Privacy Policy

1. Controller

Christian Manunzio is the controller within the meaning of Article 4(7) GDPR. You may submit privacy requests at any time using the contact details above.

2. Data we process and where it comes from

• Account and profile data: email address, username, name, profile image, account status, registration, login, verification, roles, teams, and consent records.
• Training and activity data: activities, FIT files, sport, time, duration, distance, elevation, power, heart rate, cadence, speed, GPS positions, splits, sensor and stream data, and metrics derived from that data.
• Health and performance data: including heart rate, sleep, stress, recovery, readiness, training load, subjective wellbeing, body measurements, tests, and data that may reveal a person's physical or mental condition.
• Planning and library data: workouts, notes, training phases, folders, calendar data, versions, sharing permissions, and synchronisation decisions.
• Coaching, team, and communication data: coach-athlete relationships, team roles, permissions, messages, comments, notes, and status information.
• Integration data: provider identifier, granted permissions, OAuth access and refresh tokens, synchronisation status, provider IDs, and technical import logs.
• Technical and security data: IP address, timestamp, requested resource, browser, operating system, device class, session data, and error, access, and security logs.
• AI data: prompts, audio recordings used by voice features, selected context data, and responses from the AI provider displayed in the relevant feature.

Data is obtained from you, uploaded files, third-party accounts that you explicitly connect, authorised coaches or team members, and the technical use of FITAnalyse. Data received from connected providers is processed in accordance with Article 14 GDPR and for the purposes described in this policy.

3. Purposes and legal bases

Our legitimate interests are IT security, prevention of misuse, troubleshooting, traceable access management, and the establishment, exercise, or defence of legal claims. Where consent is required, it takes precedence over reliance on legitimate interests.

You must provide the information marked as mandatory for account creation and login. Integrations, AI features, and additional training data are optional; without them, the respective functions will be unavailable or limited.

4. Health data and explicit consent

Before use, your explicit consent to the processing of health data described in this policy is recorded. The record contains the document version, time, IP address, user agent, and source of consent. Consent is voluntary and may be withdrawn at any time with future effect by emailing the privacy contact.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Because health data is central to the training analysis, those functions cannot continue after withdrawal. Statutory retention and documentation duties and processing required for legal claims remain unaffected to the extent necessary.

5. Connected sports and training services

An integration is enabled only when you explicitly connect the relevant service. FITAnalyse stores the identifiers, permissions, and tokens required for that connection. The data that can be read or written depends on the provider, the permissions granted there, and the function initiated by you.

• Garmin: account, permission, activity, workout, and, where authorised, health and historical data; imports may use Garmin push and backfill functions.
• Strava: profile, activity, detail, and stream data, as well as webhook-based updates where provided by Strava.
• WHOOP: profile, body measurements, recovery, cycles, sleep, and workouts, including automatic webhook updates.
• Wahoo: account and workout data, historical imports, and webhook-based updates.
• Intervals.icu: FITAnalyse requests ACTIVITY:WRITE, WELLNESS:WRITE, CALENDAR:WRITE, CHATS:WRITE, LIBRARY:WRITE, and SETTINGS:WRITE. Write access includes read access for each scope. Depending on the specific FITAnalyse feature used, this permits completed activities, wellness data, planned workouts and calendar entries, chats, groups and messages, library folders and content, and athlete settings to be read and updated. A transfer is triggered only by a specific feature or user decision; granting the permission alone does not start synchronisation.

During OAuth authorisation, providers receive technical connection data and the information needed for authorisation. You can disconnect a provider in the FITAnalyse settings and revoke access in the provider account. Processing performed by the provider is governed by its own privacy policy: Garmin, Strava, WHOOP, Wahoo, and Intervals.icu.

6. Optional AI and voice features

AI features become active only when you provide an input or initiate an analysis. Depending on the displayed feature, prompts, selected training, recovery, comment or team context, and generated responses are transmitted to the configured provider. For voice features, the recording is sent to OpenAI for transcription.

Providers may include OpenAI and Anthropic. The provider used is shown in the relevant feature. Do not submit third-party data unless you are authorised to do so. AI output is not used without human review as a medical diagnosis or binding training decision.

