Athmex
On this page

Privacy Policy

Last updated: 25 October 2026

Who we are#

Athmex is operated by Lee Evans, trading as Athmex, a sole trader based in Belfast, United Kingdom. For the purposes of the UK GDPR, Athmex is the data controller for the personal data described in this policy.

Contact: privacy@athmex.com

If you need our full postal address, for example to exercise a data protection right in writing, email privacy@athmex.com and we will provide it.

What Athmex does#

Athmex keeps your athlete context (your profile, goals, races, personal bests, thresholds and constraints) and makes it available to the ChatGPT or Claude assistant you connect. Athmex does not give training advice. ChatGPT or Claude does the reasoning.

What data we hold#

Account data

  • Your name and email address
  • Account and authentication identifiers

Sign-in credentials are managed by our authentication provider, Supabase Auth. Athmex does not store your password in readable form.

Athlete profile and training context

  • Date of birth, height, weight, and sex where you supply it
  • Primary discipline or training focus
  • Home country, and region or city where you supply it or where it is needed for your membership
  • Personal bests and thresholds, such as FTP, threshold heart rate, maximum heart rate and threshold pace
  • Goals, races and their priority
  • Training availability and constraints, including injuries or health-related constraints you choose to record
  • Equipment and shoes
  • Athlete notes and the history of your profile values
  • Sweat-rate and sweat-salt self-assessments, where you use them

Billing and membership data

  • Stripe customer and subscription references
  • Your chosen billing interval (monthly or annual), billing market and currency
  • Trial dates, billing-period dates, and renewal or cancellation dates
  • Subscription and payment status
  • Limited records of checkout and billing outcomes

Athmex does not store your full card details.

Contact and support

If you use the contact form or email us, we keep your name, email address and message so we can reply, provide support and keep an appropriate record of the enquiry.

Email

We send transactional emails and account or service emails. If you opt in, we also send Athmex product updates and offers. We keep minimal records of your consent, any unsubscribe or suppression, and delivery status.

Data generated automatically

  • Records of when ChatGPT or Claude requested or updated data, for security and troubleshooting. These record the type of request, its outcome, its duration and timing, the response size and, where supplied, the trusted client name and version. They never record the content of your conversations.
  • Basic technical logs, including IP addresses and timestamps.
  • Website measurements from Vercel Web Analytics, which reports aggregate site usage and is designed to work without cookies or persistent cross-site tracking of visitors, and Vercel Speed Insights, which provides anonymous, aggregate performance measurements.

Activity data

Athmex is not an activity-history importer. Depending on the platform and assistant you use, your training and activity information may reach ChatGPT or Claude through different supported connection methods that you set up with those services. Athmex's role is your persistent athlete context.

Some of what Athmex holds is special category health data under Article 9 of the UK GDPR: for example your weight, heart-rate values, injury information, health-related constraints and any other health information you choose to add. We process it only with your explicit consent, which you give separately when you create your account.

  • Contract (Article 6(1)(b)): to provide your account, the service and your membership
  • Explicit consent (Article 9(2)(a)): for special category health data
  • Consent (Article 6(1)(a)): for making your athlete data available to the AI provider you choose
  • Consent: for opted-in product update and offer emails
  • Legitimate interests (Article 6(1)(f)): for security, fraud prevention, service reliability, technical logs and, where appropriate, support administration

You can withdraw consent at any time. Withdrawal does not affect processing that already took place lawfully. You can object to processing based on our legitimate interests by contacting privacy@athmex.com.

How your data reaches ChatGPT or Claude#

This is the core of what Athmex does, so we want to be explicit.

When you connect Athmex to ChatGPT or Claude, you set up a private connection for your account. Data then moves in two directions:

  1. When your connected assistant requests it, Athmex returns the relevant parts of your athlete context. That data becomes part of your conversation with the provider you chose: OpenAI (ChatGPT) or Anthropic (Claude).
  2. Where supported, and when you ask for it, your assistant can send updates to your athlete profile, which Athmex stores.

What this means in practice:

  • Data is only sent in response to a request from your own connected assistant.
  • Athmex does not store your ChatGPT or Claude conversations.
  • Once your data is in your conversation, it is handled by that provider under their terms and privacy policy, not ours.
  • OpenAI and Anthropic differ in how long they keep conversations and whether they use them to improve their models. Check your provider's settings and privacy policy.
  • You can revoke a connection at any time from your Athmex account, which stops further data being served.

If you would rather your athlete data were not sent to an AI provider, do not connect ChatGPT or Claude.

Payments through Stripe#

Membership payments are handled through Stripe Managed Payments. For these transactions, Stripe, selling through Link, acts as the merchant of record. To manage your purchase, Stripe may receive your name, email address, billing and contact details, payment information, and membership and order details. Stripe uses this information under its own privacy information.

Athmex does not give Stripe your athlete profile or training context because you make a payment.

Who we share data with#

We do not sell your personal data. We do not use your athlete profile for advertising, and we do not show your data to other Athmex users.

