Privacy Policy

1. Introduction

This Privacy Policy explains how Coach Vita ("we", "us", or "our") collects, uses, and protects your personal data when you use our personal training and coaching application. Coach Vita is available as a web application and as a mobile app for iOS and Android. It is operated by Coach Vita UG (haftungsbeschränkt), based in Berlin, Germany. We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR/DSGVO).

This policy explains what we do with your data and on which legal basis (Section 4). Where processing needs your consent, we ask for it separately in the app; using the app is not itself consent.

2. Data Controller

The data controller responsible for your personal data is:

Coach Vita UG (haftungsbeschränkt) has been the controller since its entry in the commercial register on 2 September 2026. Before that date, Martin Eliason was the controller as a natural person. The purposes, recipients and retention of your data are unchanged.

3. Personal Data We Collect

We collect the following types of personal data:

Account Information

• Name
• Email address
• Password (stored securely using industry-standard hashing)
• Authentication tokens (for Google and Apple Sign-In)

Workout and Training Data

• Training programs and exercises
• Workout session logs (dates, weights, sets, reps, RIR)
• Personal notes on exercises
• Progress metrics and statistics
• Daily check-in responses (mood, sleep quality, soreness, and optional tags such as feeling stressed or run down)
• Activities from connected wearables and apps: type, start time, duration, distance, steps, calories and GPS route (see Section 5 for routes)

Health and Fitness Data (Special Category, see Section 4)

• Heart rate variability (HRV) and resting heart rate
• VO2 Max and cardiovascular fitness metrics
• Sleep data (duration, stages, scores)
• Body weight and body composition measurements
• Recovery scores and strain data
• Stress levels and Body Battery data (Garmin)
• Heart rate, heart rate variability, stress, Body Battery, respiration, blood oxygen and skin temperature measured during or around an activity by a wearable
• Nutrition data (calories, macronutrients) if you enable it
• Mobility check results (your range-of-motion checks and any routine built from them), stored only after a separate explicit opt-in before your first check

Health data is collected from Apple Health (HealthKit), Google Health Connect, and/or third-party wearable integrations (Garmin, WHOOP, Withings, Strava) only when you explicitly connect them.

Location and Route Data (Mobile App Running Feature, see Section 5)

• Precise GPS location, collected only while a guided run is active
• Your run route, a simplified line of GPS points, kept in the app and stored with the run on our servers
• Distance and pace, calculated on your device from that location

Location is used only during an active run, never in the background at any other time. Your route is stored with the run in your account and is never given to the AI coach. See Section 5 for full details.

Breathe (Mobile App Breathing and Meditation)

The mobile app includes Breathe: guided breathing sessions, short meditations, multi-week practice journeys and a breath-bracing drill for lifting.

• Your session history: which session and length you played, when you started and finished, how far you got, whether you finished or stopped early, and the journey a session counted towards. We keep this for as long as you have your account, and delete it with your account.
• Your journeys and Breathe settings: the journey you are on, its start date and any pauses, whether you finished the first-run pages, the moments you picked (for example after training or before bed), and which suggestions we showed you, so we do not repeat them too often.
• Two optional questions, if you answer them. The first-run pages ask what you would like from Breathe (for example to feel calmer or sleep better) and when a minute of breathing would help (for example in the evening or on busy days). Both are optional, you can skip either, and you pick from a fixed list with nothing to write in. We keep your answers so Coach Vita can suggest sessions that fit. They are your own wishes, not a judgement about your health, and answering the second one does not set a schedule or a reminder.
• Your answer to "How do you feel now?" after a session, if you give one: calmer, about the same, or worse. We never ask why, and there is no place to write a reason. Coach Vita can see this answer for your last 14 days.
• The Breath-Brace check stays on your phone. Before the bracing drill, the app asks five yes or no questions about your health. We never store your answers, and they are never sent to us. If you answer no to all five, your phone remembers only that you passed, for 90 days, so it does not ask every time. If you answer yes to any of them, nothing is saved.
• Heart rate variability or resting heart rate, from sources you already connected. If you have connected Apple Health, Health Connect or a wearable and given the health-data consent in Section 4, a journey can show your own overnight values next to your practice days. Breathe collects nothing new: it shows data you already share with us, only to you, with no score and no conclusion about your health, mood or stress.
• Your morning check-in. If your daily check-in says you slept poorly, your mood is low, you are sore from yesterday, or you feel sick or run down, Breathe may suggest one calm session on the Today screen that day. This uses only your own check-in answers, never a wearable score, and only with the health-data consent in Section 4. On other days, Breathe shows nothing on the Today screen.
• Coach Vita sees your last 14 days of sessions: which Breathe sessions you played, how long they were, your "How do you feel now?" answer, and the two optional answers above if you gave them, so it can talk about them with you. This is sent to Anthropic, our AI provider (see Section 7). The coach never sees your heart rate variability, your resting heart rate or your Breath-Brace answers.
• Apple Health, only if you allow it. If you give the app permission, a finished session is saved to Apple Health as mindful minutes. The app also reads your mindful sessions back on your phone, to leave out heart rate readings taken right after practising. Those readings stay on your phone.

