The short version.
AIDSTATION provides AI-driven coaching for endurance and multi-sport athletes. To do that, we collect information about your training, your goals, and (with your separate permission) your health and biometric data. We use this information to generate your training plans and to operate the service.
A few things we want to be clear about up front:
- We do not sell your data, share it with advertisers, or send it to third-party AI providers for them to train their foundation models. We do use your training content to develop and improve our own AI coaching system — details in section 4. We do not train AI models on it; we work out group statistics from it, and you can take yourself back out of those.
- Sensitive data — heart rate, sleep, body composition, injury history, and similar — is only collected with your explicit, separate opt-in, and these settings default to off.
- You can access, correct, export, or delete your data at any time from within the app.
- We do not collect or process pregnancy, menstrual cycle, gender identity, or genetic data. Our AI is instructed to refuse coaching on pregnancy-related topics.
- Your training plans are generated by AI. We describe how this works in section 4.
This summary is for orientation only. The full terms below govern the relationship.
Who we are.
AIDSTATION Pro, LLC, a Texas limited liability company ("AIDSTATION," "we," "us," "our"), is the data controller for personal data processed through the AIDSTATION application and website.
Privacy contact: help@aidstation.pro
Postal address: AIDSTATION Pro, LLC, 509 Williams Avenue, Cleburne, TX 76033, United States
Website: www.aidstation.pro
Regional representatives (where applicable)
- EU Representative: [TBD]
- UK Representative: [TBD]
- South Africa Information Officer: [TBD]
If your country has a data protection authority, you have the right to lodge a complaint with them. We hope you will contact us first so we can address your concern directly.
The data we collect.
2.1 Account and profile data
We collect this when you create an account and use the service:
- Name, email address, hashed password
- Date of birth and biological sex (used for training calculations)
- Country and time zone
- Training history, goals, race targets, and discipline preferences
- Equipment you have access to and training locations you use
- Information you submit about gyms or training areas you contribute to our facility database
2.2 Activity data
This is the standard training data the service is built around:
- Workouts you log or sync from connected devices
- Pace, speed, cadence, distance, duration, elevation gain, power output
- Training volume, frequency, and adherence to your plan
- Subjective ratings (perceived exertion, fatigue, soreness)
2.3 Sensitive data (explicit opt-in required)
The following categories are sensitive under most privacy laws. We do not collect any of them unless you turn sensitive-data collection on, and it is off until you do:
- Heart rate and heart rate variability (HRV)
- Sleep duration and quality
- Weight, body composition, and body fat percentage
- VO2 max and other derived health metrics
- Resting and exercise blood pressure (if you choose to record)
- Injury history and rehabilitation status
- Medical conditions that affect training
- Precise physical address
- GPS route data from activities
You turn it on by the act of connecting a device or health provider, or by entering one of these values yourself; we record that as your consent at the moment it happens, and you can see and withdraw it in Account → Privacy. Withdrawing it disconnects your providers and stops new collection of every category in this list — it is one setting covering the list, not nine separate switches. Previously collected data is handled per the rules in section 7.
Using your sensitive data to improve our coaching, or sharing it with a research partner, each require their own separate permission on top of this one; neither is implied by turning collection on.
2.4 Communications with us
- Messages and prompts you send to the AI coach
- Support tickets, feedback, and survey responses
2.5 Device and technical data
- IP address, device type, operating system, app version
- Diagnostic logs and crash reports
- Cookies and similar technologies (see section 12 and our Cookie Policy)
2.6 Payment data
Subscriptions are sold by Polar (polar.sh), our merchant of record. Polar is the seller of your subscription, not a processor acting only on our behalf: it takes your payment, issues your receipt, and is responsible for sales tax and VAT in your country. Your card details go to Polar and stay there — AIDSTATION never receives or stores full card numbers. We retain transaction confirmation, the last four digits, billing country, and subscription status. See Partners.
2.7 What we do not collect
- Pregnancy status or pregnancy-related information
- Menstrual cycle data
- Gender identity (we collect biological sex only, for training calculations)
- Genetic or genomic data
- Information used to assess insurability or employability
Our AI coaching system is instructed to refuse engagement on pregnancy-related coaching and to direct you to qualified medical providers for those questions.
