1. Who we are and what this policy covers

LeCoach ("LeCoach", "we", "us", "our") is an AI-powered cycling and running coaching service. This Privacy Policy explains how we collect, use, share, and protect your personal information.

This policy applies to everything we operate: the LeCoach website at lecoach.app, the LeCoach web application, and the LeCoach apps for iOS and Android. The apps are a mobile view of the same service, so the same policy, the same data practices and the same rights apply there.

Data controller: LeCoach App is a trade name of Gyn Health App B.V., registered office at Achtseweg Zuid 159R, 5651 GW Eindhoven, The Netherlands, registered with the Dutch Chamber of Commerce under number 98792105. Contact: info@lecoach.app.

We are established in the European Union and apply the General Data Protection Regulation (GDPR) as our baseline worldwide. Where your local law gives you additional rights, those rights also apply (see Section 10).

2. Information we collect

2.1 Account information

Email address and name or display name
Password, stored only as a secure one-way hash (we never see it)
If you sign in with Google or Apple: the account identifier, email address and name those services return to us
Time zone, language and notification preferences

2.2 Training and health-related data

This is the heart of the service. Depending on what you record or connect, it includes:

Workouts and activities: duration, distance, power, pace, heart rate, cadence, elevation, GPS route, training load and intensity
Training history, performance metrics, fitness and fatigue values (CTL, ATL, form) and power or pace curves
Wellness entries: sleep duration and quality, resting heart rate, HRV, fatigue, soreness, stress, mood, motivation, illness or injury notes
Body and physiology: weight, height, age, sex, FTP, threshold pace, heart rate and power zones
Optional entries you choose to add: hydration, nutrition (carbohydrates, fat, protein) and menstrual cycle phase
Free-text notes and your messages to the AI coach

Menstrual cycle phase and other health data are optional. The service works without them; they simply make the coaching more accurate if you provide them.

2.3 Data imported from connected services

If you connect Intervals.icu (or a similar platform we support), we import:

Your activities and their detailed interval and stream data
Your athlete profile, zones and settings
Your wellness records
The list of platforms connected to that account (for example Garmin, Wahoo, Zwift, Strava, Oura, Whoop), so we can tell you where your data originates

Your access credentials for those platforms are stored encrypted and are used only to sync your own data.

If you connect Garmin Connect directly, we import the data you choose to share on Garmin's consent screen:

your activities: summaries plus second-by-second details (heart rate, power, cadence, speed, elevation, GPS position and laps);
the name of the Garmin device that recorded each activity, so we can show where the data came from;
if you share health data: sleep (duration and score), overnight HRV, blood oxygen (SpO2) and breathing rate during sleep, resting heart rate, steps, weight, body fat and VO2max.

You can change what you share in Garmin Connect at any time. Data held in Garmin Connect itself is covered by Garmin's own privacy notice.

2.4 Payment information

Subscriptions are handled by Stripe. We never receive or store your card number. We store the Stripe customer and subscription identifiers, your plan, billing interval, trial and renewal dates, subscription status, and any discount or referral credit applied to your account.

2.5 Push notification data

If you allow notifications, a device push token is created and processed by OneSignal so we can deliver reminders, briefings and coaching messages. You can revoke this at any time in your device or browser settings, or in LeCoach settings.

2.6 Usage and technical data

Device type, operating system, app or browser version
IP address (used for security and coarse location only, never for tracking you across the internet)
Pages and features used, actions taken, session timing
Error logs, crash reports and performance data

3. Health data and your explicit consent

Training, wellness and cycle data are "special category" personal data under Article 9 GDPR. We process them only on the basis of your explicit consent, which you give when you create an account and start entering or importing this data.

You can withdraw that consent at any time by deleting the relevant entries, disconnecting a linked platform, or deleting your account. Withdrawal does not affect processing that already took place.

We commit that health-related data is:

never sold, rented or traded;
never used for advertising, ad targeting or profiling for marketing;
never shared with insurers, employers, data brokers or credit agencies;
never used to train third-party AI models. AI providers process it only to generate your response and are contractually barred from training on it.

