Privacy Policy

The controller of your data is Running Lab (formalabs.es), the training follow-up platform Luis del Águila uses with his athletes. For any privacy question or to exercise your rights, write to info@formalabs.es.

Account data: name, email and profile picture. Sign-in is handled by Clerk, with email or with your Google, Apple or Microsoft account. Training data: planned and completed sessions, metrics (heart rate, pace, power, cadence), competitions and goals. Health data: wellness reports (sleep, heart rate variability, fatigue, mood, etc.) and injuries. This is special category data. Messages: the conversations between you and your coach inside the platform. Connected-service data: if you connect Strava (or another supported service), we import your activities. Access tokens are stored encrypted. Technical data: IP address, device type, and error and usage logs needed for the security and operation of the platform.

To provide the training follow-up service (planning, analysing sessions, communicating with your coach, sending you service emails). Legal basis: the coaching relationship you have accepted (Art. 6.1.b GDPR). To process your health data. Legal basis: your explicit consent (Art. 9.2.a GDPR), which you give when you accept the invitation and create your account. You can withdraw it at any time, although follow-up is not possible without this data. Security and proper operation of the platform (technical logs, abuse prevention). Legal basis: legitimate interest (Art. 6.1.f GDPR). We use artificial intelligence tools to help your coach analyse your sessions and prepare your plan. Training decisions are made by your coach; we do not take decisions based solely on automated processing that have legal effects on you. We do not sell your data or use it for advertising.

Your coach, Luis del Águila, has access to all your training and health data on the platform. Other athletes cannot see it. The people who technically maintain the platform may access data when strictly necessary for support or security, under a duty of confidentiality. Beyond that, only the providers listed below access your data, and only to provide their service to us.

We use the following providers (data processors): Clerk: authentication and account management. Anthropic: AI processing. When AI features are used, the training and methodology data needed is sent to its API to generate the result. Anthropic does not use this data to train its models. Microsoft Azure: application hosting and file storage, in the Germany West Central region (Frankfurt). Neon: managed database (PostgreSQL). Strato: sending service emails. Strava (only if you connect it): we import your activities read-only; nothing is sent back or shared. Some of these providers (for example Clerk and Anthropic) may process data outside the European Economic Area, in particular in the United States. In those cases the transfer relies on the safeguards provided by the GDPR, such as the European Commission's standard contractual clauses.

Communications are encrypted with HTTPS/TLS, and so is the database connection. Tokens for integrations such as Strava are stored encrypted (AES-256-GCM) and used solely to sync your activities. Access to data is limited to those who need it. No system is completely secure; if a security breach affecting you occurs, we will tell you and notify the supervisory authority where the law requires it.

Running Lab only uses technical, necessary cookies and local storage: the sign-in session (managed by Clerk) and your language and theme preferences. We do not use advertising, analytics or tracking cookies, so we do not need to ask for your consent for them.

You can exercise the following rights at any time: Access: know what data of yours we process and get a copy. Rectification: correct inaccurate data. Erasure: ask us to delete your data. Restriction: ask us to restrict processing in certain cases. Objection: object to processing based on legitimate interest. Portability: receive your data in a structured, commonly used format. Withdraw consent: without affecting processing already carried out. Write to info@formalabs.es. We will reply within one month at most and, if needed, ask you to verify your identity. If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es).

We keep your data while you are part of the platform. When your coaching relationship ends, or if you ask us to, we will delete it within 30 days at most, except for data we must keep by legal obligation, which will be blocked for the applicable period. Technical logs are kept for 30 days at most.

If we make a material change to this policy, we will let you know by email or inside the app. The date of the last update is shown at the top of this page.