Privacy Policy

The data controller is Refreesh S.r.l. Società Benefit, Via Lazzaro Spallanzani 10, 20129 Milan (MI), Italy — VAT no. IT13516410969, REA MI-2727959, which operates the Athleex service.

For privacy questions or to exercise your rights, write to info@athleex.com. We have not appointed a Data Protection Officer (DPO) because it is not mandatory: our processing is not carried out on a large scale (Art. 37 GDPR). Requests are handled by our privacy contact at the same address.

Athleex is used by Personal Trainers (PTs) and their athletes, as well as by athletes who train on their own.

• Refreesh is the controller of your account data, consents, subscriptions, security, the features it offers you directly (measurements, diary, Athleex Score and Athlete Twin, leaderboard and challenges) and abuse prevention.
• Your PT is the controller of the data they use to coach you as a professional: programs, notes, meal plans, supplements, feedback, invoices they issue to you, appointments, and the analytics Athleex provides them (for example Churn Radar). For this data, Refreesh acts as processor on the PT's behalf, under the Data Processing Agreement (DPA).
• Your PT sees your health data only if you consent (section 5) and only while your relationship on Athleex is active.

For data processed by your PT you can also contact them directly.

• Account and contact: name, email, phone, date of birth, gender, language, profile photo; for PTs also address and location coordinates (for the map), public profile, Instagram and website.
• Access and security: password stored only as a cryptographic hash (Argon2id), passkeys, temporary verification codes, recovery codes (stored only as a hash), the authenticator-app key if you turn it on (stored encrypted), active sessions with device type and part of the IP address, security events (for example failed sign-ins or password changes), IP address and browser in consent, security and administration logs.
• Health data (Art. 9 GDPR), only with your explicit consent: weight, height, body composition, circumferences and the related goals (for example a target weight), progress photos, food intolerances, food diary.
• Training: programs, logged sessions (loads, reps, perceived exertion, ratings, notes), athletic tests, personal bests, performance goals, exercise execution videos (to correct technique) and related comments, mood and energy in the training diary.
• Nutrition and supplements assigned by the PT: meal plans, advice, supplements with dosages and reminder times.
• Communications: chat messages (text, voice notes, attachments), notifications, any WhatsApp messages, if you link your number with a code, or Instagram messages, if the PT connects their account.
• Scores and statistics: Athleex Score and predictions (with consent), churn-risk score for the PT (Churn Radar), experience points, leaderboards and challenges.
• Payments: plan, status and subscription identifiers. Card data is processed by Stripe or Apple, never by Athleex. For PTs: fees and invoices they record for their athletes.
• Reviews: if you leave a review for a PT, the rating and text are published on their page with your first name and last-name initial.
• PTs' public pages: the content the PT publishes, including any before-and-after photos of their clients, allowed only with the written consent of the person shown and with no health information in the captions.
• Technical usage data: date of last activity, devices registered for notifications. For internal usage statistics: the days you use Athleex, the number of opens and the platform (web, iOS, Android).

We do not ask you for diagnoses, medical conditions or medications, and we do not process genetic data or biometric data to identify you. Please do not write this kind of information in free-text fields (chat, notes, comments): if you do, we keep it only to show it to you and to the people you sent it to.

Where the data comes from

• From you, when you sign up and use Athleex.
• From your PT, if they created your account or coach you: name and email, then programs, notes, meal plans, supplements and goals. The invitation email tells you who entered your data and where to read this notice.
• From Stripe or Apple: payment outcomes and subscription status.
• From your IP address: your country, estimated on our server with MaxMind's GeoLite2 database without sending the address to third parties, to show you the right language, currency and prices and to apply the restrictions in section 19.
• From WhatsApp or Instagram, only if you link your WhatsApp number or the PT connects Instagram and you write to them there: your number or username and the messages.

