Privacy Policy

The company named above is the controller within the meaning of Art. 5 lit. j of the Swiss Federal Act on Data Protection (DSG). It decides on the purposes and means of processing your personal data.

This policy covers the Adactiv Diagnostics web application at adactivdiagnostics.ch and the emails sent in connection with it. It follows the revised Swiss Data Protection Act (DSG, SR 235.1) and the Data Protection Ordinance (DSV, SR 235.11).

If you use the service from outside Switzerland, the data protection rules of your country of residence may apply in addition.

2.1 Account data

When you create an account we process:

• Email address
• Display name (optional)
• Profile picture (optional)
• Account creation time and sign-in times
• If you sign in with Google or Apple: the identifier and email address those providers pass to us

2.2 Ride and test data

When you upload a ride file (.FIT) or enter values manually we process:

• Power data (watts over time) and, where present in the file, heart rate and cadence
• Body weight and sex as entered by you (sex is used to estimate W′)
• Derived physiological values: Critical Power, W′, estimated VO₂max, training zones, substrate utilisation, performance category and rider archetype
• Upload time and file name

2.3 Payment data

Payments are handled by Stripe. Your full card details are processed solely by Stripe and never reach our servers. From Stripe we receive only transaction information such as amount, currency, payment status, timestamp and a payment identifier.

2.4 Technical data

Using the service generates technical data, in particular IP address, browser type, operating system, access time and pages requested. We process these to operate the service, diagnose faults and prevent abuse.

We do not use analytics, tracking or advertising services.

The physiological values derived from your ride data (including Critical Power, estimated VO₂max and training zones) and your body weight are data concerning health, and therefore count as sensitive personal data under Art. 5 lit. c no. 2 DSG.

Processing them requires your explicit consent under Art. 6 para. 7 lit. a DSG. You give it by actively ticking the corresponding box before the analysis starts. Without that tick we do not run the evaluation. You may withdraw it at any time with effect for the future; processing carried out before withdrawal remains lawful.

Without this consent we cannot provide the diagnostic, since it is the entire subject of the service.

Sharing to improve our methods

For a Comprehensive Test we offer you the option of releasing your full analysis result for our own research. We use it solely to improve the Quick Test and the automatic detection of your test intervals against real rides.

What is released is the complete result including the health data derived from it. It is copied to an internal research account held by the same controller and kept there. It is not disclosed to third parties, and the copy stays linked to your account so that we can delete it on request.

The box is ticked by default; you can untick it before the analysis starts. Your analysis is identical either way, and the release is not a condition of using the service. You may withdraw it at any time with effect for the future and request deletion of the copy (contact details below).

The analysis automatically evaluates your ride data in order to assess aspects of your health and performance: your aerobic capacity, your training zones and your standing relative to a reference population. This constitutes profiling within the meaning of Art. 5 lit. f DSG.

The evaluation serves only the diagnostic you requested. No automated individual decision with legal consequences for you is made, and we do not use the results to assess creditworthiness or suitability outside a sporting context.

The service supports coach accounts. If you redeem an invitation sent to you by a coach, or your account is linked to one, your test results become visible to that coach account.

What becomes visible includes: your name or email address, your test results and the physiological values derived from them, your test history, and any notes and targets the coach records about you.

Because these are sensitive personal data, this disclosure takes place only with your explicit consent under Art. 6 para. 7 lit. a DSG, which you give by redeeming the invitation.

Your coach is independently responsible under data protection law for what they do with those data afterwards. If you want the link removed, tell us and we will withdraw access for future analyses.

• Providing the service: running the performance diagnostic and showing you your results.
• Account management: maintaining your account, your test history and your access rights.
• Payments: processing test purchases and coach credits, and the bookkeeping required by law.
• Communication: sending transactional emails such as invitations, confirmations and training zones.
• Security and abuse prevention: detecting fraud, bot access and unauthorised use.
• Improving the service: developing the analysis models. We use data for this only in aggregated or anonymised form.

