Privacy Policy

Data Controller

The data controller for the personal data the Platform collects for its operation is DUAL LABS SAS, a company incorporated in the Oriental Republic of Uruguay, RUT 221074290016, with registered address at Bv. Gral. Artigas 2260, apto. 507, CP 11600, Montevideo, Uruguay, which operates ATHRIX. Contact for questions and for exercising your rights: privacidad@athrix.fit.

When an Organization (gym, trainer, professional) uses ATHRIX to manage its athletes, that Organization acts as data controller for the data it generates about them (assigned routines, assessments, notes, communications, events), and ATHRIX acts as data processor for that information (art. 4 lit. T, Law 18.331). The scope of this arrangement is set out in section 6.

This policy is governed by Law No. 18.331 on the Protection of Personal Data and Habeas Data Action of the Oriental Republic of Uruguay and supplementary regulations. The enforcement authority is the Unidad Reguladora y de Control de Datos Personales (URCDP), Uruguay's personal data protection authority.

1. Information We Collect

1.1 Athlete Data

When an Athlete uses ATHRIX, we collect:

• Account data: name, email, password (stored hashed, not recoverable).
• Social sign-in data: if you sign in with Google or Apple, we receive your email, name and profile photo from those providers.
• Profile data: date of birth, gender, profile photo, country.
• Physical data: weight, height, target weight, training experience, preferred days.
• Health data (sensitive): injuries, limitations, medications, medical conditions, self-reported health status.
• Apple Health / HealthKit data (sensitive, iOS only): if you turn on the integration, we read from Apple Health the metrics of the workouts you recorded on your iPhone or Apple Watch — duration, active calories and heart rate — to fill them in automatically in ATHRIX, and — if you turn on syncing in your profile — we save to Apple Health the workouts you complete in the app. It is optional and you can revoke it whenever you want (see section 3.1).
• Training data: routines, exercises, sets performed, RPE (rate of perceived exertion), progress, sports goals.
• Content you generate: notes, community feed posts, reactions, messages with your coach.
• Conversations with the AI assistant: messages sent and responses received, along with the weekly analyses the system generates automatically.
• Automatic technical data: IP address, browser or app user-agent, app version, login date/time.
• Device tokens: anonymous identifiers of your Android/iOS device used to send you push notifications.

1.2 Data of Organizations and their staff

When an Organization (gym, trainer, professional) uses ATHRIX to manage athletes, we collect:

• Institutional data: legal or trade name, RUT or equivalent tax identification, address, business contact details (email, phone), line of business and logo.
• Staff data: name, email, password (hashed), role assigned within the Organization (coach, administrator, assistant), profile photo and, where the activity requires it, professional credentials or qualifications.
• Operational data: routines and templates created, exercises uploaded, physical assessments, calendars, notes about athletes (private or shared), published events and communications with linked athletes.
• Billing data: where applicable, information for issuing tax receipts for the plans purchased.
• Automatic technical data: IP address, user-agent, staff login date/time.
• Usage and analytics data: pages and sections of the dashboard you visit, actions you take (for example, creating a routine or inviting an athlete), interaction events, device and browser characteristics, and analytics identifiers stored in your browser. We collect this data through a product analytics tool (PostHog), linked to your account, to understand how the dashboard is used and improve it (see section 7).
• Advertising and measurement data: we use the Meta Pixel and associated identifiers (_fbp, _fbc) and, when you sign up or invite an athlete, we share with Meta a conversion event that includes those identifiers, your email in hashed (non-reversible) form and technical data (IP, user-agent), to measure and optimize our advertising campaigns. We never share your email in plain text. Advertising is on by default outside the EU/EEA/UK and you can turn it off whenever you want; within those regions we only turn it on if you give your consent. If it is off, we do not install the pixel or send this data (see sections 7 and 12).

