Privacy Policy

Who we are

Labonde Software Ltd ("Labonde Software"), the company operating the Coachalyst product, is the controller within the meaning of Art. 4 (7) GDPR for the own processing purposes distinguished in section 2. Processing solely on behalf of a coaching business follows the separate allocation of roles described there.

Registered office: Tasou Chatzipapanastasiou 11, LEPTOS FORTUNA COURT, Flat/Office 002, 8035 Geroskipou, Paphos, Cyprus Company number (Registrar of Companies and Intellectual Property, Cyprus): HE 497672 Email: hello@coachalyst.com Data protection contact: privacy@coachalyst.com

Coachalyst is a trademark of Labonde Software Ltd. As we are established in the European Union, we are not required to appoint a representative under Art. 27 GDPR.

Scope

This policy describes the processing of personal data when using Coachalyst. It addresses self-managed users, coaches, studios and their clients.

Labonde Software Ltd is the controller for its own processing purposes, including managing its own contractual relationships, billing and platform operations. Where we process client data solely on a coach's or studio's instructions, that coaching business is the controller and Labonde Software Ltd is the processor. This requires a separate data processing agreement. The coaching business's privacy information also applies. Roles depend on the particular purpose; not every operation within the Service is processing on another party's behalf.

Categories of personal data we process

Depending on the feature and actual processing purpose, the following categories may be involved. This does not authorise using every category for every purpose:

• Account data: email, optional name, password hash, preferred language, account creation date, email verification status.
• Profile data: date of birth, sex (optional, for health calculations), height, weight, training goals, experience level.
• Training data: workouts logged, sets, reps, weights, RPE, personal records, exercise notes.
• Nutrition data: calories, macronutrients, meals logged, supplement intake.
• Health-related data: sleep, readiness, recovery scores, menstrual cycle data (optional), Apple Health / Google Health Connect data (only if you connect it). This data is a "special category" under Art. 9 (1) GDPR.
• Progress media: photos and videos you upload.
• Communications: chat messages between you and your coach, check-in form responses, support tickets.
• Payment data: tier purchased, subscription status, invoice IDs. Payment card details are processed by Paddle (web) or Apple / Google (mobile); we never see or store card numbers.
• Device and usage data: device model, OS version, app version, IP address, crash diagnostics, coarse usage events (screens opened, features used).
• Marketing data: UTM parameters captured from ad / social links, referral codes, waitlist email and role.

Purposes and legal bases

We process each data category for specific purposes under the following Art. 6 (1) GDPR legal bases (Art. 9 (2) additionally where health data is involved):

• Provide the Service (create accounts, sync data, deliver coaching features): performance of contract (Art. 6 (1) (b)).
• Process payments and prevent fraud: performance of contract (Art. 6 (1) (b)) and legitimate interests (Art. 6 (1) (f)).
• Process health-related data: where we rely on it, your explicit consent (Art. 9 (2) (a)); see section 10 for withdrawal. Authorisation to share with a coach does not automatically cover processing by the platform.
• Security, abuse prevention, and service stability: legitimate interests (Art. 6 (1) (f)).
• Usage analytics in the apps to improve the service and fix problems: legitimate interest (Art. 6 (1) (f)). You can object at any time in the app settings (section 14).
• Send transactional emails (receipts, password resets, security alerts): performance of contract (Art. 6 (1) (b)).
• Send marketing emails (waitlist, launch updates): your consent (Art. 6 (1) (a)); withdrawable by clicking unsubscribe in any email.
• Comply with legal obligations (tax records, law enforcement requests): legal obligation (Art. 6 (1) (c)).

OPEN BEFORE PUBLICATION: Each actual processing activity needs an identified Article 6 basis and, for health data, an additional Article 9 condition. Listing alternative grounds does not provide this allocation. Independent product research and analyses across different purposes must be assessed separately.

Health, cycle, and medical data (enhanced protection)

Health data may arise directly from measurements or statements, or indirectly from combining them. It includes, in particular, sleep, heart-rate, cycle and recovery data and health-related body, training and nutrition information. Both an Article 6 legal basis and an Article 9 (2) GDPR condition are required.

