running.COACH – Privacy Policy

1. Who we are

Quevita AG, Industriestrasse 78, 4600 Olten, Switzerland ("Quevita", "we") is the controller for the personal data processed through running.COACH – the website runningcoach.me and the running.COACH mobile apps.

This policy supplements our Terms and Conditions. We process personal data under the Swiss Federal Act on Data Protection (FADP) and, where it applies to you, the EU General Data Protection Regulation (GDPR).

2. What data we process

• Account data – name, e-mail address, password (stored hashed), language and, if you sign in with Google or Apple, the identifier of that account.
• Profile data – date of birth, sex, height, weight, resting and maximum heart rate, time zone, preferred units, nickname, and your phone number if you provide one.
• Training and activity data – planned and completed sessions with date, time, duration, distance, elevation, pace, speed, heart rate, power, GPS route, perceived exertion, mood, weather, equipment used and your comments.
• Data from connected apps and devices – see section 5.
• Payment data – subscriptions, order history and the type of payment method. Card details are processed by our payment providers and never reach our systems.
• Communication data – support requests, in-app messages and comments, and, if you have consented, whether you opened a newsletter or clicked a link in it.
• Technical data – IP address, device and browser type, operating system, app version, language, referring page, timestamps, usage events, crash and error reports, and session or device identifiers.

Only your account data and the information needed to create a training plan are required. Everything else is voluntary; without it, some features may be less accurate.

3. Health and fitness data

This section explains how we handle health and fitness data, including data from Apple Health, Android Health Connect and connected wearables.

What we treat as health data. Height, weight, resting and maximum heart rate, heart rate and heart-rate-derived values during training, power and pace data, GPS routes, perceived exertion, mood, and your exercise and activity sessions. This is sensitive personal data under the FADP and a special category of personal data under Art. 9 GDPR. We protect your date of birth and sex in the same way, because combined with the above they allow conclusions about your health.

Why we process it. Only to deliver the features you use:

• to calculate and continuously adapt your personal training plan;
• to show your activities, statistics, progress and race predictions;
• to generate written feedback on your training;
• to help you when you contact support.

Who receives it. Only the processors listed in section 4 that are needed to run the service: hosting and the AI provider for written feedback. Our processors act only on our instructions under written data-processing agreements and may not use the data for their own purposes.

Staff access. Our staff do not routinely view your health data. Access is limited to authorised employees and only where necessary to provide support you requested, to investigate a technical fault or to meet a legal obligation.

Retention and deletion. We keep health and fitness data while your account exists. You can delete individual activities in the app at any time and disconnect any device or app, which stops further transfers. If you delete your account – via "Delete my account" in the app or by e-mail to privacy@runningcoach.me – all your personal data, including health and fitness data, is permanently deleted within 30 days. Backups are overwritten on a regular frequency.

Anonymised data. We may anonymise training data and use it in aggregated form to improve our training algorithms and for statistical or scientific purposes. Anonymised data is no longer personal data and may be kept.

4. Who receives data

Processors. These providers act only on our instructions under data-processing agreements. We operate the wearable and health data gateway (qwg.quevita.com) ourselves.

Independent controllers. The following receive data for their own purposes and under their own privacy policies:

• PayPal, if you pay with PayPal;
• CembraPay, if you pay by invoice or instalments, including any credit check it performs;
• Apple (App Store) and Google (Google Play) for in-app purchases;
• Google and Meta for website analytics and advertising (see section 6). They never receive health or fitness data.

2PEAK and viRACE. These products are also operated by Quevita AG. If you use them with your running.COACH account, we share your account and profile data with them. Health and training data is shared only if you activate this and consent.

Other disclosures. We disclose personal data where the law requires it, or to establish, exercise or defend legal claims. If our business is sold or reorganised, data may pass to the acquirer, who remains bound by this policy; we will inform you in advance.

5. Connected apps and devices

You can connect running.COACH to services such as Garmin, Polar, Suunto, Coros, Fitbit, Strava, Apple Health and Android Health Connect.

