Privacy
Policy

Data controller: Florian Boquet · Contact: contact@getbaseload.com

1. Introduction

Baseload is an endurance sports coaching app. Protecting your data — and your health data in particular — is central to how we build it. Our guiding principle: your health data stays on your iPhone. Only aggregated, anonymized information is, where applicable, sent to our servers to power your coaching.

This policy explains what data we process, why, on what legal basis, who it may be shared with, how long it is kept, and what your rights are.

2. The data we process

2.1 Health data (read via Apple HealthKit) — stays on your device

With your explicit authorization, the app READS from Apple Health: workouts, heart rate, heart rate variability (HRV), VO2max, sleep stages, resting heart rate, body mass.

• This data is processed locally, on your iPhone. The app never writes to Apple Health.
• It is not sent as-is to our servers: no raw heart rate, no GPS track, and no full workout series ever leaves your device.
• Only aggregated characteristics (e.g. a daily training load, a recovery trend, a per-muscle-group fatigue indicator) may be transmitted to compute your weekly review (see §4).

2.2 Profile data (that you provide)

First name, age, sex, weight, height, sports goal, disciplines practiced, target number of sessions, injury history (area + description), preferences (briefing time, language, units, coach tone).

2.3 Weekly coaching channel data

Once a week, to generate a narrative review, aggregated and anonymized characteristics (see §2.1), linked to a technical identifier (UUID), are sent to our AI provider (Anthropic — see §6). Your first name is NOT transmitted: it is re-inserted locally, on your device, into the review text after computation.

2.4 Usage measurement (analytics) data — only with your consent

If you enable usage measurement (off by default, see §8), we collect a limited, anonymous and aggregated set of events, linked to a random technical identifier (UUID) — never to your identity. No raw health data is included. Exhaustive list:

1. Profile snapshot: goal, level, disciplines, target number of sessions, tone, language — as ranges/categories (never exact values such as age or weight).
2. Daily app open: once per calendar day (to measure usage loyalty). No geolocation.
3. Daily coaching outcome: alertness level, recommended action, fitness tier — as closed categories.
4. Recommendation follow-through: whether the previous day's recommendation was followed or not (4 categorical values).
5. Onboarding progress: step reached (to understand drop-offs).

2.5 Technical identifier

A random identifier (UUID) is associated with your device/account. It does not allow us to identify you by name.

3. What we do NOT do

• We do not sell any data.
• We use no third-party advertising/tracking SDK (no Google Analytics, Firebase Analytics, Meta SDK, etc.).
• We show no advertising and do not profile you for advertising purposes.
• We never use your health data for marketing or advertising purposes, and we do not disclose it to third parties for such purposes (a commitment required by Apple's HealthKit rules).
• We do not compare users with one another.

4. Purposes

5. Legal basis (GDPR)

• Processing of health data (§2.1): explicit consent (Art. 9(2)(a) GDPR), obtained via the HealthKit authorization and your use of the app. Health data is sensitive data: its processing relies on your explicit consent and takes place locally.
• Operation of the service (profile, coaching, program): performance of a contract (Art. 6(1)(b)) — to provide the service you request.
• Usage measurement (§2.4): consent (Art. 6(1)(a)), opt-in, revocable at any time.

6. Recipients and processors

• AI model provider (Anthropic), for the weekly review: receives anonymized aggregated characteristics (UUID, without first name). The transfer of this anonymized data to this provider, located outside the European Union, is governed by the European Commission's Standard Contractual Clauses and a Data Processing Agreement (DPA).
• Hosting provider: hosting in the European Union (Paris region).
• Analytics database: data residency in the European Union.
• No other disclosure to third parties, except as required by law.

7. Data location and retention

• Health data: on your device, until you delete it (uninstall or account deletion).
• Analytics data: kept for a rolling 180 days, then purged.
• Account/profile data: until you delete your account.
• Hosting: European Union (except the anonymized weekly-review processing, governed by §6).

8. Usage measurement — consent and revocation

Usage measurement (§2.4) is off by default. It is enabled only if you explicitly tick the corresponding option during onboarding. You can disable it at any time from Profile > GDPR.

9. Your rights (GDPR)

You have the rights of access, rectification, erasure, portability, restriction, objection, and withdrawal of consent at any time.

• Export your data (JSON format): from Profile (built-in export feature).
• Delete your account and your data: from Profile (built-in deletion feature).
• Other requests: contact@getbaseload.com
• You may lodge a complaint with the CNIL (the French data protection authority, www.cnil.fr).

10. Specific Apple HealthKit commitments

In accordance with Apple's rules: data obtained from HealthKit is never used for advertising or marketing purposes, is never sold, and is not disclosed to third parties for advertising or data-mining purposes. It is used solely to provide you with coaching and tracking.

11. Minimum age

In France, the age of digital consent is 15. We apply this rule: the app is reserved for people aged 15 or over.

12. Changes

We may update this policy. Substantial changes will be notified to you in the app. The last-updated date appears at the top.

13. Contact

Florian Boquet — contact@getbaseload.com

See also: Terms of Service.