Privacy Policy
Last updated: [DATE] · Version [LEGAL_VERSION]
This policy explains how [COMPANY LEGAL NAME] ("we", "us"), operator of VO2max Health ("the Service"), processes your personal data. Contact: hello@vo2max.health, [POSTAL ADDRESS]. Data protection contact: privacy@vo2max.health.
1. What we collect
| Category | Examples | Source |
|---|---|---|
| Account data | email address, sign-in timestamps, consent records | you |
| Waitlist (before launch) | email address, which watch you use, consent date | you |
| Profile data (optional) | birth year, sex — used only to compare VO2max with age/sex norms | you |
| Health and fitness data | VO2max, resting heart rate, heart-rate variability (HRV), sleep duration and score, steps, stress / energy metrics, activities (type, time, duration, distance, heart rate, heart-rate zones) | the services you connect (e.g. Garmin Connect), only after you authorise it |
| Connection data | provider account identifier, encrypted access tokens, the permissions you granted | the connected service |
| Technical data | IP address, browser type, error logs | your device, automatically |
We do not collect GPS location tracks, contacts, payment card data (unless a future paid plan says so), or data from services you have not connected.
2. Why we use it and our legal bases
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Email you about the launch if you joined the waitlist | Consent (Art. 6(1)(a)); leave any time via the link in our email or hello@vo2max.health |
| Provide the Service: show your metrics, trends, tiers and insights | Contract (Art. 6(1)(b)); explicit consent for health data (Art. 9(2)(a)) |
| Sync data from connected services | Explicit consent, given when you connect the service |
| Answer questions through the MCP/AI integration you enable | Explicit consent (you create the token and choose to use it) |
| Security, fraud prevention, debugging | Legitimate interests (Art. 6(1)(f)) |
| Legal obligations (e.g. responding to lawful requests) | Legal obligation (Art. 6(1)(c)) |
Under Thailand's PDPA, health data is sensitive data and is processed only with your explicit consent. We do not sell personal data, use health data for advertising, or build advertising profiles.
3. Sharing
- Service providers (processors) under written contracts: hosting ([HOSTING PROVIDER]), email delivery ([EMAIL PROVIDER]), error monitoring ([MONITORING PROVIDER]). They may only process data on our instructions.
- Connected services: we send your authorisation back to them (e.g. to revoke access when you disconnect).
- AI assistants: only if you create an MCP token and connect an assistant; data is then sent to that assistant when you ask it a question, under that assistant's own terms.
- Authorities, if required by law.
4. International transfers
Data may be stored in [REGION]. Where data leaves the EEA/UK, we use Standard Contractual Clauses or equivalent safeguards.
5. Retention
- Health and fitness data: while your account and the connection are active. When you disconnect a service or it tells us you revoked access, we stop syncing and delete that service's data within [30] days.
- Account deletion: all data deleted within [30] days; encrypted backups roll off within [35] days.
- Raw provider notifications (for debugging): kept at most [14] days.
- Consent records: kept as long as needed to prove consent, then deleted with the account.
6. Your rights
Access, portability (download in Settings → "Download all my data"), rectification, erasure (Settings → "Delete my account"), restriction, objection, and withdrawal of consent at any time (disconnect a service or delete your account) — without affecting processing before withdrawal. You can complain to your data protection authority. Contact privacy@vo2max.health; we answer within one month.
7. Security
Tokens are encrypted at rest, connections use TLS, access is limited to authorised staff, and we keep audit records of consent. See Security.
8. Children
The Service is not for people under 16 (or the age of digital consent in your country).
9. Changes
We will notify you of material changes in the app or by email and ask for consent again where required.