Privacy in the WEARCOACH app

What the app does not do

• It has no account and no sign-up.
• It does not send what you record about yourself or your athletes to us or to anyone else. The app has no server of its own for it.
• It has no analytics and no advertising, and it does not follow you across other apps.
• It does not ask for your contacts, your location, your photos, your camera or your microphone. The one permission it asks for is to show notifications, and only if you turn on the daily reminder.
• It does not read health data from your device or from other apps.

The app is made for coaches. It is not meant to be used by children.

What stays on your device

The app keeps what you enter in its own storage, on the phone or tablet you are using:

• each athlete you add: a name or nickname, and the day you confirmed that consent is in place,
• the sessions you log, for yourself and for your athletes: the day, the duration, the RPE and your note,
• the morning checks: the day, hours slept, the five wellness ratings, morning HRV if you enter it, whether symptoms were reported, and your note,
• for each athlete, the day you started the baseline again, if you did,
• your rules: the inputs you read, their thresholds, the flag a crossed threshold raises, the action for each flag and who is involved,
• the units of the 30-day path you have marked as done, whether the reminder is on and its time, the language you chose for the programme’s pages, the minutes you last entered, and whether you have seen the welcome screens,
• for Community: that you accepted the forum’s rules, and a random number the app created for this installation (see Community, below).

The app uses this only to work for you and to show you your own numbers. Apart from the random number, which goes with a comment you write, none of it is sent to us. We cannot see it, and we cannot bring it back if it is lost. It stays until you delete it or remove the app.

The app has no lock and no encryption of its own: it relies on the lock of your device. Anyone who can open your device can open the app. Keep it locked.

Your athletes’ data

What you record about an athlete, such as sleep, wellness, HRV and symptoms, is health data. You decide what you record. You, or your club, are responsible for it under the data protection rules of your country.

• Record an athlete’s data only when the athlete knows what you record and agrees to it.
• For an athlete under 16, a parent or guardian must agree as well, and the young athlete should hear, in words that fit their age, what you record. That is the programme’s rule. The law of your country may set a different age: check it.
• The programme has a consent statement you can use, Template A1. Have it checked against the law of your country.
• The app asks you to confirm that consent is in place before you add an athlete, and it keeps the day you confirmed. It does not ask the athlete’s age, and it does not keep the consent itself. Keep the signed statement with your club’s records.
• A nickname or initials are enough. The app does not need an athlete’s full name.
• Write in a note only what you need.
• An athlete can ask to see what you have recorded about them: show them their page in Athletes.
• If an athlete, or a parent or guardian, withdraws their agreement, remove the athlete. Their sessions and morning checks are deleted with them. Note the request in your club’s records, and delete any exported file that still holds the athlete.

Copies of your data

Export. “Export my data” writes your entries, your rules and your place in the 30-day path into one file and hands it to your device: you choose where it goes. The random number and your acceptance of the forum’s rules stay out of it. The file is not protected by a password: anyone who has it can read it. Keep it, and send it, only where you would keep your athletes’ records. An athlete you remove later is still in a file you exported earlier.

The app removes its temporary copy of the file when the device’s share window closes. If the app is closed first, the copy can stay in the app’s temporary storage until you use “Delete all data” or the device clears it.

Import. “Import data” replaces what is on the device with what is in the file, your rules too. The app asks you before anything changes.

Backups of your device. On Android the app is set to stay out of the device’s backup; with some makers’ phones, a transfer from an old phone to a new one can still copy it. On an iPhone or iPad the app’s data can be part of the device’s backup to iCloud or a computer, your athletes’ data included. A backup belongs to your account and follows its rules; we cannot see it. The app keeps no copy for you: if you want one, use “Export my data”.

Deleting

• “Remove athlete” deletes one athlete with all their sessions and morning checks.
• “Delete all data”, under More, deletes everything you have entered in the app, your rules, your place in the path, your acceptance of the forum’s rules, and the answers and progress the programme’s pages keep in the app, with the writers you hid in Community. It also turns the reminder off, clears the app’s temporary files and gives the app a new random number. The pages clear what they keep the next time one of them is opened.
• Removing the app removes its data from the device.