  • Supabase: database, authentication and hosting
  • Vercel: website and application hosting, Web Analytics and Speed Insights
  • Resend: sending transactional, account and opted-in product update emails
  • Stripe (Managed Payments and Link): membership checkout, subscriptions and payments
  • OpenAI: when you connect and use ChatGPT with Athmex
  • Anthropic: when you connect and use Claude with Athmex

Some of these act on our behalf as processors. Others, such as Stripe as merchant of record and the AI provider you choose, handle data under their own terms. We may also disclose data where the law requires it.

International transfers#

Some of these providers process data outside the UK. Where a transfer needs a safeguard, we rely on an appropriate mechanism, which may include UK adequacy arrangements, the UK International Data Transfer Agreement, or the UK Addendum to approved standard contractual clauses. The mechanism depends on the provider.

Contact privacy@athmex.com if you want information about the safeguards used for a particular transfer.

How long we keep it#

  • Account, profile and training-context data: while your account is open, subject to your right to delete it and to any legal requirements.
  • Technical and security logs containing IP addresses: no longer than 12 months.
  • Consent records: kept where necessary to show what you agreed to and when.
  • Billing and accounting records: kept where required for tax, accounting or other legal obligations.
  • Contact and support correspondence: kept for a reasonable period to handle your enquiry and any related dispute.
  • Marketing consent and unsubscribe records: kept as long as needed to respect your choices.

When you delete your account, your athlete profile and context are deleted through our account deletion process. We aim to complete this within 7 days and always within 30 days. We may keep limited records where the law requires it, for tax or accounting, to prevent fraud, or to handle disputes or legal claims.

Your rights#

Under the UK GDPR you have the right to access, rectify and erase your data, to restrict processing, to data portability, to object to processing, and to withdraw consent.

Within Athmex you can:

  • View and edit your profile and training context
  • Revoke any ChatGPT or Claude connection
  • Download everything Athmex holds about you from your account settings
  • Delete your account

To exercise any right, email privacy@athmex.com. We respond within one month.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113.

Security#

Data is sent over TLS and stored in an access-controlled database. Connection credentials are stored hashed. Access to production data is restricted and used only for support and maintenance.

No system is completely secure. If we become aware of a breach affecting your personal data, we will notify you and the ICO as the law requires.

Children#

Athmex is not intended for anyone under 16. We do not knowingly collect data from children.

Changes#

We will post changes here and update the date above. If a change materially affects how your data is used, we will tell you appropriately, including by email where necessary.

Website cookies, analytics and campaign attribution#

This section covers optional measurement on athmex.com. It is separate from the account, health data and membership processing above, and it never depends on your account consent. The full detail is in the Cookie Policy.

Your choice. A cookie card on the site lets you allow or decline optional cookies. We remember that choice in a first-party cookie called athmex_consent for about six months. You can change it at any time with Cookie settings in the footer.

Analytics (only if you allow it). Google Analytics, provided by Google Ireland Limited, shows us which pages are used and how visitors reach Athmex. It sets cookies and may send your IP address and browser details to Google, which can involve a transfer outside the UK.

Marketing (only if you allow it). Google Tag Manager loads our advertising measurement only if you choose Marketing. This includes the Reddit Pixel, which measures visits to public Athmex pages and whether a genuinely new account was created after someone saw or clicked a Reddit advert. Reddit may receive the page address and referrer plus technical details such as your IP address, browser and device. We do not send Reddit your name, email address, account identifier, athlete data or signup form values. We will not activate the Pixel until Reddit's Enhanced Metadata Sharing and Automatic Advanced Matching have been disabled and verified off.

Campaign attribution (only if you allow Analytics). We save in your browser the source, medium, campaign, content and term of the link that brought you to Athmex, the page you landed on, the website you came from and the time. If you then create an account, we store these details against your account in a dedicated record, so we can see which channels bring athletes to Athmex. We do not use fingerprinting or match IP addresses. This record is deleted when you delete your account, and your browser copy is removed if you withdraw your choice.

Legal basis. Consent (Article 6(1)(a) UK GDPR and the Privacy and Electronic Communications Regulations), which you can withdraw at any time without affecting your account.

Service activity summaries#

When your connected assistant reads or changes information in Athmex, we keep a small record for support, reliability and understanding which features are being used. The record may show the type of request, whether it succeeded, the fields involved and a short description—for example, a race name and priority, a goal and target date, or a cycling FTP or running personal best that was recorded.

These summaries do not copy your ChatGPT or Claude conversations, race-note text, injury or schedule notes, addresses, shoe names, login credentials or full request and response bodies. Other health measurements, such as weight and heart rate, are described by category rather than copied into these summaries. Athmex staff can view this activity in the restricted administrative area. We do not use it for advertising or share it with other athletes.

The service log is shown in the admin for recent requests and is subject to Athmex's account deletion process and other applicable record-retention requirements. The underlying profile information you ask Athmex to save continues to be stored separately in your athlete account.