2. How We Use Your Information

2.1 Uses of Athlete data

• Providing you with the service: showing routines, logging progress, connecting you with your coach or organization.
• Personalizing the AI assistant's responses with your context.
• Generating automatic weekly analyses of your training.
• Sending you push notifications about assigned workouts, messages and events.
• Sending you operational emails (account verification, password recovery, confirmations).
• Detecting, preventing and investigating fraud, abuse or uses contrary to our Terms.
• Complying with legal, tax and regulatory obligations.
• Improving the Platform and developing new features, always with aggregated or anonymized data where possible.
• Publishing your name and profile photo on your coach's public page, only if you gave us that explicit permission from the app.

2.2 Uses of the data of Organizations and their staff

• Providing access to the web management dashboard and to the tools for creating routines, assessments, content and events.
• Enabling linking and communication with the athletes who join the Organization.
• Issuing receipts and managing billing for the plans purchased where applicable.
• Sending operational emails and notifications about the institutional account, relevant changes to the Platform and support.
• Providing technical and sales support.
• Detecting, preventing and investigating fraud, abuse or uses contrary to our Terms.
• Complying with legal, tax and regulatory obligations.
• Measuring and analyzing use of the dashboard through a product analytics tool (PostHog) to understand usage behavior, detect errors and prioritize improvements. Part of this analytics is linked to your account and the rest is processed in aggregate.
• Advertising and measurement: measuring the effectiveness of our advertising campaigns and optimizing them, by sharing conversion events with Meta (Facebook and Instagram) through its Pixel and its Conversions API. It is on by default outside the EU/EEA/UK and requires your consent within those regions; you can turn it on or off at any time from the cookie banner (see sections 7 and 12).

We do not show third-party advertising within the Platform, nor do we sell your personal data. The only advertising use we make is measuring and optimizing our own campaigns; you can turn it off whenever you want and, where the law requires it (EU/EEA/UK), it only happens if you give your consent. Email marketing communications have their own consent and an unsubscribe option.

3. Health Data — Special Protection

Law 18.331 classifies health data as sensitive data (art. 4, lit. E). That is why it receives enhanced treatment:

• We only collect it with your express, free and informed consent, given in writing or by equivalent means during onboarding (arts. 9 and 18, Law 18.331).
• Providing it is voluntary. If you don't share it, you can use the Platform with limited functionality.
• Only you and the professionals you explicitly authorize can access it.
• We do not share it with third parties for commercial purposes, nor with insurers, nor for discrimination of any kind.
• You can revoke your consent and request its deletion at any time by writing to us at privacidad@athrix.fit.

3.1 Apple Health (HealthKit) integration — iOS only

On Apple devices, ATHRIX can integrate with Apple Health (HealthKit) only if you turn it on and grant the operating system permission. The integration is optional and you can revoke it at any time from Settings → Health → Data Access & Devices on your iPhone.

• What we read: only your workout metrics — duration, active calories and heart rate (minimum, average and maximum). We do not access any other Apple Health data.
• What we write: only if you turn on syncing with Apple Health from your profile, we automatically save each workout you complete — its duration and calories — as an activity session. We do not modify or delete any other Apple Health data.
• What we use it for: to offer to fill in the workouts you log in ATHRIX with that data, if you choose to, so you don't have to enter it by hand, and so your ATHRIX workouts are recorded in Apple Health alongside the rest of your physical activity.
• Where it is stored: these metrics are stored in our database, linked to the corresponding workout. If you are linked to an Organization, they form part of your performance and are visible to your coach (see section 5); by turning on the integration you give your consent for that use.

We never use data obtained from Apple Health for advertising, marketing or commercial profiling, nor do we combine it with third-party data for those purposes, nor do we disclose it to third parties except to your Organization in order to provide you with the training service. This processing follows the requirements of section 5.1.3 of Apple's App Store Review Guidelines, in addition to the enhanced treatment of sensitive data described in this section.

