Privacy Policy

Health-data policy version 2026-10-01 · in force from 1 October 2026

Ce document est une traduction. La version française est la version de référence.

Ovyxa is a training coach. It reads a small number of recovery measurements and what you tell it about your training, and it uses them to decide what you should do next. This page says exactly which measurements, why each one is needed, how long it is kept, and what you can do about it.

Ovyxa is not a medical device

Nothing here is a diagnosis, a treatment, or medical advice. Ovyxa does not detect illness or injury and is not designed to. If something hurts, if a measurement worries you, or if you are unsure whether training is safe for you, speak to a doctor or a qualified health professional. Do not delay doing so because an app said your recovery looked fine.

1. Who is responsible

Ovyxa is the data controller for everything described on this page. Questions, requests and complaints about your data all go to one address, and a human reads it.

Controller: Paul Fournier, sole trader (entrepreneur individuel)
15 rue de Bièvre, 75005 Paris, France
SIREN 843 658 519 — registered with the French national business register (RNE)
VAT not applicable, Article 293 B of the French General Tax Code
Contact: contact@ovyxa.com
Data protection officer: None is appointed. The processing falls under none of the three cases in Article 37(1): Ovyxa is not a public body, its core activity is not regular and systematic monitoring on a large scale, and the health data it processes is its own customers', one at a time, rather than large-scale processing within the meaning of that article. Write to the address above.
Service: Ovyxa for iOS, and the API at api.ovyxa.com
Where the data lives: OVHcloud, Gravelines region, France (European Union)

If you are in the EU or the UK and you think your data has been mishandled, you may complain to your national supervisory authority — in France, the CNIL. You are welcome to write to us first, but you are not required to.

2. What is collected, and why

Every category below exists because a specific part of the coaching engine reads it. If a field stops being read, it stops being collected. There is no analytics category on this table because there is no analytics collection.

