Atlas Capacity App Privacy Notice

1. Who is responsible

Atlas Cove, Lda. (NIPC / NIF 519459130), R. Hermano Neves 18, Piso 3, Escritório 7, 1600-477 Lisboa, Portugal, is the controller for all processing described here. Privacy contact: privacy (at) atlascove (dot) health.

2. How you get an account

The app has no public registration. Your account is created from your booking, which already holds your name, email address and phone number, so that you are not asked to type them a second time and so that your measurements cannot end up on a second account nobody is looking at.

Two things from your booking are deliberately not copied across: your PAR-Q readiness answers and any dietary note. Those were given for a different purpose — deciding whether you can take part safely — and they stay with the booking. The app asks its own health questions, in onboarding, with its own consent.

3. What the app holds

• Account: email address, name, role, sign-in times.
• Profile: date of birth, biological sex, height, weight and similar, because normative scores cannot be calculated without age and sex.
• Health records (Article 9 data): the measurements taken during your stay — grip strength, movement screen, VO2max, heart-rate variability, body composition, blood markers, psychological questionnaires, sleep — plus anything you enter yourself, and free-text notes from your coach.
• Consent records: what you agreed to, when, and which version of the text you saw.
• Technical: error reports via Sentry (EU) and server logs. Neither contains health data.

4. Why we may process it

Your account, your stay and your schedule are processed to deliver what you booked, under Article 6 (1)(b) GDPR. Your health data is processed only on your explicit consent under Article 9 (2)(a), given per purpose during onboarding and recorded with a timestamp. You can withdraw consent at any time; withdrawal stops further processing and does not affect what was lawful before it.

5. Who can see it

You, and the coach assigned to you. Every read of health data by someone other than you is written to an access log with who, what and when.

No processor receives your health data. Our email provider, our CRM and our advertising tools handle contact details only, and they are described in the general privacy policy. The app itself uses one external service, Sentry (EU region), to report software errors.

6. How it is protected

Everything lives on infrastructure we run ourselves at OVHcloud in France (ISO 27001 certified data centres), on encrypted disks. Identifying fields and every free-text health field — your medical history, medications, allergies, supplements, clinical notes — are additionally encrypted at the field level, so they are unreadable in the database itself.

One deliberate exception, stated plainly: the numerical measurements themselves (for example VO2max, grip strength in kilograms, blood values, questionnaire scores, minutes of sleep) are stored as numbers rather than encrypted text. Your capacity score is calculated, sorted and charted from them; encrypting them field by field would turn every number into text and there would be no product left. They are protected instead by database-level access rules, the access log described above, and full-disk encryption, and they never leave our own servers.

7. How long we keep it

Health records are kept for the duration of our relationship and the statutory retention period that follows it, unless you delete them sooner — which you can do yourself, at any time. Records of your consent outlive your account on purpose: being able to show that you consented is a legal obligation in its own right and does not disappear when you withdraw.

8. Your rights, in the app

Settings has two buttons. Download my data gives you a file containing everything we hold about you, in readable form (Articles 15 and 20). Delete my account removes your profile, your measurements and your health records immediately and permanently (Article 17).

What deletion does not reach, so that you know before you press it: your booking and its invoice remain, because we are required to keep commercial records. Our mailing list is a separate system and is not touched — use the unsubscribe link in any email, or write to us and we will do it. For anything else, including correction, restriction or objection, contact privacy (at) atlascove (dot) health. We respond within 30 days. You may also complain to the Portuguese supervisory authority (CNPD) or your local EU data protection authority.

9. No medical advice

Atlas Cove has no physician on staff and the app makes no medical claims. Your capacity score, the recommendations and any report are general wellness reflection and do not constitute medical advice, diagnosis or treatment. Validated questionnaires are scored against their published ranges and are never interpreted against a clinical cut-off. Consult a qualified physician for any health concern, and do not use anything in this app to make a medical decision.

10. Changes

If we change how the app processes your data we will update the date at the top of this page, and we will tell you in the app before a change takes effect where it affects what you consented to.