Margin — Privacy Policy

This Privacy Policy explains how Margin, operated by Fitness Family LLC ("we," "us," "our"), collects, uses, and protects information when you use the Service. By using Margin, you agree to this Policy.

• Account information: your name, email address, and password (passwords are stored in hashed form by our authentication provider — we never see them in plain text).
• Practice and financial data: the business and financial information you enter or connect, such as services, prices, costs, overhead, and volumes, used to generate your analysis.
• Payment information: handled entirely by our payment processor, Stripe. We do not collect or store your full card number; we receive only limited information such as subscription status and the last four digits of your card.
• Usage information: basic technical data (e.g., log data and device/browser information) used to operate and secure the Service.

Margin is built for practice business and financial data only. We do not request, and you must not submit, protected health information (PHI), patient-identifiable medical records, or other data regulated under HIPAA. Margin is not a covered entity or business associate under HIPAA.

We use your information to: provide and operate the Service; generate your financial analysis; process subscriptions and payments; communicate with you about your account; maintain security; and improve the Service. We do not sell your personal information.

Your data is stored using our infrastructure providers, including Supabase (database and authentication) and Vercel (hosting), and payments are processed by Stripe. These providers process data on our behalf under their own security and privacy commitments. We do not share your Customer Data with third parties except: (a) these service providers who help us operate Margin; (b) where required by law; or (c) to protect our rights or the safety of others.

We retain your data for as long as your account is active. You may request deletion of your account and associated data by contacting us at lucas.m.popiel@gmail.com. Some information may be retained as required by law or for legitimate business records (e.g., billing history).

We use reasonable technical and organizational measures to protect your information, including encryption in transit, access controls, and database-level isolation between customers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

You may access or update your account information at any time, request deletion of your data, and opt out of non-essential communications.

The Service is not directed to anyone under 18, and we do not knowingly collect information from children.

We may update this Policy; we will update the "Last updated" date and, where appropriate, notify you of material changes.

Questions about this Policy or your data: lucas.m.popiel@gmail.com