Cookie Policy

Cookies are small files that a website stores on your device to remember information between pages, for example that you're signed in. Some are essential; others are used for statistics or advertising and require your consent.

These do not require consent because they are needed to provide the service you requested:

• __Host-athleex_session (formerly athleex_session): keeps you signed in. HttpOnly, Secure, SameSite Lax (Strict for administrators). 24 hours, or 30 days with "Remember me"; at most 24 hours for administrators and 7 days for PTs who see health data; deleted when you sign out.
• _athleex_consent and _athleex_consent_id: remember your cookie choices and an anonymous identifier to prove them. 12 months.
• NEXT_LOCALE, athleex_country, athleex_currency: language, country and currency shown.
• athleex_2fa_pending, webauthn_challenge: temporary steps of two-step verification and passkeys. A few minutes.
• athleex_offline_purge: after you sign out, tells the browser to delete from the device the unsent offline changes of the account that just signed out; it contains only the account identifier. 1 day.
• athleex_verify_pending: email address confirmation after sign-up, encrypted. 1 hour.
• athleex_applock / app_unlocked: biometric unlock in the app.
• ig_oauth_state: protection for the Instagram connection for PTs. A few minutes.

We also use browser local storage for preferences such as loading the map. If your browser sends the Global Privacy Control signal, we treat it as a refusal of statistics and marketing.

Vendor: Google Ireland Limited / Google LLC. Measures, in aggregate form, usage of the public pages (visits, page views, conversions). Cookies _ga and _ga_GRLNNH64JH, up to 24 months. Without consent, the script stays in denied-consent mode and does not set cookies. GA4 does not record full IP addresses. Possible transfer to the USA (section 9 of the notice).

Vendor: Meta Platforms Ireland Ltd. Used to measure the effectiveness of our ads on Facebook and Instagram and to attribute sign-ups and subscriptions. Cookies _fbp and _fbc, up to 90 days for _fbp. The same events may also be sent from our server (Conversions API) only if you have given consent: email, phone, name and country travel as a cryptographic hash, while IP address, browser and cookie identifiers are sent as-is to enable matching. We never send health data, message content or pages from restricted areas. When you withdraw consent we delete _fbp and _fbc and stop sending events; events already sent remain with Meta under its rules.

The "Find a PT" map (CARTO tiles) and YouTube or Vimeo videos on PT pages load only after you click the notice: from that moment the vendor receives your IP address and may use its own cookies according to its notices.

In restricted areas (dashboard, settings, chat, administration), on the sign-in and registration pages, and in the iPhone and Android app, we do not load Google Analytics or Meta Pixel, regardless of the choices made on the website.

You can change your choices at any time from the Cookie preferences link in the footer, or by deleting the _athleex_consent cookie to see the banner again. Withdrawing is as easy as consenting and takes effect immediately. You can also block cookies from your browser (Chrome, Safari, Firefox, Edge): blocking the session cookie will prevent you from signing in.

We update this page when the cookies we use change; the date is shown above. Questions: info@athleex.com. Controller: Refreesh S.r.l. Società Benefit, Via Lazzaro Spallanzani 10, 20129 Milan (MI), Italy — VAT no. IT13516410969, REA MI-2727959.