Privacy Policy — Oxava

Last updated: December 30, 2024

At Oxava Fitness, we take the protection of your personal data very seriously. This privacy policy explains how we collect, use, share, and protect your information when you use our fitness coaching mobile application.

1. Data We Collect

Personal Information

When creating your account and using the application, we collect:

First and last name
Email address
Date of birth
Gender
Height
Weight

Training Data

To provide you with personalized coaching, we collect:

History of your training sessions
Exercises performed, sets, reps, and weights
Food diary and nutritional intake
Progress photos and body measurements
Fitness goals and training preferences
Progress photos (stored securely)

Health Data

Oxava does not currently integrate with Apple Health, Fitbit, or any other third-party health platform, and does not collect the data types below. This section will be updated before any such integration collects real data:

Heart rate
Step count
Calories burned
Sleep data
Active energy

Technical Data

To improve the application and ensure its security:

Device type and model
Operating system and version
Application version
IP address
Error and crash logs

2. How We Use Your Data

We use your data to:

Provide and improve our coaching services
Personalize your training experience
Generate recommendations via our coaching AI
Improve application features
Send you important notifications and communications
Ensure security and prevent fraud
Analyze application usage (anonymized data)

3. Sharing Your Data

We never sell your personal data. We may share your data only in the following cases:

Service Providers

We work with trusted partners for cloud hosting (AWS), analytics (anonymized), and AI services. These partners are contractually required to protect your data.

Third-Party Health Apps

If you choose to connect third-party apps (Apple Health, Fitbit, Strava, etc.), we only share data necessary for synchronization, with your explicit consent.

Social Features

If you use the social features of the application, some information (name, profile photo, public statistics) may be visible to other users according to your privacy settings.

Legal Obligations

We may disclose your data if required by law or to protect our legal rights.

4. Data Security

We implement robust security measures to protect your data:

End-to-end encryption for sensitive data
Secure storage with expo-secure-store
Strict access control and JWT authentication
Regular security audits
Security incident response plan

5. Your Rights (GDPR)

In accordance with the General Data Protection Regulation (GDPR), you have the following rights:

Right of access: You can request a copy of all your personal data
Right to rectification: You can correct your inaccurate or incomplete data
Right to erasure: You can request the deletion of your data
Right to data portability: You can receive your data in a structured format (JSON)
Right to object: You can object to the processing of your data
Right to restriction: You can request the restriction of processing

To exercise these rights, go to Settings > Export My Data or Delete My Account, or contact us at contact@laprogrammerie.com

6. Data Retention

We retain your data as long as necessary to provide our services:

Account data: as long as your account is active
Training data: as long as your account is active
Health data: as long as your account is active
Technical data: 12 months maximum
After account deletion: 30 days (then permanent deletion)

7. Cookies and Similar Technologies

We use local storage technologies to improve your experience:

Essential cookies: necessary for application operation
Analytics cookies: to understand usage (anonymized)
Preference cookies: to remember your choices
Performance cookies: to optimize the application

8. International Data Transfers

Your data may be transferred and stored on servers located outside the European Union, particularly in the United States (AWS). We ensure that these transfers comply with GDPR requirements and that your data benefits from adequate protection.

9. Protection of Minors

Our application is intended for people aged 16 and over. We do not knowingly collect personal data from children under 16. If you believe a minor has provided data, contact us immediately.

10. Changes to This Policy

We may update this privacy policy from time to time. We will inform you of any significant changes by notification in the application or by email. The last update date is indicated at the top of this document.

11. Contact Us

For any questions regarding this privacy policy or your personal data, contact us:

Email: contact@laprogrammerie.com
Postal address: La Programmerie
56 Rue de Panserot
91510 Lardy, France

Data Protection Officer: The legal representative (contact@laprogrammerie.com)