How we use it.
We use data for the following purposes, on the following legal bases (where applicable):
For users in jurisdictions that do not use the GDPR legal basis framework, we process data as necessary to provide the service you have requested, with separate consent for sensitive data and for any secondary uses.
How AI coaching works.
AIDSTATION uses artificial intelligence to generate training plans, exercise recommendations, nutritional guidance, and other coaching outputs. We want you to understand this clearly:
- Your training plan is generated by an AI system that draws on your profile, training history, goals, sport rules, exercise libraries, and (if you have enabled it) sensitive data such as heart rate and sleep.
- The AI runs as a multi-layer process. Different layers handle race classification, athlete evaluation, plan generation, and validation. The system is designed to update plans when your situation changes (new performance data, an injury, a travel period).
- Outputs are generated automatically. We retain the parsed coaching notes derived from your interactions. We do not retain raw conversation transcripts.
- AI inference for live coaching outputs is currently performed by Anthropic under their commercial terms. Anthropic does not use your data to train their foundation models.
- By default, AIDSTATION uses your training content and parsed coaching notes to develop, evaluate, and refine our own AI coaching systems, including our own prompts, retrieval systems, and datasets. This use is on by default; you can opt out at any time (see section 9). Where sensitive categories (as listed in section 2.3) are involved, we de-identify or aggregate inputs before they leave the production environment and we do not include sensitive categories in training without the same opt-ins that govern their collection. The license under which we use Your Content for these purposes is set out in section 8.2 of our Terms and Conditions.
- We do not train AI models on your data. What we build from it is a set of group statistics — figures worked out across many athletes, and only released where the group behind them is large enough to clear our suppression thresholds — which the coaching system cites when it writes your plan. These statistics are not anonymous data and we do not describe them as anonymous: we treat them as still relating to you, and this Policy continues to apply to them.
- You can object to this use under the right to object described in section 9. Because these are statistics rather than model weights, they can be recalculated without you: opting out stops future use from that moment and removes you from the statistics already derived from your data at the next recalculation. Deleting your account runs that recalculation as part of the erasure itself, rather than waiting for the next scheduled one. Where sensitive categories are involved, you can also exercise the right to limit use of sensitive personal information (where applicable).
This is automated processing. Under EU and UK data protection law (Article 22 GDPR), you have rights regarding decisions made solely by automated means that produce legal or similarly significant effects. Coaching recommendations are advisory; they do not produce such effects, and you are free to follow, modify, or ignore them. If you would prefer not to use AI features, you can disable them in account settings.
AI does not provide medical advice. Coaching outputs are not a substitute for consultation with qualified medical providers. Discuss any health concerns with your physician before acting on training recommendations.
Exceptions to raw transcript retention. We retain raw conversation excerpts in only two limited cases. First, when you submit a conversation as part of a safety report through our in-app reporting flow, the excerpts you choose to submit are retained as part of your report, are visible only to personnel handling safety reports, and can be deleted on request under your rights in section 9. Second, during the investigation of a confirmed safety incident, short-term forward-looking capture may be enabled for the duration of that investigation; affected users are notified through an in-app banner while it is active, capture is never retroactive, and it ends when the investigation closes. We do not capture conversations in the background during normal operation.
Where your data lives.
AIDSTATION is operated from the United States, and data is stored on servers located in the United States.
If you access AIDSTATION from outside the United States, your data is transferred to, stored in, and processed in the United States, which may not have data protection laws equivalent to those in your country.
For users in the European Economic Area, the United Kingdom, and Switzerland, we rely on Standard Contractual Clauses approved by the European Commission (and the UK addendum for UK users) as the legal mechanism for transfers. We conduct Transfer Impact Assessments and apply supplementary measures where required.
You can request a copy of the Standard Contractual Clauses applicable to your data by contacting help@aidstation.pro.
Retention & deletion.
Active accounts
While your account is active, we retain your data to provide the service.
Inactive accounts
- After 18 months of inactivity, we will notify you and give you the option to keep your account active.