Data categories, purpose and source
Category	What it is	Why it is needed	Where it comes from
Account	A pseudonymous account identifier and the stable subject identifier Apple issues for Sign in with Apple.	To recognise you across sessions and devices.	Apple, when you sign in.
Name	None. The app does not read the name Apple offers it, and the server refuses the field: it exists neither in the sign-in request nor in the database.	Nothing reads it, so nothing collects it.	—
Age confirmation	That you confirmed you are 16 or older, and when you confirmed it. Not your date of birth, which is never asked for.	The terms require it and the App Store requires it. Nothing else reads it — see section 12.	You, once, during setup.
Year of birth	A four-digit year, and nothing more precise. Still not your date of birth, and not the same record as the age confirmation above, which keeps its own separate meaning. It is optional: refusing it costs you only the estimate.	One published formula estimates a maximum heart rate from an age. Without a year there is no age, and without an age there is no estimate — see section 2a.	You, in the app, if you choose to.
Intensity anchors	The reference numbers a training intensity is measured against: maximum heart rate, threshold heart rate, resting heart rate and VO₂max. Each is stored with where it came from — declared by you, measured by your watch, or tested — and the day it was established.	An intensity is a percentage of something. Without an anchor the app cannot say what effort a session is asking for, and it will not invent one.	You, or Apple Health if you confirm a value it suggests — see sections 2a and 3.
Goals and competitions	What you are training for, its priority, and a race name, date, distance and discipline when you enter one. For a trail race, the course's ascent, descent and technicality.	It is what the plan is aimed at. The race date determines when the taper starts, and the descent changes what is prescribed before it.	You, in the app.
Training plan and history	Scheduled and completed sessions, prescriptions, weekly availability, equipment, the terrain you run on, how long you want a strength session to last if you say so, and the record of every adaptation with the reason codes behind it.	The plan itself, and the audit trail that lets a change be explained and undone.	You, and the engine.
Session feedback	Perceived effort (RPE), reps in reserve (RIR), duration, distance, and a pain flag.	Effort you report is first-class input; the plan changes because of it. A pain flag is a safety signal.	You, after a session.
Recovery measurements	Heart-rate variability (SDNN), resting heart rate, and total sleep per night, plus the baseline bands derived from them.	The recovery engine reads them to judge how recovered you are.	Apple Health on your iPhone, with your permission — see section 3.
Limitations	Codes from a fixed list, for example a knee limitation. No free text.	To stop the plan prescribing something you should not do.	You, in the app.
Durable constraints	A sentence you write yourself — "I only have a kettlebell", "I cannot jump in the flat" — and, beside it, what the model managed to translate into a closed vocabulary. Both are kept: the translation because it is the only thing an engine reads, your sentence so you can read back what was understood and deny it. A sentence nobody could place is kept untranslated and changes no plan.	No grid of checkboxes contains "I have nothing but flat ground". What you say in words is the only way to say it.	You, in the app.
Day context notes	A fixed vocabulary of four things you may say about a day: a disrupted night, travel, unusual life stress, or an expected cyclical variation.	Context that explains a measurement, so a bad number is read as a bad night rather than as lost fitness.	You, and only if you ask for it — see section 4.
Meals	What you log that you ate: the day, the meal, and for each food its name, quantity and nutrients (energy, protein, carbohydrate, fat, fibre, alcohol), and whether it came from a barcode, the Ciqual table or your own typing. No barcode, photo or product code is stored. Saved dishes and the days you mark complete are kept the same way.	To show what you have eaten against the day's ranges, and to let you log a dish or a recent food again. Only if you turned nutrition on — see section 4a.	You, in the app.
Body mass and measurements	Your body mass, and optionally your height and waist, hips, chest, arm and thigh measurements, each with the day it was taken. Every field may stay empty.	The day's ranges are published per kilogram of body mass; height is asked only to warn you about a weight target. No body-mass index, body-fat percentage or ideal weight is ever shown.	You, in the app, and only if you turned nutrition on.
Nutrition goal	Lose, gain or maintain body mass, gain muscle or perform; a target mass and date if you give them.	To pace a change of body mass inside your training, never ahead of it.	You, in the app.
Coach conversation	Your questions to the AI coach and its answers, as written — so, your own words.	So the conversation continues: the last few turns are re-read to answer the next one.	You, if you turned the AI coach on.
Time zone	The IANA time zone you are in, and from when, as an append-only record.	To place a session on the right calendar day when you travel. It is coarse location and is handled as personal data.	Your device.
Subscription status	Whether an active subscription exists, and the billing events that establish it.	To unlock paid features. Purchases themselves are handled by Apple.	RevenueCat, on Apple's report of your purchase.
Security events	Sign-ins, session refreshes, refresh-token reuse, consent changes, deletion requests. Recorded against a pseudonymous identifier.	To detect a stolen session and to prove, later, what happened to your account and when.	The service itself.
Deletion contact	One email address, captured only when you ask to delete your account, and erased when the deletion completes or is cancelled.	So we can tell you the deletion finished.	You, at the moment you request deletion.

No email address is stored for an active account. Sign in with Apple lets you hide your address, and Ovyxa never asks for it. The only exception is the deletion contact above, which exists for as long as a deletion is pending and no longer — the database itself refuses to hold one against an account that is not deleting.

2a. Estimates are never stored as if they were measurements

If you have never given a maximum heart rate and have given a year of birth, the app shows an estimate from a published formula (Tanaka 2001). It is computed for display and is not stored. An anchor enters the database only when you declare it, or when you confirm a value Apple Health suggests — and it enters with its provenance, so that no estimate can later pass for a measurement.

That formula's own error is of the order of 7 to 11 beats per minute. That is why the app says so where it shows it, and why a measured value always replaces an estimated one.

3. Apple Health, and what is deliberately not read

Ovyxa asks iOS for read access to six types and no others. It never writes anything back to Health.

