What does the company see?

Team totals on the dashboard and in exports: steps, active days, how many people joined. A team admin can see the names and active minutes of people on their own team. Nobody at the company sees workouts, heart rate, sleep, weight or location, and exports carry no names. Teams under 3 people are hidden.

Is this part of our health plan? Do you sign a BAA?

No and no. OutPace is a culture activity, not part of your group health plan. We receive no plan or claims data, we ask no medical questions, and we do not sign business associate agreements. Participation is voluntary and should stay that way.

How do people join, and who can get in?

Each team gets its own join link and QR code. You can limit sign ups to your company email domain. Employees install the free app, allow step access on their phone or watch, and join from the link. No SSO or HR system sync today.

Prizes are between you and your team. OutPace gives you the final standings; it does not pay out points or rewards. If you offer one, reward taking part rather than a step number, and remember that cash and gift cards are taxable wages while a t shirt is not. Your payroll provider can confirm.

Where is the data, and how is it protected?

Stored and processed in the United States, on Supabase and Vercel. Data is encrypted in transit, sensitive data and access keys are encrypted at rest, and database rules let each account read only what it is allowed to see. We never sell data or use it for advertising. We do not have a SOC 2 report yet; our written security answers are on the security and privacy page.

For HR, benefits and IT

Security and privacy for employers

Written so you can forward it. Every statement here matches the Privacy Policy, which is the document that binds us. Last reviewed November 2026.

Quick answers

What does the company see?: Team totals on the dashboard and in exports: steps, active days, how many people joined. A team admin can see the names and active minutes of people on their own team. Nobody at the company sees workouts, heart rate, sleep, weight or location, and exports carry no names. Teams under 3 people are hidden.
Is this part of our health plan? Do you sign a BAA?: No and no. OutPace is a culture activity, not part of your group health plan. We receive no plan or claims data, we ask no medical questions, and we do not sign business associate agreements. Participation is voluntary and should stay that way.
How do people join, and who can get in?: Each team gets its own join link and QR code. You can limit sign ups to your company email domain. Employees install the free app, allow step access on their phone or watch, and join from the link. No SSO or HR system sync today.
What about prizes?: Prizes are between you and your team. OutPace gives you the final standings; it does not pay out points or rewards. If you offer one, reward taking part rather than a step number, and remember that cash and gift cards are taxable wages while a t shirt is not. Your payroll provider can confirm.
Where is the data, and how is it protected?: Stored and processed in the United States, on Supabase and Vercel. Data is encrypted in transit, sensitive data and access keys are encrypted at rest, and database rules let each account read only what it is allowed to see. We never sell data or use it for advertising. We do not have a SOC 2 report yet; our written security answers are on the security and privacy page.

In one paragraph

OutPace is a free app that runs step and activity challenges between teams. Employees join a private company space from a link; their steps and workouts sync from their own phone or watch. The company sees team totals. Nobody at the company sees an individual’s workouts, heart rate, sleep, weight or location. OutPace is not part of your health plan, asks no medical questions and signs no business associate agreement. Data is stored in the United States, encrypted in transit, with sensitive data encrypted at rest, and is never sold or used for advertising.

What OutPace stores

For each person who signs up, OutPace keeps:

Account details: email, encrypted password, display name, date of birth (to check 18 or over, never shown), time zone.
Fitness summaries from the sources they connect: steps, distance, active minutes, workouts, and where a source provides it, heart rate and sleep totals. These are used to score challenges and build the person’s own history.
Challenge data: which challenges and teams they are in, standings, and any chat messages they send.
No GPS tracks, routes or coordinates. Location data is intentionally excluded from our database.

What an employer can and cannot see

The same lines every member sees before joining a company space:

OutPace does not collect GPS tracks or routes, and no locations are shown anywhere.
Admins above your team see participation only, and only for groups of 3 or more.
Your own team’s admin can see your name and your active minutes, and can match your nickname to your name.
No heart rate, sleep, weight or other health data is shown to your employer.
Your account, history and friends stay yours, including if you leave the company.

Dashboard and exports

Company admins get a live dashboard: how many people have joined, team standings, steps and active days per team. The CSV export carries team level numbers and no names. A competition’s final standings can be exported when it ends. The individual standings board uses the nicknames people choose. There is no per employee report, by design.

Not part of your health plan

OutPace is a workplace culture activity. It is not offered through, funded by or connected to a group health plan, and OutPace receives no plan, claims or insurance data. The app asks no medical questions and runs no health screening. OutPace therefore does not act as a HIPAA business associate and does not sign business associate agreements.

Participation should always be voluntary. If you attach a prize, reward taking part rather than a step total, and keep it small. Cash and gift cards are taxable wages at any value; a t shirt is not. Your payroll provider or benefits broker can confirm how that applies to you.

Hosting and encryption

OutPace Fit, Inc. is a United States company and your data is stored and processed in the United States.

Database, sign in and file storage: Supabase, eastern United States.
Application hosting: Vercel, United States.
Data in transit is encrypted (HTTPS/TLS). Sensitive data is encrypted at rest, and the access keys we hold for connected fitness platforms are encrypted in our database.
Passwords are hashed, never stored in the clear. Sign in is by email and password or Apple or Google sign in, with a bot check on sign up.
Database rules let each account read only what it is allowed to see.
Error monitoring runs with its personal data defaults off and no session recording.

Who else touches the data

Our service providers process data for us under contracts that limit them to our instructions. The full list, with what each receives, is in section 4 of the Privacy Policy. In short:

Vercel (hosting and cookieless website analytics), Supabase (database and sign in), Resend (email), Sentry (error monitoring), Cloudflare Turnstile (bot check), Expo (push notifications).
Anthropic receives the text of help questions typed into Ask the Aid Station and of feedback emails, never steps, distance, heart rate, sleep or names. Notion tracks feedback. GIPHY receives GIF search words.
We never sell personal data, never share fitness data with advertisers, and never share data across a person’s different fitness platform connections.

How long data is kept, and how it is deleted

Account and challenge history: while the account exists.
A disconnected fitness source: hidden for 30 days, then deleted.
Account deletion: anyone can delete their account in Settings. After a 30 day grace period everything is permanently removed. Their account, history and friends are theirs, including if they leave the company.
Security and activity logs: 365 days.
A company space can be ended at any time by asking us. Members keep their own accounts; the company dashboard and exports stop.

Who can use it

OutPace accounts are for adults 18 and over. We ask for a date of birth at sign up and refuse anyone under 18. Employees who do not want to take part simply do not join; nothing in OutPace tells the company who declined.

What OutPace does not offer today

So nobody is surprised later:

No SSO or HR system sync. People sign up with an email; your company email domain can be required.
No incentive engine, points store, HSA deposits or payroll feed. The employer runs any prize from the standings export.
No per employee report.
No SOC 2, ISO 27001 or HITRUST report. We will pursue an independent audit when the company pilots turn into paid plans. Until then, this page and the Privacy Policy are our written answers, and we will answer your questionnaire by email.

Cost and commitment

Creating and joining challenges is free, with no credit card. For the first few companies that join, the company pilot is free through the end of 2027, with no contract and nothing charged automatically. If pricing is introduced after that, companies on the pilot will hear from us well ahead of time.

Questions and incidents

Security questions, vendor questionnaires and privacy requests go to contact@outpace.fit. If a breach of personal data is likely to put people at risk, we will tell the people affected and the authorities the law requires, without undue delay.

Have a questionnaire?

Send it over and we will answer it in writing. Or ask about the company pilot, free through the end of 2027 for the first few companies that join, with no contract.

Email a security question Ask about a company pilot Back to step challenges for work