Privacy Policy

This Privacy Policy describes how LifeAnalytics s.r.o. (the "Company", "we", "us", or "our"), trading as MONS and MONS Training, collects, uses, and discloses your personal information when you visit our website at mons.training or coach.mons.training, use our mobile applications, make a purchase, or otherwise communicate with us (collectively, the "Services"). For purposes of this Privacy Policy, "you" and "your" mean you as the user of the Services, whether you are an athlete, a coach, a website or app visitor, or another individual whose information we process.

Please read this Privacy Policy carefully. Because our Services process health, fitness and nutrition information, we treat your data with particular care and only where we have a valid legal basis to do so under the EU General Data Protection Regulation (GDPR) and Czech data-protection law.

Data Controller and Contact

The controller responsible for your personal information is:

LifeAnalytics s.r.o.
Company ID (IČO): 22174281
Ostruzenka 771/3
142 00 Prague 12, Czech Republic
General contact: hello@mons.training
Privacy / data-protection contact: hello@mons.training

If you have any question about how we handle your personal information, or wish to exercise your rights, contact us at hello@mons.training.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time, including to reflect changes to our practices or for other operational, legal, or regulatory reasons. We will post the revised Privacy Policy in the app and on the Site, update the "Last updated" date, and — where the change is material or affects how we process your health data — ask you to review and, where required, re-confirm your consent before the change applies to you.

What Personal Information We Collect

The types of personal information we obtain about you depend on how you interact with our Services. When we use the term "personal information", we are referring to information that identifies, relates to, describes, or can be associated with you.

Information You Provide Directly

• Account and contact details, including your name, email address, and (where you provide them) phone number, age, and gender.
• Payment-related information, such as your name, billing address, and, for invoicing, company or VAT details. Card details are handled by our payment processor — we do not store full card numbers.
• Coaching content you submit, such as messages to your coach, check-in answers, notes, and any documents or forms your coach asks you to complete.
• Customer support information, including the content of messages you send us.

Health, Fitness and Training Information

When you use the MONS app we may collect the following, some of which under the GDPR can be "special category" (sensitive) data and is processed only with a valid legal basis, including your explicit consent where required:

• Body metrics you provide, such as height, weight, gender, date of birth or age, and your training goals.
• Training data, including workouts assigned by your coach, the sets, reps and weights you log, personal records, training notes, and exercise videos or photos you submit for coach feedback.
• Nutrition data, including meals you log, photos of food or nutrition labels you scan, InBody body-composition scan results you upload, and your macro and calorie targets and history.
• Check-in and progress data, including weekly check-in answers, readiness inputs, and progress photos you choose to submit.
• Apple Health and Health Connect data. If you grant permission, MONS reads data such as steps, heart rate, resting heart rate, sleep duration, and active energy from Apple Health (iOS) or Health Connect (Android). MONS does not write data to these sources; this data is read on your device and used solely to inform your readiness and training insights.
• Wearable device data. If you choose to connect a third-party wearable account, we collect fitness and health data from that service. For Oura Ring this includes sleep, readiness, activity, and heart-rate data. For WHOOP this includes recovery, strain, sleep, workout, and body-measurement data. These connections use OAuth and require your explicit authorization. You can disconnect a wearable at any time from your profile settings, which revokes our access.
• App usage and device information, including device type, operating system, app version, unique device identifiers, crash logs, and performance metrics.
• Permissions-based data, such as access to your device camera or photo library to scan or upload food, nutrition labels, InBody results, or progress photos; access to Apple Health or Health Connect data; and notification tokens to send in-app or push notifications.

Some features of the Services require you to provide certain information. You may choose not to provide it, but doing so may prevent you from using those features.

Usage Data and Analytics

On our website we use cookies and similar technologies to run the site and understand how it is used. In our mobile app we use in-app analytics (via our processor PostHog, hosted in the EU) to understand feature usage and diagnose problems. Session replay of on-screen activity is available only in the coach web admin and is fully masked there; it is never enabled in the client app. You are identified to the analytics tool only by an internal account identifier — never by your name, email, or the content of your health, nutrition, or training data.

