Privacy Governance & Complaints
Effective Date: Thursday, August 6, 2026
Quebec's Law 25 requires every business to put in place internal policies governing how it protects personal information, and to publish a summary of them in clear language. This page is that summary. It complements our Privacy Policy, which describes what we collect and why.
Who is responsible
Our Privacy Officer (responsable de la protection des renseignements personnels) is accountable for our privacy compliance, approves any new use of personal information, handles your requests and complaints, and assesses and reports any confidentiality incident.
Email: privacy@track28app.com
Who can see your data
Access to the production systems that hold your cycle, health, and workout data is restricted to the minimum personnel necessary to operate the service. Every access is individual and credential-based — no shared accounts — and no external provider or tool holds standing access to your data beyond what hosting the service requires.
Access is used only to operate and debug the service. Day-to-day development and testing use test data, not a copy of real user data. Copies of production data are made only for a defined operational need — diagnosing a production issue, or a safety backup taken just before a deployment — are kept only on encrypted storage, and are deleted once that need has passed. Your personal information is never placed in a spreadsheet or a consumer AI tool.
Anyone granted access is first bound by a written confidentiality undertaking and briefed on our internal governance policy.
How long we keep your information
We keep personal information only as long as it is needed for the purpose it was collected for, then we destroy or anonymize it. The full retention schedule — exactly what we keep and for how long — is published in Section 7 of our Privacy Policy and applies as written there.
Deleting your account is a real deletion, not a hiding: your profile, preferences, cycles, workouts, activities, health metrics, sessions, and connected-device tokens are erased from our database, and any connected-device link (such as Garmin) is revoked first.
One thing does outlive it: a security log recording that a change was made to an account, a training plan or a connected device — including the IP address it came from — which we keep for up to 2 years. It never contains cycle, health or location data.
How we handle your requests
You can ask us to give you a copy of your data, correct it, delete it, send it to you in a portable format, or stop processing it — see the Privacy Policy for the full list of rights. For a copy of the data you gave us, the fastest route is the export available directly in the app; a full access request — covering everything we hold about you — goes through the process below.
- Write to privacy@track28app.com.
- We acknowledge your request within 10 business days.
- We verify who you are — usually just by confirming you control the email address on the account. We never ask for more identity information than we need.
- We give you a written answer within 30 days. If we refuse, we tell you why and how to challenge it.
If you need help formulating a request, ask us — that help is part of our job.
How to make a complaint
If you are unhappy with how we handled your personal information or your request, you can complain, in French or English, at privacy@track28app.com. Include enough detail for us to identify what went wrong.
- We acknowledge your complaint in writing within 10 business days and give you a file reference.
- We examine it — the facts, the records, and anything else you tell us.
- We give you a written decision within 30 days: what we found, what we decided, and what we are fixing.
- If your complaint reveals a wider problem, we change our practices, not just your case.
A complaint about the Privacy Officer's own conduct is handled by the President of the company instead.
You can always escalate. If our answer does not satisfy you — or if we fail to answer within 30 days — you may ask the Commission d'accès à l'information du Québec (CAI) to review the matter, free of charge: cai.gouv.qc.ca. If you live in the European Economic Area, you may instead contact your national data-protection authority. Complaining to us is never a precondition, and we will never treat you differently for exercising a right.
If something goes wrong
If personal information is ever lost, accessed, or shared without authorization, we act on it: we contain the incident immediately, record it in a confidentiality incident register that we are required to keep and to hand to the CAI on request, and assess whether it presents a risk of serious injury.
Because of what we handle, we treat any incident involving cycle, contraception, health, or location data as presenting that risk unless it is clear it does not. When it does, we notify both the CAI and every affected person promptly — telling you what happened, what was involved, what we have done, and what you can do — and we take measures to prevent it happening again.
Who else processes your data
We use a small number of service providers to run Track28 — hosting, email, analytics, support chat. The categories are described in Section 11 of our Privacy Policy, and the current list of providers — who they are and where they store data — is published on our Service Providers page.
The providers that store or process your account and health information on our behalf must commit in writing to keep the information confidential, use it only on our instructions, secure it, tell us immediately about any incident, and delete it at the end of the contract. Before any personal information leaves Quebec, we assess whether it will receive adequate protection where it is going, and we document that assessment in a privacy impact assessment.
We never sell your personal information, and we never share it for advertising. We never send your health data, cycle information, or GPS routes to an analytics or advertising provider.
Keeping this current
We review our governance policy at least once a year, and immediately whenever we start collecting a new category of information, add a service provider, change who has access to production data, or experience a serious incident. Changes are published here with an updated effective date.
Contact
Privacy Officer: privacy@track28app.com
Company: Solutions Track28 inc. — 1709 av. Egan, Montréal (Québec) H4E 2J6, Canada
This page is drawn up in French. The French version prevails; this English version is provided for convenience.