Privacy

• Your health is yours: the app keeps it only with your consent, never sells it, shows no ads, and uses it for nothing but your own tracking.
• Everything is stored in Europe: the database is in Frankfurt.
• You choose what you share, and with whom, workout by workout.
• You can take everything with you, or erase everything, whenever you like, from the app.

Santé is published by [name of the sole proprietorship, coming soon], the controller of your data. For any question or request: [dedicated address, coming soon].

Marc runs the app. He only opens the database to keep it working, to fix a problem you report, or to handle a report about content.

• Your account: your name, email, password (hashed, never readable) and, if you signed up with one, the date you verified your address, photo, username, the country you live in, your date of birth, the dates you gave your health consent and accepted the terms, your time zone (taken from your device when it changes, so that your days start at your own midnight) and the app language (your device's, or the one you choose: it is then also kept in a cookie in your browser, for the pages where you are not signed in, such as signing in), and your units (distance, weight, height, temperature: picked when you first sign in from your country, the one you declared, otherwise the one you connect from, read but not kept, otherwise your phone's region; after that, by you).
• Your profile: height, sex, activity level, goals and the history of their statuses (when, by you or by a connected AI, and the reason you gave), diet and allergies, and your reference running pace (the one you set, or that the app derives from your runs).
• Your sports assessments: a test, a measurement, an estimate or a declared level, with its date, its method, and the workout that provided it if you link one. You enter them, or your connected AI records one after your consent; you correct or delete them in Réglages › Niveau et évaluations (Settings › Level and assessments). Your level in each discipline is never stored: it is computed each time it is read.
• Your VMA tests (maximal aerobic speed): the protocol (half-Cooper, VAMEVAL…, or the 2 km walk, computed with your age, sex, height and weight already on file), its settings, the result you noted (for the walk: the time and your heart rate at the finish) and the VMA it gives, with its date and the test workout if you link one. A test guided by the app (half-Cooper, VAMEVAL, heart-rate step test), run with your phone or your Apple Watch, is noted with its run when you save it; for the heart-rate step test, your heart rate at the end of each step and the max heart rate used for the calculation. When your runs show a clear change, or your last test is old, the app suggests a new one on the Sport page: nothing of it is kept, except your “Later”, on your phone. You enter them, or your connected AI adds one after your consent; you delete them in Réglages › Niveau et évaluations (Settings › Level and assessments). Your reference VMA is never stored: it is the average of your latest attempts, computed each time it is read.
• Your health: what the app reads from Apple Health or Health Connect (details below); what you log (weigh-ins, body measurements, blood pressure, medications and doses, treatments and medical instructions, and whether an instruction rules out maximal effort, blood tests and their PDFs, health events: a pain or discomfort during or after a workout, what you said about it, the workout, its status and its history); what the services you connect send (Google Health for a Fitbit tracker). When you delete a weigh-in, the app keeps its time and where it came from, without the weight, so it does not take it back from Apple Health or Health Connect at the next sync.
• Your workouts: exercises, sets, blocks (warm-up, effort, cool-down, planned and done), a run's goal and where it came from (the planned workout, a template or your choice at the start), duration, heart rate, GPS route (each position with its accuracy and the distance counted up to it), calories and cadence (measured by your watch or your phone's pedometer), notes, how the workout felt if you note it (its effort, from 0 to 10, and its context: heat, cold, wind, rain, short sleep, stress, heavy legs, fasted; your coach sees it, your friends and Strava never do), the training load of each workout (from your heart rate and, if you rated the effort, from how it felt, kept side by side with what they were worked out from; a new calculation is added, the old one stays), photos, and the music played during the workout if you connect Spotify or Apple Music; your availability (the days you can train and the longest workout each day, set by you or by your AI after your consent: a plan never goes beyond it); the adjustments to your plan you decided on (accepted, declined or undone, with the changed session before and after, so it can be undone) and your answers to “Why was it hard?”; programs, planned sessions and their history (who created, changed or removed them: you, your coach, your connected AI or the app, when, and what changed), the analysis of each workout (its figures, heart rate zones, best efforts, pace zones) with the settings that made it (your max heart rate, where it comes from and how confident it is, your reference pace) and the version of the calculation; the dated history of these settings: your max heart rate (a default without a year of birth, estimated from your age, or raised by a heart rate you held for 30 seconds above the estimate) and your reference pace (set by you, or deduced from your best efforts), each with the date it applies from; routes and privacy zones. If you start the day's session from your Garmin watch, the time it loaded it: that is how the workout coming back through Apple Health or Health Connect is recognized and marked done.
• What you eat: meals, foods, recipes, and planned meals (by you or your AI), which only count once eaten. Your shopping list is computed from them; the app only keeps what you do on it: the boxes you tick and the items you add by hand.
• Your life in Friends: follows, circles, comments, reactions, cheers, blocks and reports.
• Coaching: the link with your coach or your client, their notes and your messages. If you invite a client by email, the app keeps that address and sends them the invitation, even if they have no account.
• Events: the organisations you run, their events and races, your registrations. Some event pages are created by the app itself, with no organiser: facts taken from the event's official website (name, dates, place, distances, links), with no data about any person; your "I'm going" on one of them is seen by no one but you and your friends, only their number is counted.
• The professional space, opened by hand and by invitation only: if Marc opens it for you, your profile (coach or organiser, country, currency, activity name and the business identifier you give so it can be checked), a note Marc may add for himself, your organisations and their members (name and role, seen by the other members of the same organisation). None of it goes to a third party.
• Your connections: the tokens linking the app to Strava, Google Health and Spotify, the access of the AIs you connect and your Garmin watch (its model, and a fingerprint of its secret).
• The log of an AI's consultations of your medical record: for each one, the date, the tool, the AI and your sentence of consent, as the AI copied it. You read it in Health › Medical record › Read by an AI.
• The log of your connected AI's calls, what it reads as well as what it writes: for each one, the AI, the tool, the time, the duration, the outcome (done, preview, refused, failed), the size of the response and the usage it counts toward its limit, with the identifiers of what it targeted (the workout it read, for example). Never what it read or wrote: no meal, no workout, no health measurement. It is used to spot an AI calling in a loop and to set its usage limit: for now nothing is refused, the app only notes what would have been.
• During a run you share live: your position and route, erased at the finish. As long as you are a member of an open group (created or joined), every outdoor run of yours is shared live from the start, without a tap, from the phone as from the watch, and each of your groups sees it. Near your start and inside your privacy zones, your circles, your groups and anyone with their link see neither, only a circle: at the start, about one kilometre around the centre of your neighbourhood, the same for every run; in a zone, the zone as it is already shown. On the course of a race you are going to, the start line and the finish are public: starting from the line, your run shows from the first metre to the finish; your zones stay hidden.
• Auto start (beta, if you turn it on): on the day of a race you joined with “Participate”, your position followed by your phone in the background, to recognize your start. Nothing leaves your phone before that; afterwards, it is a run shared live, as above.
• How things run: the date of your last activity, sensor diagnostic logs for a workout, live heart-rate probes, the app's notifications.
• The app errors you run into, on the web, your phone or your watch: what failed, where, when and on which version, with your account. Never your health data, what you wrote, your email address or your IP address: everything is masked before it is kept.
• On your phone, in the app: a copy of the pages you already opened (home, Health, Training, Food, your history and your workouts, your plan, your programs, your recipes, your goals), to show them without a connection, as you saw them. 20 MB at most: the oldest go first. Your medical record (medications, instructions, history, blood pressure, lab results, health events) never goes in, nor your friends, your settings or your privacy zones. It never leaves the phone, and it is erased when you sign out, when you delete or close your account, and when another account signs in on this phone.

