Privacy Policy

Last updated: September 2026 • Policy Version 2026.1

1. Overview & Data Controller

MyAthlo (“we”, “our”, or “us”) is committed to protecting the privacy, confidentiality, and security of our users (“trainers” and “clients”). This Privacy Policy explains what data we collect, how it is processed, and your statutory rights under the General Data Protection Regulation (GDPR), UK GDPR, and applicable global privacy regulations.

2. Health & Biometric Data Processing (Article 9 GDPR)

To provide personalized workout plans, nutritional guidance, and body progress tracking, MyAthlo processes special category health data (e.g., body weight, body fat percentage, workout logs, nutritional goals, and progress photos).

Explicit Consent Requirement: We strictly process health data only with your explicit consent obtained during registration or intake. You have the right to withdraw this consent at any time through account settings.

3. Artificial Intelligence & Data Minimization

MyAthlo utilizes Google Cloud Vertex AI (Gemini Enterprise) to generate draft workout routines and meal plans. Our architecture enforces strict data minimization:

Personal Identifiable Information (such as real names, email addresses, and phone numbers) is stripped prior to sending requests to AI models.
Your fitness information is never used to train global third-party AI models.
All generation calls are processed under secure enterprise Application Default Credentials (ADC).

4. Right to Data Portability (Article 20 GDPR)

You have the right to obtain an export of all personal data, workout logs, check-ins, and metrics you have provided to MyAthlo in a structured, commonly used, and machine-readable JSON format. You can initiate this export anytime directly in your account settings.

5. Right to Erasure & Account Deletion (Article 17 GDPR)

You may request permanent deletion of your account and associated data through the application settings:

14-Day Grace Period: Upon initiating deletion, your account enters a 14-day grace period during which you can cancel the request.
Permanent Deletion: After 14 days, personal profiles, credentials, progress photos, and chat logs are irrevocably purged.
Statutory Retention: Transactional billing invoices are anonymized and retained solely as required by financial and tax reporting laws.

6. Contact Data Protection Officer

For any privacy inquiries, exercising data subject rights, or questions regarding data protection, please contact our privacy desk at privacy@myathlo.com.

1. Overview & Data Controller

2. Health & Biometric Data Processing (Article 9 GDPR)

3. Artificial Intelligence & Data Minimization

MyAthlo utilizes Google Cloud Vertex AI (Gemini Enterprise) to generate draft workout routines and meal plans. Our architecture enforces strict data minimization:

Personal Identifiable Information (such as real names, email addresses, and phone numbers) is stripped prior to sending requests to AI models.

Your fitness information is never used to train global third-party AI models.

All generation calls are processed under secure enterprise Application Default Credentials (ADC).

5. Right to Erasure & Account Deletion (Article 17 GDPR)

You may request permanent deletion of your account and associated data through the application settings:

14-Day Grace Period: Upon initiating deletion, your account enters a 14-day grace period during which you can cancel the request.

Permanent Deletion: After 14 days, personal profiles, credentials, progress photos, and chat logs are irrevocably purged.

Statutory Retention: Transactional billing invoices are anonymized and retained solely as required by financial and tax reporting laws.