Privacy policy

1 · Who processes your data

The data controller is Omar Gómez Álvarez, promotor de IINS Coach Technologies, S.L. (en constitución), owner of the IINS Coach app and the iinscoach.com website. For any privacy question, including exercising your rights: we are setting up the privacy mailbox and its address will be published here; in the meantime, in the app, under Settings, you can export all your data and delete your account yourself.

We have not appointed a Data Protection Officer: given the volume and nature of the processing, it is not required. If that changes, this policy will be updated first.

2 · What data we process

Account data

Email address, name or username, profile photo if you upload one, and the date you signed up. Your subscription is tied to your account by its identifier, not by your email.

Sport profile

Main sport, goal, level, personal bests, your IINS grade if you have one, and the training preferences you tell the Coach about.

Health data — special category

This is data the GDPR gives extra protection (Art. 9), and we process it with your explicit consent:

• Weight, height, age and sex.
• Allergies, intolerances, injuries and restrictions you tell us about.
• Results from IINS Fit, the measurement of your physical fitness (seven tests depending on your age), and from the tests you log. The waist-to-height ratio from older measurements is only stored with the health data consent, which is asked for separately and only from people aged 18 or over.
• What your watch or band writes to Apple Health and you allow us to read: heart rate, resting heart rate, variability (HRV), sleep, steps, active energy, exercise minutes, VO2 max, respiratory rate and workouts. We only read: we never write to Health. Second-by-second readings stay on your iPhone; our server receives one value per day for each metric, which band it came from and, for each finished workout, its duration, zones, load and your heart rate every 15 seconds.
• The heart rate of a strap or band you connect over Bluetooth, read only while you record an activity. While it lasts nothing leaves your iPhone; when you finish it, your heart rate every 15 seconds, its zones and its load are uploaded.

Activity in the app

Completed workouts, training, nutrition and technique plans, logged meals, tests, achievements, ranks and your position in the IINS Fit ranking and the activity ranking, if you're an adult and have chosen to appear in them.

Location

If you record a run or a ride with GPS, the app uses your location only while the activity lasts. When you finish it, the route is uploaded to our server to work out the distance and splits. Only you can see it. If you post the activity with its route, between 300 and 500 metres are trimmed from the start and the end, so it doesn't show where you start or finish. A minor can't post the route.

Social content

Posts, stories, direct and group messages, reactions, comments, who you follow and who follows you, requests, blocks and reports.

Conversations with the Coach

What you write to it, what it replies, and the memory summary the system generates so it remembers from one day to the next.

Your watch, band and strap have their own consent, separate from the one for the health data in your profile. The app asks for it before reading anything, and only from people aged 18 or over. You can withdraw it in the app at any time (see “How long we keep it”); to stop the app reading too, remove the permission in your iPhone's Settings › Privacy › Health.

Technical data

Device model, operating system and app version, time zone, the device identifier used for notifications, and the error and usage logs needed to detect faults and abuse.

Android waiting list

If you leave your email on iinscoach.com so we can tell you when the app is out on Android, we keep that email and the date. We only use it for that notice: no newsletters, no advertising. We delete it when you ask, 30 days after we've told you and, at the latest, 18 months after you signed up.

Payment data

We never see or store your card. Payment is handled by Stripe in its own environment. From Stripe we receive the email you paid with, the plan you chose, the status of your subscription and the billing details the law requires us to keep.

3 · What we use it for, and on what legal basis

You can withdraw your consent at any time. Withdrawing it doesn't affect the lawfulness of processing before then, but it does leave the Coach without the data it plans with: without health data, it can't adjust the load.

4 · The Coach and artificial intelligence

The Coach runs on Claude, a model by Anthropic, which is a third party and acts as a data processor. To reply to you, it is sent what it needs: your profile, your plan, your recent history, your grade and — depending on your plan — either a summary of your metrics or the exact values.

From your watch, band or strap it receives only summaries (for example, “recovery 62/100, sleep 6 h 10”), never the curves or the minute-by-minute samples. Anthropic stores what it receives in the United States, may also process it in other countries, and keeps it for a limited time under its policy.

• Your data is not used to train third-party models.
• The Coach makes no automated decisions with legal effects on you. Every plan change is a proposal that you confirm.
• It is not a healthcare service. The Coach does not diagnose, and it does not replace a doctor, a physiotherapist or a registered dietitian. If you have pain, an injury or any symptom, see a professional.