Read	Stored as	Why
Heart-rate variability (SDNN)	One value per measurement	The recovery engine's primary baseline.
Resting heart rate	One value per day	A recovery metric in its own right, not a confirmation of the first.
Sleep analysis	One total per night. The sleep-stage breakdown is discarded on your iPhone and never leaves it.	Sleep duration moves the recovery judgement; stage architecture does not.
VO₂max (cardio fitness)	The single most recent value, and only if you tap "Use this". No history is read, and nothing is sent unless you confirm it.	An intensity anchor you already have, rather than one you must go and test.
Heart rate, during workouts only	One number: the highest reading across recent workouts, computed on your iPhone, and only if you tap "Use this". No heart-rate series, no individual reading and no timestamp ever leaves the device — everything but that single maximum is discarded where it was read.	The highest heart rate your own training has actually produced is a real anchor, where the formula in section 2a is only an estimate.
Workouts	One summary per run, ride or strength workout, for the last 28 days and then as they arrive: its sport, start and end, duration and, when your watch wrote them to Health, its distance, climb and your average and maximum heart rate. It enters your training history, marked as coming from Apple Health, and waits for you to say how it went. No GPS route, no heart-rate series and no other kind of workout leaves the iPhone, nor any workout Ovyxa wrote itself. The bounds of your workouts over the last year are also used, on the iPhone only, to find the maximum in the row above.	Garmin, COROS, Amazfit and Oura write your workouts to Health: this is how Ovyxa knows what you did without you typing it, and adjusts what comes next.

Still not requested, and each for a reason: a continuous heart-rate timeline, because it is roughly twenty-five times the volume and nothing here reads one — the row above takes a single maximum and leaves the series on the phone; and every characteristic type — date of birth, biological sex, blood type — because none of them is read by anything. The year of birth in section 2 is typed by you if you want the estimate; it is never taken from Health. Workouts, finally, arrive only as summaries, as the row above says.

The app reads only the last fourteen days on the first upload after a cold start, and after that only what is new. It does not sweep your iPhone's history: what has no reader is not collected. The recovery engine, separately, reasons over a 60-day reference window — that is how far back it reads, not how long a measurement is kept, which section 7 states. On arrival, the server drops without storing it any measurement dated more than 60 days back, or on a day that has not yet come: what the engine will never read does not enter the database.

Granting Health access in iOS is not by itself consent to upload: Ovyxa asks you separately, inside the app, before a single measurement is sent. If you have not answered, nothing is sent. Health data is never used for advertising, and it never will be.

4. Article 9 data and its separate consent

Health data

Recovery measurements, what you say about your body on a morning check-in — including pain — the effort and feeling after a session, your limitations and the sentences of your durable constraints are all data concerning health under Article 9 GDPR. They all rest on a single explicit consent, asked for when the account is created.

That consent is required to use Ovyxa, because a training coach that can read nothing about your body cannot coach. Refusing it means not opening an account; withdrawing it ends the account, and so erases what had been read.

One of the four day-context notes — expected cyclical variation — is also Article 9 data, and it is treated differently from everything else on this page:

it has its own consent, separate from the consent for health data, and you can refuse it while using everything else;
withdrawing that consent deletes the stored notes. It does not merely stop them being read — the rows are removed;
it is never sent to the AI coach, never logged, and never sent to any analytics.

The vocabulary is deliberately thin. It names no physiological state, records no phase, predicts nothing, and is not restricted to one kind of athlete. What it says is that you expected a measurement to move on a given day.

4a. Nutrition tracking, and what turning it off erases

Nutrition tracking is off until you turn it on, and turning it on is giving its own consent, separate from the consent for health data. It covers your meals and what they contain, your body mass and measurements, and your nutrition goal. They are used for the day's ranges and the pace of your goal, and for nothing that changes your training plan: the plan is decided exactly as it would be without them.

Turning it off erases it. Your meals, completed days, saved dishes, goal, body mass and measurements are deleted at the moment you switch it off. The app offers you the export first.
Scanning a barcode asks Open Food Facts, from your phone. The barcode digits and your phone's IP address reach Open Food Facts; no Ovyxa identifier does, and the request does not pass through Ovyxa. Nothing else about you is sent anywhere by this feature.
Searching foods stays on your phone. The Ciqual table (Ciqual 2025 © ANSES, Etalab open licence 2.0) is bundled in the app, so what you type into search is never sent.
What you eat is never logged and never sent to analytics. The AI coach reads it only if you have turned on both nutrition tracking and the coach, and only when your question needs it (section 6).

