Privacy Policy

The controller responsible for your personal data is HealthspanOS AG, Zurich, Switzerland (“athletedata”, “we”, “us”). For anything about your data, including exercising your rights, email privacy@athletedata.health or write to us at the address above.

EU and UK representatives. Because we are based in Switzerland, we are appointing representatives in the EU (Art. 27 GDPR) and the United Kingdom (Art. 27 UK GDPR). Their details will be listed here. Until then, please contact us directly.

This policy covers our website, dashboard, iPhone app, the AI coach on WhatsApp, Telegram and iMessage, and MCP access for your own AI assistant. It is written to meet the Swiss Federal Act on Data Protection (FADP), the EU General Data Protection Regulation (GDPR) and the UK GDPR, and includes additional information for residents of certain US states (section 14). Swiss and EU law use slightly different words: where we say “personal data” and “health data”, the FADP says “personal data” and “sensitive personal data”.

Data you give us

• Account data: name, email address, profile photo (if you sign in with Google) and password (stored by our authentication provider in encrypted form, never by us in plain text).
• Your conversations with the coach: the messages, voice notes, photos and files you send, the coach’s replies, and your phone number or chat ID on the channel you connect.
• Your coaching profile: goals, races, availability, preferences, injuries and anything else you tell the coach, which it keeps as notes (“memory”) and summaries so it can coach you consistently.
• Documents you upload to your Health Vault, such as lab and blood test results, lactate or VO2max tests, body composition scans and medical reports, and the text we extract from them.
• Support: what you write when you email us, reply to us on WhatsApp, give feedback or book a call.

Data from the apps and devices you connect

Only if you connect them, and only the categories the provider lets you authorise. Depending on the source, this can include:

• Workouts: type, time, duration, distance, pace, speed, power, cadence, heart rate, elevation, laps and GPS routes.
• Recovery and health metrics: heart rate variability, resting heart rate, sleep and sleep stages, readiness or recovery scores, stress, blood oxygen, respiration, blood pressure, VO2max, weight and body composition.
• Nutrition: food logs, calories and macronutrients.
• Menstrual cycle: period dates and flow, if you connect a cycle-tracking app.
• Calendar: event titles and times from Google Calendar, Apple Calendar or your Android phone's calendar (such as Samsung Calendar), if you connect them, so the coach can plan around your schedule. Our phone app only reads your calendar; it never creates, changes or deletes events.
• Connection tokens that let us fetch this data for you. For a few apps that have no official connection, you give us (or our provider Terra) your login for that app, which we store encrypted.

The full list of sources is on our integrations page. Apple Health, Health Connect and Google data have extra rules, set out in section 13.

Data we collect automatically

• Location: your city and time zone, and, when you use route or weather features, start points you save and the coordinates needed to fetch the weather.
• Usage and device data: pages visited, features used, browser and device type, and the country your IP address is in. See section 11.
• Billing data: your plan, price, currency, payment status and dates. Card details stay with Stripe.
• How you found us: the referring website or campaign when you first visited.

Much of what we process is health data, which the law protects more strongly (special category data under Art. 9 GDPR, sensitive personal data under the FADP). We process it only with your explicit consent, which you give when you connect an app or device to athletedata or share health information with the coach. It covers processing your health data to coach you, including by the AI providers listed in section 6, some of which are in the United States.

You can withdraw your consent at any time by disconnecting a source, deleting the relevant data or documents, or deleting your account. This does not affect processing that already happened. Because personalised coaching is built on this data, we cannot coach you without it.

We do not sell your data, share it for advertising, or use it to build advertising profiles. We may create statistics that are fully anonymised, so no one can be identified from them, and use them to understand and improve athletedata and to publish general findings, such as trends across many athletes.

Your coach is an AI. To answer you, write your plan or send you a message, we send the relevant part of your data (your profile, recent training and health metrics, and the conversation) to an AI model, which generates a response and returns it to us.

