Privacy Policy.

1 Who we are and what this Policy covers

ATHLX AI Ltd. ("ATHLX" or "we") is a Canadian company based in British Columbia. We provide ATHLX Performance, a platform that connects to the wearable devices athletes already use and turns their sleep, heart rate and training data into training load, readiness and recovery insights for their coaches (the “Platform”).

This Policy applies to athletes who connect a wearable to ATHLX, to coaches and staff who use the ATHLX dashboard, and to visitors of athlx.ai. We treat all health and fitness information as sensitive personal information, and we never sell personal information.

2 How ATHLX works

A coach or organization invites an athlete to ATHLX. The athlete opens the invitation, reviews what will be shared and with whom, and connects their wearable account by signing in with the wearable provider. That is the only step an athlete takes; athletes do not enter data into the Platform.

After the connection, ATHLX imports the data types the athlete approved, calculates indicators from them, and shows the results to the athlete’s authorized coaches in the ATHLX dashboard.

ATHLX works with data from many wearable providers. The Platform currently supports Fitbit, through Google’s APIs. We will update the list in Section 4 before we support another provider.

3 Information we collect

4 Connecting a wearable

Connecting a wearable is how an athlete gives consent. Before connecting, the athlete sees which organization and coaches will receive the data, which data types are involved and why. The athlete then signs in on the wearable provider’s own screen and chooses which data types to share. ATHLX receives only what the athlete approves there.

We request only the data needed for the features described in this Policy. ATHLX collects data recorded from the moment of connection onward; it does not import earlier history.

Each wearable provider collects and stores data under its own privacy policy, which ATHLX does not control. This Policy covers only the copy ATHLX imports and the indicators we calculate from it.

5 How we use information

We use personal information only for the purposes below. Where the EU or UK GDPR applies, the last column shows our legal basis.

In Canada, we collect, use and disclose personal information with consent and as permitted by the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws. We obtain the athlete’s express consent before importing any health information.

We do not use health data for advertising, and we do not sell or rent personal information. We do not send marketing messages. If we want to use information for a new purpose, we will explain it first and ask for consent where required.

6 How our indicators are created

ATHLX calculates its indicators automatically by comparing an athlete’s recent data with that athlete’s own baselines. For example, HRV or sleep below the athlete’s usual range, combined with a high recent training load, may lower the readiness indicator.

Indicators are estimates. Their accuracy depends on the wearable, how consistently it is worn and how much data is available. They support coaches’ judgment rather than replace it, and they are not medical assessments.

ATHLX does not make decisions with legal or similarly significant effects on anyone based solely on automated processing. An athlete can ask us which data produced an indicator and the main factors behind it, and ask for a person to review it (Section 16).

7 Coaches and organizations

Only coaches and staff named in the athlete’s consent can see that athlete’s data, and only within their role in the organization. Coaches see each athlete’s readiness, training load and recovery status with trends, and the underlying metrics: HRV, resting heart rate, HRR, sleep and exercise sessions.

Coaches may use athlete data for training planning, load management and day-to-day availability. Our agreements with organizations prohibit using ATHLX data as the basis for contract, salary, transfer, hiring or insurance decisions.

The organization’s role. The organization that invites an athlete decides why athlete data is collected for its program. It acts as the controller (or the organization responsible for the information), and ATHLX processes athlete data on its behalf under a written data processing agreement. Athletes may send privacy requests to their organization or to us, and we will help the organization respond. The organization does not own the athlete’s health information.

8 Google API Limited Use

ATHLX’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Use of information received from the Google Health API will also adhere to the Google Health API Developer and User Data Policy, including its Limited Use requirements.

In particular, ATHLX uses Google-derived data only to provide and improve the features described in this Policy; does not transfer it to others except as needed to provide those features with the athlete’s consent, for security, to comply with law, or as part of a merger or acquisition with explicit prior consent; does not use or transfer it for advertising, marketing profiles, data brokerage, credit or lending decisions, insurance eligibility or employment decisions; and does not use it to train general-purpose AI models.

These restrictions also apply to derived, aggregated or de-identified data. ATHLX staff can read identifiable Google-derived health data only with the athlete’s explicit permission, where necessary for security or legal compliance, or once the data has been aggregated and anonymized for permitted internal operations.

9 Who can see the data

Athlete data is visible only to the coaches and organization the athlete authorized (Section 7). ATHLX does not share athlete data with any other third party, and never sells, rents or provides it to advertisers or data brokers.

We disclose information only if required by law or a valid legal request, or to protect the safety of people or the security of the Platform. If ATHLX is involved in a merger or sale of its business, athlete data is transferred only with the athlete’s explicit prior consent, and the recipient must honour this Policy.

10 Where data is stored and processed

Athlete data is stored and processed on our servers in Sweden, in the European Union. ATHLX AI Ltd. is based in Canada, and authorized ATHLX staff may access the data from Canada to operate and support the Platform.

The European Commission recognizes Canada as providing adequate protection for personal data handled by commercial organizations under PIPEDA, so this access does not require additional transfer mechanisms under the GDPR. The security measures in Section 13 apply wherever the data is accessed.

11 How long we keep information

We keep athlete data for as long as the athlete remains connected to ATHLX, so that coaches can follow long-term trends and baselines stay accurate. We keep it until the athlete asks us to delete it.

When an athlete asks us to delete their data, we permanently remove it from our systems, including backups, and confirm the deletion to them.

12 Your choices and rights

An athlete can stop sharing at any time by removing ATHLX’s access in their wearable account settings (for Fitbit, in the Google Account’s third-party connections), or by asking us or their organization. This stops new data collection and ends coach access to future data.

Athletes may also ask us to access, correct or delete their data, or to receive a copy of it, by emailing info@athlx.ai. Deleting data in ATHLX does not delete the original records in the wearable account, which the athlete manages with the wearable provider.

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada, the Information and Privacy Commissioner for British Columbia, or, in the EU, your local data protection authority.

13 Security and breaches

We protect information with encryption in transit (HTTPS/TLS) and at rest, role-based access controls, restricted staff access and secure management of credentials and keys. Wearable access tokens are encrypted and never shown to coaches or other users.

If a breach of security safeguards creates a real risk of significant harm, we will notify affected people and the relevant regulators as the law requires. No system is perfectly secure; please report suspected security issues to info@athlx.ai.

14 Athletes under 18

If an Organization invites an athlete under 18, it must first obtain consent from the athlete’s parent or legal guardian. Parents and guardians can contact info@athlx.ai at any time to access or delete their child’s data.

15 Changes to this Policy

We will post updates on this page with a new “Last updated” date. For material changes, we will notify connected athletes by email and organizations through the dashboard before the changes take effect. If a change involves a new use or sharing of health data, we will ask for consent first; continued use alone will not count as consent.

16 Contact

Questions or requests about this Policy or athlete data can be sent to our Privacy Officer.

Privacy Officer
ATHLX AI Ltd.
British Columbia, Canada
Email: info@athlx.ai
Website: https://www.athlx.ai