Assessment Privacy Notice

Peak Human Function LLC

Last revised: October 15, 2026 · Notice version: phf-assessment-privacy-2026-10-15-v1

Your report. Your choice.

You can complete the Performance Capacity Assessment and view your initial results without giving us your name or email address or subscribing to marketing. If you request the full emailed report, we process your name, email address, and health-related answers and results to prepare and deliver it, with your separate, explicit report-processing consent. Marketing is optional and requires a different choice.

Our active assessment database retains your scores and capacity profile for 90 days from your report request, not the 24 individual answers. Deleting those records does not delete a report you have received or saved.

1. Who we are and what this notice covers

Peak Human Function LLC ("PHF," "we," or "us"), based in the United States, is responsible for the personal information used in this assessment service.

Privacy contact: andrew@peakhumanfunction.com.

Public mailing address: 123 E Tarpon Ave, Tarpon Springs, FL 34689, United States.

This notice covers the assessment, requested report, related delivery support, and optional marketing sign-up alongside it. It supplements our website Privacy Policy with assessment-specific details. It does not describe all processing for separate applications, appointments, payments, consultations, or client records.

2. Information we process

You provide the assessment answers directly. The six domains are Energy & Focus, Sleep & Recovery, Metabolic Health, Stress & Resilience, Digestive Capacity, and Physical Capacity. The assessment derives domain scores, an overall score, capacity bands, constraints, and report priorities. Identifiable answers and results can be sensitive health-related information even though this is an educational assessment, not a diagnosis.

If you request an emailed report, you also provide your first name and email address. Our report service processes all 24 answers to calculate and generate the report. PHF's assessment database stores your name, email address, request date, derived scores and profile, delivery information, and relevant consent records. It does not store the 24 raw answers.

Technical information can include IP address, browser/device information, security-verification signals, request identifiers, consent choices, and email sending or delivery information. Our providers produce some of this information when hosting, securing, and delivering the service. If you contact us, we process what is needed to respond.

Use an email address you control. Do not submit someone else's answers or send additional medical records, identity documents, passwords, or unnecessary sensitive information through this assessment or ordinary email.

3. How the assessment and report work

Your initial preview is calculated in your browser without needing your name or email address. The surrounding website and security services can still process technical information about your visit. The assessment code does not use browser storage to save your answers between visits.

When you request the emailed report and provide report-processing consent, your answers and delivery information are sent to our Cloudflare-hosted report service. It calculates the full results and creates a PDF. Resend delivers the report to the address you supply. If PDF generation fails, the service may send the full report in the email itself instead.

The PDF is an ordinary email attachment, not a password-protected client portal or a Biocanic client record. Anyone with access to your mailbox or a forwarded copy may be able to read it. Email attachments are not a guarantee of end-to-end encryption or recipient-only access. Resend states that it is not HIPAA compliant and cannot sign a Business Associate Agreement; we do not represent this report-delivery service as HIPAA compliant. Keep your report somewhere you consider appropriate for health-related information.

4. Purposes, consent, and withdrawal

We use assessment information to calculate results, generate and deliver the report you request, support delivery, and handle related privacy requests. We use limited technical information to detect automated or repeated requests, protect the service, and investigate failures. We may also process limited information to meet an applicable legal obligation.

The identifiable assessment/report service is optional. For UK users, we rely on consent under Article 6(1)(a) of the UK GDPR and explicit consent for health-related information under Article 9(2)(a) for this service. Marketing has separate consent. Limited non-health security processing relies on our legitimate interest in a safe, reliable service; processing required by an applicable legal duty relies on that duty. These purposes do not authorize unrelated reuse of assessment health information.

Providing information for an emailed report is not a statutory requirement. Without the necessary information and report-processing permission, we cannot provide that emailed report. You can still view the initial browser-based preview. Declining marketing does not prevent report delivery.

You can withdraw assessment consent by emailing our privacy contact. We will stop further processing that depends on that consent and address associated deletion requests under applicable law. Withdrawal does not undo processing lawfully completed beforehand or recall a report already delivered. We will explain any limited information that must be retained for a specific legal reason.

5. Optional marketing and contact management

Requesting a report does not subscribe you to ongoing marketing. The separate marketing checkbox starts unchecked. Checking it signs you up for occasional PHF education and program information without a second email-confirmation step.

For this sign-up, we use Brevo. The assessment integration sends Brevo only your name, email address, and necessary marketing-consent details—not answers, scores, constraints, or PDFs. We do not use assessment results to select advertising audiences or personalize unrelated marketing. Existing unsubscribes and suppressions take precedence over a new assessment submission.

Where enabled and permitted, marketing email-open or click tracking can produce recipient-linked interaction information. Automated security tools and email services can register opens or clicks without a person reading or acting on a message. These signals do not prove that you read an email or renewed consent. Any required permission for tracking is separate from permission to receive marketing; this sign-up is not blanket permission for tracking tools.

Unsubscribe through a marketing message or email our privacy contact. A report request or email open alone does not renew marketing consent or override an unsubscribe. Assessment-consent withdrawal and marketing unsubscribe are separate; tell us if you want both.

6. Providers and other disclosures

Providers can use subprocessors for hosting, delivery, support, and security under their applicable terms. See the privacy information from Cloudflare, Resend, Brevo, and Squarespace.

Cloudflare Turnstile uses technical signals to check for automated traffic. Cloudflare processes signals on PHF's behalf and as an independent controller to improve bot detection, as described in its Turnstile Privacy Addendum. Our Turnstile verification payload does not include report answers.

