Privacy Policy

1. Data controller

Simon Wagneur (Achyl Studio), Belgium. Contact: info@achyl.be.

2. Data collected

• Account: email, name, profile picture (optional).
• Training profile: goal, level, frequency and available days, equipment, sex, age, height, reference loads you declare.
• Workout activity: programs created, planned and completed sessions, performance per exercise.
• Health data: nutrition, weight, declared discomfort and pain, sleep and recovery — only with your explicit consent (see section 3).
• Leagues: leagues joined, weekly WOD scores.
• Strava activities: only if you connect your Strava account (see section 7).
• Connected assistant: programs an AI assistant submits for you, pending your confirmation, with a salted hash of the submitting IP address to limit abuse (the address itself is never stored).
• Notifications: your device's notification identifier, if you allow notifications.
• Subscription: Pro status and purchase history (via the store — never card numbers).
• Audience measurement and advertising: usage events (sign-up, onboarding steps, screens viewed, program created, session completed, sharing, Pro offer opened…), linked to your account identifier and, on mobile, to your device's advertising identifier. No health data is included.
• Technical: anonymized logs for debugging.

3. Health data

Some of the data you may entrust to MyProgram concerns your health within the meaning of Article 9 of the GDPR:

• Nutrition: food log, saved foods and dishes, calorie and nutrition targets, non-sport activity level.
• Weight: weight entries and, if you provide it, body fat percentage.
• Declared discomfort and pain: the areas you report so that the app adapts your sessions.
• Sleep and recovery: sleep, heart rate variability, resting heart rate, read from Health Connect (Android) or Apple Health (iOS) once you have enabled this feature and granted access. They feed the Forme tab, which tracks your recovery.

This data is only processed with your explicit consent, requested separately for each category. You can withdraw it at any time in the app; withdrawal does not affect processing carried out before.

• For AI features (program creation, estimating the calories of a session…), it may be sent to Anthropic, our only AI provider. It is not sent to any other provider.
• Apple Health and Health Connect data is read-only: MyProgram writes nothing to them.
• It is never sent to our audience-measurement and advertising tools, never used for advertising, and never sold or rented.

It is used only to adapt your training programs and, if you use it, your nutrition tracking. MyProgram is not a medical service: no diagnosis or treatment is offered, and these adaptations are suggestions — you always stay in control. In case of pain, injury or doubt, consult a health professional (see our Terms of Use).

4. Purposes

• Provide the service: save your account, programs and performance.
• Generate your programs and some content, including with AI.
• Adapt your programs and, if you use it, your nutrition tracking to your health data, with your consent.
• Enable social features (leagues, rankings, coach ↔ client sharing).
• Send you notifications, if you have allowed them.
• Manage Pro subscription and billing.
• Improve the app (aggregated stats, debugging).
• Measure the audience of the app and the website, and the effectiveness of our advertising campaigns (Google Analytics, Meta), without any health data.

5. Legal basis

Contract performance (account creation, service access) and legitimate interest (product improvement, fraud prevention, measuring our audience and advertising campaigns). Health data relies on your explicit consent (Article 9(2)(a) GDPR), given separately for each category and revocable at any time in the app. Connecting a third-party service (section 7) relies on your consent, which you withdraw by disconnecting it.

6. Sub-processors

To run the service, we rely on the following technical providers, which process your data only on our behalf and under a contract:

• Supabase, Inc. (database and authentication) — your data is hosted in the Zurich region (Switzerland), a country covered by a European Commission adequacy decision. Supabase is a US company; its involvement is governed by its data processing agreement.
• OVH SAS (website hosting, technical relay for the assistant connector, encrypted backups — France).
• Anthropic (AI generation of programs and content — United States). Anthropic receives the data these features need, including health data (for example your weight or the constraints and discomfort you report); according to its commercial terms, it does not use this data to train its models.
• Google (Google Analytics for Firebase and Google Analytics on the website — audience measurement — United States). Receives no health data.
• Meta Platforms (Meta App Events — measurement of our advertising campaigns — Ireland and United States). Receives no health data.
• Expo (push notification delivery, through Apple's and Google's notification services — United States).
• Resend (support e-mail delivery — United States).
• RevenueCat (subscription management — United States).
• Strava (import of your activities — only if you connect your Strava account).
• Google Play / Apple App Store (distribution and in-app purchase billing).

Where data is transferred outside the European Union, in particular to the United States, the transfer is governed by the European Commission's standard contractual clauses or by the transfer framework applicable to the provider concerned.

7. Services you connect yourself

Some services are not our providers: you decide to link them to your MyProgram account, and you can revoke that access at any time.

• AI assistants (Claude, ChatGPT), through the MCP connector: once connected, the assistant can read your profile (sex, age, weight, height, language) and your training week, and suggest a program that only enters your account after you confirm it in the app.
• Strava: import of your activities (type, date, duration, distance, elevation and, when present, calories and heart rate).
• Health Connect (Android) / Apple Health (iOS): read-only access to your sleep and recovery data, with your consent (see section 3).

What you share with these services is governed by their own privacy policies.

8. Retention

Data is retained while your account is active. You can request its complete deletion at any time. Upon account deletion, it is erased immediately (see Delete my account), except for legal obligations (billing: 7 years). Health data of an account that has been inactive for 24 months is deleted.

9. Your rights

Under GDPR, you have rights of access, rectification, erasure, portability, objection and restriction, as well as the right to withdraw your consent at any time. To exercise these rights, write to info@achyl.be. You may also file a complaint with the Belgian Data Protection Authority.

10. Cookies

The website uses Google Analytics cookies to measure its audience. The mobile app does not use cookies; it includes the Google Analytics for Firebase and Meta measurement SDKs, and local storage required for operation.

11. Changes

This policy may be updated. The date at the top indicates the latest version. Substantial changes will be notified in the app.