Privacy policy

Effective from 21 October 2026. It applies to this Velín website; sections 5 and 6 also describe the Velín service (the apps and the coach cockpit) and data sources from watches and phones.

1. Controller

The controller is not required to appoint a data protection officer (DPO) and has not appointed one. For matters concerning personal data, write to vass@vassweb.com.

2. What data the website processes

• Technical data when you visit — the server the website loads from records ordinary technical data (IP address, time, requested address, browser type) for security and operation. Legal basis: legitimate interest, Art. 6(1)(f) GDPR.
• E-mail or phone call, if you contact us — name, contact details and the content of the message, solely so that we can reply to you. Legal basis: Art. 6(1)(b) GDPR (at your request) or point (f). We keep it for at most 12 months from the last communication, unless it leads to a contract.
• The “I'm interested in Velín” form — name, team or club, e-mail and message, solely to reply to your interest, send you a confirmation of receipt and an offer for Velín. Legal basis: Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract). We keep it for at most 12 months from the last communication, unless it leads to a contract. To protect the form against automated abuse, the server briefly works with a shortened IP address (legitimate interest, Art. 6(1)(f) GDPR); the content of the message is not stored in technical logs.
• Cookies — the website stores only one strictly necessary cookie without personal data (it remembers that you closed the cookie bar) and, if you click the switch, your choice of light or dark mode in your browser; no analytics or advertising cookies (see the Cookie policy).

The website does not use analytics or advertising tools and does not process health data. We do not sell data and we do not carry out automated decision-making or profiling.

3. Recipients

Data may be processed by providers who host the website and e-mail for us, always under a contract pursuant to Art. 28 GDPR — messages from the form are delivered by the e-mail sending service Resend (Resend, Inc., USA) —, and by public authorities where required by law. If a provider processes data outside the EU/EEA, this happens only with safeguards under Art. 44 – 49 GDPR (for example standard contractual clauses).

4. Your rights

• access to data, rectification, erasure, restriction of processing and portability (Art. 15 – 20 GDPR),
• objection to processing based on legitimate interest (Art. 21),
• withdrawal of consent at any time, where processing is based on consent (Art. 7(3)),
• a complaint to the Office for Personal Data Protection of the Slovak Republic, Galvaniho 7/B, 821 04 Bratislava, www.dataprotection.gov.sk.

Send your request to vass@vassweb.com or to the address of the registered office. We will handle it free of charge within one month.

5. The Velín service (apps and coach cockpit) — who sees an athlete's data

This section is not about the website but about the service — the apps for the athlete (Velín Atlét and the older VELÍN app) and the coach cockpit. We put it here because this is the only public place where a club, a coach or an athlete can read it before an agreement. The binding wording is always in the contract.

Where the AI is. The Velín Atlét app does not call the AI itself — the data it records enters the AI through the coach cockpit and — if the athlete also uses the older VELÍN app — through that app too, because both apps work with the same athlete record. Only the older VELÍN app uses the AI directly from the athlete's phone (daily advice, coach, nutrient estimate from meals).

Who the controller is. If a club or a coach orders Velín for their athletes, the club (or coach) is the controller and Vassweb s. r. o. is their processor under Art. 28 GDPR. If an athlete uses Velín on their own, we agree it with them directly.

This is health data. Heart rate variability (HRV), resting heart rate, sleep, stress level and a pain score are a special category of personal data (Art. 9 GDPR). We process them only on the basis of the athlete's explicit consent (Art. 9(2)(a) GDPR), which can be withdrawn at any time — the AI feature is then switched off for that athlete and their data stops entering it.

When the AI runs. In the VELÍN app the daily advice is prepared automatically when the home screen opens and new data has arrived; a training suggestion from the coach only when the athlete requests it, and the nutrient estimate when the athlete saves a meal or adds a photo of it. In the cockpit only when the coach asks the AI something. The Velín Atlét app never starts the AI. The AI does not run in the background or on a timer.

