Privacy Policy — Atymus

Version: 1.7 Last updated: 2026-10-09 Initial regulatory scope: European Union (launch in France + progressive EU expansion) Reference language: This is an informational translation. In case of any interpretive divergence, the French version prevails (initial jurisdiction). See privacy-policy-fr.md.

1. Who we are

This Privacy Policy describes how the mobile application Atymus ("Atymus", "the App", "we") collects, uses, stores, and shares your personal data.

Data controller (within the meaning of Article 4(7) GDPR):

Felipe Oliveira Natural person, residing in Aix-en-Provence, France Contact: admin@atymus.com

Atymus is operated in compliance with: - Regulation (EU) 2016/679 — General Data Protection Regulation (GDPR) - French Law No. 78-17 of 6 January 1978, as amended (Loi Informatique et Libertés) - Recommendations of the French Data Protection Authority (CNIL)

Atymus is initially intended for residents of the European Union. Users residing outside the EU should be aware that the rules described here are based on the GDPR standard, generally more protective than what is required in other jurisdictions. Formal expansion to other markets (Brazil, United States, etc.) will be subject to a specific update of this Policy.

2. What is Atymus

Atymus is a wellness and fitness application designed to help you track your health habits — nutrition, sleep, physical activity, and body measurements. The App offers AI-powered personalized analysis and operates on a recurring subscription.

⚠️ Atymus IS NOT a medical device. It does not diagnose, treat, prevent, or cure any clinical condition. The content and suggestions offered are for educational and personal tracking purposes, and do not replace under any circumstances the advice of a qualified healthcare professional. Always consult your doctor before any significant change to your diet, training, or lifestyle.

3. What data we collect

We collect only data necessary for the App to function and for the purposes described in Section 4.

3.1. Identification and account data

• Email address
• Name or identifier of your choice
• Password (stored in encrypted form by Firebase Authentication; we never have plain-text access)
• Date of birth
• Gender (self-declared)
• Country of residence and preferred language

3.2. Sensitive health data — special category (GDPR Article 9)

This data receives enhanced protection. We process:

• Body measurements: weight, height, body fat percentage, muscle mass percentage, body water percentage, visceral fat, metabolic age (from a manual bioimpedance scale or via photo)
• Nutrition: foods consumed, quantities, meal photos, nutritional values (calories, protein, carbohydrates, fats), nutritional goals
• Sleep: duration, perceived quality, energy level upon waking, stress level, mood
• Physical activity: workout type, duration, exercises performed, sets, reps, loads, perceived effort (RPE), distance, estimated calories
• Vitality score: aggregated value calculated from the data above, reflecting your overall wellness level
• Data from devices you connect: heart rate, measured sleep, steps and the other data described in Section 3.6

3.3. Usage data and AI interaction

• Messages sent to the conversational assistant (AI chat)
• Audio recordings and their transcriptions (when you use the voice function)
• Interaction history for personalization of responses
• AI usage logs (model used, tokens, cost) — used only for internal billing of your subscription

3.4. Technical and diagnostic data

• Device type, operating system, and version
• Unique app identifiers (not directly linked to your identity outside the App)
• Time zone
• Crash reports — collected via Firebase Crashlytics
• Aggregated and anonymous usage metrics — via Firebase Analytics (you can disable these in settings)

3.5. Subscription data

• Subscription status (current plan, renewal date, credits consumed)
• Anonymous transaction ID provided by Apple App Store or Google Play Store

We do not collect bank details or credit card numbers. Payments are handled exclusively by Apple and Google in their respective systems, according to their own privacy policies.

3.6. Data from devices and services you connect (optional)

No connection happens without your action: each one is turned on by you in Settings > Integrations and can be turned off at any time.

