Privacy Policy
1. Data controller
The data controller is Nicola Dall'Olio, an individual, acting as developer and person responsible for Coach to Wrist, a product currently in closed beta. For any request about the processing of your data you can write to support@coachtowrist.com.
2. Categories of data collected
| Category | Data | When |
|---|---|---|
| Coach access request | Name, email, city and approximate number of athletes coached; optionally organisation, wearables used, current tools, volume of structured workouts, main problem, availability for a pilot and software budget range | Submitting the "Request your coach invite" form |
| Account data | Email, session tokens; for Google sign-in: name and email of the Google account | Sign-in (email/password or Google OAuth) via Supabase |
| Training data | Workouts created by the coach; athlete results (completed sessions, heart rate, pace, RPE and other entered or recorded data) | Execution on mobile or via a wearable and ordinary use of the platform by coaches and connected athletes |
| Imported files | Images uploaded by the coach to extract a workout (sent to the AI provider without the photo metadata, such as GPS location), generated outputs and technical usage/cost data; record of the coach's confirmation not to upload personal data | Only when the coach voluntarily uses the import feature. AI-assisted programming, which would also use athlete context, is currently disabled |
| Connected AI assistants (MCP) | Workout drafts created by the AI assistant connected to the account; technical identifiers of the authorisation; for accounts created while connecting, the chosen role and the name of the connected application | Only when the user voluntarily connects an assistant (e.g. ChatGPT, Claude), asks it to create a workout or creates their account while connecting |
| Consent choices | Type of consent, whether given or withdrawn, date and version of the privacy policy in force | Each time the athlete gives or withdraws a consent (append-only record) |
| Local preferences | Chosen language, acknowledgement of the cookie banner | Stored in the browser's local storage, not on our servers |
2a. Data collected through the smartwatch (Amazfit/Zepp app)
The Coach to Wrist companion app for Amazfit smartwatches (Zepp OS) requests, only for athletes who choose to pair the watch, the following device permissions, each used solely for the function described:
| Permission | Data | Purpose |
|---|---|---|
| Heart rate | Beats per minute during the workout | Heart-rate zone on screen and average/maximum/minimum value saved with the block result |
| Location | GPS position during running blocks | Real-time pace and distance; coordinates are not saved as a route, only aggregated pace/distance |
| Steps | Step count/cadence | Cadence shown during running and strength |
| Native workout data | Metrics of the workout in progress on the watch | On-screen display during execution |
Pairing uses a code generated by the web app, valid for 15 minutes: the watch and the phone never see the athlete's password. The watch keeps locally, only as long as needed: a session state to resume the workout after the screen turns off, and a queue of results not yet synchronised when offline — both deleted as soon as synchronisation with the server succeeds. Workout results (completed blocks, heart rate, pace, cadence, RPE, sets/reps/weight) are sent to the server and are visible to the coach who assigned the workout, as for data entered on web or mobile.
3. Purposes and legal basis
- Providing the service (creating, sending and synchronising workouts) — legal basis: performance of a contract/pre-contractual measures (Art. 6(1)(b) GDPR).
- Handling beta access requests — legal basis: consent of the data subject by submitting the form (Art. 6(1)(a) GDPR).
- Authentication and account security — legal basis: legitimate interest in ensuring secure access to the service (Art. 6(1)(f) GDPR).
- Workout import — processing, at the coach's request, of the image of a workout to produce an editable proposal, which is not applied automatically. The feature is set up not to process personal data: before first use the coach confirms they will not upload files containing personal data, health data or faces, and the confirmation is recorded (see section 6). AI-assisted programming is currently disabled.
- Health data recorded by the smartwatch (heart rate) — special category of data under Art. 9 GDPR: processed only with the athlete's explicit consent, given by voluntarily pairing the watch with the account and accepting the permission request shown by the device's operating system (Art. 9(2)(a) GDPR), for the sole purpose of showing the heart-rate zone during the workout and saving it in the result. Pairing can always be revoked by the athlete from the web app or from the Zepp app settings on the phone.
3a. AI assistants connected through MCP
Coaches and athletes can connect a third-party artificial-intelligence assistant (for example OpenAI's ChatGPT or Anthropic's Claude) to their Coach to Wrist account through the MCP protocol, authorising it with their own login.
- Signing up from the assistant. If you don't have an account yet, you can create one while connecting: besides your email and password (or Google sign-in) you choose a role (coach or athlete) and enter your date of birth, which is used to check the minimum age for the consents described below. We record that the account was created through an AI assistant, together with the chosen role and the name of the connected application, to measure which channels users come from; this data stays tied to the account and is erased with it.
- Workout drafts. The assistant can send workout drafts to Coach to Wrist, which the user reviews and saves in the app; drafts that are not confirmed expire.
