Health Data Processing Consent

Last updated: 31 August 2026.

AI Athlete provides personalised training and coaching support. To analyse training, workload, recovery and related information, the Service needs to process data that may reveal your health. Health data is special-category personal data under Article 9 of the EU General Data Protection Regulation (“GDPR”).

This document explains the explicit consent requested from you. It should be read together with the Privacy Policy and Terms of Service.

1. Controller

You give this consent to:

• Talyvro OÜ
• Registry code: 17553163
• Address: Pihlaka tee 11-2, 75312 Peetri alevik, Rae vald, Harju County, Estonia
• Privacy contact: privacy@ai-coach.ee
• General contact: support@ai-coach.ee

2. Legal Basis and Nature of the Consent

By using the separate, unticked consent control described in section 12, you give explicit consent under Article 9(2)(a) of the GDPR for Talyvro OÜ to process the health-related data described below for the stated personalised-coaching purposes.

For ordinary personal data needed to provide the Service, Talyvro OÜ also relies on Article 6(1)(b) of the GDPR. Security, accounting, consent-evidence and legal-claim records may be processed on the other bases described in the Privacy Policy.

This consent is not inferred from accepting the Terms, opening an account, continued use, silence or a pre-ticked box.

3. Core Purposes Covered by This Consent

Your core health-data consent covers processing that is objectively necessary to provide the health-personalised coaching features you request:

• creating and maintaining your athlete profile and training history;
• analysing planned and completed training, competitions, goals, workload, readiness, recovery and progress;
• generating AI-assisted training, recovery, load-management and season-planning recommendations;
• taking account of injuries, symptoms, pain, discomfort, fatigue, sleep-related notes, wellbeing and recovery information that you choose to provide;
• analysing body measurements, heart-rate information, test results and similar indicators relevant to training;
• processing uploaded training files, archives, images or videos for the requested analysis;
• presenting results, explanations, trends and warnings within your account.

The consent does not cover advertising, sale of data, unrelated research, eligibility decisions, insurance, employment decisions or training a general AI model.

4. Health-Related Data Covered

Depending on what you submit or connect, the processing may include:

• training volume, intensity, exercise type, pace, distance, duration, route, power and workload;
• heart rate, heart-rate zones, VO2max and fitness or performance test results;
• recovery, fatigue, sleep-related notes, readiness and wellbeing ratings;
• injuries, symptoms, illness information, pain, discomfort and functional limitations;
• body weight, height, body composition and other measurements;
• competition history, training history, goals and indicators derived from them;
• health-related content in messages, comments, uploaded files, images or videos; and
• health-related data imported from an optional connected service after you separately choose to connect it.

We ask you not to submit information that is not needed for the feature you are using.

5. Separate Optional Choices

The following processing is not activated merely because you give the core consent:

5.1 Nutrition and allergy features

If a feature processes food restrictions, allergies, meal information or other nutrition data that reveals health, it is activated through a separate, clearly labelled choice. Refusing that choice does not disable unrelated training features.

5.2 Garmin, Strava or another integration

An integration remains disconnected until you take a separate affirmative action. At connection, you are shown the relevant data categories and permission scope. You can refuse or later disconnect it without losing unrelated features.

Once health-related data has been imported at your request, the core consent permits its use for the personalised coaching purposes in section 3. Disconnecting stops future imports but does not itself delete data already imported.

5.3 Optional product research or analytics

Identifiable health data, private training history and AI conversations are not used for optional product research, broad analytics or model training unless a new, specific, separate and genuinely optional explicit consent is presented.

6. AI Processing and Service Providers

The Service uses AI to analyse the information you provide and generate the output you request. Relevant health-related data may therefore be sent to the current AI provider, OpenAI, acting as a processor under a data-processing agreement. Stored explicit-health context is enabled separately for each AI workflow. When enabled, it is consolidated into one health-context block; each included health field is limited to 2,000 characters and ends at a natural text boundary. If the relevant workflow switch is off or missing, the explicit-health fields covered by the matrix are removed from the stored context before transmission. The current message you type into AI Coach chat is your direct request and is not part of this stored-context limit.

We apply data minimisation:

• only data reasonably needed for the requested analysis is included;
• direct identifiers such as your name and email address are excluded where they are not needed;
• access is limited to authorised systems and personnel; and
• your data is not used to train or fine-tune a general AI model unless you later make a separate, specific and optional choice.

Other necessary processors may host the application, store files and databases, deliver email or monitor technical errors. The current provider categories, main providers, legal roles and international-transfer safeguards are described in the Privacy Policy.

