Privacy Policy

1. Who we are and what this policy covers

LeCoach ("LeCoach", "we", "us", "our") is an AI-powered cycling and running coaching service. This Privacy Policy explains how we collect, use, share, and protect your personal information.

This policy applies to everything we operate: the LeCoach website at lecoach.app, the LeCoach web application, and the LeCoach apps for iOS and Android. The apps are a mobile view of the same service, so the same policy, the same data practices and the same rights apply there.

Data controller: LeCoach App is a trade name of Gyn Health App B.V., registered office at Achtseweg Zuid 159R, 5651 GW Eindhoven, The Netherlands, registered with the Dutch Chamber of Commerce under number 98792105. Contact: info@lecoach.app.

We are established in the European Union and apply the General Data Protection Regulation (GDPR) as our baseline worldwide. Where your local law gives you additional rights, those rights also apply (see Section 9).

2. Information we collect

2.1 Account information

• Email address and name or display name
• Password, stored only as a secure one-way hash (we never see it)
• If you sign in with Google or Apple: the account identifier, email address and name those services return to us
• Time zone, language and notification preferences

2.2 Training and health-related data

This is the heart of the service. Depending on what you record or connect, it includes:

• Workouts and activities: duration, distance, power, pace, heart rate, cadence, elevation, GPS route, training load and intensity
• Training history, performance metrics, fitness and fatigue values (CTL, ATL, form) and power or pace curves
• Wellness entries: sleep duration and quality, resting heart rate, HRV, fatigue, soreness, stress, mood, motivation, illness or injury notes
• Body and physiology: weight, height, age, sex, FTP, threshold pace, heart rate and power zones
• Optional entries you choose to add: hydration, nutrition (carbohydrates, fat, protein) and menstrual cycle phase
• Free-text notes and your messages to the AI coach

Menstrual cycle phase and other health data are optional. The service works without them; they simply make the coaching more accurate if you provide them.

2.3 Data imported from connected services

If you connect Intervals.icu (or a similar platform we support), we import:

• Your activities and their detailed interval and stream data
• Your athlete profile, zones and settings
• Your wellness records
• The list of platforms connected to that account (for example Garmin, Wahoo, Zwift, Strava, Oura, Whoop), so we can tell you where your data originates

Your access credentials for those platforms are stored encrypted and are used only to sync your own data.

2.4 Payment information

Subscriptions are handled by Stripe. We never receive or store your card number. We store the Stripe customer and subscription identifiers, your plan, billing interval, trial and renewal dates, subscription status, and any discount or referral credit applied to your account.

2.5 Push notification data

If you allow notifications, a device push token is created and processed by OneSignal so we can deliver reminders, briefings and coaching messages. You can revoke this at any time in your device or browser settings, or in LeCoach settings.

2.6 Usage and technical data

• Device type, operating system, app or browser version
• IP address (used for security and coarse location only, never for tracking you across the internet)
• Pages and features used, actions taken, session timing
• Error logs, crash reports and performance data

3. Health data and your explicit consent

Training, wellness and cycle data are "special category" personal data under Article 9 GDPR. We process them only on the basis of your explicit consent, which you give when you create an account and start entering or importing this data.

You can withdraw that consent at any time by deleting the relevant entries, disconnecting a linked platform, or deleting your account. Withdrawal does not affect processing that already took place.

We commit that health-related data is:

• never sold, rented or traded;
• never used for advertising, ad targeting or profiling for marketing;
• never shared with insurers, employers, data brokers or credit agencies;
• never used to train third-party AI models. AI providers process it only to generate your response and are contractually barred from training on it.

4. Why we use your data, and on what legal basis

We do not make decisions with legal or similarly significant effects about you by automated means. AI-generated training advice is a suggestion you are free to ignore.

5. Who we share data with

We use a small number of carefully chosen providers ("processors"). Each is bound by a data processing agreement and may use your data only to provide their service to us.

We may also disclose data where we are legally required to, or to establish or defend legal claims. If LeCoach is ever acquired or merged, your data may transfer to the acquirer, who must continue to honour this policy; we will tell you before that happens.

