DRAFT for review. Have a solicitor or data-protection adviser check this notice before you launch, then delete this box.
Privacy notice
Last updated: September 2026.
Who we are
Box Nutrition & Performance Ltd ("Box", "we") runs Athlete OS. We are the controller of the personal data described here. Contact: [add contact email].
What we collect
Account details: your email address, your first name (optional) and a securely hashed password. We never store your password itself.
Test results: results from tests done at Box, such as VO₂ max, thresholds, lactate, resting metabolic rate and body composition. This is health data, which UK GDPR treats as special category data.
Consent records: when you agreed to this notice and whether you opted in to emails.
Training data you connect: if you connect intervals.icu, we store your intervals.icu API key (encrypted) and a copy of your recent activities and wellness data (for example workouts, heart rate, sleep and HRV). We only read this data, never change anything in your intervals.icu account, and delete it when you disconnect or delete your account.
Payment details if you pay: handled by Stripe. We do not see or store your card number.
Why we use it, and our legal basis
To run your dashboard and show your results: your contract with us, and for health data, your explicit consent, which you give when you create your account.
To email you news from Box: only if you ticked the optional box. You can withdraw this at any time.
To keep the service secure and prevent abuse: our legitimate interests.
We do not sell your data, use it for advertising, or share it with other coaches or companies.
Who processes it for us
Railway (hosting), Neon (database, hosted in London) intervals.icu (only if you choose to connect it) and, if you pay, Stripe (payments). They act on our instructions. [Confirm the Railway hosting region and add it here.]
How long we keep it
Until you delete your account. You can delete your account and all your results at any time from inside your dashboard. Payment records are kept by Stripe as the law requires.
Your rights
You can access, correct, export or delete your data, object to how we use it, and withdraw your consent. Downloading and deleting are built into the dashboard. For anything else, email us. You can also complain to the Information Commissioner's Office at ico.org.uk.
Cookies
We use one essential cookie to keep you signed in. We do not use advertising or analytics cookies.
Security
Connections are encrypted, passwords are hashed with scrypt, and sessions can be ended at any time by logging out. No system is perfectly secure, and we will tell you promptly if a breach affects you.