what you agreed to, and the date, time, and IP address when you agreed. We keep these to prove we had your permission.
• ▸Signatures: when you sign a waiver or authorise a membership freeze on screen, we keep the signature with the signed document.
• ▸Forms: when you send a contact form, a job application, or a sign-in help request, we log the IP address and browser it came from, to stop abuse. We clear these after one year.

Identity checks at the front desk

When you first come in, our staff look at your physical government ID to confirm you are who you say you are. We do not photograph, scan, copy, or store your ID, and we never record its number. We record which type of ID was checked (for example, driver's license), who checked it and when, and the name and date of birth printed on it, so we can confirm your legal name and your age.

Your profile photo

Our staff take a photo of you at the front desk and store it on your account. Its only purpose is so staff can confirm that the person coming in matches the membership. It is an ordinary photograph. We do not run facial recognition on it, and we do not create or store a faceprint, face template, or scan of your facial geometry. Nothing in our system identifies you automatically from your face.

Payment information

Membership payments are handled by ABC Fitness, our billing provider. Card details are entered on their secure payment page, not ours. We never see or store your full card number. From their records we keep a payment history that includes the amount, date, card brand, and the last four digits.

Health and fitness information (mobile app and training services)

This is the most sensitive information we hold, so we want to be specific about it. If you use the Ryse mobile app or buy training services, we may collect:

• ▸Workout data you log: exercises, sets, weights, and session history.
• ▸Health metrics from a wearable or phone, only if you connect one and grant permission. For example steps, resting heart rate, heart-rate variability, blood-oxygen level, respiratory rate, sleep, and estimated VO2 max.
• ▸Body-composition results, if you book a body scan. For example weight, body-fat percentage, lean mass, and body measurements.
• ▸Nutrition and food logging, if you use those features.
• ▸Everyday supplements you log in the app's Supplements tracker, and the days you took them. See "Supplements you track in the app" below for what is stored and what never leaves your phone.
• ▸Notes and goals recorded by a personal trainer you work with.

You control this. Connecting a wearable is optional and you can disconnect it at any time in your device settings. We do not sell health data, share it with advertisers, or use it to make decisions about your membership or pricing.

The app has an optional Research setting (Settings, then Research). It is off unless you turn it on. If you turn it on, your workouts, body composition and weigh-ins, wearable readings, your sex and your age as a band (not your birthday) are included, under a random ID that is not linked to your account, in Ryse's own long-term look at how training changes the body. Your name, email, phone, birth date, photos, posts, messages, membership, billing, door records and supplements list are never included. Research data is never sold. Turning it off removes you from every future analysis right away; it cannot change an analysis that has already been run.

What you post in the mobile app

If you post in the app, we store what you post: photos, videos, captions, comments, and direct messages, along with who posted them and when. Who can see a post depends on where you posted it and on your privacy settings. Direct messages are stored so they can be delivered and shown to you and the person you sent them to, and so we can act on a report.

Reports you make about other members, and reports made about you, are stored and read by staff. We never tell the person reported who reported them.

Automated checking of photos

Photos posted to the app are checked by an automated safety classifier before other members can see them. This check looks for prohibited content, not people: it performs no facial recognition, creates and stores no scan of face geometry or other biometric identifier, and cannot identify anyone. Images are processed transiently for this purpose. The classifier is a Google Gemini model, reached through OpenRouter (or, if OpenRouter is down, Google's Gemini API directly); the only thing kept is a text verdict about the photo. See Section 3 for our position under Illinois' biometric privacy law.

AI that reads your food and programs

Some app features use AI to read what you give them:

• ▸A photo of a meal, or of a nutrition label, when you log food.
• ▸A meal you type or say, such as "2 eggs and toast".
• ▸Photos, a PDF, or text you paste when you import a training program.

When you use one of these, the photo, file, or text, plus any note you add, goes from your phone to our server and from there through OpenRouter, an AI routing service, to a Google Gemini model. It sends back the food and its nutrition, or the program, for you to review. Nothing else about you goes with it: not your name, your email, or your health data. We do not store the photo or file. We keep only what you choose to save, such as the food entry or the program. We ask OpenRouter to send these requests only to providers that keep no copy. OpenRouter and Google handle what they receive under their terms. If OpenRouter is down, the same request may go to Google's Gemini API directly.