AI and your data (AI Transparency Statement)

What the AI does. LeCoach uses AI models from Google Cloud (Vertex AI / Gemini) to answer your questions, write your reports and build your workouts and plans. The model processes your data only to produce that response. Google does not use it to train its models.

Your Garmin data and AI. Your AI coach uses data from Garmin only if you allow it. When you connect Garmin, a separate box "Let my AI coach use my Garmin data" is unticked by default. You can switch it on or off at any time in Settings › Connections.

On: the AI coach can read your Garmin activities and health data when it answers you and writes your reports. Its answers are then marked "Insights derived in part from Garmin device-sourced data".
Off: your Garmin activities and health records still count for your plan, workout scores, charts and fitness numbers, but they are never sent to an AI model. A few overall numbers calculated from all your training together can be; see section 4, "Garmin data and AI".

What we never do with your data, Garmin data included:

train, test, evaluate or benchmark AI models with it, ourselves or through our providers;
build an AI knowledge base from it.

To find and fix problems, the text of AI requests and answers can be stored in our analytics tool (PostHog, see section 6) for a limited time. AI requests and answers that contain Garmin data are never stored there; for those we only record measurements such as response time and cost.

Prompts and answers that contain Garmin data are treated as Garmin data. Our internal technical logs of AI requests are deleted after 30 days (see section 8). Your own conversations with the coach are not affected.

4. Your Garmin Connect data

This section explains how LeCoach collects, uses, processes and stores data from Garmin Connect™. It applies only if you connect your Garmin account to LeCoach, and only to the data you choose to share on Garmin's own consent screen.

What we collect

Activities (if you share them): summaries and second-by-second details (heart rate, power, cadence, speed, elevation, GPS position, laps), and the name of the Garmin device that recorded each one.
Health data (if you share it): sleep (duration and Garmin's sleep score), overnight HRV, blood oxygen and breathing rate during sleep, resting heart rate, steps, weight, body fat and VO2max.
Account notices from Garmin: when you disconnect LeCoach in Garmin Connect or change what you share.

In the other direction, if you allow workout import on Garmin's consent screen, LeCoach puts your planned LeCoach workouts on your Garmin Connect calendar so you can follow them on your device. You can switch this off in Settings › Connections.

How we use it

to show your activities and health values in LeCoach, marked with "Garmin" and the device that recorded them;
to compare each activity with your planned workout and score it, and to calculate your training load, fitness and fatigue, FTP estimates, power curves and training zones;
to assess your recovery and readiness and adapt your training plan;
to send you your activity reports, daily report and weekly roundup by email or notification, if you have them switched on. These carry Garmin's attribution;
for the AI coach: see "Garmin data and AI" below.

We do not use Garmin data for advertising, and we never sell it.

How we process and store it

Garmin sends the data directly to LeCoach's own servers. We store it in our database and private file storage, hosted by Supabase in the EU (Frankfurt, Germany), encrypted in transit and at rest, with row-level security so that only your account can reach it. Your Garmin access keys are stored encrypted. Only authorised LeCoach staff can access it, for support and troubleshooting (see section 11).

We keep your Garmin data while your account exists, so your training history and numbers stay complete. It is deleted when you choose Disconnect and delete Garmin data or delete your account (see sections 8 and 9).

Who else processes your Garmin data

We do not share Garmin data with other users or give it to anyone for their own purposes. Only these providers process it, on our behalf and under a data processing agreement:

Provider	What it does with Garmin data	Where
Supabase	Hosting, database and file storage	EU (Frankfurt)
Google Cloud (Vertex AI / Gemini)	Third-party AI processing for the AI coach, as described below. Never used to train AI models.	EU or US, based on your location
Resend	Delivers the emails that contain your reports	EU
OneSignal	Delivers notifications that can mention an activity or your recovery	EU / US (EU-US Data Privacy Framework)

Map backgrounds come from CARTO: it receives requests for the map area shown, not your activity data. PostHog, our analytics tool, never receives the text of AI requests or answers that contain Garmin data.