• Providing the service (contract, Art. 6(1)(b)): account, PT-athlete relationship, programs, workout logging, chat, service notifications, subscriptions and support.
• Health data (explicit consent, Arts. 6(1)(a) and 9(2)(a)): see section 5.
• Athleex Score and Athlete Twin (consent, Art. 6(1)(a); for estimates on weight, body composition and body measurement goals also explicit consent, Art. 9(2)(a), only if you have consented to health data): see section 6.
• Churn Radar for the PT (the PT's legitimate interest in following their clients, Art. 6(1)(f); Refreesh acts on the PT's behalf): see section 6. You can object at any time.
• Leaderboard (consent, Art. 6(1)(a)) and weekly challenges among athletes of the same PT who chose to appear on the leaderboard.
• Preventing abuse of the free plan (legitimate interest, Art. 6(1)(f)): athletes linked to a coach use Athleex without a subscription. To prevent coach accounts from being created solely to obtain this access, we analyse certain signals in relationships where the coach is on the free plan: time between the coach's sign-up and the athlete being linked, the athlete's activity, the coach's involvement (program dates, messages, notes, feedback, never the content), and similarity between names or email addresses. The check only produces a list reviewed by authorised staff: it does not block, suspend, or store any score. Any measure is decided by a person after asking you for clarification. You can object (section 10).
• Security (legitimate interest and security obligations, Arts. 6(1)(f) and 32): access, administration and security-event logs, prevention of unauthorised access, backups, email alerts about security events on your account (for example a sign-in from a new device, a password change or an attempt to sign up with your address; for administrators also a new passkey or the use of a recovery code).
• Internal usage statistics (Refreesh's legitimate interest in understanding how the service is used and improving it, Art. 6(1)(f)): for each day we count whether you use Athleex, how many times you open it and from which platform. The internal dashboard only shows totals; no third-party services and no additional cookies: your login session is enough. Administration accounts are excluded. You can object in Settings » Usage statistics: the data already counted is deleted.
• Legal obligations (Art. 6(1)(c)): retention of Refreesh's accounting records on subscriptions, responding to authorities.
• Newsletter (consent, Art. 6(1)(a)), revocable from any email or from Settings.
• Usage statistics and campaign measurement on the public website (consent via the cookie banner, Art. 6(1)(a)): see the Cookie Policy.

Health data is activated through two distinct choices, both optional and revocable from Settings:

• Consent to processing: allows us to save measurements and weight, body composition and body measurement goals, progress photos, food intolerances and food diary in your account. Without this consent, those sections do not save data; the rest of Athleex works normally.
• Consent to share with your PT: allows the PT you have an active relationship with to see measurements and the related goals, progress photos, intolerances and food diary. Requires consent to processing. Without sharing, the PT does not see this data.

• If you withdraw only the sharing consent, the PT immediately stops seeing the data; the data remains in your account.
• If you withdraw consent to processing, the data is hidden immediately and permanently deleted after 30 days (it remains in encrypted backups until they expire, section 7). Sharing with the PT is automatically switched off.
• Consent to processing has existed since 14 September 2026. If you had saved health data before that date, it is hidden until you give consent: you can give it from Settings within 30 days to keep it, otherwise it will be deleted. Sharing with the PT granted before that date covers measurements and photos only; for intolerances and diary you need to confirm the new sharing consent.

No decision producing legal effects or similarly significantly affecting you is taken solely by automated means (Art. 22 GDPR). The scores described here are informational tools.

Athleex Score and Athlete Twin (optional, with consent). Based on your training data from the last 12 weeks and your goals, they compute a 4-week estimated one-rep max (1RM) with a confidence interval, a recovery/overtraining risk index, a goal projection, and a score from 0 to 100. Projections on weight, body composition and body measurement goals are calculated only if you have also consented to health data. Methods: the Epley formula, linear regression, exponential moving average, linear extrapolation. Visible to you and your PT; the PT sees projections on body goals only if you share your health data with them. These are statistical estimates, not medical advice or prescriptions. Withdrawing consent deletes the predictions immediately; otherwise they are kept for a maximum of 60 days.

Churn Radar (for the PT). For each athlete with an active relationship, Athleex calculates a daily churn-risk score from 0 to 100 for the PT, based on: days since the last workout, consistency, rating trends, unanswered messages, overdue payments, missed goals, date of the last measurement (only if you share your health data) and last activity. Only your PT sees it, to decide whether to reach out; no message is sent automatically. Scores are kept for 90 days. You can opt out from Settings: existing scores are deleted and no more are calculated.