We do not sell, rent or trade your personal data. We use the following processors, which process your data only on our instructions and for the purposes stated (Art. 19 para. 2 lit. c and para. 4 DSG):

• Google Ireland Ltd. / Google LLC (Firebase): authentication, database and file storage
  Country: Ireland / United States · Safeguard: Adequate protection under Annex 1 DSV; Google LLC is certified under the Swiss–US Data Privacy Framework.
• Stripe, LLC / Stripe Payments Europe Ltd.: payment processing and fraud prevention
  Country: Ireland / United States · Safeguard: Adequate protection under Annex 1 DSV; Stripe, LLC is certified under the Swiss–US Data Privacy Framework.
• Vercel, Inc.: hosting and delivery of the web application
  Country: United States · Safeguard: Adequate protection under Annex 1 DSV; Vercel, Inc. is certified under the Swiss–US Data Privacy Framework.
• Resend (Plus Five Five, Inc.): sending transactional email
  Country: United States · Safeguard: Standard Contractual Clauses under Art. 16 para. 2 lit. d DSG: the EU clauses (Decision 2021/914) with the adaptations required for Switzerland, recognised by the FDPIC on 27 August 2021. Resend is certified under the EU–US Data Privacy Framework and its UK Extension, but not under the Swiss–US framework, so the Annex 1 DSV adequacy does not cover this disclosure.
• Intuition Machines, Inc. (hCaptcha): bot and fraud detection during checkout; embedded by Stripe
  Country: United States · Safeguard: Embedded via Stripe as part of their processing.

Beyond this we disclose data only where we are legally obliged to, or where it is necessary to enforce our rights.

As set out in section 7, personal data are disclosed to the United States and to countries in the European Economic Area.

For the United States we rely on Annex 1 DSV where the provider is certified under the Swiss–US Data Privacy Framework, and otherwise on Standard Contractual Clauses under Art. 16 para. 2 lit. d DSG. For the European Economic Area an adequacy decision under Annex 1 DSV applies.

We will provide details of the safeguards used on request.

We keep personal data only as long as necessary for the purposes described (Art. 6 para. 4 DSG):

• Account and test data: for as long as your account exists. After you delete it we remove them from active systems within 30 days; backups are overwritten within 90 days.
• Payment and accounting records: ten years. This period is required by Art. 958f para. 1 of the Swiss Code of Obligations and takes precedence over a deletion request. It covers amount, date, payment identifier and the details needed to attribute the transaction, not your ride or health data.
• Server and security logs: normally 90 days.
• Aggregated or anonymised analyses: indefinitely, as they no longer relate to an identifiable person.

We take appropriate technical and organisational measures reflecting the heightened protection health data require: transmission over TLS only, encryption of stored data, least-privilege access control and server-side enforced access rules.

Uploaded ride files are processed in memory and not stored as files; what we retain are the computed results.

Under the DSG you have, in particular, the following rights:

• Access (Art. 25 DSG): confirmation of whether we process data about you, and information about those data.
• Rectification (Art. 32 para. 1 DSG): correction of inaccurate data.
• Erasure and prohibition (Art. 32 para. 2 DSG): deletion of your data, or prohibition of a particular processing or disclosure.
• Data portability (Art. 28 DSG): release of the data you provided in a common electronic format, or transfer to another controller.
• Withdrawal of consent: at any time with effect for the future, in particular for the processing of health data and for your coach's access.

A message to info@adactivdiagnostics.ch is enough. We may ask you to prove your identity first.

If you believe we are processing your data unlawfully, you may report this to the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland. Recourse to the civil courts under Art. 32 DSG remains open to you.

On the public pages we set a single strictly necessary cookie (NEXT_LOCALE) which stores your language choice. We use no analytics, tracking or advertising cookies.

Once signed in, Firebase stores authentication information locally in your browser so that you stay signed in. During checkout, Stripe and the hCaptcha bot protection Stripe embeds set their own cookies; these are required to process the payment securely.

We may amend this policy as the service or the law changes. The version published on this page, with the date shown, is the one that applies. We will tell you about material changes in advance by email or in the service.

This policy is governed by Swiss law. The exclusive place of jurisdiction is the Canton of Schwyz, Switzerland. Mandatory provisions of the law at your place of residence are reserved.