ThresholdXpert Privacy Policy

1. Who we are

ThresholdXpert provides physiological test analysis, athlete management and AI-assisted training guidance for coaches and endurance athletes. The platform is intended for users in the United Kingdom and the European Economic Area.

ThresholdXpert is an enterprise project of the University of Essex. The University of Essex is the controller for the purpose of data protection law in respect of your personal information collected and used when you use the ThresholdXpert platform.

You may raise a data protection matter either through the ThresholdXpert contact form or directly with the University Data Protection Officer. Contacting either route is sufficient. Where a matter concerns the exercise of your legal rights, the ThresholdXpert team will refer it to the Data Protection Officer.

2. What we collect

2.1 Information you give us

• Account details: name, email address, date of birth, sex, height, body mass, sport, country of residence and time zone.
• Training context: goals, target event and date, weekly availability, blocked days, experience level, intensity preference, self-assessed fitness, and your own description of recent training.
• Health information you enter: conditions or limitations recorded in the plan builder, session feedback, fatigue and soreness ratings, and rating of perceived exertion.
• Messages: your conversations with the AI Coach, and notes exchanged with your coach.

2.2 Physiological test data

Files and results from laboratory and field testing, including cardiopulmonary exercise testing (CPET), blood lactate testing and near-infrared spectroscopy (NIRS) muscle oxygenation. These are uploaded by you or by your coach.

2.3 Data from connected services

When you choose to connect a Garmin account, and only after you have authorised it, we receive the data you permit Garmin to share. Depending on the permissions you grant, this may include recorded activities, heart rate, power, pace, distance, elevation and location data associated with those activities, and training-related metrics.

We use the Garmin Activity API and the Garmin Training API. The Training API allows us to send structured training sessions to your Garmin device or account, so that a session created in ThresholdXpert appears on your watch. That transfer contains only the session structure and targets we have generated for you.

You can disconnect Garmin at any time from your profile, or by revoking ThresholdXpert’s access within your Garmin account. Section 7 explains what happens to the data when you do. Garmin’s own handling of your data is governed by Garmin’s privacy policy, not this one.

2.4 Data we derive

We calculate values from the data above, including ventilatory and lactate thresholds, training intensity zones, VO₂max and related estimates, training load, fatigue and recovery indicators, and adherence measures. Section 4.3 explains how derived values are treated, because they are subject to specific commitments.

2.5 Payment information

Subscriptions are processed by Stripe. We receive confirmation of your subscription status and related billing metadata. We do not receive or store your full card details.

2.6 Technical data

Authentication tokens, and security and error logs generated when you use the service. We do not operate advertising or behavioural tracking technologies on the platform.

3. Why we process it, and on what legal basis

You give explicit consent to health data processing when you create your account, upload a test, or connect a device. You can withdraw that consent at any time through Profile, Privacy and data rights, or by contacting us. Withdrawing consent stops further processing of health data and will end most of the platform’s functionality, since the service cannot operate without it. Withdrawal does not affect processing that took place before you withdrew.

• Contract performance: processing needed to deliver the service you signed up for (Art. 6(1)(b)).
• Consent:for health and fitness data (Art. 9(2)(a)), which you provide when you set up your account, upload tests, or connect devices. You can withdraw this consent at any time via Profile → Privacy & data rights or by contacting us.
• Legitimate interests: analytics to improve the platform, security monitoring, and fraud prevention (Art. 6(1)(f)).
• Legal obligation: compliance with applicable laws.

4. Artificial intelligence and external processing

This section sets out the limits we place on where your data can be sent. It is the section referenced in our declarations to connected-device providers.

4.1 Our commitment on connected-device data

Data obtained from the Garmin API is not shared with, transferred to, or processed by any external artificial intelligence provider or third-party AI service.

Raw data received from Garmin, including activity records, heart-rate streams, power and pace data, and location data, is processed only within ThresholdXpert’s own infrastructure by our own deterministic algorithms. It is never transmitted to an external language model or any other external AI or data-processing service.