We process your session history, journeys, Breathe settings, the two optional onboarding answers and your "How do you feel now?" answers under Art. 6(1)(b) GDPR, because recording and counting your practice is part of the Breathe feature you chose to use. Showing your heart rate variability or resting heart rate, and reading your check-in answers for a suggestion, rely on your explicit consent under Art. 9(2)(a) GDPR described in Section 4; without it, Breathe works without them.

Coach Vita Conversations

• Messages you send to the AI coaching assistant
• AI-generated responses and recommendations
• Conversation summaries for context continuity
• Files you choose to attach in the chat (images or PDF documents), stored with Cloudflare R2 in the EU for the life of your account; unfinished uploads are deleted automatically after about three days. A PDF can contain health information and is sent only after you have given the health-data consent in Section 4. We delete a single attachment on request.

Technical Data

• Device type and operating system
• App version
• Push notification tokens, your notification settings and a delivery log. The content of a notification can be derived from your training or health data; the lock-screen title is deliberately generic and details appear only in the opened message. Delivered through Expo (EAS) and Apple APNs or Google FCM (see Section 7).
• Crash reports and performance data (via Sentry)
• IP address

Subscription Data (Mobile App)

• If you take out a subscription: subscription status, purchase receipts and expiry dates (via RevenueCat, see Section 7)
• Payments themselves are processed by Apple (App Store) or Google (Play Store). We never receive card numbers or bank details.

Waitlist and Email

• Waitlist sign-up: email address, first name, chosen platform (iOS or Android) and the optional answers on the form (experience level, how you track today, your biggest challenge); your invite code and status; a delivery log per email
• Emails about your account (confirmations, your invitation, notices of material changes to the app), sent through Resend (see Section 7)
• The waitlist form is protected by Cloudflare Turnstile, which processes technical characteristics of your browser and your IP address to block automated sign-ups

Data Stored on Your Device (Mobile App)

• Authentication tokens in the OS-encrypted keychain (iOS Keychain / Android Keystore via expo-secure-store)
• Offline workout data in a local SQLite database (synced to the server when online)
• App preferences and cache in AsyncStorage

4. Legal Basis for Processing

We process your personal data based on the following legal grounds:

General Personal Data (GDPR Article 6)

• Contract (Art. 6(1)(b)): Processing is necessary to provide the training tracker and coaching service you have subscribed to. This covers your account data, workout logs, and program data.
• Consent (Art. 6(1)(a)): For optional integrations with third-party services, we process data only with your explicit consent. You can withdraw consent at any time by disconnecting the integration in Settings.
• Consent (Art. 6(1)(a)): For anonymous product analytics (PostHog), we collect usage data such as screen views and feature adoption only with your explicit consent. You can enable or disable analytics at any time in Settings. Analytics data never includes health information, workout details, or personal content.
• Legitimate Interest (Art. 6(1)(f)): For crash reporting and performance monitoring (Sentry) to maintain service quality and fix bugs. You can object to this processing by contacting us.
• Legitimate Interest (Art. 6(1)(f)): For usage records we keep in our own database, with no analytics vendor: which step of onboarding or of the running setup you reached, that a workout, chat message or program was created, and the app language. During onboarding, before you have an account, these records carry a random interview identifier and are attached to your account when you sign up. They contain no health data and no message content and are never shared. You can object by contacting us.
• Consent (Art. 6(1)(a)): For the waitlist and the occasional notes we send before your invitation; each of those emails has an unsubscribe link. Emails about your account are sent under the contract (Art. 6(1)(b)). The bot check on the waitlist form (Cloudflare Turnstile) rests on legitimate interest (Art. 6(1)(f)).

