How your data is handled

Your members' card numbers never touch us

When a member pays, the card goes straight to Stripe. Stripe is the company that runs payments for millions of businesses. We never see the card number, we never store it, and we never pass it along. We only ever hold a Stripe reference, never the card itself. So even if someone got into our systems, there is no card number there to take.

Your gym is walled off from every other gym

Your members, your programs, and your numbers live in their own locked room. Another gym on Marrow cannot see into yours, and you cannot see into theirs. One coach can never see another coach's people.

This is not a setting we remembered to switch on. The database itself has rules about who can read each row, and our server, which does most of the reading for the website and the app, checks again on every request that a coach is asking about someone on their own roster. We check both walls against an attack plan on a regular basis.

Your data is locked while it moves and while it sits

Everything is encrypted on the way in and on the way out, and encrypted again while it sits in storage. In plain terms, if anyone grabbed it in transit or at rest, they would see scrambled nonsense, not your members and not your money. There is no open, unlocked path for your data anywhere in the system.

Most of the smart decisions never leave our system

A lot of what looks like AI is actually simple decision logic that runs right inside Marrow. Sorting a lead, flagging who might need attention, routing a task. None of that is sent to any outside AI. It is decided in our own system and nothing about your members goes anywhere to make those calls.

What AI sees, and when

Marrow sends no member or coach data to an AI provider, and pays for no AI. Where an AI helps, it is the Claude or ChatGPT the person already uses, on their own account with that company. If they connect it to their Marrow account, it reads what they let it read through that connection; otherwise they copy a prompt into it and paste the answer back. Either way Marrow checks only the shape of what comes back and shows it to the person, to check before anything is saved.

These are the files a person now reads with their own AI. A lab report a member adds as a PDF or a photo, or one a coach adds for a client who shares their labs with that coach. A program a coach brings across from another app as a PDF, a Word document or a photo; a CSV program file is still read by Marrow itself, with no AI. A meal plan a coach wrote as a PDF or a photo, and a photo a member takes of a meal plan they already have; a meal plan as text or a Word document is still read by Marrow itself, with no AI. A photo a member takes of a body scan sheet. And in Drop anything, when Marrow cannot tell from a file itself what it is, the coach picks the kind; nothing is sent anywhere to ask.

A member can ask for meal ideas and a grocery list in their own Claude or ChatGPT. Connected to their Marrow account, it reads their targets and the day's log through that connection and writes the ideas in its own chat. Marrow sends nothing to an AI for it and stores none of it.

A coach can draft a program with their own connected AI, which saves it into their library as a private draft; it cannot publish or assign it without the coach's yes. A member can draft one with their own AI too; if they have a coach, it goes to that coach as a proposal and cannot change the coach's program. Marrow sends nothing to an AI for either.

A member can ask their own Claude or ChatGPT about one of their own lab reports. Marrow gives them a prompt with that report's marker table to copy into it. Marrow sends nothing to an AI for this, and that AI reads nothing in Marrow and writes nothing back. What it says is general education, not medical advice.

Separately, a coach can ask the co-pilot to draft a short message to a member from their dashboard. Marrow fills in a plain template for the coach to edit and sends nothing about the member to an AI. If the coach drafts it with their own connected Claude or ChatGPT instead, that AI reads the member's recent training through the coach's connection, with the member as a coded pointer, never by name, unless both yeses below are given. The coach reads and edits the draft before it goes anywhere.

A coach can also press Draft a reply on a member's weekly check in. Marrow fills in a plain template from that member's week and the answers they wrote on that check in, and sends nothing to an AI. A coach who drafts it with their own connected AI does so through their connection, as above. The coach reads and edits the draft, and nothing is sent until the coach presses Send.

Each job works on one member or one document at a time.

A coach can also connect their own Claude to their own Marrow account, described below. That is the one place a member can appear to an AI by name, and only after two yeses: the coach switches on Client profiles, and the member agrees in their own Marrow account. Until both are true, a member reaches that AI only as a count or a coded pointer. We keep this page matched to what is actually running.

No AI provider of our own

For the Marrow platform, Marrow sends no member or coach data to an AI provider. The one exception is an Anthropic key a gym or coach saves in Marrow themselves: a gym's WhatsApp front desk, the website studio and a coach's client list import can then send what that job needs to Claude on that key, under their own account with Anthropic. A client list import sends only the column names and what the values look like, never the values. Nothing is sold, and your information is not handed around. An assistant a coach or member connects to their own account is their own choice of company, on their own account, as described below.

Note. This single-provider point describes the Marrow platform. Our separate AI phone and messaging product (the AI receptionist) uses a few named specialist vendors for the phone line, the hearing, and the voice. If you take that product, you get its own plain list of who touches the call and why.

We name the companies that touch your data

We do not keep a secret list of vendors. The outside companies that touch your data are named on a public page with what they do and what they see. If we ever add or change a vendor, you hear about it. You can read the list any time.

When you connect your own Claude, the account stays yours

Marrow connects the Claude account you already pay for to your Marrow account. It is your subscription with Anthropic, not ours, and how they handle what you send is governed by your settings and their terms. We do not sit in the middle of it and we do not keep a copy.

It can see what your dashboard shows you: your own content, your prices, your schedule, your revenue, and your clients' programs, workouts, messages, check ins, nutrition, measurements, bookings and billing with you. Clients reach it as coded pointers. A client reaches it by name only when you switch on Client profiles and that client has agreed in their own Marrow account, and they can take that back at any time.

Anything that reaches a person, moves money or changes what a client sees happens in two steps: it shows you exactly what would happen and to whom, and acts only after you say yes. A text goes only to a client who said yes to texts themselves, in their own Marrow account. You can disconnect it here at any time, at which point it loses access immediately. The full terms are in the connection agreement.