5. Lawful bases

Processing	Basis
Running your account and delivering the training plan you asked for	Contract — Article 6(1)(b)
Health and recovery data (heart-rate variability, resting heart rate, sleep, pain flags, limitations, constraints said in words, session feedback)	Explicit consent — Article 9(2)(a), asked for when the account is created and recorded against this policy version
Expected cyclical variation	Separate explicit consent — Article 9(2)(a). Withdrawal deletes the data.
Nutrition tracking: meals, body mass and measurements, nutrition goal	Separate explicit consent — Article 9(2)(a), given by turning nutrition on. Turning it off withdraws the consent and deletes the data.
Sending a summary of your training to the AI coach, and your answers during the onboarding interview	Separate explicit consent, asked for before the first message — at sign-up, in its own switch, optional
Keeping the service secure, and the security-event trail	Legitimate interests — Article 6(1)(f). The interest is preventing account takeover; the records are pseudonymous and hold no health values.
Receiving technical error reports	Legitimate interests — Article 6(1)(f). What is sent is built from an allowlist (section 8) and carries no account identifier, no message and no request content.
Keeping billing records	Legal obligation, and contract

Withdrawing a consent is as easy as giving it. Each one has a switch in Settings inside the app, and turning it off takes effect immediately — the same screen, the same number of taps. The health-data consent is the one exception, and it is said plainly: withdrawing it ends the account, because Ovyxa cannot coach without it.

6. The AI coach

You are talking to an artificial intelligence, and the app says so where you write to it. The AI coach explains decisions. It does not make them. Every change to your plan is decided by deterministic engines that run on our own servers; the model is given the decision and asked to put it into words. It cannot alter your schedule, override a safety rule, reach the database, or produce a diagnosis. What it proposes — skipping, moving or easing a session — is shown to you, and nothing changes without your agreement.

When you use it, a small summary is sent to OpenAI, in the United States: your main goal and its nature, your current block's phase, upcoming sessions and recent training in summary form, the recovery verdict and its reason codes, the last adaptation decision and its codes, the families of your durable constraints, and the last few turns of the conversation — which contain your own words.

And only when your question needs it, the coach can look up more of your own data, through tools we wrote that read your account and nothing else: your plan over at most four weeks, the day in progress (verdict, check-in answers, today's sessions), a summary of what you did over at most six weeks (sessions, minutes, distance, perceived effort), your profile (maximum and threshold heart rate, VO₂max, easy pace, availability, equipment, strength prescriptions) and, if you turned on nutrition tracking, what you logged over the last thirty days: the day's totals (kcal, protein, carbohydrate, fat, fibre), and the foods of one day at a time. These tools cannot write anything. A simple question calls none of them, and none of this leaves until the model has needed it to answer you.

When you ask it to, the coach can also prepare a card: log a meal you describe (its values are then an estimate, marked as such), a weight or a body measurement, a heart rate or a VO₂max you give it, a day you cannot train, or a session written for you in place of a planned one — whose duration and effort are computed by our own engines, never harder than the session it replaces, and refused under pain if it would be any harder. Nothing is saved until you confirm it, and confirming it goes through the same checks as entering it yourself.

If your onboarding left topics open — your reference heart rates, or what lastingly shapes your training, the two optional topics the form does not ask —, the coach can offer to pick them up: a message in the conversation, at most twice, the first at least three days after you joined, the second a week later, and only if the AI coach is on. For this we keep the list of those topics (codes, never an answer), how many offers were made and, if you say no, the date you did. The message is written by the app: nothing is sent to OpenAI to write it, it does not count against your questions for the day and it changes nothing in your plan. If you choose to pick them up, it is the onboarding interview described below, limited to those topics. "No thanks", or the switch in Settings, stops these offers and erases nothing.

The onboarding interview. If you accept the AI coach, it is the coach that welcomes you, even before you create your account: it asks you questions, one at a time, about your sports, your goal, your current volume, your availability, your equipment, the length of your strength sessions, the ground you run on and your limitations. Your answers are sent to OpenAI to conduct the conversation — including before any subscription, and including whatever you choose to write there (a pain, an injury, the name of your race). We add nothing to them: no Apple Health measurement, nothing from nutrition, no identifier. With your words goes only what has already been understood from your answers, so that you are not asked the same question twice. Nothing is recorded until you have read and confirmed the summary; what you confirm is then recorded as if you had entered it in the form. Ovyxa does not keep the onboarding conversation: it stays on your phone until you confirm, then is erased; the server keeps only counters (the number of interviews, turns and tokens, section 7). Accepting it is optional: without it you answer the form and receive the same plan — only the conversation is missing.