Location and other metadata in what you upload

Photos taken on a phone can carry hidden metadata, including the GPS coordinates of where they were taken.

• ▸Photos: we remove location and other metadata on our servers AFTER the photo is uploaded, not on your phone. For JPEG and PNG photos this works and the stored copy carries no location. For HEIC photos — the default format an iPhone camera produces — we do NOT currently remove it, so a HEIC photo you post may still contain the location it was taken at. We are telling you this plainly rather than implying otherwise; if that matters to you, turn off location tagging for your camera in your phone's settings, or set your camera to save photos as JPEG.
• ▸Videos: we do NOT currently remove metadata from videos. A video you post may still contain the location it was filmed at. We are telling you this plainly rather than implying otherwise; if that matters to you, turn off location tagging for your camera in your phone's settings before filming.

Your location, for Eat Out

The app uses your phone's location in one place: Eat Out, which finds restaurants near you. When you open Eat Out, your phone asks whether Ryse may use your location. If you allow it, the app sends your position from your phone straight to OpenStreetMap's Overpass service (public servers in Germany that serve OpenStreetMap map data) to search for places nearby. Your location is never sent to Ryse and we do not store it.

• ▸The app keeps the list of places it found on your phone, labeled with an area rounded to under a mile, so it does not have to search again. That list stays on your phone.
• ▸On iPhone, the map on that screen comes from Apple Maps.
• ▸If you say no, or tap Use my gym, Eat Out searches around the gym instead. You can change the permission at any time in your phone's settings.
• ▸The app only uses your location while Eat Out is open. It never tracks you in the background.

Push notifications

If you allow notifications, we store a push token for your device so we can send them. It identifies the device, not you personally, and it is deleted when you sign out.

Supplements you track in the app

The app's Supplements tracker (it used to be called the protocol tracker) keeps two kinds of entries apart. The app decides which is which on your phone, before anything is sent.

• ▸Everyday supplements are backed up to your account. An entry counts only if every word in its name is a common supplement word or a plain description, such as "Creatine monohydrate 5g" or "Vitamin D3". For these we store the name, the dose, how often you take it, the start date, and the days you marked it taken. That way your log survives a new phone, and a coach you have chosen to share your data with can see which days you took it. History from before backup existed is only uploaded if you say yes when the app asks.
• ▸Everything else never leaves your phone. That includes TRT, peptides, prescriptions, any name the app does not recognize, and any mix such as "Testosterone + Vitamin D". It is stored in your device's secure keychain, it is excluded from device backups, and it is never sent to us. We hold no copy of it, which means there is no copy of it to lose.

For every entry, of either kind, your dose history, phases, plans, reminders, and notes stay only on your phone. Nothing in the tracker is ever sent to an AI model. The backed-up supplement log is deleted when you delete your app account.

Website usage

Our host, Vercel, counts page views for every visitor without cookies and without identifying anyone, and our error monitor (Sentry) receives a report if a page breaks. Detailed analytics, such as how you moved through the site, and session recording run only if you accept analytics in the banner shown on your first visit. If you choose “Essential Only,” neither loads. The signed-in areas (the member portal, staff admin, and trainer portal) are never recorded, whatever you chose.

Information about other people

Some information we hold is about people who never signed up themselves: the emergency contact you name, a parent or guardian for a member under 18, and guests you sign in. We use it only for the purpose you gave it to us for. If you are one of those people and want to know what we hold, contact us and we will tell you.

2. How we use your information

• ▸Create and manage your membership, day passes, and account.
• ▸Confirm your identity at the desk and provision your door access.
• ▸Process payments and billing through ABC Fitness.
• ▸Send you messages about your account: billing and past-due notices, receipts, password resets, and security alerts. These are part of having a membership and are not marketing.
• ▸If you start signing up online and don't finish, send you one email reminder with a link back to where you left off. It has an unsubscribe link, and unsubscribing stops it.
• ▸Send you promotional email or texts, only if you opted in. You can opt out at any time and it takes effect everywhere.
• ▸Show you your own workout, health, and progress data in the app.
• ▸Keep the gym and our systems secure, investigate incidents, and meet legal, tax, and insurance obligations.

