Privacy Policy — Entrena+

Last updated: June 15, 2026

This Policy explains how Stephanie Sarria ("Entrena+", "we"), with registered office at Gran Vía Asima 20, 07009 Palma de Mallorca, Spain and tax ID 49770369W, processes your personal data when you use the Entrena+ app (iPhone and Apple Watch) and related services (api.entrenaplus.com, app.entrenaplus.com, www.entrenaplus.com).

Data controller: Stephanie Sarria. Contact / Data Protection Officer: hola@entrenaplus.com.

Health data is a special category (GDPR Art. 9): processing is based on your explicit consent.

Use of the Service is also governed by our Terms & Conditions, which include the AI disclaimer (it does not replace medical or professional advice) and your responsibilities for the content you upload.

1. What data we process

Account and identity: email and password (stored hashed, never in clear text), name and profile details.

Health and fitness data (special category), read from Apple Health (HealthKit) with your permission:

  • Heart rate, HRV, resting heart rate.
  • Sleep, wrist temperature, SpO2, respiratory rate, VO2max.
  • Steps, active energy, exercise minutes, workouts.
  • Menstrual flow (if logged), for cycle-aware training.

Training and performance data: sessions, exercises, sets, reps, weight, RPE/RIR, rest; Velocity-Based Training metrics (per-rep velocity, %1RM, power, velocity loss) computed from the Apple Watch motion sensors and, optionally, a Bluetooth barbell sensor; personal records.

Camera (technique analysis): if enabled, the camera analyzes your technique on-device. Live-analysis frames/video are NOT stored or transmitted to our servers in this version.

Photos and videos you upload: if you choose to save or post content (e.g. a clip in your passport, a post to your community circle, or a purchase receipt), that content is stored on our self-hosted media (MinIO) to provide the service. You retain ownership; you warrant that you hold the rights and the consent of anyone who appears (especially minors), under the Terms & Conditions.

Coaching and AI: messages and context with the AI coach ("Sebastián"). Processing may be on-device (Apple Intelligence) or sent to third-party AI providers (Anthropic, OpenAI). We do not use your data to train third-party models.

Technical data: device identifiers, app/OS version, error logs.

2. Purposes and legal bases

Create and manage your account; provide the servicePerformance of a contract (Art. 6.1.b)
Process your health data to train, autoregulate and share progress with your coachExplicit consent (Art. 9.2.a)
AI coachingConsent / performance of a contract
Security, fraud prevention, supportLegitimate interest (Art. 6.1.f)
Billing (paid plans)Performance of a contract / legal obligation

You can withdraw your consent at any time (by revoking Health permissions in iOS and/or in the app settings), without affecting prior lawful processing.

3. Who we share data with

  • Your coach within the platform (sees your readiness, sessions, progress and, live, your active session).
  • Members of your community circle: if you post to a circle (academy/club/team), your content is visible to its members. Circles are private, never public, and supervisors may moderate or remove posts.
  • Service providers (processors): hosting Hostinger (Germany); media self-hosted MinIO; AI Anthropic, OpenAI; payments Stripe (no card numbers stored); integrations you connect (e.g. Strava).
  • Apple (HealthKit): Health data lives on your device.
  • Authorities, where legally required.

We do not sell your personal data.

4. International transfers

If any provider (e.g. AI) processes data outside the EEA, we do so with GDPR safeguards (Standard Contractual Clauses or other adequate mechanisms). Details at hola@entrenaplus.com.

5. Retention

We keep your data while your account is active and, afterwards, for applicable legal periods. Health data is deleted when you close your account or withdraw consent, unless legally required to retain it.

6. HealthKit-specific use (Apple requirement)

  • We only access the Health data necessary for the features you use, with your permission, and never for advertising, marketing or data mining.
  • We do not sell or disclose HealthKit data to third parties for advertising.
  • HealthKit data is used solely to provide your health and fitness service.

7. Security

Encryption in transit (HTTPS), hashed passwords (Argon2id), rotating session tokens, multi-tenant isolation, and restricted access to health data. No system is 100% foolproof, but we work to protect your information.

8. Your rights (GDPR)

You may access, rectify, erase, restrict, object to, and port your data, and withdraw consent. Write to hola@entrenaplus.com. You may also lodge a complaint with your supervisory authority (in Spain, the AEPD, www.aepd.es).

9. Children

Entrena+ may be used for under-age athletes only through an account managed by their parent or legal guardian, who creates it, supervises it and provides the consents needed to process the minor’s data and, where applicable, their image (e.g. technique videos). We do not knowingly collect a minor’s data without that consent. The guardian may exercise the rights under GDPR Art. 8 et seq. on their behalf and withdraw consent at any time.

10. Changes

We may update this Policy. We will post changes here and, if material, notify you in the app.

11. Contact

Stephanie Sarria — Gran Vía Asima 20, 07009 Palma de Mallorca, Spain — hola@entrenaplus.com