- Analysis of your own workouts. If you wish, you can let the assistant you connected read your training data to analyse it at your request: completed sessions, block-by-block results, heart rate, RPE, readiness, device metrics, plus age, sex, height and reference values (max and resting HR, thresholds). Name, email, date of birth, contact details and raw telemetry series are not shared. It covers only the personal data of the person who connects the assistant: a coach cannot read their athletes' data this way. As this includes health data, the legal basis is your explicit consent (Art. 9(2)(a) GDPR), separate from authorising the connection: you give it with a dedicated checkbox when connecting or from your Profile; it is optional and can be withdrawn at any time from your Profile, with effect for the future. Every choice is recorded with its date and the version of the privacy policy, and every read by the assistant is logged (user, application, function, date).
- Athlete data for the coach. Today no function of an assistant connected by the coach reads their athletes' data (profiles, sessions, heart rate, readiness).
- Sharing athlete data with AI assistants. If and when the assistant is able to read an athlete's data, this will happen only for athletes who have given explicit, specific consent, separate from the consent to share with the coach (Art. 9(2)(a) GDPR, as this includes health data), for the sole purpose of helping the coach program for that athlete and limited to the data needed. Consent is optional — refusing does not limit the use of the app in any way — and can be withdrawn at any time from the athlete's Profile, with effect for the future. Every choice is recorded with its date and the version of the privacy policy.
- Minors. Users under 14 (or without a date of birth) cannot give these consents on their own (Art. 8 GDPR and Art. 2-quinquies of the Italian Privacy Code): for them, sharing with AI assistants stays off.
- Recipients and transfer. Any data shared is processed by the provider of the assistant chosen by the person who connects it, as an independent controller, under the terms of the service that person uses; the provider may be located outside the European Union (see section 6).
- What the coach writes. Information the coach enters on their own initiative in the conversation with the assistant is processed under the coach's responsibility, with their account at the provider, and does not go through the Coach to Wrist consent mechanism.
4. Processing methods and retention
Data is processed with IT tools and stored on cloud infrastructure (Supabase) for as long as needed to provide the service. Source files of imports are kept in a private space associated with the account, together with the logs and outputs needed for review, deduplication and diagnostics. Access requests that are not accepted are kept for up to 24 months, unless deleted earlier on request.
5. Disclosure of data to third parties
We do not sell or transfer personal data to third parties for advertising purposes. Data may be processed, as processors or independent controllers, by the following providers:
- Supabase (Ireland) — authentication and data storage.
- Vercel — hosting and delivery of the website.
- Google — only if you choose "Continue with Google".
- DeepSeek (China) — processing of the workout image uploaded by the coach for the import feature, without the photo metadata; no other data is sent.
- AI assistant providers chosen by the user (e.g. OpenAI, Anthropic) — only if you connect an assistant; they receive from Coach to Wrist the outcome of the drafts they create and, if you have consented, your training data (section 3a).
- Platform of the connected wearable (e.g. Amazfit/Zepp) — synchronisation of workout data.
6. Transfers outside the EU
Application data (accounts, workouts, access requests and imported files) is hosted by Supabase on servers located in Ireland. The website is delivered through Vercel, a US company. The import feature sends to DeepSeek, based in China — a country for which there is no European Commission adequacy decision — only the workout image uploaded by the coach, stripped of its metadata. Since adequate safeguards under Articles 46 et seq. GDPR are not yet in place for this transfer, the feature is set up not to process personal data: before first use, the coach must confirm that they will not upload files containing names or other personal data, health data or faces, and the confirmation is recorded. This is a temporary measure, pending the switch to a provider based or hosted in the European Union or offering adequate safeguards. AI assistants connected through MCP (section 3a) may be provided by companies based in the United States; any transfer takes place on the basis of the EU-US Data Privacy Framework, if the provider participates in it, or of the European Commission's standard contractual clauses. The bases, safeguards and conditions of any transfers outside the EU must be verified in the legal and contractual review before the paid launch.
7. Cookies and similar technologies
The site only uses the browser's local storage to remember the chosen language and the acknowledgement of the information banner, plus the technical session cookies needed to keep you signed in. No profiling or advertising cookies are used.
8. Your rights
As a data subject, you have the right to request at any time, under Articles 15-22 GDPR:
- access to your personal data;
- rectification of inaccurate or incomplete data;
- erasure of your data ("right to be forgotten"), within the limits set by law;
- restriction of processing;
- portability of your data in a structured, machine-readable format;
- objection to processing based on legitimate interest.
You can exercise these rights by writing to support@coachtowrist.com.
9. Complaint to a supervisory authority
If you believe the processing of your data infringes the applicable law, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.gpdp.it) or with the supervisory authority of the EU Member State where you habitually reside.
10. Changes to this policy
This policy may be updated during the beta. The date of the last update is shown at the top of the page.
11. Contact
For any question about this policy, write to support@coachtowrist.com.