Intervals.icu. LeCoach does not send activities or health data from Garmin to Intervals.icu. If you also connect Intervals.icu and choose to apply a new FTP or threshold heart rate that LeCoach estimated, or to add a LeCoach summary to an activity description, that value or summary is written to your Intervals.icu account; summaries based partly on Garmin data carry Garmin's attribution.

Garmin data and AI

Your AI coach reads your Garmin activities and health data only if you allow it, with the separate switch "Let my AI coach use my Garmin data". It is off unless you tick it when connecting, and you can change it at any time in Settings › Connections. Answers that use Garmin data are marked "Insights derived in part from Garmin device-sourced data".
With the switch off, your Garmin activities and health records are never sent to an AI model. The AI coach does receive your profile settings (such as your FTP and weight) and a few overall numbers LeCoach calculates from all your training together (fitness, fatigue and form, and your weekly training time). Some of these are based in part on your Garmin data.
Garmin data is never used to train, test, evaluate or benchmark AI models, by us or by our providers.

Your choices

Change what you share at any time in Garmin Connect.
Switch AI use of your Garmin data and sending workouts to Garmin on or off in Settings › Connections.
Disconnect Garmin in Settings › Connections: we tell Garmin to end LeCoach's access and receive no new data.
Disconnect and delete Garmin data: also deletes every activity and health value LeCoach received from Garmin, with the scores and raw data built on it.

5. Why we use your data, and on what legal basis

Purpose	Legal basis
Creating and running your account, delivering the coaching service	Performance of a contract
Processing training, wellness and cycle data to generate plans, workouts and advice	Your explicit consent (Art. 9(2)(a) GDPR)
Sending your data to AI providers to produce coaching output	Performance of a contract and your explicit consent
Syncing with Intervals.icu and other platforms you connect	Performance of a contract
Payments, invoicing, fraud prevention and tax records	Contract and legal obligation
Service emails, push notifications and training reminders	Contract, or your consent for optional notifications
Product analytics, error monitoring and improving the service	Legitimate interest (running and improving a reliable service)
Security, abuse prevention and protecting our legal position	Legitimate interest and legal obligation

We do not make decisions with legal or similarly significant effects about you by automated means. AI-generated training advice is a suggestion you are free to ignore.

6. Who we share data with

We use a small number of carefully chosen providers ("processors"). Each is bound by a data processing agreement and may use your data only to provide their service to us.

Provider	Role	Where
Supabase	Hosting, database, authentication, file storage	EU
Google Cloud (Vertex AI / Gemini)	AI coaching, plan and workout generation	EU or US, based on your location
Stripe	Payments, subscriptions, invoicing	EU / US
Intervals.icu	Two-way training data sync (only if you connect it)	EU
OneSignal	Push notification delivery	EU / US (EU-US Data Privacy Framework)
PostHog	Product analytics and error tracking	EU
Resend	Transactional email delivery	EU
Google, Apple	Sign-in with Google / Sign in with Apple	US
CARTO	Map background tiles for activity maps	EU / US

We may also disclose data where we are legally required to, or to establish or defend legal claims. If LeCoach is ever acquired or merged, your data may transfer to the acquirer, who must continue to honour this policy; we will tell you before that happens.

Data sources you connect. If you connect Intervals.icu or Garmin Connect, we receive data from them as described in section 2.3. When you disconnect either one, we tell that service to end LeCoach's access.

We do not sell your personal information and we do not share it for cross-context behavioural advertising.

7. International transfers

Some providers are located in, or process data in, the United States. Where that happens, transfers are covered by the European Commission's Standard Contractual Clauses, the EU-US Data Privacy Framework where the provider is certified, or another lawful transfer mechanism, together with additional safeguards such as encryption in transit and at rest.

You can ask us for details of the safeguards used for any specific provider at info@lecoach.app.

