Privacy Policy

1. Who we are

Corriamo Ltd, trading as OneTrack Club ("OneTrack", "we", "us"), is the controller of your personal data. This means we decide how and why it is used.

• Company number: 11998802
• Registered office: A And L, Suite 1-3 Hop Exchange, 24 Southwark Street, London, England, SE1 1TY
• Email: hello@onetrack.club

This policy covers our website at onetrack.club (the "Site"), the OneTrack mobile app, and our live virtual coaching (together, the "Services"). Our Services are aimed at users in the United Kingdom, and we apply UK data protection standards to everyone who uses them. Please read this policy alongside our Terms and Conditions.

We have appointed a Data Protection Officer (DPO), who can be reached at hello@onetrack.club or by post at the address above, marked "Data Protection Officer".

If you are unhappy with how we use your data, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

2. What we collect

2.1 Account and profile

• Full name, email address, phone number and password (stored as a secure hash)
• Date of birth, gender, and location or country
• Profile photo (optional)

2.2 Health and fitness data

Health data is "special category" data under UK GDPR. We collect it only with your explicit consent (see Section 4).

• Biometrics: heart rate, heart rate variability and resting heart rate
• Activity: pace, distance, duration, cadence, stride length, elevation and split times
• Physical details: height, weight, body composition, fitness level and running experience
• Injuries and medical conditions that affect your training, if you tell us
• Readiness, recovery, sleep and training load
• Lab and test results you or your coach add to your account
• Menstrual cycle information, only if you choose to share it with your coach
• Goals and preferences, such as target races, training objectives and availability

2.3 Location data

During outdoor workouts we collect your precise GPS location, route and pace from your phone. Routes and maps are saved in your workout history.

2.4 Data from wearables and other apps

If you connect a wearable cloud platform (such as Garmin Connect, Polar Flow, Wahoo, Suunto, Fitbit or Coros) through our integration partner Terra, we receive:

• The last 30 days of activities of all types (running, cycling, swimming, strength and cross-training)
• New activities on an ongoing basis
• Sleep, recovery scores, training load, VO2 max estimates and other health metrics
• Body measurements such as weight and body fat percentage

We may also receive data from Apple Health, Google Fit, Samsung Health, Strava or TrainingPeaks if you connect them. See Section 15 for how these connections work.

2.5 Live session data

• Real-time heart rate from your wearable via Bluetooth, and GPS location and pace from your phone
• Brief video at the start of a session for check-in. Sessions then continue as audio only.
• Audio throughout the session, so you can talk with your coach
• Workout summaries and charts generated at the end of each session

2.6 Coaching records

• Messages between you and your coach
• Your coach's notes from calls with you, and files your coach attaches to your account
• Training plans, and Assistant AI chats and saved interpretations if you have agreed to Assistant AI (see Section 5)

2.7 Website, device and usage data

• Device type, model and operating system, app version, browser type, time zone and mobile network
• IP address and device identifiers, including advertising IDs
• Pages and features you use, how long you use them, clicks, in-app searches, and the sites or search terms that referred you
• Crash reports and performance data

We collect some of this using cookies, log files, web beacons and pixels (see Section 9).

2.8 Orders, payments and support

• Name, billing and shipping address, email and phone number when you buy something from the Site
• Payment card details, which are handled by our payment provider. We do not store your full card number.
• Purchase history and subscription status
• Support requests, survey responses and feedback
• Your marketing preferences

3. How we use your data, and our legal basis

UK GDPR requires a legal basis for each use of your data. For health data we also rely on your explicit consent.

Where we rely on legitimate interests, we have weighed our interests against your rights. You can object at any time (see Section 13).

6. Who we share your data with

We do not sell your personal data.

6.1 Your coach

• Your assigned coach can see your training history, workouts, health data, wearable data and Assistant AI outputs, to plan and deliver your coaching.
• In a live session, the coach leading it sees real-time heart rate and GPS data only for people booked into that session.
• Coaches cannot download or export your raw session data.
• If you change or remove your coach, the previous coach's access ends immediately.
• Coaches are bound by confidentiality agreements and may use your data only to coach you.

6.2 Service providers

We use the providers below to run the Services. Each acts on our instructions under a contract that includes data protection terms, and may not use your data for its own purposes.

This table lists all the providers that process personal data for us. If we add or change one in a way that affects health, location or biometric data, we will email you before it happens (see Section 19).

6.3 Other cases

• Legal requirements: when the law, a court order or a regulator requires it, or to protect our rights or the safety of others.
• Business transfers: if OneTrack is sold or merges, under the conditions in Section 18.
• Anonymised data: we may share aggregated statistics that cannot identify you with partners, researchers or the public.

7. International transfers

We store your app data in the UK, on AWS servers in London.