We do not sell your personal information and we do not share it for cross-context behavioural advertising.

6. International transfers

Some providers are located in, or process data in, the United States. Where that happens, transfers are covered by the European Commission's Standard Contractual Clauses, the EU-US Data Privacy Framework where the provider is certified, or another lawful transfer mechanism, together with additional safeguards such as encryption in transit and at rest.

You can ask us for details of the safeguards used for any specific provider at info@lecoach.app.

7. How long we keep data

• Account, training and wellness data: for as long as your account exists. This is deliberate: long-term training history is what makes coaching accurate.
• After you delete your account: deleted from live systems within 30 days.
• Backups: purged on our normal backup rotation, within 90 days at the latest.
• Invoices and payment records: kept for 7 years, as Dutch tax law requires.
• Analytics and error logs: retained for up to 12 months.
• Support correspondence: retained for up to 24 months.

8. Deleting your account and data

You can delete your account yourself at any time: open Settings in the app or on the web, scroll to the account section and choose Delete account.

This removes your profile, training plans, scheduled workouts, imported activities, wellness records, coaching conversations, memories and connected-service credentials. An active subscription is cancelled as part of the process. Records we are legally obliged to keep, such as invoices, are retained for the statutory period and nothing else.

Prefer us to do it for you, or want a copy of your data first? Email info@lecoach.app and we will handle it within 30 days.

9. Your rights

Wherever you live, you can ask us to:

• Access: give you a copy of the personal data we hold about you
• Rectify: correct anything inaccurate or incomplete
• Erase: delete your data ("right to be forgotten")
• Port: provide your data in a structured, machine-readable format
• Restrict or object: pause or object to certain processing
• Withdraw consent: for health data processing, notifications or analytics, at any time

European Union / EEA and United Kingdom: the rights above are your GDPR and UK GDPR rights. You may also complain to your national supervisory authority, or in our case the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Switzerland: equivalent rights apply under the Federal Act on Data Protection.

California: under the CCPA/CPRA you may request disclosure, deletion and correction, and you may not be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined, and we do not use sensitive personal information for anything other than providing the service you asked for.

Brazil (LGPD), Canada (PIPEDA), Australia (Privacy Act), and other jurisdictions: we honour the local equivalents of the rights listed above.

To exercise any right, email info@lecoach.app. We respond within 30 days and never charge for a reasonable request.

10. Security

• Encryption in transit (TLS) and at rest
• Row-level database security, so each account can only reach its own data
• Password hashing and support for Google and Apple sign-in
• Encrypted storage of third-party API credentials
• Access controls, audit logging and monitoring

Administrative access: authorised LeCoach staff may view account data in read-only mode for support, debugging and service quality. This access is limited to what a support request requires and is logged.

Breach notification: if a data breach is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours and inform you without undue delay.

No system is perfectly secure. We work hard to protect your data but cannot guarantee absolute security.

11. Cookies, analytics and tracking

11.1 Essential storage

We use cookies and local storage to keep you signed in, remember your preferences and make the application work. These cannot be switched off without breaking the service.

11.2 Analytics

We use PostHog to understand how the product is used: page views, feature usage, performance and errors. This is first-party analytics, hosted in the EU.

11.3 Choices

• Visitors on public pages: you can opt out through the cookie banner, and your choice is remembered.
• Signed-in users: analytics is part of running and improving the service; email us to opt out and we will honour it.

We use no advertising cookies and no third-party ad trackers, on the website or in the apps.

12. Children

LeCoach is not intended for anyone under 18 and we do not knowingly collect data from children. If you believe a child has given us personal information, contact us and we will delete it promptly.

13. Changes to this policy

We may update this policy as the service evolves. If a change is significant we will notify you by email or inside the application before it takes effect. The effective date at the top always reflects the current version.

14. Contact

Email: info@lecoach.app
Gyn Health App B.V. (trading as LeCoach App)
Achtseweg Zuid 159R, 5651 GW Eindhoven, The Netherlands
Chamber of Commerce (KvK) number 98792105

If you are not satisfied with our response, you may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or your local supervisory authority.