This is enforced in our software rather than by policy alone. Data carries a record of where it came from, and a single controlled component is the only route by which any data may reach an external model provider. That component rejects any value originating from a connected-device provider. An automated test runs on every change to our software and fails the build if a restricted value could reach an external model.

4.2 Where we do use an external AI provider

We use a large language model supplied by OpenAI to generate conversational responses in the AI Coach and to help structure training plans. Processing takes place outside the United Kingdom and the European Economic Area, and is covered by the safeguards described in section 6. The information sent to that provider is limited to:

• Information you or your coach have entered: your goal, target event and date, availability, experience level, preferences, self-assessed fitness, your own description of your training, and the text of your messages.
• The structure of your training plan: session types, titles, durations, phase labels and zone labels.
• Derived physiological values, as described in section 4.3.

Our agreement with the provider prevents your data being used to train or improve their models. Training plans are also generated by our own deterministic engine, which runs on our infrastructure and involves no external provider.

4.3 Derived metrics

A derived metric is a value our own algorithms calculate. Examples include your ventilatory or lactate thresholds, your training intensity zones, VO₂max estimates, training load, and fatigue or recovery indicators.

Some derived metrics are calculated wholly or partly from data obtained through a connected device such as Garmin. We treat these derived values as our own outputs rather than as connected-device data, and we may provide them to our external AI provider in order to personalise the guidance you receive. To be precise about what this means:

• What may be sent: derived values such as zone boundaries, threshold values, estimated VO₂max, training-load and fatigue indicators, and adherence summaries.
• What is never sent: the underlying data those values were calculated from. Raw activity files, heart-rate and power time series, GPS and location data, and any other record obtained directly from a connected device do not leave our infrastructure and are never provided to an external AI provider.

If you would rather your derived metrics were not provided to an external AI provider, contact us and we will process your account without that step. The AI Coach’s guidance will be less specific as a result.

4.4 Automated decision-making

The platform generates training recommendations automatically, including session structure, intensity targets and adjustments in response to your feedback. These recommendations are guidance, not decisions that produce legal effects or comparably significant effects on you, and you are free to disregard any of them. Where a coach is linked to your account, plans may additionally be subject to their review before activation. You may ask us to explain how a recommendation was reached, ask a person to review it, and object to automated recommendations.

4.5 Safety

The AI Coach is not a medical service and does not provide medical advice or diagnosis. Where a message contains language suggesting a possible medical concern, it is handled by our own safety logic and is not sent to the external AI provider, and you will be advised to seek appropriate medical attention. If you are unwell or injured, consult a qualified clinician.

5. Who we share data with

We do not sell your personal data. We do not share identifiable health data for advertising, and we do not share it with advertisers in any form.

5.1 Our processors

Each processor is bound by a written agreement requiring it to process data only on our instructions and to protect it appropriately.

5.2 Your coach

If you are linked to a coach, that coach can see your profile, test results, analyses, zones, training plan and session feedback. This is the purpose of the coach and athlete relationship, and you control it. You can see who is linked to your account and remove a coach at any time.

If a coach removes you from their roster (or you remove the coach), that action only ends the coach–athlete link. It does not delete, deactivate or otherwise erase your ThresholdXpert account. Your profile and data remain yours; you can continue using the platform as a solo athlete (for example under your own subscription). The coach will no longer be able to see your data after the link is removed.

5.3 Connected services

Where you have connected Garmin and enabled it, we send the structured training sessions we generate for you to your Garmin account through the Training API. We do not send your test files, your derived physiological values, your messages, or any other personal data to Garmin.

5.4 Legal disclosure

We may disclose data where we are required to by law, court order or regulatory authority, or where necessary to protect the safety of a person.

6. International transfers

Your personal data, including your health and physiological data, is stored and processed in the United States.

The platform runs on Amazon Web Services infrastructure in the US East (Northern Virginia) region. This includes your account details, your athlete record, and the physiological test files you or your coach upload.

