Progressive disclosure
Bring only what helps.
The Gym receives a purpose-built projection—not a medical record. Inspect every field before connecting it.
Checking context…
The Gym is checking its HttpOnly session cookie; it is not reading a Passport from browser storage.