Consumer Health Data Privacy Notice

1. What this notice covers

“Consumer health data” means any information that identifies your past, present or future physical or mental health condition, measurements, or wellness-related preferences. Under GDPR this is a special category of personal data (Article 9). This notice describes only the consumer health data collected through the Atlas Cove Website. For our broader processing activities, see our Privacy Policy.

2. What we collect, and when

2.1 Retreat booking — PAR-Q readiness screen

When you book a retreat through /experiences/retreats/book we ask five yes/no readiness questions (heart condition, joints, blood pressure, pregnancy, regular medication) and an optional free-text note. A “yes” answer flags the booking for internal review by a qualified team member. We do not block your booking based on any answer.

2.2 Capacity Analysis at community events

At Atlas Cove community events (Berlin Life Summit, Sunday Run, Aethos Lisbon, similar formats) we measure grip strength and, where available, VO2 max. With your explicit consent we record these measurements alongside basic demographic context (age, biological sex, height, weight, hand dominance, optional lifestyle context) so we can produce a personalised written report comparing your values against published age and sex norms.

3. Legal basis

We process consumer health data only on the basis of your explicit consent under Article 9 (2)(a) GDPR, captured in a granular checkbox separately from any marketing or newsletter consent. Withdrawing this consent results in the deletion of the corresponding data and any derived report.

4. Where it is stored, and for how long

All consumer health data is stored encrypted at rest in our own PostgreSQL database running on Hetzner Online GmbH infrastructure in ISO 27001 certified data centres in Falkenstein and Nuremberg, Germany. Direct identifiers (name, email) and numeric measurements (grip strength, VO2 max, weight, height) are AES-256-GCM encrypted. Indexable lookup hashes use a keyed (peppered) HMAC-SHA-256.

Capacity-analysis submissions are retained for up to 24 months from the date of submission, then deleted. Retreat booking PAR-Q data is retained for the duration of the booking lifecycle plus the applicable contract and tax retention obligations.

5. Who has access

Consumer health data is accessed only by Atlas Cove team members on a need-to-know basis to prepare your report or to flag a PAR-Q answer for medical-style screening. It is never shared with our CRM (Attio), email provider (Mailjet), any website analytics or advertising tool (such as Google Analytics, Google Ads or the Meta Pixel) or any other third-party processor. It is not used to train any AI model.

6. Your rights

Under GDPR you have the right to access, rectify, delete and port your consumer health data; to restrict or object to processing; and to withdraw consent at any time with future effect. To exercise any of these rights or to request a copy of your data, please email privacy (at) atlascove (dot) health. We will respond within 30 days.

7. No medical advice

Any personalised report we send you (for example, after a capacity analysis) is general wellness reflection only and does not constitute medical advice, diagnosis or treatment. Consult a qualified physician for any health concerns. Do not rely on Atlas Cove materials to make medical decisions.

8. Contact and complaints

Controller: Atlas Cove, Lda. (NIPC / NIF 519459130), R. Hermano Neves 18, Piso 3, Escritório 7, 1600-477 Lisboa, Portugal. Privacy contact: privacy (at) atlascove (dot) health. You can also lodge a complaint with the Portuguese supervisory authority (CNPD) or your local EU data protection authority.