How We Use Your Personal Information and Our Legal Bases

Under the GDPR we must have a legal basis for each purpose. The table below summarizes how we use your information and the basis we rely on:

• Providing the Services, such as creating and managing your account, assigning and tracking training programs, processing payments, and delivering features — legal basis: performance of our contract with you.
• Training and nutrition personalization, such as calculating readiness, showing training and nutrition insights, and generating AI-assisted weekly and dashboard summaries for your coach — legal basis: performance of contract and, for health-related data, your consent.
• AI-assisted features, such as scanning a nutrition label, food photo, or InBody result, building a program from a plain-text description, and generating AI comments or summaries — legal basis: consent. To provide these features we send the relevant data (photos, scanned text, body-composition values, or written input) to Google (Gemini), which processes it solely on our behalf to generate the result.
• Security and fraud prevention — legal basis: our legitimate interest in keeping the Services and your account safe.
• Service-related communications, including account, coaching, or transaction notifications and push notifications you have opted into — legal basis: performance of contract or our legitimate interest in operating the Services.
• Marketing communications, where offered — legal basis: your separate, opt-in consent, which you can withdraw at any time.

We do not use your health, fitness, or nutrition data for advertising, and we do not sell your personal information.

Automated Processing and Scoring

The Services automatically analyze the data you provide to produce readiness scores, training and nutrition summaries, and similar indicators. This is a form of automated processing (profiling). These outputs are provided for informational and educational purposes only; they are not medical decisions and do not produce legal or similarly significant effects about you. You can stop this processing at any time by withdrawing your consent or deleting your account. If you have questions about how a score is produced, contact us at hello@mons.training.

How We Disclose Personal Information

We share personal information only as needed to run the Services, and only with providers who process it on our behalf under appropriate contractual and security safeguards:

• Infrastructure and hosting providers that store our database and files (Supabase), send transactional email on our behalf (Resend), and host our website (Cloudflare).
• AI providers, specifically Google (Gemini), for nutrition/label/InBody scanning, AI-assisted program building, and AI-generated summaries and comments. Google processes this data only to provide the feature and is subject to contractual restrictions on its use.
• Payment providers, specifically Stripe, to process payments, subscriptions, and payouts to coaches.
• Push notification providers, specifically OneSignal, to deliver notifications you have opted into.
• Wearable device platforms. When you connect a wearable account (such as Oura Ring or WHOOP), we exchange authentication tokens with that provider to retrieve your health and fitness data. We do not send your MONS data to these providers. Apple Health and Health Connect data is read directly from your device and is not shared with any third party.
• Your coach. If you are a client, the coach you are linked to (and, where relevant, their coaching organization) can see the training, nutrition, check-in, and progress data you submit — sharing that data with your coach is the purpose of the Services.
• Where required, to comply with legal obligations, respond to lawful requests from authorities, or protect our rights, and in connection with a business transaction such as a merger.

International Transfers

We are based in the Czech Republic and prefer to keep processing within the European Economic Area (EEA). Some of our processors (for example, Google, Stripe, OneSignal, or other providers) may process data outside the EEA, including in the United States. Where we transfer personal information outside the EEA, we rely on a recognized transfer mechanism such as the European Commission's Standard Contractual Clauses, or an adequacy decision, to ensure your data remains protected.

Security and Retention

We use technical and organizational measures to protect your information, including encryption in transit, access controls, and row-level security that restricts your data to your own account and the coach you are linked to. No system is perfectly secure, but we take safeguarding your health and training data seriously.

We retain your personal and health information for as long as you maintain an account so that we can provide the Services and your history. When you delete your account, we delete your identifiable data and uploaded files, and revoke connected wearable access. We may retain limited records where required by law (for example, transaction records for accounting), and we may retain de-identified or pseudonymized data for research and to improve our models where you have consented to that use; this research data is held separately from your account and is not used to contact or identify you.

Your Rights

Subject to applicable law, you have the following rights in relation to your personal information:

• Access — request a copy of the personal information we hold about you.
• Rectification — ask us to correct inaccurate information.
• Erasure — ask us to delete your personal information (you can delete your account and associated health data at any time from the app).
• Portability — receive a copy of certain information in a structured, machine-readable format.
• Restriction and objection — ask us to restrict or stop certain processing.
• Withdraw consent — where we rely on consent (including for health-data processing, AI features, and marketing), you may withdraw it at any time, without affecting processing carried out before withdrawal.

To exercise any right, contact us at hello@mons.training. We will respond within the time required by law (generally one month). We may need to verify your identity before acting on a request.

Complaints and Supervisory Authority

If you have a concern about how we process your personal information, please contact us first at hello@mons.training. You also have the right to lodge a complaint with a data-protection supervisory authority. Our lead authority is the Czech Office for Personal Data Protection:

Úřad pro ochranu osobních údajů (ÚOOÚ)
Pplk. Sochora 27
170 00 Praha 7, Czech Republic
www.uoou.gov.cz

You may also contact the supervisory authority in your own EU country of residence.

Children

The Services are intended for adults (18+). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us at hello@mons.training and we will delete it.