Before your account: the welcome session. So that the coach can talk to you before you have an account, the app opens a 24-hour welcome session. It is opened only for a genuine Ovyxa app on a genuine iPhone: Apple proves it through App Attest, a key that belongs to the app on your phone. We then keep, with neither your name nor any Apple identifier: the fingerprint of that key and its public half, a fingerprint of the session (never the session itself, which stays in your phone's keychain), a pseudonym of the day of your IP address, your three agreements (age, health data, AI coach) with their date and version, and the interview's counters. When you create your account at the end, your agreements are attached to it at their original date, with the counters, and the session closes. If you do not create an account, everything is deleted at most 48 hours after it opened; the key's fingerprint, which serves only to limit interviews per device and to stop anyone starting conversations in bulk at our expense, is deleted 180 days after its last use (section 7). That limit rests on our legitimate interest in preventing fraud (Article 6(1)(f)); the conversation itself rests on your consent. If your phone cannot provide this proof, the coach welcomes you after the account is created.

What is never sent: your name, your email, your Apple identifier, raw Apple Health samples — heart rate variability, resting heart rate, sleep —, the name or place of a competition, the exact sentence of a durable constraint, your day-context notes, your body measurements, and the contents of the database. Nothing is sent at all unless you have turned the AI coach on. OpenAI does not use what is sent to train its models.

7. How long things are kept

This table is verified by an automatic gate against the retention catalogue the nightly purge runs on: a duration published here that stopped being the code's fails the build. It is exhaustive — every table in the database appears, except four that hold no personal data at all (the exercise catalogue, the list of connectable providers, the purge's own log and its internal bookkeeping).

Retention periods by data category
Data	Kept	Why this long
Recovery measurements read from Apple Health	500 days	Last year's sixteen-week block sits 400 to 490 days back: 400 days would keep race day and delete the build that produced it.
Morning check-in, including the pain flag	500 days	A recovery observation, not training history. A recurring pain that matters must become a declared limitation, which lives with the account.
The computed recovery verdict and its reason codes	180 days	A computation, not a measurement: it is reproducible from its inputs for as long as they exist.
Day-context notes	60 days	They only ever explain a recent measurement. Past the window the engine reads, nothing consults them. Withdrawing the consent deletes them sooner.
Meals, logged foods, days marked complete	500 days	So a season can be compared with the last. Turning nutrition off deletes them at once.
One-off availability exceptions	500 days	A past date opens nothing any more; it explains a past week.
Closed training blocks	500 days	The same window as the measurements they explain.
Conversation with the AI coach	14 days	Only the last few turns serve the next answer. Beyond that nothing reads the conversation, so it is deleted — your own messages included.
Cards prepared by the AI coach	14 days	A meal you described to it, a weight or a heart rate you gave it, a day you cannot train: nothing is saved until you confirm the card, which expires after 48 hours. Once confirmed, the fact lives in its own category; the card follows the conversation it came from.
Security event log	395 days	One annual review cycle plus a month. This log is pseudonymous and survives account deletion: an audit trail a deletion could erase would not be one.
The plan and its history: completed sessions, feedback, declared missed sessions, strength prescriptions, schedule revisions, session lineages, adaptation decisions, goals and competitions	For the life of the account	This is your training record, and the trail that lets a change be explained. Deleting it earlier would break the progression the coach is built on.
Your profile: pace and intensity anchors, limitations, equipment, constraints said in words, per-sport baselines, weekly availability, week template, the programme you confirmed with the coach, strength benchmarks (what you can do on an exercise), zones	For the life of the account	These are the durable facts every plan is built from. You can withdraw any of them at any time in the app.
Nutrition goal, saved dishes, body mass and measurements	For the life of the account	For as long as nutrition is on. Turning it off deletes them, like the rest of section 4a.
Account, Apple identity, consent record, entitlement, billing events, and the coach's counters (the day's questions, the onboarding interview, and, to pick the onboarding up again, the list of topics left open, the number of offers and any "no")	For the life of the account	The consent record is what proves what you agreed to and when; billing events answer an accounting obligation. The counters hold numbers only, never what was said.
Connections to a third-party service, and their encrypted tokens	For the life of the account	Until you disconnect the service, which revokes the token and deletes it.
Sign-in sessions and refresh tokens (their hash only)	30 days after expiry or revocation	How long the reuse of an old token must still be detectable as a theft.
Welcome session: the session's fingerprint, a pseudonym of the day of the IP address, the agreements and the interview's counters	1 day after expiry (48 hours at most)	It lasts 24 hours. If you create your account, your agreements and the counters are attached to it before the session is deleted.
App Attest fingerprint and public key of the app on your phone	180 days after its last use	It limits interviews per device, including after an account is deleted; past that, nothing reads it.
Apple sign-in challenges	1 day after expiry	They are worth minutes; the rest is clock margin.
OAuth states for connecting a third-party service	1 day after expiry	The same reason: an anti-replay token worth one redirect.
Plan-change proposals left unanswered	30 days after expiry	A proposal you never decided eventually stops proposing anything.
Session definitions nothing names any more	30 days after the last reference	A session no schedule revision, no lineage and no proposal points at any more.
Request idempotency keys	30 days	What stops a repeated upload counting twice; beyond that, the repeat no longer arrives.
Events received from a connected third-party service	30 days	The window in which a duplicate event must still be recognised.
Background job queue	14 days	Enough to diagnose a job that failed, and no more.
An Apple token revocation left pending	No automatic purge	No timer may remove it: a row still there after 30 days fails the nightly run until a human closes it. A credential we failed to revoke must not vanish quietly.
Scheduled job runs	No automatic purge	The operational record that a backup and a purge did run. It goes with the account at erasure.
Encrypted backups	Up to 38 days	An erasure removes you from the live database; backup copies age out within that window and are never restored selectively. A restore re-applies the erasures pronounced since.