We work with several AI providers and choose between them automatically for each request, based on what the request needs, how fast it has to be and what is available. Any of the providers listed under “AI providers” in section 6 may therefore process your data, and which one does can change over time. Whoever it is, the same rules below apply.

• No training on your data. We do not use your data to train or fine-tune AI models, and the AI providers that generate your coaching do not train on it either. Some providers keep requests for a short time only to detect abuse, then delete them.
• Memory and summaries. The coach automatically keeps notes about you and summaries of past conversations so it can coach you consistently. You can ask it what it remembers, and ask it to correct or forget things.
• People. Our team may look at a conversation when that is needed to help you, fix a problem or improve the coaching. Access is limited to what is needed.
• Profiling, no automated decisions. The coach builds a picture of your fitness and recovery to personalise its advice. It does not make decisions with legal or similarly significant effects on you. Your subscription, payments and account are handled by fixed rules you can see in our Terms, not by AI, and you can always contact a person about them.

Our service providers process data on our behalf, only on our instructions:

Services you connect. Apps and devices you connect (for example Garmin, Strava, WHOOP or Oura) are independent controllers of the data they hold. When you ask us to, we send data to them: workouts to your watch or training platform, events to your calendar, or a short line in your activity description (which you can turn off in your settings).

Your own AI assistant. If you connect ChatGPT, Claude or another assistant through MCP access, that assistant’s provider receives the data it requests and handles it under its own privacy policy. You can disconnect it at any time in your dashboard.

Your coach or team. If you join a coach’s team, the coach sees the data you agree to share when you accept the invitation (training, recovery and activity data). They do not see your conversations with the AI coach. You can leave the team at any time.

Others. We share data with authorities or others only where the law requires it, to protect our rights or someone’s safety, or with a company that takes over the Service (in which case we will tell you first).

We are based in Switzerland. Some of our providers process data in other countries, mainly the United States, and also the EU/EEA and the UK. Switzerland, the EU and the UK recognise each other as providing adequate protection. For transfers to the United States we rely on the provider’s certification under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework where available, and otherwise on the standard contractual clauses approved by the European Commission (with the Swiss and UK amendments). For transfers based on your explicit consent (section 3), the consent itself is the legal basis. You can ask us for a copy of the safeguards at privacy@athletedata.health.

• While your account is open we keep your data so we can coach you. You can delete individual items (for example a document or a connection) at any time.
• When you delete your account it is deactivated immediately. After a 7-day recovery window we permanently delete your data, including your files. Copies in our backups are overwritten within 90 days.
• Everything else we keep only as long as we need it for the purposes in section 4, then delete or anonymise it.
• Billing and accounting records are kept for 10 years, as Swiss law requires.
• After you delete your account we keep a small record of business facts (for example the month you signed up and whether you subscribed) under a one-way code instead of your name or email, so we can count our customers accurately. It contains no health data.

We protect your data with encryption in transit (HTTPS/TLS), encrypted storage for the files you upload, access controls that limit who in our team can see what, and logging. Passwords for third-party apps are stored with additional encryption. No system is perfectly secure; if a breach puts your rights at risk, we will tell you and the relevant authorities as the law requires.

You have the right to ask us for access to your data and a copy of it, to correct it, to delete it, to restrict or object to how we use it (including to object at any time to direct marketing), to receive it in a portable format, and to withdraw any consent you gave. Some of this you can do yourself in the dashboard, for example deleting your account or disconnecting an app; for anything else, email privacy@athletedata.health. We reply within 30 days. We may ask you to confirm your identity first.

You also have the right to complain to a data protection authority:

• Switzerland: the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, edoeb.admin.ch
• EU/EEA: the authority in the country where you live or work (list at edpb.europa.eu)
• United Kingdom: the Information Commissioner’s Office, ico.org.uk

We would appreciate the chance to sort things out with you first.