4. AI Assistant — External Processing

Conversations with the AI assistant are processed through Vercel's AI Gateway (based in the United States), which routes them to the provider that runs each model: Microsoft Azure or Google Cloud (Vertex AI), also in the United States. The models are made by OpenAI and Google, but the ones who run them — and therefore the ones who receive your messages — are those two companies. To personalize responses, we send context about your profile, goals, training and, when relevant to the query, health data.

All of them act as data processors: they process that data solely to answer your query and following our instructions. Every request we send imposes two conditions on the provider that receives it: that it does not use your data to train its models and that it does not retain it once the query has been answered. If no available provider meets both conditions, the request fails instead of being sent anyway.

Conversations are stored on our servers so you can pick them up again; you can delete them at any time from the app.

5. Sharing Data with your Coach or Organization

If you join a gym, trainer or organization, it will be able to access:

• Your name, profile photo and basic details.
• Your goals and training progress.
• Your assessments, physical metrics and performance in assigned routines.
• The notes your coach writes about you (some may be private to the coach and others visible to you).
• The messages you exchange with the organization in Messages, if the organization has it turned on: they are read and answered by any member of its team who has access to your profile, and each reply shows who wrote it. If you stop training with the organization, its team can keep reading the conversation, without being able to reply to it, for up to 180 days afterwards.

The content of your messages is not used for analytics and is not kept in our technical logs. Sending a message does not depend on your consent for health data: it is a communication you choose to send, even if you talk about an injury or how you feel.

Your coach does NOT have access by default to your conversations with the AI assistant, your sensitive health data or your personal nutrition data, unless you explicitly authorize it.

When you are linked to an Organization, that Organization is a joint controller of the training data it assigns you and of the notes your professionals generate about you. You can revoke the link at any time from the app.

Your name and profile photo may appear on your coach's public page, only if you gave us that explicit permission from Privacy in the app. It is off by default: if you never answered, you don't appear. We never publish anything else about you — not your records, your goals or your health data — and no new recipient is involved: we publish that page ourselves. You can withdraw the permission whenever you want with a single tap, and you stop appearing immediately.

6. Role of Organizations as Data Controllers

When an Organization uses ATHRIX to manage its athletes, that Organization acts as data controller for the data it generates about the athletes in its charge: assigned routines, physical assessments, notes, events, messages and other content uploaded from its account. With respect to that information, ATHRIX acts as data processor (art. 4 lit. T, Law 18.331), processing it following the Organization's instructions and exclusively to provide the service.

There is joint responsibility for data whose processing is defined jointly by ATHRIX and the Organization (for example, the configuration of the Athlete-Coach link or enabling features within the Platform).

Organizations that use ATHRIX undertake to:

• Inform their athletes of any additional use they make of their data outside the Platform and obtain the corresponding legal basis under Law 18.331.
• Process sensitive health data only with the athlete's express consent and limit access to it to strictly necessary staff.
• Respond to the ARCO rights their athletes exercise regarding the data the Organization generated, within the legal deadlines.
• Safeguard their staff's access credentials, promptly remove staff who leave the Organization and report to ATHRIX any security incident they detect.
• Keep professional credentials or qualifications current when the activity they carry out through the Platform requires it.
• Not use athletes' data for purposes unrelated to the service they provide them, nor disclose it to third parties without consent.

ATHRIX, for its part, undertakes to process that data following the Organization's instructions, apply appropriate security measures and report incidents affecting the information processed.

7. Third Parties We Share Data With

To provide the service, we engage providers who act as data processors under contractual agreements, except for payment providers, who act as independent controllers as indicated in each case. We do not sell or disclose your data for purposes unrelated to the service.