Deleting an account is not instantaneous, and that is deliberate. A deletion request opens a 7-day window during which you can cancel it by signing in again; at its close, a nightly job erases the account and everything attached to it. The app tells you the date. What survives is stated above: the security log, pseudonymous and without your account.

Your data is never sold, and never shared for anyone else's marketing.

Processor	What they get	Where
OVHcloud	Hosting for everything — the database, the API and the backups. It is the only processor that holds the whole.	Gravelines, France (EU)
Apple	Sign in with Apple, and App Store purchases. Apple does not receive your training or health data from us.	EU / United States
RevenueCat	A pseudonymous identifier and subscription status, and nothing else. No health data, no training data.	United States
OpenAI — the contract is with OpenAI Ireland Ltd (Dublin); the processing takes place in the United States	Only the summary described in section 6, and only if you turned the AI coach on. It is not used to train models.	United States
Sentry	The server's technical error reports, built from an allowlist: the error class, its uppercase code, a digest of the message, validated stack frames, the route pattern, a status code and the request identifier. There is no field for a message, a header, a request body, a breadcrumb or a user identifier — not even a pseudonymous one.	Frankfurt, Germany (EU)
healthchecks.io	Monitoring of the nightly jobs: the job name, its exit code and the last lines of its output — which are counts and never an identifier ("erased an account: 412 rows", never which one). No personal data.	Riga, Latvia (EU)
Open Food Facts	A barcode and your phone's IP address, sent by the app from your phone when you scan a product, and never through Ovyxa. Open Food Facts is an open database (ODbL); it receives no Ovyxa identifier and nothing about what you ate.	France (EU)

Transfers outside the European Union. OpenAI and RevenueCat are established in the United States. Those transfers rest on the Article 46 safeguards — standard contractual clauses or Data Privacy Framework certification — and the sub-processor register names, for each, the safeguard that applies. The AI coach is the one of the two that can carry your words: refuse it and nothing goes to OpenAI.

There is no advertising network, no tracking SDK, no product-analytics vendor and no third-party crash reporter receiving health values. That is a design constraint, not a current configuration.

9. What is never done

Your health data is never used for advertising or profiling for advertising.
Your data is never sold, rented, or shared for another company's marketing.
Health values are never written to application logs — not heart-rate variability, not resting heart rate, not sleep, not the pain flag, not your notes.
Your raw health history is never sent to a language model.
Ovyxa never writes anything into Apple Health.
An AI model can never change your plan, and can never override a safety rule.