Some approved providers or subprocessors may process data outside the European Economic Area. Talyvro OÜ uses the safeguards described in the Privacy Policy, such as an adequacy decision or the European Commission’s Standard Contractual Clauses, together with supplementary measures where needed.

7. AI Limitations and Health Safety

AI output may be inaccurate, incomplete or unsuitable for you. AI Athlete is intended for general training and coaching support and is not intended as a medical device, diagnosis, treatment plan or substitute for a doctor, physiotherapist, dietitian, coach or other qualified professional.

Do not rely on an AI output as the sole basis for a health or safety decision. Seek qualified advice if you have an injury, illness, unusual symptoms, pain or doubt about whether an activity is safe.

The Service does not make solely automated decisions that produce legal effects concerning you or similarly significantly affect you within Article 22 of the GDPR.

8. Why Consent Is Requested and Whether It Is Voluntary

Giving consent is your choice. You are not legally or contractually required to use AI Athlete’s health-personalised coaching.

However, processing health-related training and recovery information is objectively necessary for those coaching features. If you do not consent, or if you withdraw consent, Talyvro OÜ cannot provide the affected personalised coaching functions.

Refusal or withdrawal does not prevent you from:

• accessing account, billing and privacy controls as far as reasonably possible;
• cancelling a subscription;
• requesting data export or erasure;
• exercising consumer or data-protection rights; or
• using a feature that does not require health data, where such a feature is available.

Your decision is not used for advertising or to penalise you outside the functions that technically depend on the consent.

9. Withdrawing Consent

You may withdraw consent at any time:

• through the privacy or consent settings in your account; or
• by contacting privacy@ai-coach.ee.

Withdrawal must be as easy as giving consent and does not require a reason.

After withdrawal:

• Talyvro OÜ blocks new AI analysis and skips queued AI work without undue delay;
• a response from an already running request is not used if the withdrawal is detected before the result is accepted;
• affected coaching features are disabled;
• no new health data is sent to AI or other processors for coaching;
• processing carried out before withdrawal remains lawful;
• the data is not automatically deleted; and
• you may separately delete available data or request erasure of the account.

You may later give fresh consent to reactivate the affected features. We do not treat an earlier withdrawn consent as restored automatically.

Data already held in short-lived provider logs or backups is removed according to the restricted retention and rotation periods in the Privacy Policy and is not restored to active coaching use.

10. Evidence of Consent and Withdrawal

To demonstrate compliance, Talyvro OÜ keeps a limited record of:

• your account identifier;
• the document version and language shown;
• the choices you made;
• the date, time and method of consent or withdrawal;
• the applicable parent or guardian authorisation; and
• limited IP-address and user-agent evidence where proportionate.

This evidence record is not used for coaching, advertising or model training. It is normally kept for up to three years after the account relationship ends and longer only where reasonably needed for an active complaint, investigation or legal claim, as explained in the Privacy Policy.

The evidence record is retained on compliance and legitimate-interest grounds and does not depend on the withdrawn health-data consent.

11. Adult Eligibility

This consent is collected only from an account holder aged 18 or older. The current invite-only Service is not offered to minors and does not use a guardian-authorisation route for new accounts.

12. Explicit Consent Declaration

The consent must be collected through a separate, unticked control using wording equivalent to:

> I explicitly consent to Talyvro OÜ processing my health-related and special-category personal data for the personalised training, recovery and AI-assisted coaching purposes described in the Health Data Processing Consent. I understand that relevant data will be processed by necessary service providers, including the AI provider, and that I can withdraw consent at any time, after which the health-dependent coaching features will stop.

The interface must link to this document and the Privacy Policy before the user confirms the choice. Acceptance of the Terms must be collected separately.

Optional nutrition, integration, research or analytics choices must not be bundled into this core declaration where a separate choice is reasonably possible.

13. Rights, Questions and Complaints

Your data-protection rights, retention periods, recipients and international-transfer safeguards are described in the Privacy Policy.

Questions and requests may be sent to privacy@ai-coach.ee.

You may also lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or the supervisory authority of the EEA country where you habitually reside, work or consider that an infringement occurred.

14. Language

The English and Estonian versions are intended to have the same meaning.

For a user giving consent through the Estonian-language interface or a Consumer habitually resident in Estonia, the Estonian version prevails to the extent of an inconsistency. For other users, the English version prevails to the extent of an inconsistency.

Mandatory transparency and language requirements remain unaffected.