The intended platform purposes include display and personal analysis within the selected features. The categories and specific purposes must be clearly described before a decision. Acceptance of Terms and operating-system permission do not replace required explicit consent. A feature permission does not generally authorise general-purpose AI training, advertising or independent research.

Health data is not sold or shared for advertising with data brokers, employers or insurers. Personal analyses must be distinguished from advertising profiles. Any legally required disclosure to authorities is assessed individually for its legal basis and permitted scope; notice is given where required and permitted by law.

When Apple HealthKit or Google Health Connect is connected, technically authorised categories are imported for permitted features. The HealthKit connection is read-only. Revoking operating-system permission stops that access but does not automatically erase previously imported data.

Platform consents and withdrawals can be managed in “Agreements and privacy”. Permissions for a coaching business are separate. Withdrawal ends processing based on that consent; further storage requires another valid basis. Otherwise the affected data, including relevant copies and derived values, must be erased. Account deletion is not a general prerequisite.

OPEN BEFORE PUBLICATION: Purpose-specific erasure after withdrawal, complete mapping of the data actually processed and access roles including administrative exceptions are not yet fully implemented or confirmed. The existing stop controls alone do not establish these additional requirements. Backup and other copy retention must be specified under section 8.

How each type of data is used

The following overview describes intended uses. The applicable legal basis also depends on section 4 and, for health data, section 5. Retention is addressed in section 8.

• Account data and password hash: sign-in, access protection and account administration. Passwords must not be stored in plain text.
• Profile and body data: display and personalisation of the functions you use; health-related information also requires a condition under Art. 9 GDPR.
• Training, nutrition and supplement entries: personal tracking and analysis, and coaching within the lawfully authorised sharing scope.
• Sleep, pulse, recovery and cycle data: display and analysis for selected health functions. Sharing with a coaching business must be addressed separately.
• Apple HealthKit and Google Health Connect: importing technically authorised categories for selected functions. Operating-system permission does not replace any required consent to processing.
• Private progress photos and videos: your gallery and coaching feedback you authorise. Publication in the shared food catalogue is separate.
• Community contributions (food data, food photos, recipes and correction suggestions): building and maintaining the shared catalogue. Public visibility may already be selected when creating a food item; check before saving. Image and correction submissions for the shared catalogue are processed for review and possible publication. Do not upload health records, identifiable people or unnecessary personal details there. For catalogue contributions expressly agreed on that basis, Terms section 9 provides for continuing, non-exclusive rights for Labonde Software Ltd. These do not end merely because the account is deleted; you may continue using your own content elsewhere. Statutory rights remain unaffected. A preselected public setting alone is not such an agreement. A content licence does not replace a data protection legal basis. Removing an account identifier does not guarantee anonymity. Statutory rectification and erasure rights remain applicable; see Terms section 9.
• Messages, check-ins and notes: communication and documentation within the relevant participant and access scope.
• Payment and subscription data: service entitlements, billing and statutory obligations. Payment providers process additional information under their own privacy information; see section 6 for roles.
• Diagnostics and technical app-start reports: identifying errors and technical usage events. Section 14 addresses data scope and the distinction from product analytics.
• App usage events: improving the service and detecting abandoned or failing workflows, without content or health values. Details and how to switch it off are in section 14.
• Campaign and referral attribution: allocating campaigns or referrals where the particular processing is lawful and any necessary consent is in place.
• Security logs and support requests: access protection, abuse prevention and handling your enquiries.

Using personal health data for additional statistics or product improvement requires a separate assessment of purpose, legal basis and safeguards. Creating anonymised data is itself initially processing of personal data.

Who we share data with

We do not sell your personal data. Recipients and their data protection roles depend on the particular processing. A payment provider is not automatically our processor.

