Privacy & GDPR

1. Data controller

Léo Nourrisson, sole trader (SIRET 919 727 255 00029), publisher of unbrokn.fit and the Unbrokn app.

Address: BAT H - 2ND - H205, 20 rue Lucie Aubrac, 44800 Saint-Herblain, France.

Contact: contact@unbrokn.fit. Website: unbrokn.fit

Your coach's role: Unbrokn and your coach are separate data controllers. Unbrokn is responsible for running the Platform (your account, hosting, security, payments and the processing described in this policy). Your coach is responsible for how they use your data to coach you: they choose the content of your program and the information they ask you for (questionnaires, check-ins), and access your data only for this coaching. You can exercise your rights with them or with us; a request about their coaching that reaches us is forwarded to them.

2. Data collected

Depending on how you use Unbrokn (visitor, athlete or coach), we process the following data:

• Account information: first name, last name, email address, password (stored hashed), profile picture, language, time zone, display and unit preferences
• Athlete profile data: date of birth, height, weight, target weight, resting and maximum heart rate (heart rate zones)
• Training data: scores, personal records, session history and duration, session notes, photos and videos of your performances, competition results
• Health and wellbeing data (within the meaning of Article 9 GDPR): reported injuries and affected body areas, pain, mood, perceived exertion (RPE), sleep, stress, energy, body measurements, progress photos, answers to the check-ins configured by your coach, answers to the intake questionnaire of an individual program (history, injuries, nutrition), and the indicators computed from this data (training load, readiness, wellbeing). These indicators support your coach and never produce any automated decision about you.
• Health data synced from Apple Health or Health Connect, if you enable this connection from your profile: daily steps, active calories, activity sessions (duration, average heart rate), weight, sleep and resting heart rate. This sync is optional and based on your explicit consent. This data is visible to your coach as part of your coaching and is never used for advertising purposes. You can disconnect the sync at any time from your profile and choose, at the same time, to immediately delete the data already synced.
• Menstrual cycle tracking, if you enable this feature from your profile: the start date of your period, your average cycle length and your period length. This data falls under Article 9 GDPR and is only stored after your explicit consent, collected when you enable the feature. The cycle phase derived from it is visible to your coach only if you additionally enable sharing with your coach; they then see the current phase and the day of the cycle only, never your dates nor your history. You can disable tracking and delete all of this data in one click, at any time, from your profile. These estimates are neither medical advice nor a contraceptive method.
• Coach and space data: space presentation, logo, banner, diplomas and supporting documents, team members, programs, external links, Stripe Connect account identifier
• Payment data: processed by Stripe. We never store your full card number or security code, only the card type, its last 4 digits and the history of your subscriptions and payments
• Messages exchanged with your coach: text, images, voice messages and their automatic transcription
• Push notification tokens and device type
• Connection and security logs: IP address, browser or device type (user-agent), date, approximate city and country derived from the IP address. This geolocation is computed on our own servers, without any transfer to a third party.
• Usage data: pages viewed, interactions, technical errors and loading performance, session recordings (only with your consent, see section 9), visit counts of the public pages of spaces and programs (computed from a hash of the IP address and browser)
• Prospects: first name, email address and messages sent through the website chat; name, email address, phone number and comment entered when booking a demo; for coaches we contact, name, Instagram account, business email address, city and discipline, taken from public sources

Some data may be provided by your coach: your email address when they invite you or add you to a program, and the data they enter on your behalf (records, competitions, scores and session completion and, only if you have given your health consent, weight, body measurements, mood, effort and injuries). These entries are marked as entered by your coach.

3. Purposes and legal bases

Suspicious account detection relies on objective signals (IP address, device, email domain, approximate city). It never produces an automated decision: a signal only triggers a human review.

4. Health data

Some of the information you may enter in your athlete area is data concerning health within the meaning of Article 9 GDPR: injuries and painful areas, mood, perceived effort and end-of-session note, check-in answers (sleep, stress, fatigue, pain), weight, body measurements, heart rates and progress photos. It is only recorded after your explicit consent (Article 9(2)(a) GDPR), given in a dedicated screen, separate from accepting the terms and conditions, and timestamped. This consent is optional: you may decline it and keep using the application, your sessions and scores still being recorded. You can withdraw it at any time from your profile ("Health tracking" section). Withdrawal prevents any further entry of such data; it does not delete data already recorded, the erasure of which you may request at contact@unbrokn.fit.

When you fill in the sign-up questionnaire of an individual program, your answers, which may contain health information, are only sent to the relevant coach after you have ticked a dedicated consent box, including if you do not have an account. The date of that consent is stored with your request.

Menstrual cycle tracking and the Health sync each rely on a separate consent, collected before they are enabled and revocable from your profile. Menstrual cycle tracking relies on two consents: one to store the data, another to share it with your coach. Withdrawing either takes effect immediately.

