Who is the data controller
The data controller responsible for the personal data described in this policy is:
[Luca Danesino / legal entity name once incorporated]
[registered address, Switzerland]
Contact for privacy and data-protection matters: [privacy@yourdomain]
Because 17H is currently an early-access, pre-company product, the contact above is the person operating it. This section will be updated with a registered company name and address once 17H is formally incorporated.
What data we collect
We collect only what's needed to create and show your personal report, and nothing more. We do not collect GPS routes, maps, workout-by-workout detail, or any other raw file content — the numbers below are the only things that leave your device.
| Category | What it includes | Where it comes from |
|---|---|---|
| Account data | Your email address | Entered by you at sign-up, used only to send your sign-in link and, if you opt in, product updates |
| Entered wellness metrics | Resting heart rate, HRV, VO2 Max, sleep score | Typed in by you, read from your own device's app |
| Computed training-load summary | A 7-day:28-day load ratio, a 4-week volume trend, and the share of your recent training that was running | Calculated in your browser from a CSV export you upload; only these summary numbers are saved — the CSV file itself is never uploaded to our servers or stored anywhere |
| Technical data | A session token that keeps you signed in | Created automatically by our authentication provider when you sign in; stored only in your browser |
We consider the wellness and training-load data above to be health-related data under GDPR Article 9, and we treat it with the corresponding extra care described in Section 4 below.
Why we process it, and our legal basis
- To create and show your personal report — necessary to perform the service you asked for when you signed up (GDPR Art. 6(1)(b), performance of a contract).
- To process your wellness and training-load metrics specifically — because this is health-related data, we rely on your explicit consent (GDPR Art. 9(2)(a)), which you give by entering your metrics and uploading your training history. You can withdraw this consent at any time by deleting your data (Section 7).
- To send you your sign-in link and, if you choose, occasional product updates — based on your consent (GDPR Art. 6(1)(a)), given when you provide your email.
We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects on you. The "ideas worth exploring" shown on your report are general, educational information, not an automated medical decision.
We do not sell or share your data
17H does not sell your personal data. We do not share it with advertisers, data brokers, or any third party for their own marketing or commercial purposes. We do not run third-party advertising or analytics trackers on this site.
Your data is only ever accessible to you — the database that stores your saved report is configured so that each account can only read and write its own rows, and no one else's.
We use a small number of infrastructure providers strictly to operate the service (sometimes called "processors" under GDPR) — for example, our database and authentication provider, and our hosting provider. These providers process data only on our instructions, under a data processing agreement, and never for their own purposes. We do not currently share data with any provider outside of this narrow technical role.
Where your data is stored, and how it's protected
- All data in transit between your browser and our servers is encrypted (HTTPS).
- Your saved report is protected by row-level access rules at the database level, so it can only be read or written by your own signed-in account.
- We do not store your raw training-history file (CSV) — it is parsed in your browser and discarded; only the computed summary numbers are saved.
- If our infrastructure providers process data outside the European Economic Area or Switzerland, that transfer is covered by an appropriate safeguard under GDPR Chapter V, such as the European Commission's Standard Contractual Clauses.
How long we keep your data
We keep your account and saved reports for as long as your account is active. If you delete your account, or ask us to delete your data, we remove it from our active systems within 30 days, except where we are required to retain limited records for legal or accounting reasons.
Your rights under GDPR
If you are in the EU, EEA, UK, or Switzerland, you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate or incomplete data.
- Erase your data ("right to be forgotten").
- Restrict or object to certain processing.
- Port your data to another service, in a structured, commonly-used format.
- Withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal.
- Lodge a complaint with your local data protection supervisory authority if you believe your rights have been violated.
To exercise any of these rights, contact us at [privacy@yourdomain]. We will respond within one month, as required by GDPR Article 12.
Cookies and local storage
We use only strictly necessary local storage — a session token that keeps you signed in to your personal page. We do not use third-party advertising cookies, cross-site trackers, or analytics cookies that identify you individually.
Children's privacy
17H is not directed at, and is not intended for use by, anyone under the age of 16. We do not knowingly collect personal data from children.
Changes to this policy
If we make material changes to this policy, we will update the "Last updated" date above and, where appropriate, notify you by email.
Contact
Questions about this policy or your data can be sent to [privacy@yourdomain].