Privacy Policy
Effective: September 16, 2026
1. Overview and Scope
This Privacy Policy informs you about the nature, scope, and purposes of the collection and processing of personal data when using the MedalMaker platform (https://medalmaker.app), its companion mobile applications, and Wear OS smartwatch services.
Protecting your personal data — especially sensitive sports science, physiological, and health data — is our highest priority. We process data strictly in compliance with the General Data Protection Regulation (GDPR) and applicable EU/German data protection laws.
2. Data Controller & Contact Details
Data Controller:Concepts for You GmbH
Hardtstr. 43b
85247 Schwabhausen
Germany
Email: privacy@medalmaker.app
3. Special Category Data: Processing of Athlete Health Data (Art. 9 GDPR)
MedalMaker processes health and performance data to optimize training load and reduce injury risks. In accordance with Art. 9(2)(a) GDPR, processing is based on explicit, voluntary consent:
- Daily Wellness & Recovery: Sleep duration/quality, muscle soreness, fatigue, mental and academic stress levels.
- Load Monitoring (ATL, CTL, ACWR): Session RPE multiplied by duration in minutes.
- Injury Tracking & Pain Mapping: 2D/3D anatomy markers, severity, injury diagnosis, and return-to-play timelines.
- Menstrual Cycle Coaching: Cycle phase tracking to support female physiology and load adaptation.
- Wearable Biometrics: Heart rate, HRV, and sleep stages via Garmin, Whoop, Polar, Apple Health, or Google Health Connect.
4. Multi-Tenant Isolation & Data Security
All athlete records are isolated per organization. Coaches only have access to athletes assigned to them. Data is hosted in ISO 27001 and SOC 2 Type II certified European Union data centers (Compute & App in Frankfurt am Main, Germany · Relational Database in Ireland, EU).
5. Automated WhatsApp Notifications (Meta WhatsApp Cloud API)
For the optional delivery of automated daily check-in reminders, we utilize the official WhatsApp Business Cloud API provided by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
The following strict privacy safeguards apply:
- Zero Health Data Transmission: We only transmit neutral notifications (e.g., "Hello [Name], please remember to complete your daily check-in for [Club]!"). Special category health or biometric data pursuant to Art. 9 GDPR (wellness scores, pain points, menstrual cycle, or training loads) is never transmitted via WhatsApp.
- Data Processing Agreement & Safeguards: Meta processes message payloads pursuant to Art. 28 GDPR under the official Meta WhatsApp Business Data Processing Terms, safeguarded by European Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework (DPF).
- Voluntary Participation & Opt-Out: Athletes may choose whether to provide a mobile phone number for WhatsApp reminders and can opt out at any time by updating their profile or clearing their phone number.
6. Web Analytics & Cookies (Google Analytics 4 / Google Consent Mode v2)
Web analytics cookies and identifiers are only loaded after you have provided your explicit prior consent via our cookie settings banner pursuant to § 25(1) TDDDG and Art. 6(1)(a) GDPR. Through Google Consent Mode v2, all tracking storage is denied by default until you actively opt in.
7. Your Rights as a Data Subject
Under Chapter III of the GDPR, you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), data portability (Art. 20), and withdrawal of consent at any time without affecting past processing.