• Hetzner Online GmbH (Germany): backend and database hosting, and email hosting and delivery.
• Paddle: Merchant of Record for web purchases. Paddle processes data for contracting, payment and its own legal obligations. Paddle's privacy information also applies.
• Stripe: payments for coaching offers through Stripe Connect. The seller and contracting party is the coach. Stripe's role depends on the processing and contractual relationship; Stripe's privacy information also applies.
• Apple and Google: in-app purchases through their stores under their respective privacy information.
• Sentry: diagnostic software in our self-hosted instance. Using the software does not automatically disclose data to Sentry's cloud service.
• DeepSeek: an external AI provider for meal-photo analysis that you choose to use. We send the selected image with technical metadata removed, and detected food names, quantities and matching catalogue values. Visible personal details in the picture are not automatically removed. This analysis requires separate consent; a general catalogue licence or operating-system photo permission does not replace it.
• Cloudflare: Turnstile protection against automated form submissions, which involves technical connection data.

In a coaching relationship, the coaching business receives access to data authorised for that purpose. Consent to share health data is separate from merely connecting to a coach.

Where a provider processes data on our instructions, an agreement under Art. 28 GDPR is required before that processing. Independent controllers rely on their own applicable legal bases. This recipient overview does not demonstrate that the required agreements have already been concluded.

International transfers

International data flows require consideration of remote access, support and further service providers as well as server location. An EU server region alone does not rule out transfers to third countries.

Personal data may be transferred outside the EU/EEA only where the conditions in Art. 44 et seq. GDPR are met. This may require an applicable adequacy decision or other appropriate safeguards, such as validly agreed Standard Contractual Clauses together with any necessary supplementary measures. The EU-US Data Privacy Framework applies only within its scope to transfers to actually participating organisations.

OPEN BEFORE PUBLICATION: confirm and add the countries, roles, data types and specific transfer basis for every actual recipient. This draft does not claim that the necessary agreements or transfer assessments already exist. Contact: privacy@coachalyst.com.

For the external AI provider DeepSeek, the actual contracting entity, API terms, processing and access countries, retention periods and any necessary transfer safeguards must be documented before activation. According to the Open Platform terms, the general DeepSeek privacy policy alone does not describe processing of our end users’ data. Meal-photo analysis remains technically disabled until the provider review is approved.

Retention periods

Retention depends on the processing purpose, contractual relationships and statutory retention requirements.

• Account, profile, training, nutrition, health and private media data are processed for use of the account. The in-app deletion process provides a 30-day cancellation period after the request. The automated deletion job then initiates permanent deletion. Statutory erasure rights remain unaffected; contact privacy@coachalyst.com to exercise them directly.
• Invoices and tax records are subject to the applicable statutory retention requirements. Such a requirement does not justify retaining all account or health data.
• Security and abuse-prevention data are retained only as necessary for the specific security purpose or the establishment, exercise or defence of legal claims.
• Community contributions require a distinction between factual product information, content licences and personal data contained in them. See section 5b and Terms section 9.
• Backups are subject to a separate deletion and restoration policy. Deleting a record from the production database does not automatically remove it from every backup at the same time.
• App usage events (section 14) are deleted at the latest when the account is deleted. A shorter fixed retention period has not yet been set. OPEN BEFORE PUBLICATION: define the retention period.
• Truly anonymised statistics may be reused only where identification is no longer possible, including when taking other available information into account.

Before publishing this draft, specific retention periods for backups, security logs, support and tax records must be added based on actual operations and applicable legal bases.

Contract, contribution and consent evidence is a separate data set. When an account is erased, necessary DPA, business-contract and contribution evidence may be retained in reduced form under specifically defined grounds; a remaining person identifier is still personal data. The start and duration of retention for original records and the reduced archive must be defined separately before publication. The configurable archive duration is not a statutory retention period.

Your rights

Under the GDPR and Cypriot law you have the following rights with respect to your personal data:

• Right of access (Art. 15): you may request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): ask us to correct inaccurate data.
• Right to erasure (Art. 17): ask us to delete your data ("right to be forgotten").
• Right to restriction of processing (Art. 18).
• Right to data portability (Art. 20): receive your data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21): object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent (Art. 7 (3)): where processing is based on consent, you may withdraw it at any time; this does not affect the lawfulness of processing before withdrawal.
• Right not to be subject to automated decision-making (Art. 22): see section 11.
• Right to lodge a complaint with a supervisory authority (Art. 77).

How to exercise your rights

The app provides functions to export data, edit profile information and request account deletion.