We do not sell your personal information, and we do not share it with third parties for their own advertising.

3. Biometric information

Styku body scans are treated as biometric information. Styku has not confirmed whether a scan captures the shape of your face or head, so we treat every scan as if it does and follow the Illinois Biometric Information Privacy Act (740 ILCS 14) for all of them.

• ▸Consent first. Before your first scan you read and sign a written consent, in the app, on our website, or at the front desk. No scan is booked, and no scan result is attached to your account, until it is signed. A copy is kept in your Documents.
• ▸Purpose. A scan is used only to measure your body composition and show the results to you.
• ▸Retention and destruction. Scans are kept until your membership ends or 3 years after your last visit, whichever comes first, then permanently destroyed by us and by Styku. You can ask us to destroy them sooner at any time.
• ▸Withdrawing. You can withdraw your consent at any time from your Documents. We delete our copies of your scans right away and have Styku delete theirs.
• ▸Never sold. We never sell, lease, trade or otherwise profit from your scans, and we share them only with Styku to run the scan, or when the law requires.

Nothing else we do is biometric: we do not take fingerprints or handprints, we do not scan faces, irises, retinas, or voices, and we do not create or store any faceprint or template derived from your face. Door access uses a mobile credential or key card, not your body. The profile photo described in Section 1 is a photograph, which that statute expressly excludes from the definition of a biometric identifier, and we run no recognition on it.

4. How we share information

We share personal information only with providers that help us run the gym, only as needed, and only for the purposes described here:

• ▸ABC Fitness: membership billing, payments, and member records.
• ▸Openpath / Avigilon Alta: door access control. Receives your name, email, phone, and door-entry activity.
• ▸Styku: the 3D body scanner at the club. Only if you choose a scan, Styku records and stores a 3D model of your body shape and your measurements.
• ▸Supabase and Vercel: database, file storage, authentication, and website hosting.
• ▸Resend: sending our email. Twilio: sending our text messages, if you opted into them.
• ▸PostHog: website analytics, only if you accepted analytics. Signed-in visitors are identified to it by an account number, not by name or email. Website only — the mobile app does not use PostHog.
• ▸Vercel Analytics: cookie-free page-view counts that identify no one.
• ▸Sentry: error reports from the website, so we can fix what breaks. No screen recordings.
• ▸Stripe: card payments for personal training sessions and coach subscriptions you buy on our site, and paying our trainers and coaches their share. Stripe receives your name, email, and card details for those payments. Gym membership dues do not go through Stripe; ABC Fitness handles them.

No mobile information is shared with third parties or affiliates for marketing or promotional purposes. Your phone number and your text-message consent go to Twilio only so it can deliver our texts, and are never sold, rented, or shared with anyone else.

Providers used by the mobile app

• ▸Expo: app builds, over-the-air updates, and delivering push notifications.
• ▸OpenRouter: routes the app's AI requests to the model that answers them (a Google Gemini model). That covers the automated photo safety check, reading food photos, nutrition labels, typed meals, and imported programs (all described in Section 1), and Ryse Coach (below).
• ▸Google (Gemini): the model behind those AI features, reached through OpenRouter, or directly through Google's Gemini API if OpenRouter is down.
• ▸OpenStreetMap (Overpass): finding restaurants near you in Eat Out, only if you allow location. It receives your position directly from your phone and, like any website, your phone's internet address. Nothing else about you.
• ▸Ryse Coach requests (through OpenRouter, as above): to answer usefully, the request includes health information about you: your first name, age, sex, height, current body weight and recent weight trend, along with what you have logged (food, workouts, and goals).
• ▸Sentry: crash and error reports. Receives a member ID so we can tell whether a crash hit one person or everyone. It does not receive your email address.
• ▸USDA FoodData Central and Open Food Facts: nutrition lookups. These receive the food being searched for and no personal information about you.

We may also disclose information if required by law or valid legal process, to protect the safety of members or staff, or in connection with a sale or transfer of the business.

5. How long we keep information

We keep your membership record for as long as you are a member and afterward as needed for billing, tax, insurance, and dispute purposes.