Leaderboard and challenges. If you choose to appear on the leaderboard, other athletes of the same PT see your name and last-name initial, points and rank; with the same choice you may be matched into weekly challenges with them.

Abuse prevention is described in section 4.

• Account: while active. If you don't use Athleex for 24 months we notify you by email; if you don't sign in within 30 days the account is deleted. Accounts with an active paid subscription or an active relationship with a PT are excluded.
• Account deletion from Settings: immediate. Only copies of messages in the other person's conversations and encrypted backups remain until they expire.
• Accounts never activated: a sign-up that is never confirmed is deleted after 30 days; an account created by a PT and never used is deleted 30 days after the relationship with the PT ends.
• Health data: while consent to processing is active; deleted 30 days after withdrawal, including the technical copies of offline sync.
• Technical copies of offline sync (used to avoid saving twice data sent without a connection): 7 days.
• Athleex Score and Twin predictions: 60 days. Churn Radar scores: 90 days.
• Health-data access log: 12 months. Administration activity log: 24 months. Verification codes: 24 hours.
• Consent log: for the duration of the account (the IP address fingerprint is removed after 180 days). Visitors' cookie choices: 13 months.
• Sessions and devices: until you sign out or the session expires, then 90 days to recognise a sign-in from a new device.
• Requests about your rights: 12 months from closure.
• Contacts received from a PT's public page: 90 days from the request, even if the PT has already contacted you; if you become their client, 90 days later, because from then on your data lives in your account. Waitlist: until unsubscription and in any case no longer than 24 months.
• Refreesh's accounting records on subscriptions: 10 years (Art. 2220 Italian Civil Code), with Stripe or Apple for payment data.
• Encrypted backups of database and files: 14 days on the server and 60 days in the off-site EU copy.
• Usage statistics: 13 months, then deleted.
• Payment events received from Stripe: 60 days. WhatsApp messages we cannot match to an account: 30 days.
• Technical server logs: rotated by size, typically a few weeks.

If data is needed to establish, exercise or defend legal claims, or an authority requests it, we keep it for as long as strictly necessary, even beyond these periods.

We do not sell personal data and do not use it for third-party advertising. Data is visible to your PT within the limits of section 5, to authorised Refreesh staff (with logged access) and to vendors that help us deliver the service, bound by contract:

• Hetzner Online GmbH (Germany): servers and database.
• Backblaze, Inc.: off-site backup copy, encrypted before sending, stored in the EU region (Netherlands).
• Stripe (Stripe Payments Europe Ltd. and Stripe, LLC): web payments. Receives email, billing data and subscription identifier.
• Apple Inc.: in-app purchases on iOS and push notification delivery on iPhone.
• Google (Google Ireland Ltd. and Google LLC): push notification delivery on Android (Firebase Cloud Messaging) and, only with your consent, website usage statistics (Google Analytics 4).
• Mozilla Corporation and Microsoft Corporation: delivery of web push notifications in the Firefox and Edge browsers, if you enable them. They only receive the technical delivery address and the encrypted message, with no health content.
• Microsoft Ireland Operations Ltd. (Microsoft 365): the info@athleex.com mailbox, which receives the messages and requests you send us.
• Our accounting and tax advisor: subscription billing data, for legal obligations.
• Resend (Plus Five Five, Inc., USA): sending service emails and the newsletter. Receives address, name and email content.
• Meta Platforms Ireland Ltd.: only with marketing consent, measurement of campaigns on the website (Pixel and Conversions API); only if you use WhatsApp or Instagram with your PT, delivery of messages on those channels.
• OpenStreetMap Foundation (United Kingdom): converting the PT's address into coordinates for the map.
• CARTO and YouTube/Vimeo: only if you click to load the "Find a PT" map or a video on a PT's page; they receive your IP address.

Push notifications: the text that passes through Apple and Google is generic (for example "New message from Marco" or "Time for your supplement") and does not contain the content of messages, supplement names or dosages, or measurement values. Details are only visible inside the app.

The list of vendors that process data on behalf of PTs is published at /legal/sub-processors. We may disclose data to authorities only when required by law.