• Health Connect (Android): with the permissions you grant in Health Connect itself, Atymus can read workouts (type, time, duration, distance, calories, heart rate, elevation), steps, sleep, resting heart rate and heart rate variability. Atymus does not read weight or body fat from Health Connect: weigh-ins come only from what you record in Atymus. You can withdraw each permission in Health Connect. Atymus only reads: it never writes to Health Connect, and reading happens while the App is open.
• Polar (direct connection, Premium feature): when you connect your Polar Flow account, you authorize Polar Electro Oy to send us, through Polar's official API (AccessLink): the workouts uploaded to your account after the connection (sport, time, duration, calories, distance, average and maximum heart rate and heart rate over the workout, time in each heart rate zone, the limits of each zone, the cardio load calculated by Polar and the device that recorded the workout), your daily activity (steps, active calories, distance), your nights (sleep duration and stages, and the heart rate variability Polar measures overnight) and your fitness profile in Polar (VO2max, maximum and resting heart rate, aerobic and anaerobic thresholds). The weight, height, date of birth and gender that Polar sends along with this profile are discarded on arrival: we do not keep them.
• What we keep to maintain the Polar connection: your Polar account identifier and the access credential (token) issued by Polar, encrypted with a dedicated key. We only send Polar an opaque identifier needed to register the connection; none of your health or profile data is sent to Polar.
• When you disconnect, we ask Polar to revoke access and we delete the credential. Workouts already received stay in your history, like any record of yours, until you delete them.
• When the same workout arrives through two routes (for example, through Polar and through Health Connect), we keep a single copy.
• Imported data is treated like the data you enter: it appears on your screens with its source shown, may be included in AI analyses (Section 12), and follows the same retention periods and rights described in this Policy. It is never sold or used for advertising.
• Route of outdoor activities (location): when an outdoor workout (run, walk, hike, ride) is recorded with GPS, Polar sends us the path you covered (latitude and longitude points along the workout); from Health Connect, the path is only read if you grant the specific route permission. We keep only a simplified drawing of the path, without the start and the end (by default, 200 m at each end are cut off before storing, to protect the area around your home), and the marks for each kilometer. The route is only used to draw the map in the activity details: it is not used in AI analyses or in the chat, and it only reaches your coach if you left “Your workouts” on for them (Section 3.7). In Settings > Privacy & documents > Activity routes you can stop receiving routes, change the hidden stretch (none, 200 m or 500 m) and delete stored routes; deleting a workout also deletes its route.
• Polar is responsible for the data in your Polar account, under its own privacy notice: https://www.polar.com/en/legal/privacy-notice

3.7. Sharing with your coach (Atymus Studio)

Atymus Studio is the tool used by the professional who coaches you (personal trainer, coach). They only see your data if you accept their invitation in the App, and only what you leave switched on in Your Coach > What they see. You can change this or end the link at any time: switching something off notifies no one, and ending the link cuts access immediately.

What each switch shows (all start switched on, except recovery):

• Your workouts: your sessions and how they went (duration, distance, pace, heart rate and zones, effort, sets and loads, your comments), your steps and, for outdoor activities recorded with GPS, the route map: the same simplified drawing described in Section 3.6, without the start and end you hide. With “Everything, not just their program” switched off, the coach only sees the workouts they prescribed.
• Your recovery (starts switched off): sleep and resting heart rate from your watch.
• Nutrition: your targets; what you ate; what was in each meal.
• Planning: your week.
• Body composition: weight, body fat, lean mass and measurements.
• Before the link: the 60 days before you accepted.

Your coach does not see your conversations with the AI, your payment data or anything switched off. If you turn off routes in Settings > Privacy & documents > Activity routes, the map stops appearing for them too. Your coach is an independent professional and is responsible for how they use what they see; Atymus only shows what you have authorized.