10. Your rights, and how to use them

Under the GDPR you have the right of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw a consent at any time without affecting what was lawful before you withdrew it.

In the app

Withdraw any consent — Settings. Immediate, and the same number of taps as granting it.
Export your data — Settings. You get a machine-readable file containing your profile, goals, plan, sessions, feedback and recovery measurements.
Delete your account — Settings. This erases your data, not just your login. You will be asked to sign in with Apple again first, so that nobody else can delete your account by picking up your phone.

By email

Anything above, plus rectification, restriction and objection: contact@ovyxa.com. We answer within one month, as the GDPR requires, and usually much sooner.

11. How the data is protected

Everything travels over TLS. The database is on no public address at all.
The application connects to the database with a role that cannot drop a table, and every query is confined to your own rows by the database itself, not only by application code.
Sessions use short-lived access tokens and rotating refresh tokens. Only a hash of a refresh token is stored. If an old one is presented, the whole session family is revoked — because that is what a stolen token looks like.
Erasure and the purge run under credentials distinct from the application's, and the one that erases an account cannot delete the record saying that it did.
Third-party credentials are encrypted at rest under a separate key.
Backups are encrypted and written to storage that cannot be deleted by the key that writes it.

12. Children

Ovyxa is for adults. It is not directed at children, and you must be 16 or older to use it.

Your date of birth is never asked for. During setup the app asks you to confirm that you are 16 or older, and records two things: that you confirmed, and the moment you did. That is the whole record. A birthday would answer the same yes-or-no question while leaving a permanent identifier in the database that nothing else here would ever read, so it is not collected — the same reason section 3 gives for refusing Apple Health's date-of-birth characteristic.

You may also give a year of birth, and that is a different record with a different purpose: it is optional, it exists only to estimate a maximum heart rate (section 2a), and it neither replaces the confirmation nor is re-derived from it. A year carries roughly one three-hundred-and-sixty-fifth of the identifying power of a birthday, and a birthday would buy at most 0.7 bpm of precision against a formula whose own error is 7 to 11 bpm — so a full date is still never asked for.

The confirmation is an account fact. It is not sent to the coaching engine, is not used to personalise training, and is erased with the rest of your account. If you believe a child has an account, write to contact@ovyxa.com and it will be erased.

13. Changes to this policy

This policy carries a version, shown at the top of the page. Your consent is recorded against the version that was in force when you gave it.

A new version never silently widens what you already agreed to. When the health-data version changes, the agreement you already gave keeps authorising exactly the collection it was given for — taking that away from you would be its own wrong — but it does not extend to whatever the new version added. Anything new is refused, by the server as well as by the app, until you agree at the current version, and the app can tell you that what you agreed to is an earlier one.

The four consents, and the version each is at

Ovyxa asks for four separate agreements, not one. Each is versioned on its own, each can be refused or withdrawn without touching the others, and the version your answer was recorded against is one of these:

Consents, their current version, and what each one covers
Consent	Version in force	What agreeing allows
Health data	2026-10-01	Everything Ovyxa holds about your body: what you tell it on a morning check-in, including pain; how hard a session felt and how you felt after it; any injury or limitation you declare; the sentences of your durable constraints; and, if you connect Apple Health, heart-rate variability, resting heart rate, sleep duration, the summary of your workouts and the intensity anchors of sections 2 and 2a. Ovyxa cannot coach without this, so it is required to use the app; taking it back deletes your account. Sections 2, 2a, 3 and 4.
Nutrition tracking	2026-09-21	Storing what you log that you ate. Withdrawing it erases what was logged, not merely stops reading it. Section 4a.
Expected cyclical variation	2026-09-21	Storing that one day-context note, which is Article 9 data. Withdrawing it deletes the stored notes. Section 4.
The AI coach	2026-09-25	Sending your answers during the onboarding interview, the small summary described in section 6 and what its tools look up when a question needs it, to OpenAI, in the United States. Refuse it and the rest of the app is unaffected: onboarding then goes through the form. Section 6.

A version here is a date because that is the day the document it names came into force — this page, at that version. It is not a release number and it does not move when the app changes.