Servers, databases and backups remain in the European Union. Some vendors (Stripe, Apple, Google, Microsoft, Mozilla, Resend, Meta) may process data in the United States. In these cases the transfer relies on the EU-US adequacy decision (EU-US Data Privacy Framework) for the companies that are certified and in any case on Standard Contractual Clauses approved by the European Commission, provided for in vendor contracts; you can request a copy at info@athleex.com. Web push notifications go through the service chosen by the browser itself (for example Mozilla for Firefox, which does not participate in the Data Privacy Framework): it receives only a technical delivery address and the encrypted message, which it cannot read, and sending it is necessary to deliver the notifications you enabled (Art. 49(1)(b) GDPR). The United Kingdom (OpenStreetMap Foundation) benefits from an adequacy decision.

You can exercise the rights under Arts. 15-22 GDPR at any time, free of charge:

• Access and portability: Settings » Export my data (JSON or PDF, with all categories). The download happens from the app after signing in; for security we ask you to confirm your password. To move to another service, see also the section "Data export and switching provider" of the Terms.
• Rectification: from your profile and the data sections.
• Erasure: Settings » Delete account. Stripe subscriptions are cancelled automatically; those purchased on iPhone must be cancelled from your Apple ID settings.
• Withdrawal of consent (health data, sharing with the PT, Athleex Score and Twin, leaderboard, newsletter, cookies): from Settings, with immediate effect and without prejudice to processing carried out beforehand.
• Objection to processing based on legitimate interest, in particular Churn Radar and usage statistics (toggle in Settings) and abuse prevention, and restriction of processing: from the requests form in Settings or by writing to info@athleex.com.
• Complaint to the Italian Data Protection Authority (garanteprivacy.it) or the authority of the country where you live.

We respond without undue delay and in any case within one month; if the request is complex or we receive many, we may extend this by two further months, telling you within the first month (Art. 12(3) GDPR). We may ask you to write from your account's email address to verify the request is yours.

Athleex is reserved for adults. During registration we ask for the date of birth; for accounts created by a PT we ask at first sign-in. If an age under 18 is found, the account is suspended immediately, consents to health data are withdrawn, relationships with PTs are closed, and the data is deleted within 30 days, unless a person exercising parental responsibility requests otherwise in writing to info@athleex.com. PTs must not create accounts for minors and, when they create an athlete's account, they confirm the athlete is an adult. The waitlist and the contact forms on PTs' pages are also reserved for adults.

We adopt measures proportionate to the risk, including:

• encrypted connections (HTTPS with TLS 1.2 or 1.3 and HSTS); server reachable only with a key and protected by a firewall; database not exposed to the Internet;
• passwords stored with Argon2id, as recommended by the Italian cybersecurity agency (ACN) guidelines; two-step verification mandatory for administrators, with a phishing-resistant passkey and recovery codes, and for PTs who access athletes' health data, with an authenticator app or an email code and sessions that last at most 7 days and expire after 24 hours of inactivity; optional for others, also with an authenticator app; passkey to unlock the app; a list of connected devices that you can sign out, and an email alert for every sign-in from a new device; password confirmation before downloading all your data;
• access to health data only with consent and an active relationship, with an access log; photos, attachments and invoices served only after authorisation is verified; metadata, including location, removed from uploaded photos and videos; photos, videos, attachments and invoices encrypted on the server (AES-256-GCM);
• daily encrypted backups of database and files (AES-256 with integrity verification), an off-site EU copy and a monthly restore test;
• continuous monitoring with alerts, a security-event log, a breach-management procedure, authorised staff bound by confidentiality.

The server's database is not encrypted at the disk level: it is protected by the access controls described above, and backups are encrypted. No system is 100% secure: if a breach occurs that exposes you to risk, we notify you as required by law.

The website uses necessary technical cookies (session, consent preferences, language, two-step verification, email address confirmation) and, only with your consent, statistics cookies (Google Analytics 4) and marketing cookies (Meta Pixel) on public pages. In restricted areas and in the iPhone and Android app we do not use statistics or marketing cookies. Details and preferences in the Cookie Policy. Internal usage statistics do not add cookies or other identifiers to your device: they only use your existing login session.

We update this notice when processing activities or the law change. The date of the last update is shown above. If changes are significant we notify you in the app on first sign-in and, when necessary, by email; if new consents are needed we ask for them before starting the processing.