Some providers may process data outside the UK, including in the United States:

• Google, for Assistant AI (Gemini), Firebase and Google Analytics
• Sentry, Wix and ClickUp
• Advertising platforms, if you accept advertising cookies

When data leaves the UK, we make sure it is protected by an approved safeguard. This is either a UK adequacy decision (including the UK-US Data Bridge), or the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. You can ask us for details.

Apps you connect yourself, such as Garmin Connect or Strava, handle your data under their own privacy policies, which may involve transfers outside the UK.

8. Live sessions

8.1 What your coach sees

During a live workout, your heart rate streams from your wearable and your GPS location, route and pace stream from your phone. Only the coach leading the session sees this data. Your coach may mention your first name or general location to encourage you, for example "great effort on that climb, Sarah".

8.2 Group sessions

• Other participants can see your first name and hear you when you are unmuted.
• They cannot see your heart rate, pace, distance or location.
• You join muted with your camera off, and choose when to unmute or turn your camera on.

8.3 Your controls

• Stop heart rate streaming at any time by disconnecting Bluetooth or removing your wearable.
• End the session at any time.
• Outdoor sessions need GPS so your coach can guide you, so turning GPS off ends the session. Indoor workout modes don't need GPS.

8.4 Recordings

We do not record live sessions. If we ever introduce recording, we will ask for your explicit consent first. You will be able to take part without being recorded, and recordings will be encrypted and deleted after 30 days.

10. Marketing emails

We send marketing emails only if you tick the box to receive them, when you sign up or later in Settings > Notifications. They include:

• Weekly newsletter: running tips, community stories and product updates
• Promotional emails: offers, discounts and new features
• Training tips: coaching insights and workout ideas

You can unsubscribe at any time by clicking "unsubscribe" in any marketing email, changing Settings > Notifications, or emailing hello@onetrack.club. Marketing preferences are currently a single choice. If you only want some types, email us and we will adjust them for you.

We will still send service messages you need, such as session reminders, payment receipts and account or policy notices. Please keep your email address up to date so you receive them.

11. How long we keep your data

We keep personal data only as long as we need it to provide the Services, or as long as the law requires.

11.1 When you delete your account

• Immediately: your account is deactivated and can no longer be accessed.
• Within 7 days: your data is removed from our live systems.
• Within 45 days: your data is removed from all backups, which are encrypted and kept only for disaster recovery.

11.2 Disconnecting a wearable

When you disconnect a wearable platform, we stop importing new data straight away and the platform will no longer list OneTrack as connected. Data already imported stays in your account until you delete it or your account. You can ask us to delete it sooner by emailing hello@onetrack.club.

11.3 Keeping data longer

We keep data beyond these periods only when we must, for example to meet a legal obligation or court order, to deal with a legal claim, or to prevent fraud. We then keep only the minimum needed and delete it once the reason ends.

11.4 Anonymised data

We may turn data we no longer need into anonymised, aggregated statistics, for example to improve route recommendations, coaching methods and sports science research. We remove names, emails, precise timestamps and specific routes, so the statistics cannot identify you.

12. Security

12.1 How we protect your data

• Encryption in transit: HTTPS/TLS for all connections, encrypted WebRTC for live audio and video, and VPN for admin access
• Encryption at rest: AES-256 for data, databases and backups on AWS
• Application security: bcrypt password hashing, signed JWT tokens, salted and hashed authentication tokens, and encrypted API keys
• Two-factor authentication for every staff account with access to production systems or user data
• Automated monitoring and vulnerability scanning, with critical vulnerabilities patched within 24 to 48 hours
• Regular security reviews of our providers and integrations

12.2 Who at OneTrack can see your data

Everyone with access signs a confidentiality agreement, completes data protection training and has background checks. All access is logged.

12.3 Account Assistance Mode

If you ask for help and agree to it, an authorised support person can temporarily view your account as you see it, to fix the issue. You are told when this starts and ends. Sessions are time-limited and every action is logged.

12.4 If something goes wrong

No system is completely secure, so we cannot guarantee absolute security. If a breach puts your rights at risk, we will:

• Report it to the ICO within 72 hours of becoming aware of it
• Tell you without undue delay, by email and in the app, and by SMS for high-risk breaches
• Explain what happened, what data was affected, what we are doing about it, and how to protect yourself

13. Your rights and controls

13.1 Your rights

Under UK GDPR you have the right to:

• Access: get a copy of the personal data we hold about you
• Rectification: correct inaccurate data, in your account settings or by contacting us
• Erasure: ask us to delete your data, or delete your account in your settings
• Restriction: ask us to limit how we use your data
• Portability: download your data in a machine-readable format from your account settings
• Object: object to uses based on legitimate interests, and to direct marketing at any time
• Withdraw consent: for health data, Assistant AI, wearable connections, cookies or marketing, at any time
• Complain: to the ICO at ico.org.uk

These rights apply to every OneTrack user, wherever you live. To use them, email hello@onetrack.club. We will reply within one month, and we aim to acknowledge data protection questions within 72 hours.

