Built to hand
to the next gym.

A gym's records carry the organization they belong to. Reads are scoped by that organization, and a guard in the database client flags reads that forget. The shared library — exercises, equipment, the base taxonomy and the base templates — is the deliberate exception, shared by construction and explicitly so.

Branding, timezone, the booking horizon and the late-cancel window are organization settings. No gym gets its own build, so no gym gets left behind on one.

Helping a gym with a problem doesn't require a permanent account inside it. Support access is read-only, has to be granted, cannot be invited through any screen a gym's staff can reach, and expires on its own rather than waiting to be revoked.

Medical fields — considerations, medications, injury notes, assessment narratives — are encrypted in the database, not merely behind a login. That text survives a database dump as ciphertext; the key lives elsewhere.

Every API endpoint that touches health data declares it, and the declaration is what writes the audit row — so the record of who looked at what is a property of the route, not a thing somebody remembered to add. If that row cannot be written, the read does not succeed.

Admin, coach, physio, athlete, front desk — and the read-only support role above. Injuries, assessments and the medical fields on a profile are admitted to admin, coach and physio; a front-desk account takes a payment and books a session without them.

Programs come from a coaching method applied to each athlete's data. The same inputs give the same program, and when a program changes, something it was built from changed: the athlete, the gym's setup or the method. Never chance.

Each exercise Helix chooses carries the reason it was chosen, in coaching terms, which makes a coach's override a decision rather than a fight with a black box.

It's learned only from your own coaches' programs, and it's never shared with another gym without your written consent.