Privacy Policy

Effective August 26, 2026

This policy explains what The Protocol ("we", "us"), operated by Johnson & Cameron LLC, collects, how we use it, and your choices. By using The Protocol you agree to this policy.

1. Information we collect

Account & profile

Name, email, password (stored only as a salted hash), and profile settings such as wake/sleep times and timezone.

Health & intake data

Responses to our onboarding questionnaire (goals, training experience, dietary and lifestyle information, and health-screening answers including pain/restriction and pregnancy/postpartum status where you provide them).

Biometric data from connected devices

If you connect a wearable (e.g. Oura), we receive metrics you authorize — such as readiness, sleep, heart-rate variability, resting heart rate, and activity. We access this only via the permissions you grant and only to operate The Protocol. You can disconnect a device at any time from the app.

Usage data

Protocol completions, workout logs, compliance records, and basic technical logs needed to run and secure the service.

2. How we use your information

To assign and personalize your protocol and training program.
To adapt your plan based on connected biometric signals (e.g. adjusting a session when recovery is low).
To let your coach review your progress and provide support.
To send you the notifications and reminders that are core to the service.
To operate, secure, and improve The Protocol.

3. How information is shared

We do not sell your personal information. We share data only with service providers that help us run The Protocol, under contract and only as needed:

Wearable providers (e.g. Oura) — to retrieve data you authorize.
Cloud hosting & database — to store and serve your data.
Push notifications (Google Firebase Cloud Messaging) — to deliver alerts.
Payments (Stripe) — to process subscriptions; we never store full card data.
Your coach within Johnson & Cameron LLC, to deliver coaching.

We may also disclose information if required by law.

4. Data retention & security

We retain your data while your account is active and as needed to provide the service. Data is encrypted in transit (TLS). You may request deletion of your account and associated data (see Contact). We take reasonable measures to protect your information, though no system is perfectly secure.

5. Your choices & rights

Disconnect any wearable at any time in the app.
Access, correct, or delete your data by contacting us.
Disable notifications in your device settings.

6. Health information & HIPAA

When The Protocol is provided to you through a healthcare provider or clinic, health information you share with that provider may be Protected Health Information governed by HIPAA and the provider's own notice of privacy practices. Johnson & Cameron LLC enters into Business Associate Agreements with clinic customers. This consumer policy governs your direct use of The Protocol; it does not replace your provider's HIPAA notice.

7. Children

The Protocol is not intended for anyone under 18.

8. Changes

We may update this policy; material changes will be reflected by the “Last updated” date.

9. Contact

Questions or requests: theprotocol.tf@gmail.com.

Contact: theprotocol.tf@gmail.com · Last updated August 26, 2026