The conversation with your coach, WhatsApp and appointments. While the link is active, you and your coach can talk in Atymus, and only the two of you read that conversation:

• What is stored: the messages (text, photos and anything quoted: a workout, a meal idea, a weigh-in or an appointment), when each of you read them (“Seen”) and the mute you choose. Your coach can also send the same message to several students at once: it arrives in each conversation, marked “to several students”.
• Photos are uploaded through our server and stored behind a private link, never a public one. They are removed when the link ends and when the account is deleted.
• When the link ends, you can still read the conversation but can no longer write, and you can delete it at any time in Your data > Conversations with past coaches; your coach loses access and the photos are removed. If you delete your account, your conversations are deleted, photos included (Section 7.3).
• Phone notifications: your coach's name and the start of the message go through Firebase Cloud Messaging (Google) so the notification can appear. You can mute a conversation or turn off “Messages from your coach” in the bell's settings. If you reply from the notification itself, the reply goes straight to our server.
• Your WhatsApp: if you enter your number on your coach's screen, only your coach sees it. You can change or delete it at any time, and it is removed when the link ends.
• Appointments your coach schedules (an assessment or a chat) reach the App with the type, day, time and place, and keep your answer (“I'll be there” or “I can't make it”). The reminder 1 hour before is set by your phone itself. If your coach subscribes to their schedule in a calendar (Google, Apple), the appointments appear there with the type and your first name, without notes.

4. What we use your data for (purposes)

Important: the processing of sensitive health data only occurs with your explicit consent, collected during initial onboarding and revocable at any time. You may withdraw this consent at any moment — in which case we will cease processing and may not be able to provide the service.

5. Who has access to your data (processors)

We do not sell your data. We only share with technical service providers strictly necessary for the App to function. Each of these is contractually obligated to comply with the GDPR via a Data Processing Agreement.

International data transfers: some of the above providers process data outside the European Union, particularly in the United States. These transfers are made on the basis of the Standard Contractual Clauses approved by the European Commission, pursuant to Article 46 GDPR. You may request a copy by writing to admin@atymus.com.

Services you connect: Google Health Connect and Polar are not Atymus processors: they are your own services, which send us data because you authorized it. Polar Electro Oy (Professorintie 5, 90440 Kempele, Finland) processes the data in your Polar account as an independent controller.

Maps: the background map images come from OpenFreeMap (a public map service based on OpenStreetMap). The App requests these images directly from it, like any map on the internet: the request carries your device's IP address and the area shown, never your path or your account.

6. How long we keep your data

You may request immediate deletion of your account at any time (see Section 7).

7. Your rights

In accordance with Articles 15 to 22 GDPR, you have the following rights over your personal data:

7.1. Right of access (Art. 15)

You may view all data we collect about you at any time, directly within the App.

7.2. Right of rectification (Art. 16)

You may correct or update your information in the App settings (Profile, Goals, Preferences).

7.3. Right to erasure ("right to be forgotten", Art. 17)

You may delete your account and all associated data at any time, in Settings > Account > Delete my account. The process is irreversible and removes: - Your authentication account - All records (meals, workouts, sleep, measurements, bioimpedance) - AI chat history - Settings and preferences - Uploaded photos - The connection to your Polar account (access is revoked at Polar and the credential is deleted) - Your link with your coach, if any: it ends, and your email, your WhatsApp, their notes about you, the appointments and your conversation are removed from the coach's records

Backups are deleted within 30 days of the request. Logs subject to a legal retention obligation (consent, billing) are kept only for the minimum periods required by law and in reduced form.

7.4. Right to portability (Art. 20)

You may export all your data in a structured format (JSON) in Settings > Account > Export my data. The file includes: profile, meals, workouts, sleep, measurements, bioimpedance, goals, consent history, subscription data, and your conversations with your coach. The access credential for connected services is not part of the export: it is an access key, not data about you.

7.5. Right to object (Art. 21)

You may object to the processing of non-essential data (analytics, crash reports) in Settings > Privacy > Telemetry.

7.6. Right to restriction (Art. 18)

In specific circumstances (contesting accuracy, objection under review), you may request the temporary suspension of certain processing. Write to admin@atymus.com.

7.7. Right to withdraw consent (Art. 7)

You may withdraw your consent to the processing of sensitive data at any time. This immediately interrupts the use of this data and may result in the inability to continue using the App. Withdrawal does not affect the lawfulness of processing carried out before it.