This data is used solely for your coaching. It is accessible to your coach and the members of their space. It is never sold, never used for advertising and never sent to our audience-measurement tools. Our technical processors (section 5) host or route it on our behalf, without being allowed to use it for their own purposes.

Unbrokn is a sports coaching tool. It is not a certified health data host (HDS) within the meaning of article L. 1111-8 of the French Public Health Code: the service must not be used to store data collected in the context of prevention, diagnosis or care activities.

5. Recipients of data

Your data is accessible to:

• your coach and the members of their space (profile, training, health and wellbeing, messages);
• other athletes of the same program, for your name, profile picture and the scores you leave visible on the leaderboard;
• the Unbrokn team, only when necessary for support, security or incident resolution;
• the providers below, acting on our behalf (processors) or, where stated, as separate controllers.

We never sell your personal data.

Where data is transferred outside the European Union, the transfer relies on the European Commission adequacy decision of 10 July 2023 (EU-US Data Privacy Framework) for certified providers, or otherwise on the European Commission standard contractual clauses. You can obtain a copy of these safeguards by writing to us.

6. Data retention

• Account, training and health data and messages: for as long as you use your account.
• Inactive accounts: an account with no login for 3 years is deleted, with all its data, after a notice email sent 30 days beforehand; logging in once is enough to keep it. This does not apply to an account with an ongoing subscription or enrollment, a suspended account, the account of a member of a coaching team, the account of a coach whose workspace still has members or athletes, or data needed to handle a dispute. You can also delete your account at any time from the app.
• Moderation: if an account is suspended, we keep the ground, the summary of facts, the date of the decision and the date it was lifted, under our legal obligations (Regulation (EU) 2022/2065) and our legitimate interest in keeping the Platform safe. The record of the decision and of its lifting is kept for 6 years (the general limitation period, plus one year).
• Renewal notices: we use your email address and your subscription data (program, term, price) to send you the information required by article L. 215-1 of the French Consumer Code, and keep the date of that notice as evidence.
• Account deletion: your data is erased immediately from our live database, including your health data, media and direct conversations. It then disappears from our encrypted backups as they rotate, at the latest 2 years after deletion. A backup is only used in case of incident and never restores a deleted account.
• Menstrual cycle tracking: permanently deleted as soon as you disable the feature. Apple Health or Health Connect data: deleted immediately if you choose so when disconnecting.
• Billing data: 10 years, under our accounting obligations (article L. 123-22 of the French Commercial Code).
• Connection logs: 12 months. The IP address and approximate city of sign-up and last login are kept with your account.
• Prospects (website chat, demo requests, coaches contacted): 3 years from your last contact with us, or until you object if earlier.
• Cookie choices: 6 months. Audience-measurement data: 25 months at most.
• Visit statistics of public pages: kept as a non-reversible hash.
• Data needed to handle a dispute: for the applicable statutory limitation periods.

7. Your rights

In accordance with the GDPR, you have the following rights:

• Right of access to your data
• Right to rectification
• Right to erasure
• Right to data portability
• Right to object
• Right to restriction of processing
• Right to lodge a complaint with the CNIL (the French data protection authority, www.cnil.fr)

You may also withdraw your consent at any time, without affecting processing already carried out, object at any time to marketing by replying to the email received or writing to us, and set instructions on what happens to your data after your death (article 85 of the French Data Protection Act). You can delete your account yourself from your profile (athlete) or your settings (coach). To exercise your rights, write to contact@unbrokn.fit. We reply within one month, which may be extended by two months for a complex request, and may ask you to prove your identity if we have reasonable doubts. You may also lodge a complaint with the CNIL (www.cnil.fr).

8. Security

We implement appropriate technical and organisational measures to protect your data: SSL/TLS encryption, password hashing, available two-factor authentication, encrypted backups, access to data limited to what is strictly necessary.

9. Cookies

We use cookies that are strictly necessary for the service (session, authentication, security, remembering your choices), which do not require your consent. Audience measurement and session recording tools (PostHog, hosted in the EU) and advertising measurement tools (Google Tag Manager, Google Ads, Meta pixel) are only activated with your consent, collected through our cookie banner on the website and, in the app, through a prompt from your device. You can change your choice at any time through the Cookies link at the bottom of the website pages, through "Manage my cookies" in your profile or settings, or through the button below. Details are in our cookie policy.

10. Minimum age

Unbrokn is reserved for people aged 18 or over, in line with our terms and conditions. We do not knowingly collect data about minors. If you notice that a minor has created an account, write to us at contact@unbrokn.fit and we will delete it.

11. Contact

For any questions regarding this policy, contact us:

contact@unbrokn.fit

Note: this English version is provided for information purposes. The French version is the legally binding text.