• Vercel — AI Gateway (USA): the queries the Platform makes to AI models pass through here, including every assistant message, on their way to the provider that answers them.
• Microsoft Azure and Google Cloud — Vertex AI (USA): they run the models that generate the assistant's responses. They receive your messages, profile and context, without using them for training or retaining them once the query has been answered (section 4).
• TypeSafe AI (USA): AI model provider. The Platform reaches it through the same AI Gateway as the rest, with the same no-training and no-retention conditions, and through Cloudflare. It does not receive your name, your email, or your training or health data.
• Cloudflare (USA / global): hosting of the API, database, image storage and content delivery (CDN). All data at rest lives on its infrastructure, including that of our customer CRM.
• Google — Firebase Cloud Messaging (USA): delivery of push notifications to your device.
• Resend (USA / EU): sending of operational emails (verification, password recovery, notices). Among those notices is the one your trainer's team receives with the names of the athletes whose birthday is that day, if you have your birthday visible.
• PostHog (EU): product analytics platform. It measures use of the web management dashboard and the public website (pages visited, actions, interaction events and technical device and browser data) to help us improve the service. The data is hosted and processed on its European Union infrastructure. Requests are routed through an ATHRIX subdomain before reaching PostHog. We do not use this information for advertising purposes.
• Sentry (EU): error and performance monitoring platform. It receives crash reports from the mobile app, the public website, the management dashboard and the API so we can diagnose and fix them. It is not an analytics tool and does not receive usage events: the details of what each report contains are in section 13. The data is hosted and processed on its European Union infrastructure and kept for a maximum of 90 days.
• Meta Platforms (USA / Ireland): advertising cookies, on by default outside the EU/EEA/UK and subject to your consent within those regions. We use the Meta Pixel and its Conversions API to measure and optimize our campaigns on Facebook and Instagram. We share conversion events with it (for example, a sign-up or an athlete invitation) with browsing identifiers ({{fbpCookie}}, {{fbcCookie}}), your hashed email and technical data (IP, user-agent). We do not send it your email in plain text, nor your health data, training data or AI conversations. If you turn it off, none of this is activated.
• Google Sign-In / Apple Sign-In: social authentication when you choose that login option.
• Lemon Squeezy (USA): processes the payment for the ATHRIX plans that Organizations purchase and acts as merchant of record: it is the one that issues the charge and the invoice. It receives the email, name, billing details and card details of whoever pays on behalf of the Organization; ATHRIX never sees or stores the card number. It acts as an independent controller of that data, under its own privacy policy. That is why the charge appears on your statement under the name Lemon Squeezy (LEMSQZY), not ATHRIX.
• Mercado Pago (Argentina / Uruguay): when an Organization charges its athletes through ATHRIX, the payment is processed in that Organization's Mercado Pago account, not in an ATHRIX account. Mercado Pago receives the email of the paying athlete and the subscription details (plan, amount, frequency). It acts as an independent controller of that data, under its own privacy policy. ATHRIX only keeps the status of the subscription to reflect it on the platform.
• Public authorities: when required by a court order or valid legal request.

8. International Data Transfers

Several of our providers process data in the United States or other countries that the URCDP has not declared to have an adequate level of protection (Resolution 23/2021). Law 18.331 (art. 23) prohibits transfers to those countries except in certain cases, including the express consent of the data subject and the signing of appropriate contractual clauses in accordance with URCDP Resolution 41/021.

By accepting this policy you give express consent to the international transfer of your personal data, including sensitive data when strictly necessary for the service. We do not currently have signed contractual clauses with those providers: each one processes your data under its own terms of service and data processing terms, and under the restrictions we send with each request (for example, AI queries require the provider not to use your data to train its models or retain it once the query has been answered; see section 4).

9. Storage, Security and Retention

Your data is stored on servers with encryption in transit (TLS) and at rest. Passwords are stored with an irreversible cryptographic hash. We apply access controls and log security events.

Indicative retention periods:

• Active account: for as long as you keep it open.
• After the account is closed: up to 30 days to allow reactivation, and up to 90 additional days in backups before permanent deletion.
• Session logs (IP, user-agent): up to 12 months.
• Technical logs of each request to our servers (account and organization identifier, without IP or email): up to 7 days.
• Technical service usage metrics per organization (without data that identifies a person): up to 90 days.
• Error and performance reports (section 13): up to 90 days.
• Meta advertising identifiers (_fbp, _fbc) that we keep to measure campaigns: up to 90 days (Meta's attribution window), after which they are deleted automatically.
• AI conversations: until you delete them, or until your account is closed.
• Messages with an organization: up to 180 days after you stop training with it, or until your account is closed if that comes first.
• Accounting data: the period required by applicable Uruguayan tax and commercial law.
• Data required by court order: for the period that order specifies.