7.8. Right to lodge a complaint

If you consider that the processing of your data violates the GDPR, you may lodge a complaint: - In France: Commission Nationale de l'Informatique et des Libertés (CNIL) — https://www.cnil.fr/en - In other EU countries: the national data protection authority of your country of residence (official list: https://edpb.europa.eu/about-edpb/about-edpb/members_en)

8. How to exercise your rights

Most rights may be exercised directly within the App (Settings). For any question or request requiring our intervention, write to:

admin@atymus.com

We will respond within 30 days, extendable to 60 days for complex requests with prior notice. We reserve the right to request proof of identity in case of reasonable doubt.

9. Data security

We implement appropriate technical and organizational measures to protect your data:

• Encryption in transit: all communications between the App and our servers occur via HTTPS/TLS 1.2+
• Encryption at rest: data stored on Firebase Firestore is automatically encrypted with AES-256 using keys managed by Google Cloud
• Access control: restrictive Firestore security rules ensure that each user can only access their own data; no data is shared between accounts, except with the coach you accepted, and only what you authorized (Section 3.7)
• Strong authentication: delegated to Firebase Authentication, with future support for multi-factor authentication
• Auditing: access and action logs are maintained for incident detection
• Backups: automated Firestore backups with 30-day retention, stored in the EU region
• Connected-service credentials: the access credential for your Polar account is stored encrypted, with a dedicated key, in an area the App cannot read, and never appears in exports
• Continuous updating: rapid correction of security vulnerabilities via Dependabot and GitHub Security

In the event of a data breach posing a risk to your rights, we will notify you by email within 72 hours of becoming aware, and notify the CNIL as required by Article 33 GDPR.

10. Cookies and trackers

The App does not use cookies (it is not a web application). We only use:

• Anonymous Firebase identifiers (instance ID) for technical operation
• Crashlytics and Firebase Analytics with identifiers not linked to your personal identity outside the App

You may disable Crashlytics and Analytics in Settings > Privacy > Telemetry.

Atymus does not display advertising, does not share data with advertising networks, and does not perform advertising profiling.

11. Minors

Atymus is intended for users 15 years of age or older, in accordance with the threshold set by French legislation for autonomous consent to personal data processing. We do not knowingly collect data from minors under 15.

If you are a legal guardian and discover that a minor under 15 has created an account without your consent, write to admin@atymus.com to request immediate closure and data deletion.

12. Artificial Intelligence — specific information

Atymus integrates a conversational assistant based on large language models (Google Gemini). Given the sensitive nature of this technology:

• Your messages sent to the chat are transmitted to Google (processor) in order to generate responses. Google contractually commits to not using your messages to train public models (see Google Cloud DPA).
• AI responses may contain inaccuracies. No response should be interpreted as professional medical, nutritional, or sports advice.
• The AI DOES NOT make diagnoses. Atymus's system instructions explicitly direct the model to refuse diagnoses and to recommend a healthcare professional for any clinical question.
• Sensitive data included in the chat (e.g., "I have knee pain") is processed like any other message and is subject to the same retention rules and rights. We recommend not including ultra-sensitive information (document numbers, bank details) in the chat.
• AI usage logs (tokens, cost, agent triggered) are stored for plan billing and internal auditing; conversation content is linked to your profile for personalization.

You may request the deletion of your chat data at any time via the right to erasure (Section 7.3).

13. Modifications to this Policy

This Policy may be updated to reflect legal, technical, or functional changes. In case of substantial modification (introduction of a new processor, change of purposes, change of retention period), you will be notified:

1. By email at the address associated with your account
2. By in-app message at the next opening
3. If the change affects the "consent" legal basis, we will request new explicit consent before proceeding

The current version of the Policy is always available in Settings > About > Privacy Policy and at the public address https://atymus.com/privacy-en.html.

14. Contact

For any question regarding the protection of your personal data:

📧 admin@atymus.com

📍 Felipe Oliveira · Aix-en-Provence, France

This Privacy Policy was drafted for use in European Union jurisdictions, with a focus on GDPR compliance and CNIL recommendations. Formal expansion to other markets (including Brazil and the United States) will be subject to a specific update in a future version. The French version is the legal reference; this English version is informational.