8. How long we keep data

Account, training and wellness data: for as long as your account exists. This is deliberate: long-term training history is what makes coaching accurate.
After you delete your account: deleted from live systems within 30 days. We retain a limited record of deleted accounts to prevent abuse of the free trial.
Backups: purged on our normal backup rotation, within 90 days at the latest.
Invoices and payment records: kept for 7 years, as Dutch tax law requires.
Analytics and error logs: retained for up to 12 months.
Support correspondence: retained for up to 24 months.
Raw activity details received from Garmin: kept while your account exists, so we can recalculate your numbers when your FTP or zones change. Deleted when you delete your account or choose "Delete my Garmin data".
Technical logs of AI requests: for troubleshooting, we keep an internal log of the full request sent to the AI model when it builds a workout. The text in these logs is deleted after 30 days; only measurements such as response time remain. This is separate from your conversations with the coach, which stay in your account until you delete them or your account.

9. Deleting your account and data

You can delete your account yourself at any time: open Settings in the app or on the web, scroll to the account section and choose Delete account.

This removes your profile, training plans, scheduled workouts, imported activities, wellness records, coaching conversations, memories and connected-service credentials. An active subscription is cancelled as part of the process. Records we are legally obliged to keep, such as invoices, are retained for the statutory period and nothing else.

Deleting your account also ends LeCoach's access to your Intervals.icu and Garmin Connect accounts at those services. To remove only your Garmin data, use Settings › Connections › Garmin Connect › Disconnect and delete Garmin data. This deletes every activity LeCoach imported from Garmin, with its scores and raw data.

Prefer us to do it for you, or want a copy of your data first? Email info@lecoach.app and we will handle it within 30 days.

10. Your rights

Wherever you live, you can ask us to:

Access: give you a copy of the personal data we hold about you
Rectify: correct anything inaccurate or incomplete
Erase: delete your data ("right to be forgotten")
Port: provide your data in a structured, machine-readable format
Restrict or object: pause or object to certain processing
Withdraw consent: for health data processing, notifications or analytics, at any time

European Union / EEA and United Kingdom: the rights above are your GDPR and UK GDPR rights. You may also complain to your national supervisory authority, or in our case the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Switzerland: equivalent rights apply under the Federal Act on Data Protection.

California: under the CCPA/CPRA you may request disclosure, deletion and correction, and you may not be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined, and we do not use sensitive personal information for anything other than providing the service you asked for.

Brazil (LGPD), Canada (PIPEDA), Australia (Privacy Act), and other jurisdictions: we honour the local equivalents of the rights listed above.

To exercise any right, email info@lecoach.app. We respond within 30 days and never charge for a reasonable request.

11. Security

Encryption in transit (TLS) and at rest
Row-level database security, so each account can only reach its own data
Password hashing and support for Google and Apple sign-in
Encrypted storage of third-party API credentials
Access controls, audit logging and monitoring

Administrative access: authorised LeCoach staff may view account data in read-only mode for support, debugging and service quality. This access is limited to what a support request requires and is logged.

Breach notification: if a data breach is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours and inform you without undue delay.

No system is perfectly secure. We work hard to protect your data but cannot guarantee absolute security.

12. Cookies, analytics and tracking

12.1 Essential storage

We use cookies and local storage to keep you signed in, remember your preferences and make the application work. These cannot be switched off without breaking the service.

12.2 Analytics

We use PostHog to understand how the product is used: page views, feature usage, performance and errors. This is first-party analytics, hosted in the EU.

12.3 Choices

Visitors on public pages: you can opt out through the cookie banner, and your choice is remembered.
Signed-in users: analytics is part of running and improving the service; email us to opt out and we will honour it.

We use no advertising cookies and no third-party ad trackers, on the website or in the apps.

13. Children

LeCoach is not intended for anyone under 18 and we do not knowingly collect data from children. If you believe a child has given us personal information, contact us and we will delete it promptly.

14. Changes to this policy

We may update this policy as the service evolves. If a change is significant we will notify you by email or inside the application before it takes effect. The effective date at the top always reflects the current version.

15. Contact

Email: info@lecoach.app
Gyn Health App B.V. (trading as LeCoach App)
Achtseweg Zuid 159R, 5651 GW Eindhoven, The Netherlands
Chamber of Commerce (KvK) number 98792105

If you are not satisfied with our response, you may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or your local supervisory authority.