Who is responsible
Holistic Path is operated by Copenhagen Nutrition and Fitness, a Danish sole proprietorship owned by Frederik Lundelius, CVR 45208036. Our registered address is c/o Frederik Lundelius, Ved Amagerbanen 31A, 2. 2, 2300 København S, Denmark. Contact us at support@holisticpathapp.com.
We determine how platform accounts, security, support and our own coaching services use personal information. Independent coaches determine the purposes of their own coaching services. Where we process their records only on their instructions, we act as a processor. The applicable coach identity, responsibilities and data-processing arrangements must be clear before independent-coach beta use.
The planned client beta is for adults aged 18 or over in the EU/EEA, for fitness and wellbeing coaching. It is not a clinical or medical-care service.
Current health-record use is limited to the operator’s own records and authorized test accounts. Client health-data use has not started. The planned client beta requires its own consent, provider and operational checks before that processing begins.
Information and sources
We receive information from you, your linked coach, files you choose to upload, your browser/device and services you authorize. We create calculations, charts and summaries from those records. The information processed depends on the features used.
- Account and profile details, including name, email, role, coach/client links and supplied profile measurements.
- Coaching records such as plans, completed workouts, exercise loads, times, distances, effort, habits, goals, nutrition entries and check-ins.
- Health and recovery information supplied through relevant features, such as injury information, sleep, heart rate and recovery measurements. Some records can reveal sensitive health information.
- Notes, support messages, files and attachments. Some features under controlled development accept photographs, audio or reviewed transcripts.
- Manually imported Garmin activity and wellness records. Activity files can contain heart-rate measurements, precise routes or location information. Only upload information you intend to have processed.
- Technical information such as session identifiers, browser/device details, connection and security metadata, notification subscriptions and usage/performance events.
Purposes and legal grounds
We use necessary account and service information to provide the requested workspace and agreed coaching services under GDPR Article 6(1)(b). Necessary security, abuse prevention and reliability processing may rely on our legitimate interests under Article 6(1)(f), subject to necessity and your rights. A specific legal obligation, where applicable, uses Article 6(1)(c).
Optional Garmin connections and optional sharing are planned to rely on consent under Article 6(1)(a). Processing information concerning health also needs a valid Article 9 condition. Client health-data processing has not started; the current private-use/test stage is not an offer to collect client health records. For the planned fitness/wellbeing client beta, we will require separate, explicit health-data consent under Article 9(2)(a) before enabling that processing. This notice, account creation and a Garmin authorization screen do not by themselves record that consent. The consent and withdrawal process is part of beta preparation.
You can decline optional information and connections; this limits the related feature. Where processing relies on consent, you can withdraw it through available controls or by contacting support. Withdrawal does not affect earlier lawful processing. We must also address retained information that no longer has a lawful purpose; stopping future synchronization alone does not erase past records.
Progress and recovery calculations support human review. Coaching decisions remain with the coach and client. The planned beta does not include solely automated decisions with legal or similarly significant effects.
Providers and international processing
The app uses Vercel for hosting and server-side processing; Supabase for authentication, database and private-file storage; and Resend for transactional email. Optional Vercel Web Analytics and Speed Insights collection is paused in the release accompanying this notice. The support mailbox uses Dynadot and forwards messages to an ordinary personal Gmail account. Google is a recipient in that support-email chain; consumer Gmail is not covered by a customer processor DPA. Please avoid sending health records or sensitive attachments through routine support email; ask us to arrange an appropriate channel.
The Supabase database is located in Ireland. Current Vercel Production deployment metadata identifies Washington, D.C., US (iad1). These locations do not describe every gateway, support, edge, log or subprocessor operation. EU/EEA account eligibility does not mean all processing stays within the EU/EEA.
Processor terms, permitted health-data scope and international-transfer arrangements for the planned Garmin connection are being reviewed before activation. Relevant arrangements can include an adequacy decision or Standard Contractual Clauses with any necessary additional safeguards. Contact us for information about the arrangements applicable to your processing; this notice does not certify an unverified agreement or EU-only operation.
Garmin operates its own accounts and services under its own terms and privacy information. A browser/device push provider also receives the technical information needed to deliver notifications you opt into. Other optional AI/media features require their own provider, purpose and data-flow information before client use; they are not authorized by accepting this notice.
Cookies, device storage and analytics
Authentication uses session cookies. The app stores preferences, an offline identity record, downloaded training information, queued workout changes and some recovery drafts in browser storage. These records can contain personal or health information; they are not all anonymous preferences. Use a trusted device and appropriate account/device controls.
Optional Vercel Web Analytics and Speed Insights collection is paused in the release accompanying this notice. Earlier app versions enabled those tools throughout the app, with query strings, fragments and UUID path segments removed from event URLs. That reduction of identifiers did not establish that every event was anonymous. Any resumption requires review of the actual purpose, lawful basis, device-storage requirements and appropriate user controls, with updated information.
Device notifications are optional and depend on your permission and device settings. Browser storage and provider behavior must be considered when you request deletion or change devices; deleting server records does not automatically clear every local or downloaded copy.
Retention, exports and deletion
We retain information for the relevant service purpose and any specific legal need. We consider whether the account is active, whether training history is still useful for the requested service, whether a coaching relationship continues, and whether a valid deletion request or necessary legal exception applies. Ending a coaching link alone does not require erasing the client’s independent history. Proposed numerical inactivity, support and log schedules are beta operating changes; they are not represented here as existing automatic deletion jobs.