Health Data: Special Category (GDPR Article 9)

5. Location and Route Data (Running Feature)

The Coach Vita mobile app includes a guided running feature. When you start a run, the app can record your location to show your live pace and distance and to draw your route. This section explains exactly what that involves and where the data goes.

What we collect

• Precise GPS location from your device, collected only while a run is active
• Your route, stored as a simplified line of GPS points for that run
• Distance and pace, calculated on your device from those location readings

On iPhone, if you allow it, location keeps recording while your screen is locked, so a run does not stop tracking when your phone is in your pocket. This background recording happens only during an active run. Location is requested when a run starts and switched off when the run ends or when you pause it yourself. If the app pauses a run automatically because you stopped moving, for example at a traffic light, location stays on during that short pause so the run can resume by itself when you move again. Coach Vita never records your location at any other time, and never in the background when you are not on a run. On Android, recording can continue behind the lock screen as a foreground service with a visible notification, again only during a run.

Location is entirely optional. If you decline the location permission, a run still works as a timer; it simply does not show pace or distance, or draw a route.

Why we use it

• To show your live pace and distance while you run
• To show your route on the run summary and in your run history in the app
• To draw your route on an optional keepsake card you can save or share
• To send a finished run to Strava, only when you ask us to

Where it is stored

Who receives it

• Not the AI coach. Your GPS route is never made available to Coach Vita's AI coaching.
• Our hosting providers. Neon and Vercel store and serve it on our behalf, as processors (see Section 7).
• Maps. When the app shows your route on a map, the map background comes from Apple Maps on iPhone or Google Maps on Android. Your device requests the map images for that area from Apple or Google. The route line itself is drawn on your device.
• Strava, only when you ask. If you tap to post a finished run to Strava, we send it to your Strava account: the route with its timing, the distance and duration. Heart rate is not sent. From then on Strava processes it under its own privacy policy.

Legal basis

We process your location and route under Art. 6(1)(b) GDPR, because recording, storing and showing your runs is part of the running feature you chose to use. Recording location on your phone also requires the location permission, which you grant and can withdraw at any time in your device Settings; without it a run still works as a timer. A run is posted to Strava only on your instruction for that run.

Retention and deletion

Your routes are kept with your run history for as long as you have your account. When you delete your account, they are deleted from our servers together with all your other data (see Section 9). If you want a single run and its route removed, write to support@coach-vita.com. Deleting the app removes the copy on your phone. A workout imported from Apple Health comes back on the next sync unless you also delete it in Apple Health. A run you posted to Strava stays on Strava until you delete it there.

Saving a run keepsake to your Photos

At the end of a run you can save a keepsake card, a summary image of your run that may include your route line, to your device's photo library, or share it through your device's share sheet. This happens only when you tap to save or share. Coach Vita has add-only access to your photo library: it can add the card you chose to save, and it cannot read, browse, or import any of your existing photos. On iPhone this is the "add photos only" permission, which you can change at any time in Settings.

