Privacy Policy

1. Data controller and processor

• Controller: the user is the controller of their own data.
• Processor: RPE Trainer acts as a data processor, providing the platform for storing and analyzing data.
• Data protection contact: info@rpetrainer.ee

2. Personal data we collect

We process data you enter into the Service voluntarily:

• Account data: name, email address, password, date of birth (for age verification).
• Training data: distance, speed, duration, workout type, Rate of Perceived Exertion (RPE).
• Subjective data: wellness, muscle soreness, stress level, fatigue, sleep.
• Synced data: data imported from third-party services (e.g. Polar, Garmin, Suunto, Strava, Apple Health) when you have authorized it.

3. Purposes of processing

We use your data for the following purposes:

• Providing the Service and analyzing training data.
• Giving researchers access (with your consent) to provide feedback to you or your coach.
• Conducting research in anonymized form (data is presented as aggregate values, ensuring anonymity).
• Providing user support and resolving technical issues.

4. Legal basis

Processing of personal data is based on:

• Performance of a contract: providing the Service under the Terms of Service.
• Consent: processing special categories of data (e.g. health-related wellness) and sharing data with researchers.
• Legitimate interest: securing the Service and developing anonymized statistics.

5. Sharing and transfer of data

We do not share your personal data with third parties, except:

• Researchers: persons bound by confidentiality obligations who need the data for analysis.
• Processors: service providers (e.g. server hosting, email systems) necessary for the application to function.
• Legal obligations: when we are required to disclose data under Estonian or EU law.

6. Artificial intelligence (AI) and data use

We use external AI providers for certain features (e.g. training analysis summaries and recommendations). Your privacy is protected by the following principles:

• We never send personalised or personal data (e.g. name, email address, date of birth, location) to AI providers or other third-party data processors.
• All data sent to AI is anonymized beforehand and is never in raw format.
• Raw data synced from third-party providers (Strava, Polar, Suunto, Garmin, Apple Health) is never sent to AI providers or third-party data processors.
• Data sent to AI providers is not used for training AI models.

7. Data retention

• We retain your data for as long as your account is active.
• When you delete your account, your personal data is deleted or anonymized within a reasonable time, unless law requires it to be retained.
• Anonymized data that can no longer be linked to you may be used in research even after account deletion.

8. Security

We apply appropriate technical and organisational measures (e.g. encryption, access restrictions) to protect data against accidental or unlawful destruction, loss, or unauthorized access.

9. Your rights

Under the GDPR you have the right to:

• Access your data and receive a copy of it.
• Correct inaccurate or incomplete data.
• Request deletion of your data (the “right to be forgotten”).
• Withdraw consent to data processing at any time.
• Lodge a complaint with the Estonian Data Protection Inspectorate (www.aki.ee) if you believe the processing of your data violates your rights.

10. Cookies

We use cookies in the web environment that are necessary for authenticating users and remembering preferences (such as language choice).

11. Changes to this policy

RPE Trainer may amend this privacy policy. We will notify you of significant changes by email or through the application.