In the event of a security incident affecting your data, we will notify you without undue delay and report it to the URCDP where applicable.

10. Your Rights (ARCO)

We respond to every request within a maximum of 5 business days of receiving it, no matter which country you are in. This is the deadline set by arts. 14 and 15 of Law 18.331, and it applies to all our users because DUAL LABS SAS, the data controller, is established in Uruguay. It is a single deadline for all the rights in this section, including the export of your data.

Under Law 18.331 you have the right to:

• Access: know what data of yours we process, its purposes and the third parties we share it with (art. 14).
• Rectification, Updating, Inclusion or Erasure: correct inaccurate data or request its deletion (art. 15). This procedure is free of charge.
• Objection: object to specific processing where legally appropriate.
• Portability: export your data in a structured format, including your complete Messages conversations: your messages and the replies from the organization's team. We put the copy together and email it to your account's email address, within the same 5 business days.
• Withdrawing consent: including the link with your coach or organization at any time.

When the right you exercise concerns data generated by an Organization you are linked to (for example, notes from your coach, assessments or assigned routines), ATHRIX will coordinate your request with that Organization, which is the data controller for that information and must respond within the legal deadlines. In all cases you can contact us for help in exercising your right.

If you are in the European Union, the European Economic Area or the United Kingdom, the GDPR also grants you the rights in its arts. 15 to 22: access, rectification, erasure, restriction of processing, portability and objection. We respond to them within the same 5 business days, which is shorter than the one month that art. 12.3 of the GDPR sets as a maximum. We do not use the extension that article allows.

To exercise these rights, write to us at privacidad@athrix.fit from the email linked to your account, proving your identity. If you do not receive a response within the legal deadline or believe your rights have been violated, you can file a habeas data action and report the situation to the Unidad Reguladora y de Control de Datos Personales (URCDP) (gub.uy/unidad-reguladora-control-datos-personales), the enforcement authority for Law 18.331.

11. Minors

ATHRIX is intended exclusively for people over 18. We do not knowingly collect personal data from minors. If we detect an account belonging to a minor, we will suspend it and delete the associated data. If you are a parent or guardian and believe a minor in your care has given us data, contact us at privacidad@athrix.fit.

12. Cookies and Similar Technologies

On the public website (athrix.fit) and the web management dashboard (app.athrix.fit) we use cookies and local storage in three categories: essential, needed for the site to work; analytics, to understand how the site is used and improve it; and advertising, to measure the effectiveness of our campaigns.

As for analytics: on the public website we measure by default anonymously and without cookies (legal basis: legitimate interest) and only install analytics cookies if you accept them; on the management dashboard analytics is off by default and only turns on with your consent, except on the sign-up screen reached from an ad, where we measure anonymously and without cookies just as on the public website. As for advertising: outside the EU/EEA/UK it is on by default and you can turn it off whenever you want; within those regions it only turns on if you give your explicit consent. This applies on both sites.

The first time you visit, we show you a banner so you can accept, reject or configure non-essential cookies, with separate controls for analytics and for advertising. If you reject, we turn off analytics and advertising entirely, with no measurement at all, not even anonymous. We keep your choice (with its version and date) for 6 months; after that period we ask you again.

12.1 Essential cookies and storage

Needed to provide the service you requested. They do not require consent and cannot be turned off.

12.2 Analytics

We use PostHog to understand how people navigate the site and the dashboard, so we can improve them. The details of this provider are in section 7.

Your analytics choice also governs the enriched level of error monitoring: if you reject it, crash reports are limited to the minimal, anonymous report described in section 13.