- After 24 months of inactivity with no response, your account is de-identified: personal identifiers such as your name, email, contact details, and account credentials are removed, and your remaining training history is decoupled from your identity. The decoupled data is retained in pseudonymized form, and any genuinely aggregated data in aggregated form, for product improvement and research.
Deletion requests
- You can delete your account at any time from the app (Account → Privacy → Delete Account).
- You can delete your account at any time: see https://app.aidstation.pro/account-deletion for the steps and what is deleted and kept.
- When you request deletion, your account is marked for deletion and you have 14 days to change your mind by logging back in.
- If you don't cancel, your personal data is erased from our active systems and the process completes within 30 days of your request — the maximum period allowed under GDPR Article 12(3). For unusually complex requests we may extend this by up to two further months, and we will tell you if we do.
- Data in routine backups is purged within 90 days as those backups roll over; backups are not selectively edited, and if a backup is ever restored, your deletion is re-applied.
- We may retain limited information where required by law (e.g., tax records, fraud prevention).
Billing records after deletion
If you have ever paid for a subscription, deleting your account does not delete the record of that payment.
Subscriptions are sold by Polar, our merchant of record (see Partners). Polar is the seller and is required by tax law to keep records of the sale — typically for around seven years, depending on the country. Those records include your name, billing address and country, the amount, and the date. They are kept by Polar under its own privacy policy and are not something we can delete on your behalf. Requesting deletion also stops your subscription from renewing, so you are not billed for a period you will never use.
On our side we keep only the minimum needed to match a payment to an account for accounting and dispute purposes, and no card details at any point.
This is a legal obligation rather than a choice, and it is the largest thing "delete my account" cannot cover. The others are the request record described immediately below, copyright notice records, irreversibly aggregated data, and a tombstone row that records that an account existed and was deleted without identifying whose it was. Everything else described in this section is erased on the schedule above.
The record of your request
Where you make a data-rights request to us — by email, or through an authorized agent, rather than by using the self-service controls in the app — we keep a minimal record of it for six years, including where the request was to delete the account. That record holds the email address the request was made about, who made it, what was asked for, and how we handled it. Where someone acted on your behalf as an authorized agent, we also keep the fact of that authorization and its basic details: the document type, the signer's name, the date, what it covered, and whether we accepted it.
It is kept because we are required to be able to show that requests were handled correctly, and because a record that cannot say whose request it was proves nothing. We rely on the legal-obligation and legal-claims exemptions to erasure for it, and we keep nothing in it beyond what is needed to answer the question "was this request handled properly?".
Raw AI conversations
We do not retain raw conversation transcripts in normal operation. Only parsed coaching notes and structured outputs derived from your interactions are stored. We retain raw excerpts only when you explicitly submit them through a safety report, or temporarily during the investigation of a confirmed safety incident, in each case as described in section 4.
Aggregated and de-identified data
Data that has been irreversibly aggregated — combined across users so that it can no longer be linked to you — may be retained indefinitely, and once data reaches that state it is no longer personal data under applicable privacy laws. Pseudonymized data, including data left after an inactive account is de-identified, may still in principle be linked to you and therefore remains personal data; we continue to apply this Policy to it.
AI coaching systems and derived statistics
We do not train AI models on your data. What we build from it is a set of group statistics — figures worked out across many athletes, and only released where the group behind them clears our suppression thresholds — which our coaching system cites when it writes your plan. We treat these as pseudonymized rather than anonymous, and this Policy continues to apply to them.
Because these are statistics rather than model weights, they can be recalculated without you. If you opt out of this use, we stop using your data from that moment and remove you from the statistics already derived from it at the next recalculation. If you delete your account, the recalculation runs as part of the deletion itself — that is, once the 14-day window described above has passed and the erasure runs, rather than at the next scheduled recalculation. This is a stronger position than "we stop using it going forward", and it is the behaviour we build to.
Prompts, retrieval indexes and datasets that cite those statistics continue to operate; they hold generalized findings, not identifiable copies of your data. We take reasonable technical measures to prevent memorization and identifiability in outputs.
Where we use a general-purpose AI model built and trained by a third party, we cannot reach inside that model. We do not send your data to be used as training material for such a model. Our current inference provider, Anthropic, does not train its foundation models on your data under the commercial terms we use (see section 4); we require the same commitment from any AI provider we add. See section 8.2 of our Terms and Conditions for the license under which Your Content is used for these purposes.