The app only reads what you allow in your phone's permission sheet, and you can take it back at any time in the settings of Apple Health or Health Connect.

Workouts from other apps and their routes are used to complete a run they measured instead; your watch's heart rate (Apple Watch, or a watch that writes it to Health Connect) is read during your workouts, and throughout the day, one average per minute, for the day's curve. What the app writes is there for your other apps.

The app does not read your walking data (speed, step length, stairs…). Heart rate recovery (how much your heart rate drops one minute after an effort) and wrist temperature are kept with your other vitals.

Workouts that other apps record there (the Apple Watch Workout app, Strava…) are offered to you in What's new, from the day the feature arrived: their type, times, distance, calories, route and heart rate. Until you answer, they are kept on our servers; ignored, its route and heart rate are erased; imported, it becomes yours, and what the app measured (route, heart rate, distance, calories) stays attached to the workout. When several apps recorded the same outing (your watch and your band), it is imported once: what each one measured stays attached to it, to compare and choose the reference. All of it goes with the workout when you delete it.

When you first connect, it imports your history (on iPhone, since 1 January 2022; on Android, since the same date if you give Health Connect access to your history, otherwise the last 30 days, and the rest as soon as you give it). With your permission, reading continues in the background, about once an hour, so your tracking stays up to date without opening the app. On Android, the day's distance is also read each time you open the app, along with steps and calories.

