Privacy Policy

Last updated: October 28, 2026

This Privacy Policy describes how FitCoach AI ("we", "us", or "our"), developed by the Artificial Intelligence Research Group at the Facultad de Informática Mazatlán (FIMAZ), Universidad Autónoma de Sinaloa (UAS), collects, uses, and protects your personal data, including health and fitness data obtained through Garmin Connect.

1. Data We Collect

With your explicit consent, we collect the following data from your Garmin Connect account:

• Sleep data (duration, stages, sleep score)
• Heart rate variability (HRV)
• Body Battery levels
• Training load and readiness scores
• VO2 Max estimates
• Activity data (type, duration, distance, calories)
• Steps and intensity minutes
• Body composition data (if available)
• Stress levels

We also collect your name, email address, and optional athlete context you provide to personalize your analysis.

2. How We Use Your Data

Your Garmin health data is used exclusively to:

• Generate personalized training analysis and recommendations using AI
• Create weekly training plans adapted to your recovery status
• Store your analysis history so you can track progress over time
• Conduct anonymized academic research on AI-powered athletic performance analysis (only with your additional consent)

We do not sell, rent, or share your personal health data with third parties for commercial purposes. Limited processing by the service providers listed in Section 4 is necessary to deliver the service.

3. Data Storage and Security

• Garmin authorization tokens and any stored credentials are encrypted (AES-128 with authentication) before storage, and passwords are stored only as salted bcrypt hashes
• All data is stored on secure servers with industry-standard protection
• Access to your data is restricted to authorized personnel only
• We use HTTPS for all data transmission
• Authentication tokens expire automatically and are renewed securely

4. Data Sharing and Third-Party Service Providers

We do not sell your data. We use the following service providers (data processors) strictly to operate FitCoach AI. Each processes data only on our behalf and for the purpose described:

• Garmin (Health API and Activity API): Source of your fitness data, retrieved only with your explicit authorization via Garmin's OAuth flow. You can revoke access at any time.
• Anthropic (Claude API): Receives your Garmin health metrics and the optional context you write, to generate your personalized analysis and training plan. See anthropic.com/privacy.
• Railway: Cloud hosting of our backend and PostgreSQL database, where your account, Garmin-derived metrics, and analysis history are stored. See railway.com/legal/privacy.
• Resend: Transactional email delivery (welcome message, analysis reports, password reset, weekly summary). Receives your email address, name, and the content of the report being sent. See resend.com/legal/privacy-policy.
• Hostinger: Hosts our static website (konekta.com.mx). It does not receive or store your Garmin data.

We do not share your identifiable health data with any other third party, and we do not use Garmin data for advertising or sell it to data brokers.

5. Your Rights

You have the right to:

• Access all data we hold about you
• Request deletion of your account and all associated data
• Revoke Garmin Connect authorization at any time from your Garmin account settings or by disconnecting inside FitCoach AI; on disconnection we stop retrieving your data
• Export your analysis history
• Opt out of any anonymized research use of your data

6. Data Retention

We retain your data for as long as your account is active. Upon account deletion, all personal data including Garmin credentials, health metrics, and analysis history are permanently deleted within 30 days.

7. Children's Privacy

Our service is not directed to individuals under the age of 18. We do not knowingly collect personal data from minors.

8. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes via email or through the platform. Continued use of the service after changes constitutes acceptance of the updated policy.

9. Legal Basis

We process your data based on your explicit consent, which you provide when connecting your Garmin account to our platform. You may withdraw this consent at any time.