Privacy, in plain terms.

Dante Larroy. Questions and requests to exercise your rights: privacy@executiveathletesmethod.com.

Account and identity; metrics from Garmin and Withings that you authorise; sync status; consent records; audit logs and reports reviewed by your coach. OAuth tokens are stored encrypted and separately from the metrics.

We use the data to import your history, show trends, build deterministic daily briefs, and support the reviews your coach writes. Health data is processed only with your explicit consent (GDPR arts. 6.1.a and 9.2.a); operational data necessary to provide the service is processed under art. 6.1.b.

We do not share your data with external artificial intelligence providers, and we do not allow any third-party AI service to process it. This expressly includes data obtained through the APIs of the device manufacturers you connect — Garmin and Withings — which is never sent to any external AI or data-processing service.

Nor is it used to train models. The reports and analysis you see are computed deterministically by our own platform and written by your coach: there is no automated generation of text about your data. No decisions with legal or similarly significant effects are taken, and no medical diagnosis is offered.

Supabase hosts authentication and PostgreSQL; Vercel hosts the application. Garmin and Withings receive the OAuth authorisation that you initiate and act as independent controllers under their own policies. All storage and processing takes place in the European Union.

Separately, if you book an introductory call from our website, Cal.com handles that scheduling and receives only what you type into the booking form — your name, your email, and any notes. It never receives device or health data.

HTTPS in transit, encryption at rest, tokens sealed with AES-256-GCM, role-based access, row-level security, audit logging and least privilege. Confirmed deletion removes your data from active systems immediately. Encrypted backups are taken out of use and expire within seven days at most; a restore is never opened to users before the deletion log has been reapplied. Raw provider payloads are deleted automatically after 90 days.

From your profile you can download a structured export and delete your account. You may also request access, rectification, restriction or objection, withdraw any consent, and lodge a complaint with the competent data protection authority. We respond within one month.

The service is for adults aged 18 or over only. Material changes are announced within the platform before they take effect.