• The technical export provides data in JSON format and, where available, media download references. You can also contact privacy@coachalyst.com for a complete response to an access request under Art. 15 GDPR.
• The account deletion process includes a 30-day cancellation period. Your statutory right to erasure without undue delay where its conditions are met remains unaffected.
• You can withdraw health-category sharing permissions for your coaching business in the sharing settings. This is distinct from consent to processing by Coachalyst itself.
• To withdraw processing consent, request restriction, object or make another privacy request, contact privacy@coachalyst.com. Disabling a tracker alone is not equivalent to deleting previously stored data.

We handle requests without undue delay and in any event inform you of the action taken within one month of receipt. Where Art. 12 (3) GDPR permits an extension, we inform you of the reasons within that initial period.

Platform consent can also be managed and withdrawn in “Agreements and privacy”. This is separate from permission to share data with a coaching business.

Automated decision-making

Coachalyst does not make decisions that produce legal effects or similarly significant effects about you based solely on automated processing (Art. 22 GDPR).

We use automated calculations for training load estimates, macro targets, and recovery scores. These are informational aids and never replace professional medical advice or produce legally binding decisions.

Children

Under the proposed Terms, Coachalyst is intended for people aged 16 or older. This product age limit is not a uniform worldwide legal threshold for consent or contractual capacity. Applicable requirements for minors and, where necessary, a valid declaration by their legal representative must be met separately.

OPEN BEFORE APPROVAL: Actual age checks, permitted markets and required evidence of representation remain to be confirmed. Contact privacy@coachalyst.com if you suspect unlawful processing of a minor’s data; we assess the necessary protective and erasure measures.

Security

We must protect personal data with technical and organisational measures appropriate to the risk (Art. 32 GDPR). These include access restrictions, secure authentication and transmission, and procedures for backup, restoration and deletion.

Specific statements about encryption algorithms, backup retention, review intervals or completed penetration tests require current evidence from actual operations. These details must be documented in the technical and organisational measures.

Our duties following a personal data breach depend on our role. As processor, we notify the controller without undue delay after becoming aware of a breach. As controller, we notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals' rights and freedoms. Where a high risk is likely, we notify affected individuals without undue delay unless a statutory exception applies (Art. 33 and 34 GDPR).

Cookies and tracking

Optional website marketing attribution is disabled initially. You can enable it and change your decision in Cookie settings. We do not use product analytics on the website. Further information is available at /cookies.

Error diagnostics use our self-hosted Sentry instance. Depending on the application, technical metadata, error reports and masked screen or view attachments may be collected. Technical app-start reports may contain an installation identifier and are not controlled solely by the website cookie choice.

Usage analytics in the apps: In the Coachalyst apps (desktop app, client app and trainer app) we record how the service is used in order to improve it and to detect problems in workflows. This happens only while you are signed in: start and end of a session, active usage time, screens visited, features used and whether a workflow was completed, abandoned or failed, each with app, app version and platform. Events are linked to your account and, where applicable, to your coaching business. We do not record content such as messages, form input or search terms, nor health, training or nutrition values, photos or videos. Quantities are sent in coarse ranges. We also record active usage time and workflow durations as time values. Events are briefly buffered on your device and sent to our own server; no third-party analytics provider is involved. The legal basis is our legitimate interest in improving and fixing the service (Art. 6(1)(f) GDPR). You can switch usage analytics off at any time in the settings of each app; the local buffer is then deleted. The events are included in data access requests and are deleted with your account. See section 8 for retention.

The legal basis, necessity, data scope and any consent requirements must be established for each application. Self-hosting does not replace this assessment.

Changes, contact, and complaints

We keep this information current when actual processing changes and inform you in time where additional information is required before a change. Publishing a new privacy notice does not replace necessary consent or another required legal basis. No fixed email or in-app advance-notice period is promised without a verified process.

Questions and requests: privacy@coachalyst.com.

You may complain to a competent data protection authority, particularly in the Member State of your habitual residence, workplace or the alleged infringement. In Cyprus: Office of the Commissioner for Personal Data Protection, https://www.dataprotection.gov.cy. A directory of German authorities is available at https://www.bfdi.bund.de.