Privacy Policy

Last updated August 26, 2026.

METAFITRX (“we,” “us,” or “our”) operates metabolic assessment and coaching services in Richmond and Charlottesville, Virginia, and this website. This policy explains what personal information we collect, why we collect it, who we share it with, and what you can ask us to do with it.

Because our services involve health and fitness assessments, some of the information we hold is sensitive. We treat it accordingly, and this policy describes it plainly rather than in general terms.

Information we collect

Information you give us

Account details — your name, email address, and a password. Passwords are stored only as a one-way hash; we never see or store the password itself.
Contact and profile details — phone number, date of birth, mailing address, and an emergency contact’s name, relationship, and phone number.
Health screening responses — your answers to the PAR-Q+ pre-participation questionnaire, which asks about heart conditions, blood pressure, chest pain, dizziness or loss of consciousness, chronic medical conditions, prescribed medications, and bone, joint, or soft-tissue problems. We store your answers, the resulting clearance status, and when the screening was completed. PAR-Q+ responses are renewed annually.
Waivers — the liability waiver you sign before your first assessment, including the signature you draw on screen and the date and time you signed it.
Assessment results — the measurements produced by the services you book, such as DEXA body composition scans, resting metabolic rate testing, and VO2max assessments, together with any notes your provider records.
Booking details — the services you select, the location and time of your appointments, and your appointment history.
Messages you send us — anything you submit through our contact form or send to us by email.

Information collected automatically

Session records — when you sign in, we record the IP address and browser user-agent associated with your session, so that you can review and revoke active sessions and so we can detect suspicious access.
Server logs — our hosting provider records standard request information, including IP address, in the ordinary course of serving the site.

Analytics

We use Google Analytics, loaded through Google Tag Manager, to understand how people find and use the site — which pages are visited, how visitors arrive, and where they run into trouble. This sets cookies in your browser and shares information with Google, including your IP address, the pages you view, and general details about your device and browser.

We use this only to improve the site. It is not linked to your account, your health information, or your assessment results, and it is not used to build an advertising profile of you. You can opt out across all sites using Google’s browser add-on at https://tools.google.com/dlpage/gaoptout, or by blocking cookies in your browser.

What we do not do

We do not sell personal information, and we do not share it with data brokers. We do not run advertising on this site, and we do not use your health information, assessment results, or intake responses for marketing.

We also never receive your full card number. Payments are entered directly with our payment processor — see Payments below.

How we use your information

To create and maintain your account and keep you signed in.
To schedule, confirm, reschedule, and deliver your appointments.
To screen you for safe participation and to determine whether medical clearance is needed before an assessment.
To produce, store, and explain your assessment results, and to provide coaching based on them.
To take payment, issue refunds, and keep financial records.
To send you transactional messages — booking confirmations, reminders, intake requests, receipts, and account emails such as password resets.
To keep the site secure, including guarding the sign-in and registration forms against automated abuse.
To meet our legal, tax, insurance, and professional record-keeping obligations.

We do not send marketing email unless you have asked us to, and any such message will include a way to stop receiving them.

Payments

Card payments are processed by Stripe. Card details are entered directly with Stripe and never reach our servers. We store only the identifiers Stripe returns — a checkout session, payment, or refund reference — so we can reconcile your booking. Stripe’s handling of your information is governed by its own privacy policy at https://stripe.com/privacy.

Service providers

We share personal information with a small number of providers who process it on our behalf, only as needed to run the service:

Stripe — payment processing.
Resend — delivery of transactional email on our behalf.
Neon — the managed PostgreSQL database where your records are stored.
Vercel — application hosting and request logging.
Bunny.net — the content delivery network that serves images and other static files on this site.
Cloudflare — the Turnstile challenge that protects our sign-in, registration, and password-reset forms from automated abuse.
Trigger.dev — the scheduled background jobs that send reminders and keep booking records in sync.
Google — Google Analytics and Google Tag Manager, for the website measurement described above. Google’s handling of that information is governed by its own privacy policy.

Some pages load typefaces from Adobe Fonts and Google Fonts. Those services receive your IP address as part of serving the font files. They are not used to identify you.

We may also disclose information to our professional advisers, or where we are required to by law, legal process, or to protect the safety of a person.

Cookies

We use two kinds of cookies:

Essential cookies — these keep you signed in and keep our forms secure. The site cannot work without them. If you block them you will not be able to access your account.
Analytics cookies — set by Google Analytics to measure how the site is used. Blocking these does not affect anything you can do on the site.

We do not set advertising cookies, and no third party places advertising cookies through our site.

How long we keep your information

Account and profile information is kept while your account is open, and for as long afterwards as we need it for legal, tax, or insurance purposes.
Signed waivers are kept as a permanent record.
Health screening responses are retained with your assessment history; the screening itself expires annually and is renewed before your next assessment.
Assessment results are kept so that you and your provider can compare measurements over time.
Payment records are kept for as long as financial and tax rules require.
Session records expire automatically and are removed when they do.

Your choices and rights

You can view and update much of your information yourself by signing in and opening your profile. You can also ask us to:

confirm what personal information we hold about you and give you a copy of it;
correct information that is inaccurate or incomplete;
delete information, where we are not required to keep it;
stop sending you messages that are not essential to a booking.

Virginia residents have specific rights under the Virginia Consumer Data Protection Act, including the right to confirm, access, correct, and delete personal data, and the right to appeal a refused request. To make a request, email info@metafitrx.com. We will ask you to verify your identity before we act, and we will respond within the time the law allows.

Some information cannot be deleted on request — a signed waiver or a completed financial record, for example — because we are required to retain it.

Security

Information is transmitted over encrypted connections and stored in access-controlled systems. Passwords are hashed. Access to health and assessment records is limited to staff who need it to deliver your care. No system is perfectly secure, and we cannot guarantee absolute security, but we take the sensitivity of this information seriously.

Children

Our services are intended for adults. We do not knowingly collect personal information from anyone under 18. If you believe a minor has given us information, contact us and we will delete it.

Changes to this policy

We may update this policy as our services change. When we do, we will revise the date at the top of this page. If a change materially affects how we handle your information, we will tell you directly.

Contact us

Questions about this policy, or about the information we hold, can go to info@metafitrx.com. We have locations at 7001 Forest Ave, Suite 110, Richmond, VA 23230 and 195 Riverbend Dr, Suite 2, Charlottesville, VA 22911.