6. How We Use Your Data

We use your personal data to:

• Provide and maintain the training tracker and coaching service
• Authenticate you and secure your account
• Store and display your workout history and progress
• Generate progress charts, statistics, and personal records
• Provide AI-powered coaching features (Coach Vita) including personalized training recommendations
• Deliver recovery and readiness assessments based on health data
• Send push notifications (workout reminders, coaching nudges) when enabled
• Sync with third-party fitness services when you opt in
• Diagnose and fix errors (crash reporting via Sentry)

7. Third-Party Service Providers

We use the following third-party services to operate Coach Vita:

Several service providers are located in the United States, including our database provider Neon. Your account data, including health data, is therefore stored in the United States. These transfers are safeguarded by the European Commission's Standard Contractual Clauses (Article 46(2)(c) GDPR) contained in or incorporated into each provider's data processing terms. Where a provider is also certified under the EU-U.S. Data Privacy Framework, the Commission's adequacy decision (Article 45 GDPR) applies in addition. Providers listed with a European Union location store your data in the EU; some of them are U.S. companies, and the same safeguards cover any access from the United States. You can request a copy of the safeguards that apply to your data at support@coach-vita.com.

8. Cookies and Local Storage

Coach Vita uses only essential cookies and local storage required for authentication and service operation. We do not use tracking cookies or advertising cookies. If you opt in to product analytics, PostHog operates in memory-only mode and does not set cookies or write to local storage.

9. Data Retention

We keep your account data and everything connected to it for the life of your account. This includes your profile information, workout history, run routes, training programs, coach conversations, health data, and any connected service data. When you delete your account, all of it is deleted promptly and irreversibly, at the latest within 30 days.

• Inactive accounts: we contact you after 24 months without use and delete the account 3 months later if there is no response.
• Waitlist entries that never convert: deleted after 24 months.

Crash reports and anonymized performance data may be retained for up to 90 days after the event for debugging purposes.

10. Your Rights Under GDPR

Under the GDPR, you have the following rights regarding your personal data:

• Right of Access (Art. 15): You can request a copy of all personal data we hold about you. You can also export it yourself directly in the app under Profile > Download My Data.
• Right to Rectification (Art. 16): You can request correction of inaccurate personal data.
• Right to Erasure (Art. 17): You can request deletion of your personal data ("right to be forgotten"). You can delete your account directly in the app under Profile > Delete Account.
• Right to Restrict Processing (Art. 18): You can request that we limit how we use your data.
• Right to Data Portability (Art. 20): You can request your data in a machine-readable format, or download it as a single JSON file in the app under Profile > Download My Data.
• Right to Object (Art. 21): You can object to processing based on legitimate interests.
• Right to Withdraw Consent: You can withdraw consent for health data processing at any time in the app (Disconnect & Delete Data for Apple Health or Health Connect under Profile) or by writing to us. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us at support@coach-vita.com. We will respond to your request within 30 days as required by GDPR.

11. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. This includes encrypted data transmission (HTTPS/TLS), secure password hashing, OS-encrypted keychain storage for authentication tokens on mobile devices, server-side access controls, and rate limiting on API endpoints.

12. Age Requirement

Coach Vita is intended for users who are at least 16 years of age (in accordance with GDPR Article 8 and German law). We do not knowingly collect personal data from anyone under 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us so we can delete the information.

13. AI Transparency (Automated Decision-Making)

Coach Vita includes an AI-powered coaching assistant powered by Anthropic's Claude API. In accordance with GDPR Article 22, we inform you about automated processing:

What data the AI processes

• Your workout history, training programs, and progress data
• Health metrics from connected sources (sleep, HRV, recovery scores, weight)
• Your profile information (goals, experience level, equipment, limitations)
• Your conversation messages with Coach Vita
• Files you attach in the chat, which are sent to Anthropic together with your message

Not included: the GPS route of a run and your mobility check results are never made available to the AI coach.

How the AI is used

The AI generates training program recommendations, exercise suggestions, recovery guidance, and coaching conversations. These are informational recommendations only; they do not constitute medical advice and do not produce legally or similarly significant effects. You are always free to disregard, modify, or override any AI recommendation.

Data handling by Anthropic

Data sent to the AI is processed per Anthropic's Privacy Policy. Anthropic does not use API inputs or outputs to train its models, and retains this data only briefly under its data processing terms before deletion.

You can disconnect any health data source at any time from Settings, which will stop that data from being included in AI coaching context.

14. Garmin Connect Data

Connecting Garmin is optional. If you choose to connect your Garmin account in Settings, we receive health and activity data from Garmin's Health API and Activity API, delivered to us by Garmin's push notification service. This section explains exactly what we receive, why we use it, who else processes it, where it is stored, and how you can stop it.