• ▸Door-entry history: 7 years, then automatically deleted. This runs on a schedule, not by hand.
• ▸Signed waivers: kept indefinitely. A waiver is our record of an agreement about physical injury, and it has to outlive the membership to be worth anything.
• ▸Text-message consent records: kept while you are on our list and for a period afterward, because if you ever ask whether we had permission to text you, we are the ones who must prove it.
• ▸Cancellation emails you send us: kept with your member record so we have an accurate history of your request. After one year the original formatted email and its raw message data are deleted automatically; the plain text of your request, who sent it, and when stay with your record.
• ▸Staff action logs: kept for 3 years so we can investigate if something goes wrong with an account, then deleted.
• ▸Online sign-ups we decline: personal details beyond your name and email are cleared after 90 days. Sign-ups that never become a membership are cleared the same way after one year.
• ▸Job applications and sign-in help requests: deleted after 2 years.
• ▸Your profile photo: deleted one year after your membership ends.

We keep less than we could. Holding personal data we no longer need only widens the group of people we would have to notify if we ever suffered a breach.

Your health and training history

We keep your health and training history for as long as your account is open, so you can look back over years of progress in full detail. You can delete any period of your health data whenever you like, from Settings, and deleting your account deletes all of it.

We want to be straight about the trade-off, because it is a deliberate choice and not an oversight. Nothing expires on a timer. There is no job that thins your old data into monthly averages and no automatic purge. A member who trains for ten years should be able to open the app and see exactly what their resting heart rate, sleep and HRV were on a given day in year one, next to the workout they did. Averaging that away, or deleting it, would be a decision made for you about your own body. The cost of that choice is that we hold day-by-day health data indefinitely, which is more to lose in a breach — so the controls above are real ones you can use at any time, not a formality.

Deleting a post, and deleting your app account

Deleting a post removes both the post and its photo from our systems, not just the entry in your feed.

You can delete your Ryse app account yourself, inside the app: open Settings, tap Delete app account, and type DELETE to confirm. You do not need to ask us. It removes:

• ▸Your posts, stories, comments, and likes, and the photos, videos, and profile pictures you uploaded.
• ▸Your direct messages and the conversations they were in.
• ▸Your app profile, username, friends, blocks, and squad memberships. A squad you own passes to another member, or is deleted if no one else is in it.
• ▸Everything you tracked in the app: workouts and sets, food logs, weigh-ins and body measurements, meals and recipes, cardio, health data from your phone or wearable, body scans in the app, and backed-up supplements.
• ▸Your coaching relationships in the app, and what was written in them.
• ▸Your notification settings and the push tokens for your devices.

The app then signs you out and clears its data from that phone, including the Supplements tracker.

Deleting without the app. If you no longer have the app, email support@ryseathleticclub.com from the email address on your account, or ask at the front desk, and say you want your Ryse app account deleted. We may need to confirm it is you first. We will delete the same data listed above within 30 days and tell you when it is done. To delete more than the app account, see “How to make a privacy request” in Section 7. You can also delete your whole Ryse account, app and login together, yourself in the member portal under Account.

Deletion from our live systems happens when you ask for it. Encrypted backup copies persist for a short period afterwards before they age out of our backup cycle. While they exist they are not used for anything, are not searchable, and are only ever restored in a disaster. We would rather describe this accurately than tell you deletion is instant and permanent everywhere, which for any service that keeps backups is not true.

A few things are deliberately kept when an app account is deleted:

• ▸Your sign-in. The app uses the same login as your gym membership and the member portal, so deleting the app account does not delete it. Your membership, billing history, door access, signed waiver, and check-in history are not touched either.
• ▸Your gym membership itself. Deleting your app account does not cancel your gym membership and does not stop your dues. Membership billing is handled by ABC Fitness and has to be changed separately. To cancel your membership: joined online, send a cancel request from your account (Account, then Cancel My Membership); joined at the front desk, cancel at the desk or by mailed written notice.
• ▸Reports other members filed about you, and any restriction we placed on your account. A complaint or a ban should not be erasable by deleting the account it is about.
• ▸Reports you filed about others, so staff can still act on them. Your name is removed from them.
• ▸Food items you contributed to the shared database, because other members' logs reference them. Your name is removed from them.
• ▸Counts of how often you used the app's AI features and what they cost, so deleting and re-creating the account cannot reset the usage limits. They hold no photos or text.
• ▸A body scan you took at the gym stays in the gym's own records, no longer linked to the app.
• ▸A dated record that the account was deleted, so we can answer questions about it later.