We use cookies to sign you in and run the site, and analytics tools to understand how it is used. Which cookies we use and how to manage them is explained in our Cookie Policy. Our iPhone app adds no tracking of its own; the dashboard screens it shows use the same analytics as the website.

The coach only messages you after you connect a channel yourself, by sending us a code from your own device. It then replies to you and sends messages about your own training and recovery. Occasionally one of our founders may also message you, for example to ask how your trial is going.

You can stop the messages at any time, and we act on it immediately. Tell the coach to stop, or disconnect the channel in Coach page of your dashboard . On WhatsApp and iMessage you can also reply STOP to stop the messages the coach sends on its own (you can still write to it), or UNSUBSCRIBE to end messaging on that channel altogether.

The messaging service you use (Meta for WhatsApp, Telegram, or Apple for iMessage) also processes your messages under its own privacy policy. Our use of WhatsApp follows the WhatsApp Business Messaging Policy.

Apple Health (HealthKit)

If you install our iPhone app and allow it, we read from Apple Health the categories you approve: workouts and workout routes, sleep, heart rate, heart rate variability, resting heart rate, blood pressure, VO2max, weight and body fat, steps and walking or running distance, running form metrics, and nutrition (energy and macronutrients). We never write to Apple Health.

We use HealthKit data only to provide your coaching and analytics. We do not use it for advertising or data mining, do not sell it, do not use it for research, and do not share it with third parties except the service providers in section 6 that process it on our behalf, or your coach if you choose to join a team. You can revoke access in iPhone Settings → Health → Data Access & Devices → athletedata.

Health Connect (Android, including Samsung Health)

If you install our Android app and allow it, we read from Health Connect the data types you approve: exercise sessions with their distance, calories, elevation and heart rate, sleep and sleep stages, heart rate variability, resting heart rate, weight, body fat, steps, nutrition (energy and macronutrients) and blood pressure. This includes data that Samsung Health and other apps write to Health Connect. With your permission we also read your history and read in the background, so the coach stays current without you opening the app. We never write to Health Connect.

We use Health Connect data only to provide your coaching and analytics, as described in sections 4 and 5. The use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements. We do not use it for advertising, do not sell it, do not use it to determine credit or insurance eligibility, and do not share it with third parties except the service providers in section 6 that process it on our behalf, or your coach if you choose to join a team. You can change or revoke access at any time in Android Settings → Health Connect → App permissions → athletedata, and disconnecting in your dashboard stops the sync.

Google user data

athletedata’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Health, Calendar and Sheets data only to provide the features you use, do not use it for advertising, do not sell it, and do not let people read it except with your permission, for security or legal reasons, or for support you ask for. You can revoke access at myaccount.google.com/permissions.

This section is our Consumer Health Data Privacy Policy under the Washington My Health My Data Act, Nevada law (SB 370) and the Connecticut Data Privacy Act, and applies to residents of those states.

• What consumer health data we collect and where from: the health, fitness, sleep, nutrition, cycle and body data described in section 2, from you, the apps and devices you connect, and what we derive from them (for example fitness and recovery trends).
• Why: to provide the coaching and analytics you request, as described in sections 4 and 5.
• Who we share it with: the service providers (processors) in section 6, services you connect or ask us to send data to, and a coach if you join their team. We do not sell consumer health data.
• Your rights: to confirm whether we collect your consumer health data, access it, get a list of the third parties we share it with, delete it and withdraw consent. Email privacy@athletedata.health with the subject “Consumer health data”. If we deny your request, you can appeal by replying to our answer, and if you are still not satisfied you may contact your state’s Attorney General.

athletedata is for adults aged 18 and over. We do not knowingly collect data from anyone younger. If you believe a minor has given us their data, please contact us and we will delete it.

We will update this policy when our processing changes. If a change is significant, we will tell you by email or in the product before it applies, and ask for your consent again where the law requires.

HealthspanOS AG, Zurich, Switzerland
Privacy questions and requests: privacy@athletedata.health