This data is never used for advertising and never sold. It only goes to a third party if you ask: a workout published to Strava, an AI you connect, a share link you create.

• Providing the app (your account, tracking, workouts, friends): that is what the terms of use you accepted are for.
• Keeping your health data: your explicit consent, given separately on the “Your health data” screen, after seeing what is kept and where. You withdraw it in Réglages › Mon compte › Accord santé (Settings › My account › Health consent); without it the app cannot keep anything about your health, so withdrawing it means deleting your account.
• Checking your age: the law sets an age to sign up on your own (see below).
• Reading reports, removing content, suspending an account: protecting the people who use the app, as the terms and the app stores require.
• Diagnosing a sensor that drops out, understanding an error, protecting the app from abuse: keeping the service working.
• Warning an inactive account before deleting it: keeping nothing longer than needed.
• Verifying your address when you create an account with a password: so that no one opens an account, or gets into one, with someone else's address.

No advertising, no commercial profiling, no resale. The app trains no AI on your data. An AI you connect follows its own policy, training included.

• You.
• The people you choose: your followers or your circles, workout by workout (Visibility; in a public circle, neither your workouts nor your live runs until you open them there), and your meals if you share them (My profile); anyone holding a link you create (a day of heart rate, a workout, a period, your live tracking); each group you are a member of, its members and anyone with its link: your outdoor runs, live, while it is open, since you joined (you leave it with “Leave the group”); your coach, if you link up (they see your workouts, private ones included, with how they felt but not your notes, and your health and meals if you open them); the organiser of an event you sign up for (your public profile and your race); every account, for a recipe you share yourself to the shared bank, without your name (a recipe created by you or your AI stays yours).
• An AI you connect (Claude by Anthropic, ChatGPT by OpenAI, Le Chat by Mistral AI, Perplexity): it reads, and writes if you allow it, what you open to it, and what it reads goes to its publisher. Your medical record (blood tests, medications, history, instructions, blood pressure, health events) is open to it only if you tick “Read the medical record” when you plug it in, and each reading needs your consent. The locations of your workouts (GPS, point by point) are open to it only if you tick “Read your workout locations”: the start, the finish and your privacy zones stay hidden, as for your friends, but your starts and returns can hint at your neighbourhood, and what it reads of them stays with its publisher. Your raw daily measurements (each value your devices sent, with its source) are open to it only if you tick “Read your daily measurements”. Without these two boxes, it reads your workouts without any coordinates, and summaries of your days. It also reads your routes (My routes: their name, distance and elevation), without their coordinates. The points of a route (all of them, start and finish included: nothing is hidden, they show where it goes, so often where you live) are read to it only with the positions box ticked and your consent for that route, at each reading: it must ask you and copy your answer, or the app gives it no point; each reading is noted in the log of calls. If you allow it, it creates one for you, from a place you give it (sent to Photon to be found) or the usual start of your runs (sent to openrouteservice to compute the route). You plug it in, after seeing what it will read and where it goes, and you unplug it in Réglages › Connecteur IA (Settings › AI connector). What it does with your data is governed by its own policy. For a workout, it can read what the workout sheet shows: your reference pace (the one you set, or the one the app derives from your runs), the time spent in each pace zone, the run's effort compared with your runs of the six previous weeks, and, when several apps measured the same outing, what each one measured, with its name. It reads how a workout felt when you noted it, and can note what you tell it, in two steps: it shows you first, and the app only writes after you agree. A pain goes to your medical record instead. It can also read all your goals, closed ones included, one at a time, with the history of their statuses, and go back through your workouts, weigh-ins, activity and meals beyond their usual window, up to a year at a time. If you let it write, it can create a goal (to be defined, or active) and change its status (pause, resume, achieved, abandoned, replaced), always in two steps: it first shows you what would change, and the app only writes once you agree; each change is noted in the goal's history, with its name. Each of its writes is noted in the log of calls, without what it wrote; a planned session it creates, changes or removes is also noted in that session's history, with its name. It can redo a workout's analysis with today's settings, after your consent: the reanalysis is kept next to the original analysis, which remains the workout's. It also reads what a run's analysis now keeps: its phases, its climbs, its cardiac drift (when its conditions hold) and the observations the app notes by fixed rules, without AI, as on the workout sheet; and, if it asks, your comparable runs and the trend of your pace at equal heart rate, worked out on request, without keeping anything more. It also reads your records (5 km, 10 km, half, marathon: the best time of your runs with a track, a race over the distance, or a run up to 500 m shorter brought to the distance; its date and its workout, in training or in a race) and your estimated times, worked out on request from a race you ran, an all-out run (an effort rating above your usual, or a heart rate close to your max), your best efforts or your VMA test less than 90 days old, as Réglages › Niveau et évaluations (Settings › Level and assessments) shows them; nothing of it is kept. It can also read your level in each discipline (what you declared, what your workouts show, your assessments) and record one after your consent, with a preview. It can read your VMA and your tests, add one, and suggest a training plan built from your VMA: it shows it to you first, and the app only writes its run templates and calendar sessions after your consent. It can also set your availability, in two steps. The plan, whether it comes from the AI or from Sport › Build a plan, fits within your availability, suggests only endurance under an active medical instruction, and does not rise faster than your recent volume. After a missed session of your plan, or a quality session stopped before the end, the app suggests an adjustment (moving the session, or turning the next quality session into an easy run); after a session harder than usual (your ratings compared with each other, and checked against your heart rate, duration or pace), it asks you why. When your easy runs get easier (your heart rate at the same pace going down, or your effort ratings going down), it suggests a bit longer or a bit faster, your choice; your AI sees the same suggestion and only applies it with your choice. Your AI sees the same suggestions, and your answers, and only applies a change or records an answer, in two steps, after your consent. A plan's run templates stay out of your own list of templates; they are deleted with the last session that uses them. It can read your shopping list, ticked boxes included, but not change it. Your medical record (blood tests, treatments current and past, medical history and allergies, medical restrictions, blood pressure, health events) is opened to it one reading at a time: it must ask for your consent before each one and copy your answer, or the app refuses; a consent is good for one reading only, and each one is logged. Without consent, it only knows that a medical restriction is active, not what it says. It can log a health event you report to it, change its status, archive it, correct a medical history entry or tick “no maximal effort” on an active instruction (never untick it), only after showing you what it would write and getting your consent to that step; the event's history says the AI logged it. It never deletes anything from your medical record: that is done in the app.
• Strava, if you connect it: a workout only goes there when you publish it with “Also on Strava” on, with its title and your note as its description; changing the title or the note afterwards changes them on Strava too.
• Garmin, if you connect your watch: it loads the workouts and course you pick on it, and the finished workout goes to your Garmin Connect account.
• Marc, to run the app and handle reports.
• The providers below, each for its own part.

