← AWPREP

Privacy Policy

Version 1.0 · Effective 18 July 2026 · Data controller: the AWPREP platform operator (EU legal entity — full details will be published upon company registration). This policy is written to comply with the EU GDPR.

1. What we process and why

Data	Whose	Purpose	Legal basis
Account data (name, email, password hash, language)	coaches, athletes	authentication, service operation	contract (Art. 6(1)(b))
Coaching data: check-ins, measurements, plans, chat	athletes	the coaching service itself	contract + explicit consent
Health-related data: lab results, medical records, medication, physical condition	athletes	enabling the coach to manage preparation safely	explicit consent (Art. 9(2)(a)), given at account activation and revocable at any time
Billing status of coach subscriptions	coaches	subscription management	contract
Application form data	applicants	reviewing access requests	pre-contractual steps

2. What we do NOT do

• No advertising, no sale of data, no tracking cookies on the product. The landing page stores only your language choice in your own browser.
• Coaches see only their own athletes. Isolation is enforced in the application and at the database level (row-level security).

3. AI processing

When a coach uses an AI feature, the relevant athlete context (card, diary, labs, medical record, plan) is sent to our AI provider (Anthropic) via our infrastructure to generate the response. AI providers process this data as processors and do not use it to train their models under our API terms. AI actions are logged (who, when, which kind — not the content) for billing.

4. Processors and transfers

• Hosting: Hetzner (Germany, EU). Database: Supabase (EU region). AI: Anthropic (USA — safeguarded by EU Standard Contractual Clauses under their Data Processing Addendum).
• We do not share data with anyone else, except when required by law.

5. Retention

• Active accounts: for as long as the account exists.
• After a coach's subscription lapses, data is retained for 12 months so a returning coach loses nothing, then deleted.
• Deleted accounts: removed from the live database immediately; encrypted backups expire within 30 days.
• Landing applications: deleted or anonymised within 12 months.

6. Your rights (GDPR)

• Access & portability: athletes can download all their data as JSON directly from their cabinet ("Download my data").
• Rectification: ask your coach, or the operator, to correct inaccurate data.
• Erasure: request deletion of your account — via your coach or the operator. Deletion removes your cabinet and all coaching data.
• Withdrawal of consent: you may withdraw health-data consent at any time; this stops further processing and, in practice, means closing the cabinet, since the service cannot operate without this data.
• Complaint: you may lodge a complaint with your national data-protection authority (in Spain: AEPD).

7. Security

TLS everywhere, passwords stored as Argon2 hashes, per-tenant row-level security in the database, access-controlled media, EU hosting, principle of least privilege for the application's database role.

8. Changes

Material changes will be announced in the Service in advance. The current version always lives at awprep.com/privacy.html.

Русская версия будет опубликована к открытой регистрации; при расхождении приоритет имеет английский текст.