Privacy Policy — Golf Fitness Coach

1. Who we are

The Golf Fitness Coach (the "Service") is provided by Alb3r7 Oy (business ID 3425365-5), Espoo, Finland ("we", "us"). We are the data controller for the personal data described in this policy.

This policy covers the Service and the website app.bert.fi. Our agency work and marketing tools are covered by a separate policy at bert.fi/privacy.

Current status. The Service is in development. It is currently being built and tested only with our own team's data. No outside users' data is processed yet. This policy describes how data will be handled when users connect.

2. What the Service does

The Service is an AI-assisted fitness coach for golfers, used through chat. Golf-specialised physiotherapists design its training routines. Based on your recovery and training-load data from Garmin Connect, the Service selects a suitable routine from that library and sends it to your Garmin Connect account as a structured workout, so it syncs to your watch.

3. Data we process

Category	Examples	Source
Account and contact data	Name, email address, subscription status	You
Garmin health and wellness data	Sleep, heart-rate variability (HRV), resting heart rate, stress, Body Battery, steps, intensity minutes, weight (if recorded)	Garmin Connect, with your authorisation
Garmin activity data	Completed activities and workouts, including strength sets (exercise, reps, weight), duration, heart rate and training load	Garmin Connect, with your authorisation
Profile and training settings	Units, heart-rate zones, age (for heart-rate calculations)	Garmin Connect / you
Workouts we send	The routines delivered to your Garmin Connect account	The Service
Chat messages	What you tell the coach, e.g. soreness, schedule, upcoming rounds	You

Health and wellness data is a special category of personal data under the GDPR. We only process the data needed to provide the coaching. We do not request data the Service doesn't use.

4. Purposes and legal basis

Providing the coaching (selecting and delivering routines, answering in chat, tracking your progress): performance of our contract with you (GDPR Art. 6(1)(b)). For health data, your explicit consent (Art. 9(2)(a)), which you give when you connect Garmin and can withdraw at any time.
Subscription and billing: contract, and our legal accounting obligations (Art. 6(1)(c)).
Security and fixing problems: our legitimate interest in keeping the Service secure and working (Art. 6(1)(f)).

Withdrawing consent stops further processing of your health data. It doesn't affect processing that happened before you withdrew.

5. AI processing

The Service uses large language models from Anthropic (Claude) and OpenAI to analyse your recovery and training data, select your daily routine from the physiotherapist-designed library, and answer you in chat. The AI selects from the library and does not invent exercises.

Before any user outside our own team connects, we will use these providers only through their business or API offerings, under data processing agreements and terms where your data is not used to train their models.
The Service makes no decisions with legal or similarly significant effects on you (GDPR Art. 22). It suggests training, and you decide whether and how to train.
The Service is not a medical device and does not provide medical advice, diagnosis or treatment.

6. Who receives your data

We do not sell your data, use it for advertising, or share it with data brokers. Garmin data is not used for any purpose other than providing the Service to you. Your data is processed by the following service providers (processors) on our behalf:

Provider	Purpose	Location
Anthropic PBC	AI analysis and chat (Claude)	United States
OpenAI	AI analysis and chat	United States
Cloudflare, Inc.	Website hosting and network security	Global / EU
Google (Workspace)	Email for support requests	EU / United States

Garmin is the source of your Garmin data and processes it under its own privacy policy. Transfers to the United States rely on the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.

If we add a payment provider or change processors, we will update this list before the change takes effect.

7. Storage and security

Your Garmin data is stored on our own server on full-disk-encrypted hardware. Access credentials are kept in a secure secret store and are never shared. Access is limited to authorised personnel of Alb3r7 Oy, and we request only the Garmin permissions the Service needs.

8. How long we keep data

Garmin data and chat history: while your account is active. If you disconnect Garmin or delete your account, we delete your Garmin data within 30 days.
Billing records: as long as Finnish accounting law requires (usually 6–10 years). This doesn't include health data.

9. Your rights and how to disconnect

You can disconnect the Service at any time in Garmin Connect's settings for connected apps. Our access ends immediately, and we delete your Garmin data as described above. You can also email [email protected] to:

access your data or get a copy (portability)
correct or delete it
restrict or object to processing, or withdraw consent

We will respond within 30 days. You can also lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi) or your local supervisory authority.

10. Website

app.bert.fi is a static website hosted on Cloudflare Pages. It sets no cookies and loads no analytics or advertising scripts. Fonts are loaded from Google Fonts.

11. Children

The Service is not intended for anyone under 16.

12. Changes

We will update this policy when the Service changes, and the date at the top will show the latest version. We will notify active users of material changes before they take effect.

13. Contact

Alb3r7 Oy (3425365-5)
Espoo, Finland
[email protected]