Who reported you stays secret. Nothing is sold, to anyone.

Your data is stored in Frankfurt, but several providers are American companies (Vercel, Neon, CARTO) or go through the United States (Strava, Google, Apple). These transfers rely on the EU–US Data Privacy Framework, or on the European Commission's standard contractual clauses. Open-Meteo is in Switzerland, which the EU recognises as protective.

• As long as your account exists, your data stays, except as follows.
• Your position during a shared run: erased at the finish, or two hours after its last update if your phone went silent on the way. If you are a member of an open group, your finish stays on your groups' maps, then is erased at night once 24 hours have passed since your run. A group lives 7 days after it was created, or 24 hours after the last run that started with it if that is later; created during a run, 24 hours after that run. Everything is erased the night after it expires.
• Diagnostic logs and heart-rate probes: 90 days.
• The error log: 30 days, kept by us only (no outside error-tracking service).
• The link that verifies your address: 24 hours, single use (the database keeps only its fingerprint); the note that avoids emailing you “you already have an account” twice within an hour: one hour.
• The log of the administrator's actions: 12 months.
• The log of your connected AI's calls (what it reads and writes): 90 days.
• The history of your planned sessions: as long as your account exists, even for a removed session.
• The analysis of a workout and its reanalyses: as long as the workout exists.
• The training load of a workout and its recalculations: as long as the workout exists.
• How a workout felt: as long as the workout exists, or until you clear it.
• Your availability: as long as your account exists, or until you change it.
• The adjustments to your plan you decided on: as long as your account exists.
• The history of your max heart rate and reference pace: as long as your account exists.
• A share link: until you cut it, or until its expiry date.
• If you cheer a runner on without an account (through the link of their live run or of their group): your first name and your message, or your voice message; to limit sending, two one-way fingerprints, one of a random token on your device, the other of your IP address, erased after one day. A voice message leaves the server as soon as the runner has received it, within 24 hours at most. With an account, outside their circles: the same, but under your account's first name (you do not type one), and the token fingerprint is your account's.
• A sports assessment: as long as your account exists, or until you delete it.
• A VMA test: as long as your account exists, or until you delete it.
• An event page created by the app and withdrawn (most often at its organiser's request): hidden at once, erased 30 days later along with the "I'm going" it carries; only an internal note of its withdrawal remains (the event's name, its year, the official website), so that it is not created again.
• A ticked box on the shopping list: as long as one of the planned meals it covers is still ahead. An item added by hand: until the day after you tick it.
• An AI's access: until you remove it.
• The log of an AI's consultations of your medical record: as long as your account exists, even once the AI is removed (the log keeps its name).
• A treatment you stop tracking: it becomes ended, kept with its doses as long as your account exists.
• A health event: as long as your account exists, archived ones included, until you delete it; it goes with its history. If the linked workout is deleted, the event stays, without it.
• An account inactive for two years (no app opened, nothing sent by your phone or watch, no connected AI using it): an email warns you a month before, then it is deleted, once the email has reached you. An organisation you run must be handed over first.