13.2 Private by default

• Your profile is private.
• Your workout history, routes and performance data are visible only to you and your coach.
• No other user can see your activity unless you change your settings.

13.3 Controls in the app

• Withdraw health data consent and Assistant AI consent in your Profile
• Turn off heart rate streaming, or GPS tracking and route recording
• Disconnect wearables and other connected apps
• Delete workout history, including imported data and summaries
• Delete specific routes or location history (coming soon)
• Opt out of analytics and advertising cookies
• Change your marketing preferences

14. Children and young athletes

The Services are not for children under 13, and we do not knowingly collect their data. If we learn that a child under 13 has an account, we will close it and delete their data within 7 days.

Athletes aged 13 to 17 can be coached only with the consent of a parent or guardian, who also gives the health data consent on their behalf. For athletes under 18:

• Assistant AI is not available, in either form
• A parent or guardian can ask us to access, correct or delete the athlete's data at any time

If you are a parent or guardian and think your child has given us data without your consent, email hello@onetrack.club straight away.

15. Wearables and third-party apps

15.1 Wearable platforms

We connect to wearable platforms through Terra, which reads your data on our behalf and may not use it for anything else. When you connect a platform, you are subject to both our policy and that platform's terms, and the platform may record that OneTrack has access.

Wearable platforms only allow all-or-nothing access, so you cannot choose individual data types to share. The only data OneTrack needs for live workouts is real-time heart rate over Bluetooth. Connecting a wearable cloud platform is optional, but it lets your coach personalise your plan.

You can revoke access at any time:

• In your OneTrack app settings
• In the platform's connected apps page, for example Garmin Connect > Settings > Connected Apps
• By emailing hello@onetrack.club

15.2 Strava, TrainingPeaks and similar apps

If you connect these apps, we may send them your completed workouts (date, time, distance, duration, type), pace and heart rate. The integration decides what is shared, so this can't be customised. When you disconnect, sharing stops straight away, but data already sent is covered by that app's own privacy policy. You may also need to remove OneTrack in the other app's settings.

15.3 Links to other sites

The Services may link to other websites and apps. We are not responsible for their privacy practices, so please read their policies before sharing data with them.

16. Not a medical service

OneTrack is a fitness coaching service, not a medical service or device, and our coaches are not medical professionals. Heart rate, GPS and other device data may be inaccurate and should not be used for medical purposes. Neither our coaches nor Assistant AI diagnose conditions or give medical treatment.

If you have a medical emergency during a workout, stop, call 999 (or your local emergency number) and get medical help. Our Terms and Conditions set out our full health and safety terms.

17. AI used to build our software, and Google API data

17.1 AI in our code repository

We may use AI development tools, such as coding assistants and automated code review, in our GitHub repository to help write, review and test our software. This is separate from Assistant AI. AI used in our GitHub repository will not be used to develop, improve or train generalised artificial intelligence (AI) or machine learning (ML) models. We do not use personal data, including information received from Google APIs, for this purpose.

17.2 Google API Services User Data Policy

OneTrack's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. This means we:

• Use Google user data only to provide or improve features you can see in the OneTrack app
• Transfer it to others only to provide those features, to comply with the law, or as part of a merger or sale with notice to you
• Never use it for advertising
• Don't let people read it unless you agree, it is needed for security or the law, or it is aggregated and anonymised for internal operations
• Never use it to develop, improve or train generalised AI or ML models

18. If OneTrack is sold or closes

18.1 Sale or merger

We will transfer your data to a buyer only if they will continue the OneTrack service for existing users and agree to this policy or equal protections. We will:

• Email you at least 30 days before the transfer, naming the buyer and linking to their privacy policy
• Explain how the transfer affects your data
• Let you delete your account and data before it happens
• Require the buyer to keep this policy in place for at least 90 days after the transfer

18.2 Closing down

If OneTrack stops operating, we will give you at least 90 days' notice so you can download your data, then delete all user data within 30 days of closing. We will not sell user data.

19. Changes to this policy

When we update this policy, we change the "Last updated" date at the top. For material changes we will:

• Email you at least 14 days before they take effect, unless the law requires a change sooner
• Show a notice in the app
• Give a plain-language summary of what changed and which sections
• Ask for your consent again where a change needs it, for example a new use of your health data

Previous versions are available on request from hello@onetrack.club.

20. Contact us

For questions, requests or complaints about your data, including for our Data Protection Officer:

• Email: hello@onetrack.club
• Post: Data Protection Officer, Corriamo Ltd (t/a OneTrack Club), A And L, Suite 1-3 Hop Exchange, 24 Southwark Street, London, England, SE1 1TY, United Kingdom

You can also complain to the Information Commissioner's Office at ico.org.uk.