Exactly what goes to the AI. From the cockpit: the athlete's name and discipline, the readiness score and the values it was computed from (HRV and its long-term baseline, resting heart rate, sleep, stress, the estimated energy reserve known as body battery, load), the training plan with notes, upcoming races, daily logs for the last 5 days (feel, effort, sleep, pain) and the coach's notes — and only for the athletes the coach currently has open. From the VELÍN app additionally the personal best, best placing, target times and race times, rivals, form (long-term fitness, short-term fatigue and the balance between them), how the athlete felt and their notes before and after training, where it hurts, the pain history, and food and drink from the daily log; for the nutrient estimate, the description or photo of the meal.

Transfer outside the EEA. It relies on the European Commission's standard contractual clauses (Decision 2021/914), which form part of the Anthropic Data Processing Addendum — an annex to the commercial terms that bind us and Anthropic.

How long the AI keeps it. According to its public documentation, Anthropic deletes inputs and outputs from its systems within 30 days, and its commercial terms state that it does not train models on customer content. Longer retention (up to 2 years) applies only to content flagged under its usage policy. Our server functions do not store the questions or the AI's answers in the database.

A human decides, not the AI. The AI may not change any training by itself — every change must be confirmed manually by the coach or the athlete; a calorie estimate is stored only together with a meal entry the athlete saves themselves. This is therefore not automated decision-making under Art. 22 GDPR.

6. Data sources from watches and phones

Velín takes data from watches and phones only when the athlete connects them and allows it in the system dialog. It only reads the data — it writes nothing to Apple Health, Health Connect or the athlete's account with the watch maker. This is health data (Art. 9 GDPR), so everything in section 5 about explicit consent applies to it.

• Apple Health (HealthKit) — the Velín Atlét app. It reads only the types the athlete allows: HRV, resting heart rate, heart rate recovery after exercise, respiratory rate, blood oxygen, wrist temperature during sleep, cardio fitness (VO₂ max), steps, active calories, sleep and workouts (with duration and distance).
• Apple Health (HealthKit) — the new Velín app for iPhone, once it launches: only sleep, HRV, resting heart rate and workouts.
• Android Health Connect — the Velín app for Android, once it launches: exactly five types, read only: sleep, HRV, resting heart rate, exercise and distance.
• Suunto and COROS — once the connection is switched on: the athlete signs in directly with the maker and Velín takes sleep, HRV, resting heart rate and workouts from their account (from COROS without calories). We store the maker's access keys only in encrypted form.

In the new Velín app, the first phone connection takes at most the last 30 days. We will add the new Velín app's server and its provider to the table in section 5 when the app launches.

Consent and the coach. In the new Velín app, data from watches and phones is stored only with the athlete's explicit consent to the processing of health data (Art. 9(2)(a) GDPR) and consent to connect the specific source (phone, Suunto or COROS). A coach sees it only if the athlete allows that particular coach.

Withdrawal and deletion. A connection can be ended at any time in the app; phone access can also be removed in the Health or Health Connect settings. After disconnecting Suunto or COROS, the data from that source is deleted immediately (COROS requires deletion within 24 hours at the latest) and Velín asks the maker to revoke access. When disconnecting the phone, the athlete chooses whether the data read so far is deleted. Withdrawing consent to the processing of health data deletes all of the athlete's health data (sleep, HRV, heart rate, workouts from watches, morning logs and pain entries); the plan and training history remain.

How long. We keep the data while the consent and connection are valid, or until the athlete deletes their account. The account is permanently deleted 30 days after the request — until then the request can be cancelled.

What it is not used for. We do not sell data from Apple Health, Health Connect, Suunto or COROS, we do not use it for advertising or marketing profiling, and we do not share it with anyone except the providers in section 5 who run the service for us. It serves only to let the athlete, and a coach they allow, see readiness, load and training history.

7. Security and changes

We make data available only to those who need it. We may update this policy; the current version is always on this page.