5 · What other people can see

This is the part we care about most, because health data and a social network live side by side here:

• Your health data never leaves your account. Weight, height, age, allergies, intolerances, injuries and restrictions are never shown to anyone else, under any circumstances. There's no switch to change that, because the option to share them doesn't exist.
• Sharing is always optional. Finishing a workout doesn't post it. Every post is your decision, every time.
• Nothing live. The app may let people know someone has finished an activity, never that they're training right now. There are minors using the app, and we never publish anyone's location or presence. Someone else only sees an activity's route if you post it, trimmed at the start and the end.
• Nobody sees your watch, band or strap data either. It never appears on your profile, in a post, in a story or in anything someone else sees. A watch workout can count towards the activity ranking (days trained), never with its health data. While you record an activity, your heart rate and zone may show on your iPhone's lock screen; you can turn that off in the app's Settings.
• If your profile is private, only people you've accepted can see your content. Blocking someone cuts visibility both ways.

6 · Who else processes it

Only providers who deliver a service to us, under a data processing agreement and with no permission to use your data for anything of their own:

• Supabase — database, authentication and image storage.
• Anthropic — Claude, the model that powers the Coach (United States).
• Stripe — subscription payments and invoicing.
• Apple — app distribution and delivering notifications to your device.
• Expo — distributing app updates.
• Vercel — hosting for this website.

Some of them are in the United States. Those transfers rely on the European Commission's standard contractual clauses or the applicable adequacy framework, with whatever additional safeguards each case requires.

We don't sell your data or share it for advertising. There is no advertising in IINS Coach. We will only disclose it to an authority when a law requires us to.

7 · Your relationship with the IINS centre

If you're an IINS member and link your member code, we process that code and the status of your membership to give you the Premium plan you're entitled to. IINS periodically sends us the list of members who are up to date; we don't look at anything else in your centre record.

Your health data, your workouts and your activity in the Tribu are not shared with the centre just because you're a member.

8 · Minors

You must be at least 14 to use IINS Coach, and you confirm this when you create your account. Under 14, in Spain consent is given by parents or guardians (LOPDGDD, Art. 7), and the app doesn't have that route yet, so it doesn't accept anyone under 14.

Until 18, a minor's account has extra protection: their profile is always private, they don't appear in the rankings, they can't give the health data consent or connect a watch or band, and they can't post an activity's route.

If an athlete's year of birth means they may be under 18, the Coach treats them as a minor: never a calorie deficit, weight loss, fasting or supplements, and no maximum-load tests; and if anything hurts, it asks them to tell their parents or guardians and to see a professional.

If we find an account belonging to someone under 14, we close it and delete their data. If you're a parent or guardian and want us to delete a minor's account, tell us and we'll do it without further steps: we are setting up the privacy mailbox and its address will be published here; in the meantime, in the app, under Settings, you can export all your data and delete your account yourself.

9 · How long we keep it

• While your account is active, so we can provide the service and the Coach has your history.
• When you delete your account, your personal data is erased. Stories expire and are purged after 24 hours by design.
• When you withdraw the watch, band and strap consent, we delete from our server your daily Health metrics, your sources (which band wrote and when), your heart rate curves (from Health and from your strap) and, for each workout, its zones, load and average and maximum heart rate. Your activities stay. Anything you've already discussed with the Coach stays in your conversations until you delete them.
• Billing data is kept for the period required by tax and accounting law, currently six years.
• Security and report logs, for as long as needed to establish what happened and deal with claims.

10 · Your rights

You can ask us for access to your data, to correct it, to erase it, to restrict or object to its processing, and for a copy in a readable format. You can also withdraw your consent at any time.

To exercise them: we are setting up the privacy mailbox and its address will be published here; in the meantime, in the app, under Settings, you can export all your data and delete your account yourself. We reply within one month at the latest. If you think we haven't handled it properly, you can complain to the Spanish Data Protection Agency (AEPD).

Deleting your account is something you can do yourself in the app, in Settings, without asking us.

11 · Security

Everything travels encrypted. In the database, every row of personal data is protected by policies that stop one account from reading another's, and those policies are versioned with the code rather than changed by hand. We audit the system before adding features, not after.

No system is infallible. If a breach affecting your data ever happened, we would tell you and notify the authority within the deadlines set by the GDPR.

12 · Cookies

This site uses no analytics or advertising cookies, and doesn't profile you. If you choose a language in the selector, we remember that choice in a technical cookie. When you start a payment, Stripe sets the technical cookies it needs to process it securely.

13 · Changes to this policy

If anything substantial changes, we update the date at the top and let you know in the app before it affects you. Continuing to use IINS Coach after a substantial change does not count as accepting it where the law requires fresh consent: in that case, we'll ask you for it.