What you delete cannot be brought back, unless you kept an exported file or a backup of your device. Deleting in the app does not change an exported file: delete it where you keep it.

Reminders

If you turn on the daily reminder, your device asks you once whether the app may show notifications. It then shows the reminder at the time you chose. The reminder is set on the device. Nothing is sent from a server.

Pages from the website

Learn, Community, the steps of the 30-day path, the website pages listed under More and the consent statement are pages of the WEARCOACH website, shown inside the app. For these pages the website’s own Privacy page applies:

• Like every website, the server records each request, for example the address of the device (IP address), the page, the time and the browser.
• The app adds “WearcoachApp” to the name of the browser, so that the page can be shown without the website’s menu. The server records it like any other browser name, so visits from the app can be counted apart from visits from a browser. Apart from this, the pages receive what any browser sends.
• What you type into the tools on these pages, and your progress through the modules, is kept by the pages themselves, in the app’s storage on your device, as it would be in a browser. It is not in the file that “Export my data” writes. “Delete all data” removes it, and so does “Delete everything on this device” on the Learn page.
• A video is loaded from Vimeo only after you press “Play video”. The website’s Privacy page says what Vimeo then receives.
• Links to other websites and file downloads leave the app and open in your device’s own browser, under that browser’s rules.

Community

Community is a forum on the WEARCOACH website, shown inside the app. Before your first comment the app asks you to accept the forum’s rules, and it remembers on this device that you did.

When you write a comment, the app sends the topic, your comment and the name you give to the website’s server. The comment, the name and the day are published on the topic’s page, where anyone can read them. The app does not keep the name: you type it each time.

With a comment the app also sends a random number that it created for this installation. The number is not your name, and it says nothing about you or your device. The server does not store the number. Next to your comment it keeps a code made from the number, which cannot be turned back into it. The code goes with the comment to everyone who loads the topic, although the page does not show it. It lets a reader hide all comments from one writer, and lets the project team stop a writer who breaks the rules. Comments written from the same installation carry the same code, so they can be recognised as coming from the same writer, also under different names. You get a new number when you install the app again or use “Delete all data”.

What the server keeps, and how to have a comment removed, is on the website’s Privacy page, under Community.

Do not write an athlete’s name or health data in a comment, or anything that shows who an athlete is.

Who else is involved

The app shares what you record with nobody. Others are involved only when you open pages of the website or get the app:

• The website’s server is in Germany, at the hosting company Hetzner. Mobile Adventure Sp. z o.o. (MOBAD), a company in Poland, runs the server on Wellnist’s behalf. If you download the app’s APK file from the website, this server records the request like any other.
• Vimeo, a video service in the United States, receives a request only after you press “Play video”.
• An app store, if you install the app from one.

How long, and how to have something deleted

• What you record in the app stays on your device until you delete it there. We hold no copy of it, so there is nothing we could delete for you.
• A comment in Community stays for as long as the forum is online. To take it off the page at once, report it. To have it removed for good, write to info@welln.ist.
• The server’s records of requests are kept for 100 days and then deleted.
• An email you send us is kept only as long as it is needed to answer you.

To ask what is held about you, or to have it deleted, write to info@welln.ist.

Who is responsible, and your rights

The app is published by Vidisport OÜ, Estonia, for the WEARCOACH consortium. For technical questions about the app, write to hello@vidisport.net.

Wellnist, the organisation that coordinates WEARCOACH, runs the website and Community. For questions about the project and about your data, write to info@welln.ist. Wellnist’s details are on the Imprint page.

Because the app sends nothing that you record about yourself or your athletes, neither Vidisport nor Wellnist holds any of it. What can be held is what the website holds: the server records and your comments in Community. The website’s Privacy page says what you can ask for and where you can complain.

If you install the app from an app store, that store has its own privacy rules for what it learns about the install. The figures a store reports to a publisher, such as the number of installs, do not name you.