Everything the app keeps can be taken at any time: Réglages › Mon compte › Exporter mes données (Settings › My account › Export my data), a ZIP file (your data as JSON, your routes as GPX, your photos and the PDFs of your blood tests).

Your account is deleted in the app, Réglages › Mon compte › Supprimer mon compte (Settings › My account › Delete my account), or without the app, on the Delete my account page. Your choice: now, everything is erased within the minute; or in 30 days, your account is closed at once (nobody sees it any more, nothing is written to it) and you can cancel until then: sign in again, then “Annuler la suppression” (cancel the deletion).

What goes: your workouts, health, meals, programs, profile, friends, your comments and cheers on other people's workouts; Strava and Google are disconnected. On your phone, the app also erases what it keeps there: runs and workouts not yet sent, automatic start (its schedule, its runs and their tracks), received voice notes, the offline copy, your settings and tokens. Your Apple Watch forgets its plan, its workouts not yet sent and its token as soon as it hears from your iPhone.

What stays:

• what the app wrote to Apple Health or Health Connect (you erase it from those apps), and your workouts already published on Strava;
• a recipe you had shared that someone else uses in a dish: it passes to their name, made private; a circle you share passes to its oldest member;
• on iPhone, a cheer voice message you had kept: it is erased from the phone, but stays in the iCloud backups already made, until the next one;
• the database's restore history, seven days at most, then it forgets; Vercel's logs, one hour; the backup copies Marc makes on his computer before changing the database, 30 days at most;
• your account's technical identifier and the date it was deleted, nothing else: if a backup ever had to be restored, your account would be deleted again.

You can access your data, correct it (in the app), erase it, take it with you, object to or restrict a processing, withdraw your consent, and say what happens to your data after your death. Most of this you do yourself, in the app; for the rest, write to [dedicated address, coming soon]. We answer within a month.

If you think your rights are not respected, you can complain to the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, cnil.fr) or to the authority of your country.

To sign up on your own, you must be the age set by the country where you live (not your nationality): 15 in France, 13 to 16 elsewhere in Europe, 13 in the United States, the United Kingdom and Canada, 16 elsewhere. The app asks for that country and your date of birth on the consent screen. Under that age, a brand-new account is deleted; an account that already holds data is paused, and a mistake is sorted out in writing, at [dedicated address, coming soon].

• Everything travels over an encrypted connection (HTTPS).
• Your password is hashed: nobody can read it, not even Marc.
• The tokens linking the app to Strava, Google Health and Spotify are encrypted; your devices' tokens and AI access are kept as a fingerprint.
• Administration requires, on every action, the administrator role, an account listed separately on the server, and a confirmation with a passkey less than 30 minutes old. Every action of the administrator is logged: who, what, on which account or content (an identifier), and when; no IP address.
• On Android, the app is excluded from phone backups and from transfer to another device.
• On Android, a photo taken from the app stays in the app's private storage, outside your gallery, until the next time you add a photo, or delete or close your account: it is then erased from the phone.

For residents of Washington State and of other US states protecting consumer health data: the health data the app collects, its sources, what it is used for and who receives it are described above (“What the app keeps”, “Apple Health and Health Connect”, “Why”, “Who sees it”, “Providers”). The app does not sell it and only shares it with your consent or to provide the service. You can ask to know what is kept and who it went to, have it deleted (including from backups), and withdraw your consent: write to [dedicated address, coming soon]. An answer you disagree with can be appealed at the same address.

The version and its date are at the top of the page. A change of substance will be announced in the app before it applies. The terms of use cover the rest: what you post, what is forbidden, how to report. This English version is a translation; the French version prevails.