6. How we protect information

• ▸Data is encrypted in transit, and our database and file storage are encrypted at rest by our infrastructure providers.
• ▸Access to member records requires a staff account with a specific permission, and staff actions on member records are logged.
• ▸Financial information is restricted to the owner.
• ▸Staff accounts that reach the admin panel require a second authentication step.
• ▸Uploaded files are stored in private, non-public storage.

No system is perfectly secure. If a breach affecting your personal information occurs, we will notify you and the appropriate authorities as required by Illinois law (815 ILCS 530), without unreasonable delay.

7. Your choices and rights

• ▸Marketing email: opt out with the unsubscribe link in any promotional email. It applies across our whole system, not just the one list.
• ▸Marketing texts: reply STOP to any marketing text. Reply HELP for help. Message and data rates may apply.
• ▸Account and service messages: these continue while your account is open, because they are part of the membership. They stop when you close your account.
• ▸Analytics: choose "Essential Only" in the cookie banner, or clear it in your browser to be asked again. Enabling Do Not Track in your browser also prevents analytics.
• ▸See your data: members can download a copy of their information from the member portal, under Account. It downloads immediately, you don't have to ask us.
• ▸Export from the app: you can export your app data from inside the app. It is generated on the spot and handed to your phone's share sheet — we do not store a copy of it and there is no link that could be found by anyone else.
• ▸Delete your app account: you can do this in the app under Settings, without asking us, or by email if you no longer have the app. See Section 5 for exactly what that removes and what it does not.
• ▸Correct your data: update your details in the member portal, or ask the front desk.
• ▸Connected health apps: disconnect a wearable at any time in your device settings.
• ▸Ask us to delete your information: see below for how this works.

How to make a privacy request

Send your request through our contact page or ask at the front desk, and say what you want: a copy of your information, a correction, or deletion. Requests go to the owner of Ryse Athletic Club, who reviews each one personally.

We will respond within 30 days. Most requests are answered much sooner. We may need to confirm your identity first, so that nobody else can request your information or have it deleted.

If you ask us to delete your information, we will tell you clearly what we deleted and what we kept. Some records we cannot delete on request:

• ▸Your signed waiver, which is our record of an agreement about physical injury and has to outlive the membership to mean anything.
• ▸Billing and payment records we are required to keep for tax and accounting purposes.
• ▸Records we need to keep for an open dispute, insurance claim, or legal obligation.
• ▸Proof that you agreed to receive texts, for as long as you are on that list. If you ever ask whether we had your permission, we are the ones who have to prove it.

If your membership is billed through ABC Fitness, closing your account with us does not by itself end that billing agreement. To end it: joined online, send a cancel request from your account (Account, then Cancel My Membership); joined at the front desk, cancel at the desk or by mailed written notice.

8. Children and members under 18

Memberships: you must be 18 or older to sign up for a membership online. Memberships for minors are set up in person, with a parent or guardian providing their information and agreeing to the waiver and Terms.

The mobile app: the app is for members 18 or older. We use the birth date on your membership, or the one you give in the app, to check this, and the app stays locked for a member under 18 until their 18th birthday. We do not collect anything new to do this.

We do not knowingly collect information from children under 13.

9. Where your information is handled

Ryse operates in Illinois and our members are primarily Illinois residents, so Illinois law governs how we handle your information. Our website and database are hosted in the United States by providers whose facilities may be located in other states.

10. Changes to this Policy

We may update this Policy. When we make a material change we will update the version and date at the top of this page, and ask members to review and accept the updated Policy the next time they sign in to the member portal. We keep a record of which version you accepted and when.

11. Contact us

Ryse Athletic Club · 5328 Grand Avenue, Gurnee, IL 60031. For any question about this Policy, to see or correct your information, or to make a privacy request, reach us through our contact page or at the front desk. We answer privacy requests as quickly as we can.

This Policy describes our practices and is provided for general information. It is not legal advice.