Privacy Policy
Last updated: 2 August 2026
Who we are
Athmex is operated by Lee Evans, trading as Athmex, a sole trader based in Belfast, United Kingdom. For the purposes of the UK GDPR, Athmex is the data controller for the personal data described in this policy.
Contact: privacy@athmex.com
If you need our full registered postal address — for example to exercise a data protection right in writing — email privacy@athmex.com and we will provide it.
What Athmex does
Athmex holds your training context — your profile, thresholds, goals, races, results and personal bests — and makes it available to Claude or ChatGPT, alongside your training platform's own connector. Athmex does not give training advice. Claude or ChatGPT does the reasoning.
What data we hold
Data you give us directly
- Account details: name, email address, password credentials
- Athlete profile: height, weight, date of birth, sex, primary discipline
- Performance data: FTP, threshold heart rate, maximum heart rate, threshold pace, personal bests
- Training context: goals, races and their priority, race results, athlete notes, injury or constraint notes, shoe rotation, and qualitative sweat-rate and sweat-salt self-assessments where you choose to record them
Data generated automatically
- Records of when Claude or ChatGPT requested data, for security and troubleshooting. These record the tool type, outcome, duration, response size and trusted client name/version when supplied, never the content of your conversation.
- Basic technical logs, including IP address and timestamps
- Vercel Analytics and Speed Insights measurements for site performance and usage.
What we do not hold
Athmex does not connect to Strava, COROS, Garmin, Oura or any other training platform, and does not receive your activities, laps, sleep or heart rate data from them. Those reach Claude or ChatGPT directly through the platform's own connector.
Athmex does not import activity history. Activity-platform connections are installed separately by you and remain controlled by the provider and assistant you choose.
Health data and your explicit consent
Some of what Athmex holds — weight, heart rate values, injury notes — is special category health data under Article 9 of the UK GDPR. We process it only on the basis of your explicit consent, given when you create your profile.
Our legal bases are:
- Explicit consent (Article 9(2)(a)) for health data
- Consent (Article 6(1)(a)) for making your data available to Claude or ChatGPT
- Contract (Article 6(1)(b)) for operating your account
- Legitimate interests (Article 6(1)(f)) for security, fraud prevention and technical logs
You can withdraw consent at any time. Withdrawal does not affect processing that already took place lawfully.
How your data reaches Claude or ChatGPT
This is the core of what Athmex does, so we want to be explicit.
When you connect Athmex to Claude or ChatGPT, you install a private connection using a credential issued to your account. When you ask a question, the assistant requests the relevant data from Athmex, and Athmex returns it. That data becomes part of your conversation with the provider you chose — Anthropic (Claude) or OpenAI (ChatGPT).
What this means in practice:
- Data is only sent in response to a request from your own connected assistant
- Once your data is in your conversation it is handled by that provider under their terms and privacy policy, not ours. We have no control over it at that point.
- Anthropic and OpenAI differ in how long they retain conversations and whether they use them to improve their models. Check your provider's settings and privacy policy.
- You can revoke the connection at any time from your Athmex account, which immediately stops further data being served.
If you would rather your training data were not sent to an AI provider, do not connect Claude or ChatGPT. The rest of Athmex still works.
Who else we share data with
We do not sell your personal data. We do not use it for advertising, and we do not show your data to other Athmex users.
Processors we use:
- Supabase — database, authentication and hosting
- Vercel — web application hosting
- Resend — transactional email
- Stripe — payment processing, if and when paid membership launches. Stripe receives billing details, not your training data.
- Vercel Analytics and Speed Insights — aggregate product performance and usage measurements
We may disclose data where required by law.
International transfers
Where a processor or your chosen AI provider is outside the UK, transfers are made under the UK International Data Transfer Addendum, the European Commission Standard Contractual Clauses, or an equivalent safeguard.
How long we keep it
- Account, profile and training-context data: for as long as your account is open
- Athlete notes and race results: for as long as your account is open, or until you delete them
- After account deletion: your account, profile and context data are permanently deleted. We aim to complete this within 7 days and in all cases within 30 days.
- Technical logs containing IP addresses: no longer than 12 months
Your rights
Under the UK GDPR you have the right to access, rectify, erase, restrict processing of, and port your data, to object to processing, and to withdraw consent.
Within Athmex you can:
- View and edit your profile and training context
- Revoke any Claude or ChatGPT connection
- Download everything Athmex holds about you, at any time, from your account settings
- Delete your account and all associated data
To exercise any right, email privacy@athmex.com. We respond within one month.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk, or call 0303 123 1113.
Security
Data is transmitted over TLS and stored in an access-controlled database. Connection credentials are stored hashed. Athmex is operated by a single person, and access to production data is limited to that person and used only for support and maintenance.
No system is completely secure. If we become aware of a breach affecting your personal data, we will notify you and the ICO as required by law.
Children
Athmex is not intended for anyone under 16. We do not knowingly collect data from children.
Changes
We will post any changes here and update the date above. For material changes affecting how your data is used, we will email you.