Copyright notices
If you submit a DMCA notice or counter-notification about content on the service, we retain the notice, our records of action, and related correspondence as needed to comply with U.S. copyright safe-harbor requirements and to defend against potential copyright claims. Where content has been removed in response to a DMCA notice, it remains removed independent of any deletion or opt-out you exercise; restoration occurs only through a successful counter-notification. Our DMCA process and the Designated Agent contact are at aidstation.pro/dmca.
How we protect this.
We implement technical and organizational measures to protect your data, including:
- Encryption in transit (TLS) and at rest
- Authentication, role-based access controls, and least-privilege access for our personnel
- Logging and monitoring of access to personal data
- Regular review of security practices
- Vendor due diligence on service providers
No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you and the relevant regulatory authority within the longest period permitted under applicable law in your jurisdiction, and sooner where required.
Your rights.
You have rights with respect to your personal data. The specific rights available to you depend on where you live, but the following rights are available to all AIDSTATION users:
- Access: Receive a copy of the personal data we hold about you.
- Correction: Correct inaccurate or incomplete data.
- Deletion: Delete your account and personal data (self-service in the app).
- Portability: Export your data. We provide tabular training data in CSV format and other stored data in an appropriate machine-readable format. We export only data we actually store; raw AI conversations are not retained in normal operation and are not part of exports, with the two narrow exceptions described in sections 4 and 7. A finished export archive is the most complete copy of your data that exists anywhere in our systems, so we keep it for seven days from the moment it is ready and then delete it. It is never sent to you as a link in an email; you download it from inside your logged-in account.
- Restriction: Limit certain processing in defined cases.
- Objection: Object to processing based on our legitimate interests, including the use of your data to develop and improve our own AI coaching systems. You can object via account settings or by contacting us; objection stops new use of your data for the objected-to purpose. Objection is not limited to future use: statistical outputs derived from your data are recomputed without it — at the next scheduled recomputation when you opt out, and as part of the erasure itself when you delete your account (see section 7). Any trained model already produced by a third party may continue to operate as described in section 7.
- Withdraw consent: Where processing is based on consent, withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
- Complain: Lodge a complaint with your local data protection authority.
9.1 How to exercise your rights
- In-app: Account → Privacy → Manage Data
- Email: help@aidstation.pro
We respond to requests within 30 days. Complex requests may be extended by up to an additional 60 days with notice to you.
9.2 Verification
We verify the identity of anyone making a request to protect your data. For most requests, this means confirming the request from your registered email address. For deletion or other sensitive requests, we may ask for additional verification.
9.3 Authorized agents (California and similar laws)
You can authorize an agent to make requests on your behalf. We require written authorization signed by you and direct confirmation from you that the agent is acting at your direction. We may verify the agent's identity.
9.4 Non-discrimination
We will not discriminate against you for exercising your privacy rights. Service, pricing, and features will not change based on whether you exercise these rights.
Privacy by default.
We design AIDSTATION so that the most privacy-protective settings are the defaults. In particular:
- Sensitive data collection (heart rate, sleep, body composition, GPS routes, and the other categories listed in section 2.3) is off by default, and stays off until you connect a provider or enter one of those values yourself.
- Using your sensitive data to improve our coaching, and sharing it with a research partner, are two further permissions, each separate from collection and from each other. Neither is on by default.
- Marketing communications require separate opt-in.
- Research participation can be turned off at any time in settings.
- Team plan visibility is limited to your training plan only; other personal data is never shared with teammates.
Children.
AIDSTATION is intended for users 16 years of age or older. We do not knowingly collect or process personal data from anyone under 16.
If you believe a person under 16 has provided us with personal data, please contact help@aidstation.pro and we will remove the information.
Cookies and tracking.
AIDSTATION uses cookies and similar technologies on our website and within the app. We use two categories:
- Strictly necessary cookies: Required for the service to function (authentication, security). These do not require consent.
- Analytics cookies: Help us understand how users interact with the service so we can improve it. These require your consent where applicable.
We do not use advertising or marketing cookies.