Version history

2026-10-01 — the runs, rides and strength workouts your watch writes to Apple Health are now imported, as summaries, into your training history (section 3), so the plan follows what you actually did. The previous version said no workout left the iPhone: this is new collection, so the health-data consent version moves to this date, and nothing is imported until you have accepted it. No GPS route and no heart-rate series is sent.
2026-09-25, evening — your strength benchmarks (what you can do on an exercise: a load and a number of repetitions, repetitions at bodyweight, or the fact that you do not know), told to the coach and confirmed by you, or corrected by you, are kept in your profile (section 7) so the coach can choose your loads. They are training data, not health data. The load you lifted, as you logged it, becomes your minimum load for four weeks: nothing lighter is proposed to you unless you ask, except with pain, on a recovery day or when coming back from a break. The coach reads your latest recorded weight only if you turned on nutrition tracking, and copies it nowhere. No consent version changes.
2026-09-25 — the AI coach conducts the onboarding interview, if you accept it, before your account is created, in a welcome session proved by App Attest (its data and how long they are kept are in sections 6 and 7): your answers are sent to OpenAI to conduct the conversation, before any subscription; nothing is recorded until you confirm the summary, and Ovyxa does not keep the conversation. Refusing it leads to the form, and costs nothing of the plan. Section 6 says so; section 7 names the interview's counters. The AI coach consent version moves to this date; an agreement given to the 24 September version does not cover the interview and will be asked for again. The coach no longer writes to you on its own after a check-in (the four occasions of the 24 September version are withdrawn); it can only offer, at most twice, to pick up the topics your onboarding left open, in a message the app writes without sending anything to OpenAI. Section 7 names the list of those topics.
2026-09-24 — the AI coach can prepare a session written for you, in place of a planned one: its duration and load are computed by our engines, it is never harder than the session it replaces, and nothing changes until you agree. And, if you turn it on — it is off by default —, it can write to you first after a check-in, on four occasions we set, at most once a day. Section 6 says so. Nothing is sent to OpenAI that a question did not already send. The AI coach consent version moves to this date.
2026-09-23, evening — the AI coach can now look up more of your own data when a question needs it: your profile (including maximum and threshold heart rate and VO₂max), a summary of six weeks of training, the day in progress and, if tracking is on, what you ate over thirty days. Section 6 says so, and the list of what is never sent no longer mentions "any physiological value at all" or "what you eat", which would have become untrue; it names instead what stays excluded. The AI coach consent version moves to this date.
2026-09-23 — section 3 announced five types read from Apple Health and listed workouts among what is not requested. The app has asked for six since 17 September: workouts are read, on your iPhone only, to know where to look for the highest heart rate, and none ever leaves the device. Section 3 now says so. The 21 September version also stated that nothing dropped an over-old measurement on arrival: that was wrong, the server drops without storing it any measurement outside the engine's 60-day window, and section 3 now says that too. Only the health-data consent version moves to this date: it is the only agreement text that changes. Finally, healthchecks.io was said to be established in the United States: it is operated from Riga, Latvia, so no transfer outside the Union takes place.
2026-09-21 — this policy was rewritten from the code, and published in French. Three stated retention periods were wrong and are corrected: recovery measurements from Apple Health are kept 500 days and not 60 (60 days is the window the recovery engine reads, which is not the same thing); the AI-coach conversation is deleted after 14 days rather than kept until you delete it; and nothing refused an over-old measurement on arrival, contrary to what was written — it is the app that reads only fourteen days back. Sentry and healthchecks.io are named for the first time, section 7 became exhaustive and automatically verified against the code, the hosting location is corrected (Gravelines only), constraints said in words and the coach conversation enter section 2, and the absence of a data protection officer is reasoned. All four consent versions move to this date: the text you would be agreeing to has changed.
2026-09-18 — the health-data consent stopped meaning a wearable's readings alone and started meaning every health datum the product holds: the pain and heaviness of a morning check-in, the effort and feeling after a session, the limitations on a profile.
2026-09-17 — added the intensity anchors and the optional year of birth (sections 2, 2a and 12), and two Apple Health read types, each sending a single confirmed number and no series (section 3).
2026-09-08 — the first published version of this policy.

No athlete has ever consented against a version earlier than 21 September 2026: the service was not open. The earlier texts are archived in the product's repository, under docs/compliance/policy-archive/.