The manual Garmin account-archive importer processes the complete outer archive in your browser and uploads bounded import batches to private storage. Processed raw batches become eligible for cleanup after seven days and can be deleted sooner using available raw-file controls. This is not a guarantee that every raw object disappears exactly seven days after upload. Normalized imported records remain until deleted through the applicable process; detached manual edits can remain.
Available controls support an export of retained account data, deletion of eligible individual records and session revocation. Contact support for account deletion and other rights requests. We do not represent a complete self-service account-deletion journey as available. Retained backups, provider copies and necessary legal records can have different expiry rules; we will explain applicable limits when handling a request and must account for deleted information if a backup is restored.
Optional Google and iCloud calendars
Calendar connections are available only where configured and enabled. Connecting is optional and relies on your consent. Google asks permission to read your subscribed calendar list and events on accessible calendars. Holistic Path lists those calendars so you can choose which ones to display; none is selected initially. We fetch events only from selected calendars for the requested date window. The Google permissions do not allow Holistic Path to create, move, edit or delete Google events.
The feature displays your private calendar beside training and app-owned activities. Using a calendar for your own availability checks is a separate choice, off by default. Calendar overlays belong to the connected account and are not automatically shared with linked coaches or clients. We do not infer a linked client from event titles or attendees. Missing, hidden or stale calendars cannot establish conflict-free availability.
Google API responses can contain event details such as descriptions, attendees or locations while being processed on our server. The retained normalized snapshot contains calendar identifiers and names, event identifiers and titles, dates/times, time zones, recurrence/version references, busy status and refresh metadata; it does not retain descriptions, attendees or locations. Vercel processes the provider requests, and Supabase stores the private snapshot and encrypted access/refresh credentials. The app displays the selected information in your signed-in browser. Persistent credentials permit renewal and requested refreshes without authorizing Google again each time; this is not a promise of continuous background synchronization.
Google Calendar information is used for the calendar display and availability features you request. It is not sold, used for advertising or used to train AI models. We do not send Google event data to AI providers. Access by operators is limited to your specific support authorization, necessary security investigation or legal requirements. Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
The optional iCloud connector uses the Apple account identifier and app-specific password you supply. The password is encrypted on the server. Holistic Path uses read-only calendar operations, although Apple app-specific credentials are not themselves limited to read-only access by the provider. The calendar display, private cache and sharing choices described above also apply to iCloud. Apple operates its own account and calendar services under its terms and privacy information.
A successful refresh replaces the cached window. The freshness warning is not an automatic deletion deadline: older snapshots can remain after a failed refresh. Hiding a display layer does not erase its cached entries. Saving calendar-selection changes clears the active cached snapshot; a subsequent refresh can fetch the selected calendars again. Disconnect in Holistic Path removes the stored provider credentials and private snapshot. It does not revoke the Google-side grant or Apple app-specific password; also remove Holistic Path from your Google Account connections or revoke the password in your Apple Account to end that provider authorization. Provider originals remain unchanged. Account exports, deletion requests and backup limits follow the process described above.
Optional AI workout capture for coaches
Where enabled, authorized coaches can choose to use AI-assisted workout capture. Selecting “Read photo” sends the prepared workout image through our servers to OpenAI for text extraction. Selecting “Transcribe recording” sends the recording through our servers to Groq for speech recognition. Separate interpretation and correction actions send the relevant workout text, exercise instructions and entered workout values to OpenAI to propose changes. Coaches review the results before applying changes or saving training records.
These tools are intended for workout information. Remove private names, injury or health notes, and unrelated background information before submitting material. The tools do not automatically redact every sensitive detail. Their availability does not expand the permitted uses of Garmin-derived or sensitive health information described elsewhere in this notice.
This capture flow does not durably save original photos or recordings in our app database or file storage by default. Extracted text, inserted transcripts and review information can persist in browser drafts, which have no automatic expiry. Saving completed training also stores the full source evidence and review information, including source lines excluded from the performed workout, alongside the reviewed training records. Workspace access and deletion rules apply to these saved records. Separately enabled coaching-note features require their own explicit review and save action.
OpenAI and Groq process submitted information under their applicable service terms and data controls. Provider handling and retention are separate from what Holistic Path saves. Provider security logs, service processing or other retention exceptions can apply. Processing can occur outside the EU/EEA; we do not promise EU-only processing or zero retention.
Planned Garmin connection
Official automatic Garmin synchronization is in preparation and has not been activated by this notice or by the developer application. The requested first phase is consent-based future Health and Activity synchronization, display and human coach review. A voluntary one-time account-archive upload is the proposed route for historical information, since Starter access does not supply historical backfill.
Training API access is requested for a later phase: an athlete reviews and approves sending a structured running workout to Garmin Connect and a compatible device. The selected workout name, steps, targets and calendar date would be sent. Unrelated health records and coach-private notes should not be included. This requires separate permissions, compatible-device testing and activation review.
Before enabling automatic Garmin features, we will confirm the actual permitted providers, data flow, consent, sharing, revocation and deletion arrangements and update the relevant notice. Submitting a developer request does not connect any athlete or authorize new processing.
Your rights and contact
Depending on the processing and applicable conditions, you can request access, correction, erasure, restriction or a portable copy of your information, and object to processing based on legitimate interests. You can withdraw consent where used. Contact support@holisticpathapp.com; proportionate identity verification may be needed. We normally respond without undue delay and within one month, with any lawful extension explained.
You may complain to Datatilsynet, the Danish Data Protection Agency, or another competent supervisory authority. You do not have to contact us first. Datatilsynet’s website is www.datatilsynet.dk.
Material changes to purposes, providers or features require updated information and any separately required permission. The published notice displays its effective date and is available before the relevant collection.