What we receive from Garmin

• Sleep: total duration, time in deep, light and REM sleep, time awake, and Garmin's sleep score
• Heart rate variability (HRV): your overnight average and your highest five-minute reading
• Stress and Body Battery: average and maximum stress level, time spent stressed and at rest, and Body Battery charged, drained, and current level
• Daily summaries: steps, active calories, resting heart rate, and average stress level
• Body composition, if you use a Garmin scale: weight, body fat percentage, muscle mass, bone mass, and body water percentage
• Fitness metrics: VO2 Max for running and cycling, and Garmin's fitness age estimate
• Skin temperature deviation, if your device records it
• Health snapshots recorded on your device
• Activities: activity type, the name you gave it, start time, duration, distance, calories, steps, average and maximum heart rate, average and maximum speed, average pace, elevation gained and lost, and the name of the device you used

Alongside the details listed above, we store the complete record Garmin sends us for each item, exactly as Garmin delivers it. For activities, that record can also include the detailed sample data your device recorded during the session, which for an outdoor activity can include the GPS track of your route. We keep the original record so your history stays complete and accurate when we improve how the app reads it, without asking you to reconnect or re-sync.

When you first connect, we ask Garmin to send your recent history so your account is not empty. Garmin makes this available from up to 30 days before the day you connected.

How we use it

We show your Garmin data back to you in your activity and health views. We use it to build your recovery and readiness picture, to adjust your training plan around how well you have slept and recovered, to record your cardio work alongside your strength sessions, and to give Coach Vita the context it needs to coach you accurately.

Sending planned workouts to your Garmin calendar

Garmin data also travels in the other direction. If you turn this on, Coach Vita sends the running workouts in your plan to your Garmin Connect account through Garmin's Training API, so they appear on your Garmin calendar on their planned day and your watch can guide the session. What we send is the workout itself: its name, the sport, its steps and their durations, the pace or heart rate targets for each step, and the date it is planned for. We do not send your health data, your account details, or anything else about you to Garmin. If you change or skip a session, we update or remove it on your Garmin calendar so it does not show a workout you are no longer doing. You can turn this off at any time in Settings, and it stays off unless you turn it on.

Is Garmin data shared with or processed by third parties, including AI services?

Yes. Three kinds of processing happen outside our own code:

• Hosting and database: your Garmin data is stored in our database, hosted by Neon in the United States, and served by our application hosted on Vercel in the United States. Both act as our processors and are listed in the Third-Party Service Providers section above.
• AI coaching: to generate your coaching guidance, summaries derived from your Garmin data, for example how you slept, your recent HRV and resting heart rate, your Body Battery, your VO2 Max, and the type, duration, distance and average heart rate of your recent activities, are sent to Anthropic and processed by its Claude AI service, acting as our processor for this purpose only. We do not send Anthropic the complete records Garmin delivers to us, and we never send it the GPS track of an activity. Anthropic does not use this data to train its models, and retains it only briefly under its data processing terms before deletion.
• Garmin itself: if you turn on the workout sending described above, the workouts we send are processed by Garmin under Garmin's own privacy notice. Garmin is an independent controller for the data it holds about you (Garmin Würzburg GmbH, Germany) and states that it stores it on servers in the United States, the United Kingdom and/or Australia.

We do not sell your Garmin data. We do not share it with advertisers, with other users, or with any other third party for their own purposes.

Where it is stored and how long we keep it

Your Garmin data is stored in our database in the United States and is kept for as long as your account is active, so your training and recovery history stays intact. If you delete your account, your Garmin data is deleted along with everything else in your account within 30 days, as described in the Data Retention section above.

Disconnecting Garmin

German version

The German version of this section is Abschnitt 3.11 of the Datenschutzerklärung.

15. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you via email or through the app at least 14 days before the changes take effect. We encourage you to review this Privacy Policy periodically. The "Last updated" date at the top indicates when the most recent changes were made.

16. Supervisory Authority

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with a supervisory authority. For Germany, the relevant authority is:

17. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at: support@coach-vita.com