When you connect a service, we receive the data you authorise – typically activities and workouts with duration, distance, pace, heart rate, power, elevation and GPS route, and, depending on the service, body measurements such as weight. We use this data only to fill in and adapt your training plan and to show your activities and statistics. With some services, we can also send planned workouts to your watch. The connected service's own privacy policy applies to its processing.

Apple Health. With your permission, we read and write from and to Apple Health. This data is used only for your training plan and activity display. You can manage our access at any time in the Health app on your iPhone.

Android Health Connect. With your permission, we read exercise sessions, heart rate and related fitness measurements from Health Connect. This data is used only to create and adapt your training plan and to display your activities. You can review or revoke our access at any time in the Health Connect settings on your device.

Revoking access or disconnecting a service in your running.COACH profile settings stops all further transfers. Data imported before remains in your account until you delete the activities or your account.

6. Cookies, analytics and advertising

Our website uses cookies and similar technologies that are strictly necessary to run the site and keep you logged in.

Only with your consent, given in our cookie banner, we also use:

• Google Analytics 4 (Google Ireland Ltd.) to understand how the website is used. GA4 does not store IP addresses.
• Google Ads conversion and remarketing tags to measure our advertising and show running.COACH ads to people who visited our site.
• Meta Pixel (Meta Platforms Ireland Ltd.) for the same purpose on Facebook and Instagram. We and Meta are joint controllers for collecting and transmitting this data (Art. 26 GDPR); Meta is solely responsible for its further processing.

These tools receive technical and usage data such as IP address, device and browser information and the pages you visited. They never receive health, fitness, training or GPS data, nor any data from Apple Health, Health Connect or a connected wearable.

You can change or withdraw your consent at any time via the cookie settings on our website and block cookies in your browser settings.

The running.COACH mobile apps contain no advertising or analytics trackers. The SDKs they include (Firebase Cloud Messaging, Sentry, RevenueCat) are used only for the purposes listed in section 4.

7. International transfers

We are based in Switzerland. Our recipients process data in Switzerland, the EU/EEA, the United Kingdom and the United States.

The EU/EEA and the United Kingdom offer an adequate level of data protection. For transfers to the United States, we rely on the recipient's certification under the EU–US and Swiss–US Data Privacy Framework where it exists; otherwise on the European Commission's Standard Contractual Clauses with the Swiss addendum, plus additional safeguards where necessary.

You can request a copy of these safeguards at privacy@runningcoach.me.

8. Your rights

You have the right to:

• obtain information about the personal data we hold about you and a copy of it;
• have inaccurate data corrected;
• have your data deleted;
• restrict processing, or object to processing based on our legitimate interests;
• object at any time to the use of your data for direct marketing;
• receive the data you provided in a common, machine-readable format, or have it transferred to another controller (you can also export your activities from your profile at any time);
• withdraw any consent you have given, with effect for the future;
• request human review of automatically generated results (see section 9).

To exercise these rights, write to privacy@runningcoach.me. We may need to verify your identity and will reply within 30 days.

If you believe we process your data unlawfully, you can complain to the Swiss Federal Data Protection and Information Commissioner (edoeb.admin.ch) or, if you live in the EU/EEA, to the supervisory authority in your country of residence.

9. Automated processing

Your training plan, race predictions and written training feedback are generated automatically from your profile and activity data, so the plan fits you.

These results do not produce legal effects for you and do not similarly significantly affect you. They are therefore not automated individual decisions within the meaning of Art. 22 GDPR or Art. 21 FADP. You can adjust your plan at any time. If you want to know how your plan was calculated, or want a person to review it, contact us.

10. Security

We protect your data with TLS encryption in transit, encrypted storage of access tokens for connected services, hashed passwords, role-based access controls, access logging and regular backups. No system is perfectly secure, but we review our measures regularly. We notify you and the competent authority of a data breach where the law requires it.

11. Children

running.COACH is intended for people aged 16 and over. We do not knowingly process data of children under 16. If we learn that we hold such data, we delete it.

12. Changes and contact

We may amend this privacy policy. The current version is always available via the "Privacy" link.

Quevita AG
Industriestrasse 78
4600 Olten
Switzerland
privacy@runningcoach.me