Privacy Policy

What we collect

• Account data: name, email, password (stored hashed), country, time zone.
• Athlete profile: age, sex, height, weight, training history, goals, target races, availability, injuries or limitations you choose to tell us about.
• Training and health data from connected services: if you connect Garmin or another wearable platform, we receive the data you authorize, such as activities, GPS tracks, heart rate, HRV, sleep, stress, body composition and daily summaries.
• Data you enter in the app: workout feedback, perceived effort, notes, and messages with your coach or the AI assistant.
• Technical data: device type, app version, log files, IP address, basic usage events, used to run and secure the service.
• Payment data: handled by our payment provider. We don’t see or store your full card details.

Why we use it and on what legal basis

• To provide the service — create training plans, adapt them to your data, show your progress, let your coach work with you. Basis: performance of our contract with you (GDPR art. 6(1)(b)).
• Health and fitness data (heart rate, HRV, sleep, injuries, body data) is a special category of data. We process it only with your explicit consent (art. 9(2)(a)), which you give when you connect a device or enter that data, and can withdraw at any time.
• To keep the service secure and working — fixing bugs, preventing abuse, measuring aggregate usage. Basis: our legitimate interest (art. 6(1)(f)).
• To meet legal obligations — tax, accounting, responding to authorities. Basis: art. 6(1)(c).

We don’t use your data for advertising and we don’t sell it.

AI processing

Ultrathlete uses AI models to generate and adjust training plans and to answer your questions. To do this, relevant parts of your profile and training data are sent to our AI model provider, under terms that prohibit it from using your data to train its models. Plans are recommendations, not medical advice. No decision with legal or similarly significant effects on you is made solely by automated means.

Garmin and other connected devices

• We access your Garmin data only after you authorize it through Garmin’s own consent screen, and only the data types you approve.
• We use Garmin data only to provide Ultrathlete features to you (and to your coach, if you have one). We don’t sell it, rent it, or use it for advertising.
• You can disconnect at any time from the Ultrathlete app or from Garmin Connect. From that moment we stop receiving new data.
• You can ask us to delete the Garmin data we already hold at any time; it’s also deleted when you delete your account.
• Garmin’s handling of your data is governed by Garmin’s own privacy policy.

Who we share it with

• Your coach, if you are coached through Ultrathlete.
• Service providers that process data on our behalf under data processing agreements: cloud hosting, AI model provider, wearable data integration provider, email delivery, payment processing.
• Authorities, when required by law.
• A buyer or successor, if Ultrathlete is merged or acquired, under the same protections described here.

International transfers

Some of our providers are based outside the European Economic Area, mainly in the United States. In those cases we rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses.

How long we keep it

• Account, profile and training data: for as long as your account is active.
• After you delete your account: removed within 30 days from live systems, and within 90 days from backups.
• Invoices and accounting records: for the period required by Italian law (currently 10 years).

Security

Data is encrypted in transit and at rest, access is limited to people who need it, and our providers are chosen with security in mind. No system is perfectly secure; if a breach affects you, we’ll notify you and the authority as required by law.

Your rights

Under the GDPR you can: access your data, correct it, delete it, get a copy in a portable format, restrict or object to processing, and withdraw consent at any time (without affecting processing done before). Contact us and we’ll reply within one month.

You can also lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali, or with the authority in your country of residence.

Age

Ultrathlete is for people aged 18 or over. We don’t knowingly collect data from minors; if we find out we have, we delete it.

Changes

We’ll update this policy as the product evolves. For material changes we’ll notify you in the app or by email before they take effect.