For California residents, Athleex complies with the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). You have the right to: (a) know what personal information we collect, use, disclose; (b) delete personal information; (c) correct inaccurate personal information; (d) opt out of "sale" or "sharing" (Athleex does NOT sell personal information; cross-context behavioural advertising is governed by the cookie banner and may be disabled at /legal/do-not-sell); (e) limit use of "sensitive personal information" (which we do not use beyond strictly necessary purposes); (f) non-discrimination. Equivalent rights apply to residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Tennessee, Indiana, Iowa, Montana, Florida, Delaware, New Hampshire, New Jersey, Maryland, Minnesota under their respective state privacy laws. To exercise rights write to info@athleex.com. We respond within 45 days (CCPA) — extendable once by another 45 days. Athleex is NOT a HIPAA Covered Entity or Business Associate; the service is wellness-tracking and not medical care.

Washington — My Health My Data Act (MHMDA, RCW 19.373): workout logs, biometrics (with consent), wellness scores and any data that identifies a consumer's past, present, or future physical or mental health constitute "consumer health data" under MHMDA. Washington residents provide explicit and separate consent (RCW 19.373.020) to the processing of such data through the health-data consent described in §5, for the sole coaching purposes described in §4. Athleex does NOT sell consumer health data. Athleex does NOT share consumer health data with third parties for advertising. The vendors listed in §8 receive consumer health data solely as service providers bound by written DPAs forbidding any independent use. Washington residents may at any time withdraw consent and request deletion of consumer health data via info@athleex.com; deletion is propagated to all sub-processors within 30 days (RCW 19.373.040). Geofencing of consumer health data is prohibited and Athleex does not engage in such practices. See /legal/wa-consumer-health for the full standalone notice required by RCW 19.373.020(1).

For Canadian users, Athleex complies with the Personal Information Protection and Electronic Documents Act (PIPEDA) at the federal level and with Quebec's Law 25 (formerly Bill 64) for Quebec residents. Quebec Law 25 introduces requirements stricter than GDPR for sensitive data and automated decisions; Athleex's Art.22 protections (Athlete Twin / Athleex Score) extend to Quebec users by default. The competent authority is the Office of the Privacy Commissioner of Canada (OPC) — priv.gc.ca — and for Quebec residents the Commission d'accès à l'information du Québec (CAI). To exercise PIPEDA / Law 25 rights write to info@athleex.com.

Para los usuarios residentes en México, Athleex actúa conforme a la Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP). Tienes derecho a ejercer los derechos ARCO (Acceso, Rectificación, Cancelación, Oposición), así como a revocar tu consentimiento y limitar el uso o divulgación de tus datos. Para ello escribe a info@athleex.com. La autoridad competente es la Secretaría Anticorrupción y Buen Gobierno (SABG), que asumió las funciones del antiguo INAI en materia de protección de datos personales — gob.mx/sabg. Las transferencias de datos hacia destinatarios fuera de México se realizan exclusivamente para cumplir el contrato con el usuario y para fines de prestación del servicio.

Athleex is operated from Italy and processes personal data primarily under the EU GDPR. For users resident in Norway, Iceland, Liechtenstein, Andorra, Monaco, San Marino — the GDPR or a regime declared adequate by the European Commission applies. For users resident in countries with national data-protection laws aligned to the GDPR template — including Serbia, Bosnia and Herzegovina, Montenegro, North Macedonia, Albania, Kosovo, Ukraine, Moldova, Georgia, Armenia and Azerbaijan — Athleex applies GDPR-equivalent technical, organisational and contractual safeguards and recognises the rights granted by your local law. The competent supervisory authorities of those countries can be contacted directly; we cooperate with any lawful request. Where consent is required by your local law (e.g. Ukraine's 2024 amended Law on Personal Data Protection), the cookie banner and account-creation flows operate as the consent-collection mechanism. To exercise rights write to info@athleex.com.

Athleex does not knowingly accept registrations from territories subject to comprehensive EU, UK, US or UN sanctions, including (without limitation) Belarus, North Korea, Iran, Syria, Cuba, the Crimea, Donetsk and Luhansk regions of Ukraine. Should an account be created from such a territory, we reserve the right to suspend it without prior notice and to comply with applicable sanctions law.