Anonymous cookieless analytics (public website and the sign-up screen reached from an ad). By default we measure in aggregate and anonymously, without installing cookies or storing any identifier on your device. It does not require consent; you can turn it off by rejecting analytics in the banner or in "Cookie preferences".

Analytics cookies (require your consent). They are only loaded if you accept analytics from the banner or the preferences panel, and they let us recognize your browser across sessions for more accurate measurement:

12.3 Advertising and campaign measurement

On by default outside the EU/EEA/UK; within those regions they require your prior consent. You can turn them off whenever you want from the banner or the preferences panel. We use the Meta Pixel (Facebook and Instagram) to measure the effectiveness of our campaigns: recognizing that you arrived from an ad and recording conversions (for example, a sign-up or an athlete invitation). We complement that measurement on the server side with Meta's Conversions API, to which we send the event with those same identifiers, your hashed email and technical data (IP, user-agent) — the provider's details are in section 7. If you turn them off, we do not install the pixel or send any event to Meta.

If you arrive from the page of an ATHRIX affiliate (athrix.fit/by/…), we also store in a first-party cookie which affiliate you came from and when, so we can apply their benefit to you if you create your account or log in with yours within 7 days. If you turn off these cookies we don't store it, or we delete it if it was already there, and the benefit still applies if you follow the buttons on that page.

12.4 How to withdraw or change your consent

You can change your choice whenever you want — withdrawing consent is as easy as giving it:

• Click "Cookie preferences" in the footer (on both the website and the management dashboard) to reopen the panel and turn analytics and advertising on or off independently.
• You can also block or delete cookies from your browser settings; if you block the essential ones, some features of the site may stop working properly.

In the mobile app we do not use cookies; session tokens are stored encrypted in the operating system's secure storage (Keychain on iOS, EncryptedSharedPreferences on Android).

13. Error and Performance Monitoring

To detect and fix failures we use an error and performance monitoring tool, Sentry. It is an activity separate from product analytics: we do not use it to measure how you navigate, nor do we combine it with analytics data. It serves solely to know what broke so we can fix it.

Crash reports (legal basis: legitimate interest). When the app or the site closes unexpectedly we send a minimal, anonymous report, regardless of your analytics choice: the type of error and its technical trace, the ATHRIX version, the operating system and the device model or browser. It does not include your name, your email or any identifier of your account. The legal basis is our legitimate interest in keeping the service intact and secure: an app that crashes on launch would never even get to ask you.

With the same legal basis and the same minimal content, we send technical failures from our servers: a database query that didn't complete, a charge that couldn't be synced, a message that didn't get saved. We send them even if the failure didn't close anything and even if you didn't notice it, because these are the ones that break the service silently. The report describes what broke in our infrastructure, not who was using it: it doesn't carry your account identifier, your data or what you were doing.

Enriched diagnostics (requires your consent). Only if you accepted analytics — in the cookie banner, in "Cookie preferences" or on the mobile app's consent screen — do we add to the report your account identifier, to recognize whether a failure affects you in particular; the steps leading up to the error (screens opened and actions taken); non-fatal errors in the app and the site, which don't close them but break a feature; and performance traces, such as how long a screen or a query takes to respond. If you withdraw that consent we stop sending all of that and only the minimal, anonymous report remains.

What we don't collect. We don't record your session (we don't use session replay), we don't take screenshots, we don't log the structure of the screens you see, we don't keep any permanent identifier of your installation and we don't store your IP address: IP storage is disabled on the provider's side for all our projects.

Sentry acts as data processor under a data processing agreement. Reports are hosted and processed in its European Union region — for all users, not just those in the EU — and kept for a maximum of 90 days, after which they are deleted.

14. Changes to this Policy

We may update this policy to reflect changes in the service or in regulations. We will notify you of significant changes at least 15 days in advance by email or through a visible notice within the Platform. The date of the last update appears at the top of the document.

15. Contact

For questions about privacy, exercising your ARCO rights or any concern about how your data is processed, write to us at privacidad@athrix.fit.