Resend also performs security and abuse-prevention processing, including limited email sampling described in its processing overview. Ordinary API email sending is distinct from its AI editing/support features.

We may disclose limited information when required by applicable law or necessary to address a security incident, subject to applicable protections. PHF's ordinary delivery-failure alerts contain a report reference and error category, not your answers, scores, email address, or PDF. Providers can maintain separate service records.

The assessment integration does not sell your answers or results, publish them, send them to Brevo, or disclose them to advertising platforms. This statement concerns the assessment integration, not a representation about every separate PHF service.

7. International processing

PHF operates in the United States. Information can be processed outside your country, where privacy laws and lawful government-access rules may differ. Resend stores service data in the United States. Brevo identifies primary database hosting in the European Union. Cloudflare operates internationally. This assessment does not promise UK-only, Canadian-only, or EU-only processing.

Providers' published data-processing terms describe contractual transfer safeguards, including standard contractual clauses and a UK Addendum where applicable. Those safeguards are separate from report-processing consent; consent is not a blanket waiver of transfer protections. Contact us for information about applicable safeguards and a relevant copy, subject to necessary redactions. See the Cloudflare DPA, Resend DPA, and Brevo hosting information.

8. Retention and deletion

PHF's scheduled cleanup removes active prospect assessment records and linked application delivery, attempt, alert, and local consent/sync records after 90 days from the report request. Records become eligible at 90 days and are removed by scheduled cleanup, not necessarily at an exact second. A marketing sign-up does not exempt an assessment from deletion.

After deletion, PHF cannot look up or regenerate that report from stored assessment scores. You can take a fresh assessment and keep any report already received or saved. This policy does not authorize automatic transfer into a separate client-record system.

Short-lived request-limit records use hashed identifiers derived from email addresses and IP addresses. Their request windows are hourly or daily; expired entries are removed by request processing or scheduled cleanup. Hashing does not necessarily make information anonymous.

Brevo marketing contacts are separate from the 90-day assessment records. Our marketing-retention policy calls for monthly review and stopping marketing to contacts with no recorded activity for 24 months, pending review. Activity includes recorded opens, clicks, and relevant replies or requests; for a new subscriber without activity, the period starts at sign-up. These are activity signals, not renewed permission or grounds to override unsubscribe. This is an operator-reviewed policy, not an automatic deletion promise. Minimal consent and do-not-contact evidence can be retained under a separately documented, periodically reviewed policy to demonstrate permission and prevent unwanted re-subscription.

Provider logs and backups have separate retention periods. Resend currently describes 30-day email/log retention on its Free plan and seven-day backup retention. Cloudflare D1 recovery history is plan-dependent. PHF's active-database timer does not automatically delete every provider log, backup, or recipient's mailbox copy. See Resend retention information and Cloudflare D1 recovery information.

Where applicable law requires earlier deletion or action on provider/backup copies, we address that separately rather than waiting for the timer. If a backup is restored, applicable deletion and withdrawal instructions must be reapplied before the information is used.

9. Website cookies and security checks

Squarespace and security services process technical information to operate the website. Website analytics can involve pages visited, browser/device information, referrals, IP addresses, and cookies or similar technologies. Cookie choices are separate from assessment and marketing consent; neither checkbox authorizes unrelated analytics or advertising tracking.

The assessment setup does not install Google Analytics. PHF uses Google Search Console to review its appearance in Google Search; that does not install Google Analytics on the website. Before adding a new tracking tool, we will review its processing, update relevant privacy information and controls, and obtain any required permission before it operates. This is not a promise that website tools will never change.

For website-wide information and choices, see our website Privacy Policy and the site's cookie preferences. Squarespace explains its cookies and cookie-consent controls.

10. Security and automated results

The service uses encrypted connections and access-controlled application storage. Providers apply their own safeguards, but no website, email service, or storage system can guarantee absolute security.

Scores and report priorities are calculated automatically from your answers. They are not used to determine eligibility for employment, insurance, lending, or another legally significant service. The report is educational wellness information, not medical advice or a diagnosis. It cannot identify why a limitation exists or prescribe how to fix it.

11. Privacy requests and complaints

Email andrew@peakhumanfunction.com to ask questions, withdraw consent, or request access, correction, or deletion. Depending on your location and applicable law, you may have additional rights, including restriction, objection, portability, disclosure information, or appeal. Legal conditions and exceptions can apply.

Tell us which service or choice your request concerns. We may take proportionate steps to verify control of the relevant email address; additional medical answers or identity documents are not required by default. Do not put sensitive results in the subject line. We respond within the period required by applicable law and explain any permitted extension or reason for not acting.

To seek review of a denied request, email the same mailbox with the subject "Privacy appeal" and identify your earlier request. We will review it and explain the decision and applicable complaint route. Marketing subscription is not required to exercise privacy rights.

You can complain to a relevant regulator, including the UK Information Commissioner's Office, the Office of the Privacy Commissioner of Canada, an applicable Canadian provincial privacy authority, or an applicable US authority.

12. Adults only and changes to this notice

This assessment is for adults age 18 and older. Contact our privacy mailbox if you believe someone under 18 has submitted identifiable assessment information.

We will update this notice when assessment processing materially changes. The revision date and version identify the copy. Where new permission is required, we will obtain it before processing for that new purpose; updating a notice does not itself create consent.