CrossFit

The Life Time and Gold's Gym rows record a Mindbody vendor exposure; whether CrossFit affiliates (many of which use third-party scheduling and billing software) were affected was not confirmed this pass. CrossFit's affiliate model means individual gyms are independently owned and licensed, so member data sits with thousands of small businesses operating whatever software they chose, and the CrossFit brand governs almost none of it. For a member, the practical consequence is that the privacy policy on the national website describes a relationship they do not actually have.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-08-04

Primary source. None recorded — Unverified - heuristic first draft.

Arbitration

Not independently confirmed this pass — CrossFit's structure (a licensed affiliate-gym network rather than centrally-owned locations) means each individual CrossFit AFFILIATE gym likely has its own separate terms/waiver distinct from any CrossFit HQ-level agreement.

Data sharing

Possible MINDBODY vendor exposure (see Life Time Fitness/Gold's Gym rows; not confirmed for CrossFit this pass) — CrossFit affiliate gyms may use Mindbody for class scheduling/billing, meaning individual CrossFit affiliate members' data may flow through the same vulnerable shared vendor even though CrossFit itself (the HQ brand) operates as a licensing/certification organization rather than directly running most individual gyms.

Contacts

Privacy contact. Not recorded.

Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.

Mailing address. Not recorded.