Privacy Policy

This app processes health data. Under Article 9 of the General Data Protection Regulation (GDPR) this is a specially protected category of data. That is why this text is longer than usual, and why we ask for your explicit consent before you first use the app.

1. Controller

Email: info@postpartum-performance.de
Phone: +49 1520 668 5908

No data protection officer has been appointed. Please direct all data protection questions to the address above.

2. What data we process

2.1 Account data

Your email address and, if you register with a password, a password hash. If you sign in with Google, we receive instead the email address held by Google and a user identifier. In addition, the time of registration and the time of the last sign-in.

2.2 Basic personal data

Name and date of birth.

2.3 Health data (Article 9 GDPR)

From the intake and its later updates:

• type of birth and birth complications
• number and dates of births
• breastfeeding status
• whether medical clearance for exercise has been given
• complaints and symptoms, including pelvic floor symptoms
• warning signs ("red flags")
• current activity level and training goals
• answers to the screening questions and to the level-gate questions
• a summarising description in text form derived from the above

From the training itself:

• which sessions you completed and when
• which exercises you performed or substituted
• whether the session was free of pain and symptoms
• how strenuous you found it
• free-text notes you add yourself

2.4 Usage and log data

Generated training plans, logs of plan generation including any errors, consumption figures for AI use (number of text units processed, model used, time) and logs of proposed profile changes and their confirmation.

2.5 Server logs

When the app is accessed, our web server automatically records the IP address, date and time, the address requested, the response status and the volume of data transferred.

2.6 Consent record

The time of your consent, the version of the texts you agreed to, the language in which they were shown to you, and any withdrawal with its time. We deliberately do not store your IP address for this purpose.

3. Purposes and legal bases

For the health data in section 2.3, explicit consent under Article 9(2)(a) GDPR is the operative basis. Without it the app cannot deliver its core service, because every recommendation rests on that information.

4. Recipients

We pass your data only to the following service providers, who act for us as processors under Article 28 GDPR. There is no sale of data and no disclosure for advertising purposes.

All processing of health data takes place within the European Union. For Switzerland, an adequacy decision of the European Commission is in place.

If you sign in via Google, data is also transferred to the USA. The basis is the European Commission's adequacy decision on the EU-US Data Privacy Framework. This transfer concerns the sign-in process only, not your health data. You can avoid it entirely by registering with an email address and password instead.

5. AI-assisted generation of training plans

To generate training plans we transmit to Mistral AI in France your symptom information, your training goals, the number of weeks since the birth, your training level and the equipment available to you.

Your name is not transmitted. It is stripped from free-text entries before sending, and an automated test verifies this on every code change. Likewise, your email address, your date of birth and your account identifier are not transmitted.

The information transmitted nonetheless remains health data in pseudonymised form; we do not present it as anonymous. The model's response is then validated against our reviewed exercise catalogue and fixed safety rules before it is shown to you.

6. No automated decision-making under Article 22 GDPR

The app calculates a training level from your information. This classification produces no legal effect concerning you and does not similarly significantly affect you: it governs only which exercises are suggested. A supervising trainer can review and override it. No automated decision in an individual case within the meaning of Article 22 GDPR takes place.

7. Cookies and local storage

The app sets only those cookies that are technically necessary for signing in. They maintain your session; without them signing in is not possible. In addition, your browser stores your appearance preference (light or dark) locally.

We use no analytics, tracking or advertising cookies and embed no third-party services for such purposes. Because every cookie used is strictly necessary under § 25(2) no. 2 TDDDG for the service you have expressly requested, no separate consent is required for it. For the same reason, we do not show you a cookie banner.

8. Retention periods

If you delete your account in the settings, your basic data, your intake, your training plans, your training history and your account are removed immediately and irreversibly. Statutory retention obligations, in particular under commercial and tax law for invoicing records, remain unaffected.

9. Your rights

You have the following rights against us:

• access to the data stored about you (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• objection to processing based on a legitimate interest (Art. 21 GDPR)

Three of these rights can be exercised directly in the app, without writing to us. In the settings you will find:

• Withdraw consent – revokes your consent to the processing of your health data with effect for the future.
• Download my data – outputs your account, your basic data, your intake and your consent history as a machine-readable file.
• Delete account – removes your account and data in full.

For anything else, an informal message to info@postpartum-performance.de is enough.

10. Withdrawing consent

You may withdraw your consent at any time and without giving reasons. Withdrawal is possible with one click in the app settings and is therefore just as easy as giving consent (Art. 7(3) GDPR).

The lawfulness of processing carried out up to the point of withdrawal remains unaffected. After withdrawal we can no longer create training plans for you, because the necessary basis falls away. Your existing data remains until you delete it or remove your account.

11. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 27, 91522 Ansbach, Germany
www.lda.bayern.de

You may also contact the supervisory authority where you live.

12. Whether providing data is required

Providing your account data is necessary in order to conclude the contract. Providing your health data is not required by law, but is technically necessary: without it the app cannot generate safe training recommendations. You are free not to provide it — but then you cannot use the app.

13. Changes to this policy

If we change this policy materially, we will present it to you again for confirmation the next time you open the app. Earlier versions and the time of your respective consent remain documented in the consent record.

Version of 1 September 2026.