7. Maps, geocoding, and external content

• LocationIQ: GPS coordinates may be transmitted server-side to determine a place or address.
• OpenStreetMap/Nominatim and map tiles: when a map is displayed, the relevant server may receive the IP address, timestamp, browser data, and requested map tiles. The requested section may indicate an approximate route area.
• Content delivery networks: individual libraries or assets may be loaded from jsDelivr, cdnjs/Cloudflare, or unpkg. The provider receives technically necessary connection data such as IP address, timestamp, and requested file.

Further information is available from LocationIQ, OpenStreetMap Foundation, jsDelivr, and Cloudflare.

8. Other recipients and sharing

Personal data is made available only to parties that need it for the relevant purpose. Recipients may include the integration, AI, map, and CDN providers listed above, hosting, database, email, backup, and other infrastructure providers, and technical processors.

Coaches, trainers, team managers, or other users can see data only within the relationship, team membership, role, or permission configured by you. Future library sharing may make workouts, notes, phases, and folders visible or editable according to the selected permission. Public bodies, courts, and advisers receive data only where legally required or necessary to establish, exercise, or defend legal claims.

FITAnalyse does not sell personal data.

9. Transfers outside the EU and EEA

Some providers may process data in third countries, particularly the United States. Transfers are made only where the requirements of Articles 44 et seq. GDPR are met. Depending on the recipient, we rely on an adequacy decision, for US organisations only where the specific recipient participates in the EU-US Data Privacy Framework, EU Standard Contractual Clauses together with any necessary supplementary measures, or another lawful transfer mechanism.

If explicit consent under Article 49(1)(a) GDPR is exceptionally required, we will inform you separately about the associated risks before the transfer. You may request details of the safeguards used for a specific recipient from the privacy contact.

10. Cookies and similar storage technologies

These storage operations are necessary for the functions expressly requested and are performed under section 25(2)(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG). We do not use our own advertising or marketing cookies. If optional, non-essential technologies are introduced, they will be activated only after your consent.

11. Retention and deletion

We retain data only for as long as required for the relevant purpose. It is then deleted or anonymised unless statutory retention duties or overriding grounds for the establishment, exercise, or defence of legal claims require continued retention.

• Account, training, library, calendar, and communication data: until you delete the relevant content or account or request deletion; afterwards only where a legal basis requires retention.
• Integration data and tokens: until the connection is disconnected, access is revoked at the provider, or the account is deleted. Technical mappings and import logs may be retained where needed to prevent duplicates, investigate errors, or defend legal claims.
• Consent records: while the processing continues and afterwards for applicable documentation and limitation periods.
• Session and remember-me data: for the duration stated in section 10; expired or revoked tokens are invalidated and deleted.
• Support data: until the request is completed and afterwards where documentation, retention, or limitation periods require it.
• Error, access, and security logs: until the operational or security purpose no longer applies; for a specific incident, until its resolution and any related legal defence are complete.
• Backups: deleted data may remain in protected backups until the relevant backup is overwritten in the normal rotation and is not used for production purposes.

12. Your data protection rights

Where the relevant requirements are met, you have the right to:

• access under Article 15 GDPR,
• rectification under Article 16 GDPR,
• erasure under Article 17 GDPR,
• restriction of processing under Article 18 GDPR,
• data portability under Article 20 GDPR,
• object under Article 21 GDPR, and
• withdraw consent with future effect.

Specific information about your right to object

Where processing is based on Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then stop processing the data unless compelling legitimate grounds override your interests or processing is required for the establishment, exercise, or defence of legal claims.

Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority. The authority responsible for the controller is, in particular, the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, telephone +49 211 38424-0, email poststelle@ldi.nrw.de.

13. Automated analysis and decisions

FITAnalyse calculates metrics, models, scores, and AI-supported information. These results are intended to inform and support human training and coaching decisions. No decision is made solely by automated means that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR.

14. Data security

We implement technical and organisational measures appropriate to the risk. These include encrypted transmission, role-based access, session and CSRF protection, secure token handling, segregation of permissions, logging of security-relevant operations, and backup and recovery procedures. No internet-based system can guarantee absolute security.

15. Minors

FITAnalyse is not directed at children under 16. Persons under the age of 16 may not create their own account or use the platform independently.

16. Changes to this Privacy Policy

We update this policy when the law, features, recipients, or processing operations materially change. The current version is available on personaltrainer.bike. Where a change affects consent, we will obtain renewed consent before continuing the changed processing.