Amazon Web Services is certified under the EU-US Data Privacy Framework. The UK Extension to that Framework applies automatically to certified organisations, which means personal data may be transferred from the United Kingdom and the European Economic Area to Amazon Web Services in the United States on the basis of that certification. We additionally rely on the Amazon Web Services data processing agreement, which incorporates the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum.

Where any other processor is located outside the United Kingdom and the European Economic Area, we rely on appropriate safeguards of the same kind, together with supplementary measures where required.

7. How long we keep data

We retain your account, test data, analyses, plans and messages while your account remains active, because the record is what makes longitudinal analysis possible. Retention is also subject to the University of Essex retention schedules where these apply.

You can delete your account from Profile, Privacy and data rights, choosing either option:

• Temporary deletion: your account is deactivated and you can restore it by signing in within 30 days. After 30 days it is deleted permanently.
• Permanent deletion: your profile, uploads, analyses, plans and messages are deleted without undue delay, and in any event within 30 days.

Records of consent and of erasure requests are retained where we need them to demonstrate compliance. Retention by class:

If you disconnect Garmin, or revoke our access from within Garmin, we stop receiving your data and delete the raw Garmin data we hold within 30 days. Derived values already calculated remain part of your athlete record unless you ask us to remove them, which you can do at any time.

8. Your rights

Under the UK GDPR and the EU GDPR you have the right to:

• Access a copy of the personal data we hold about you, available through Profile, Privacy and data rights.
• Rectification of inaccurate data, which you can do for most fields in your profile.
• Erasure, through the deletion options in section 7.
• Portability, through the data export function in the same panel.
• Restriction of processing, and objection to processing based on legitimate interests.
• Withdraw consent for health data processing or for marketing at any time.
• Object to automated recommendations and request human review, as set out in section 4.4.

To exercise any of these rights, use Profile, Privacy and data rights, contact us through the ThresholdXpert contact form, or contact the University Data Protection Officer at dataprotectionofficer@essex.ac.uk. We respond within one month, which we may extend by two further months for complex requests, in which case we will tell you.

If we are not able to resolve the issue to your satisfaction, you have the right to complain to the Information Commissioner’s Office (ICO).

• Website: ico.org.uk/make-a-complaint/
• Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
• Helpline: 0303 123 1113

If you are in the European Economic Area, you may instead complain to your local supervisory authority.

9. Age requirements

The platform is currently designed for individuals aged 16 and above.

If you are aged between 16 and 18, you may only use the platform with the permission of a parent or guardian.

The platform is not suitable for anyone under the age of 16, and we do not knowingly collect personal data from anyone under 16. If you believe someone under 16 has provided us with personal data, contact us and we will delete it.

10. Cookies and similar technologies

We use strictly necessary cookies and browser storage to keep you signed in and to maintain your session. These do not require consent because the service cannot work without them.

We do not use advertising cookies or third-party tracking technologies on the ThresholdXpert platform.

11. Security

We protect your data using the following measures:

• Encrypted connections (TLS) for all data in transit.
• Encryption at rest for the database holding your athlete record.
• Server-side encryption at rest for the storage holding your uploaded physiological test files.
• Storage that is closed to public access, so files cannot be reached without an authenticated request.
• Authenticated access control through Amazon Cognito, with a password policy and session management.
• Role-based restrictions determining who can see which athlete’s data.
• Validation of uploaded files.
• Restriction of administrative access to a small number of named individuals.

If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office within 72 hours of becoming aware of it, and will notify you without undue delay where the risk to you is high. Incidents will also be reported through the University of Essex incident reporting process.

No system can be guaranteed completely secure.

12. Changes to this policy

We may update this policy. Where changes are material, we will notify you by email or by an in-app notice before they take effect. The version and date at the top of this document indicate when it was last revised.

13. Contact

You can raise any data protection matter through either route below.

The University of Essex is registered with the Information Commissioner’s Office under registration number Z699129X.