Wellness product—not a medical device
EnduraX does not diagnose, treat, prevent, predict injury, or clear participation. Qualified professionals make medical decisions.
Current posture · updated August 22, 2026
Athlete control is the architecture.
Trust is not a badge. It is the boundary between a connected team and blanket access—and a clear account of what EnduraX can substantiate today.
The controls in place now.
01
Encryption
Data is transmitted over HTTPS/TLS. Data at rest is encrypted within Supabase, and connected-provider access tokens are stored encrypted.
02
Row-level access
Database row-level security and authenticated server paths are used to restrict account and relationship access.
03
Relationship permissions
Coach, care, nutrition, performance, and administrative scopes remain separate. One role does not silently inherit another.
04
Athlete controls
Athletes can review connected people, change sharing, revoke relationships, disconnect providers, export data, and request deletion.
05
AI minimization
AI features are narrow and feature-specific. Workout paths exclude direct identifiers; fueling inputs follow separate opt-in and screening controls.
06
Monitoring and review
Sentry supports technical error monitoring. Sensitive server paths use validation, failure logging, and least-privilege database access.
Permission model
Being on the team does not mean seeing everything.
An invitation establishes a relationship. The athlete’s scope determines what that relationship can read.
01
Athlete account
The athlete can see their own daily and connected context.
02
Coach relationship
Readiness and training context only inside the sharing scope.
03
Care relationship
Separately approved injury, recovery, clearance, or clinical context.
04
Administrator seat
Membership, roles, schedules, and logistics—not individual readiness or health notes.
Current compliance posture, plainly stated.
EnduraX does not claim certifications or regulated status it has not earned. Institutional requirements are evaluated before a pilot handles institution-scoped data.
Not a HIPAA-covered entity
EnduraX is not currently represented as a HIPAA-covered entity. BAA requirements and any PHI workflow must be resolved in writing before activation.
No unsupported certification claim
This page does not claim SOC 2, HITRUST, ISO 27001, or another certification. Request the current security materials for the exact review date.
Applicable health-data duties
EnduraX states that it is subject to the FTC Health Breach Notification Rule and describes applicable consumer-health and privacy rights in the privacy policy.
Service providers and data purpose.
EnduraX does not sell personal data. The complete categories, retention terms, and legal bases remain in the privacy policy.
ProviderPurposeData category
SupabaseDatabase and authenticationAccount, profile, product, and consented health-related data
VercelApplication hostingRequests and technical hosting data
ResendTransactional emailEmail address and the minimum content required for the message
StripePayment processingBilling identifiers; EnduraX does not store full card details
AnthropicNarrow AI featuresFeature-specific minimized inputs described in the AI disclosure
SentryError monitoringMinimized technical diagnostics; health data and PII are excluded by policy
PostHogLimited cookieless analyticsPage paths and allowlisted content-free actions only
01
Retention and deletion
Account and health-related data follows the retention periods in the privacy policy. Account deletion targets personal-data deletion within 30 days; encrypted backup copies age out through the backup lifecycle.
Open details →02
Incident contact
For a suspected privacy or security incident, email rose@enduraxapp.com with “Security” in the subject. Do not include medical data in the first message.
Open details →03
Institutional review
Open the forwardable data and security overview, then request discussion of DPA, SCC, BAA, residency, or procurement requirements for the exact pilot.
Open details →