We honor Global Privacy Control (GPC) signals from your browser where applicable, treating them as a request to opt out of any data sharing that would qualify as a sale or share under U.S. state privacy laws.
For details, see our Cookie Policy at www.aidstation.pro/cookies.
Marketing communications.
We send marketing communications (newsletters, product announcements, promotional content) only with your separate opt-in consent. You can opt out at any time using the unsubscribe link in any marketing email or by changing your account settings.
Transactional communications (account verification, password reset, billing receipts, security alerts, important service notices) are not subject to marketing opt-out. You will continue to receive these as long as your account is active.
U.S. state-specific disclosures.
14.1 California residents (CCPA / CPRA)
Categories of personal information collected (in the past 12 months):
- Identifiers (name, email, account ID, IP address)
- Customer records (account information)
- Internet or network activity (app usage, device information)
- Geolocation data (general location; precise location only with opt-in)
- Sensory information (none beyond user-input data)
- Professional or employment-related information (none)
- Inferences (training preferences, performance trajectory)
- Sensitive personal information: health data, precise location (opt-in), account credentials
Sources of personal information: directly from you, from your connected integrations, automatically from your use of the service.
Categories of recipients: our service providers, integration partners you authorize, research partners with your consent, legal authorities where required.
Purposes: as described in section 3.
Your California rights:
- Right to know what we collect, use, share, and how
- Right to delete personal information
- Right to correct inaccurate information
- Right to opt out of sale or sharing (we do not sell or share)
- Right to limit use of sensitive personal information
- Right to non-discrimination
- Authorized agent submissions
Notice at collection: We collect the categories listed above for the purposes described in this policy. We retain data per section 7. We do not sell or share personal information.
14.2 Other U.S. states
Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Iowa, Tennessee, Indiana, Delaware, New Hampshire, New Jersey, Kentucky, Maryland, Minnesota, Nebraska, Rhode Island, and other states with comparable privacy laws have rights including:
- Right to access, correct, and delete personal data
- Right to portability
- Right to opt out of sale, targeted advertising, and certain profiling
- Right to appeal denial of a privacy request
To exercise these rights, contact help@aidstation.pro or use in-app controls. We respond within 30 days (extendable by up to a further two months for complex requests, with notice to you), consistent with our response-time commitment in section 9.1. We honor Global Privacy Control signals from your browser.
Regional information.
15.1 European Economic Area and United Kingdom (GDPR / UK GDPR)
- Legal bases for processing are listed in section 3.
- You have the right to lodge a complaint with your supervisory authority. Find yours at edpb.europa.eu or, in the UK, with the ICO at ico.org.uk.
- Our EU and UK representatives will be listed in section 1 when appointed.
15.2 Canada (PIPEDA, Quebec Law 25, and provincial laws)
- We follow PIPEDA principles and the additional requirements of Quebec Law 25, including privacy by default and information about automated decisions.
- You can complain to the Office of the Privacy Commissioner of Canada or to the Commission d'accès à l'information du Québec.
15.3 Australia (Privacy Act 1988 and Australian Privacy Principles)
- We handle personal information consistent with the Australian Privacy Principles.
- Complaints: Office of the Australian Information Commissioner at oaic.gov.au.
15.4 New Zealand (Privacy Act 2020)
- We handle personal information consistent with the New Zealand Privacy Act 2020.
- Complaints: Office of the Privacy Commissioner at privacy.org.nz.
15.5 South Africa (POPIA)
- Our Information Officer will be listed in section 1 when appointed.
- Complaints: Information Regulator at inforegulator.org.za.
Changes to this policy.
We may update this policy from time to time. When we make material changes, we will:
- Notify you in the app and by email at least 30 days before the changes take effect
- Update the "Last updated" date at the top
- Where required by law, request your renewed consent
If you do not agree with the updated policy, you can delete your account before the changes take effect.
Contact us.
For privacy questions, requests, or complaints:
- Email: help@aidstation.pro
- Postal: AIDSTATION Pro, LLC, 509 Williams Avenue, Cleburne, TX 76033, United States
- In-app: Account → Privacy → Contact Us
If you have a complaint we have not resolved, you can contact the data protection authority in your country (see section 15).