Privacy policy
Test Day works with data about your health. Here is, in plain words, what we do with it. Valid from 7 November 2026. The Czech version is binding.
Who processes the data
The controller is Ondřej Brabec, sole trader, company ID 19356382, address Bolevecká 1409/6, 301 00 Plzeň, Czech Republic, e-mail ondra@testday.eu.
What data and why
| Data | Why |
|---|---|
| E-mail, name, date of birth, sex | Your account, the 18+ age check, age and sex for test results. |
| Test results: blood pressure, heart rate, waist, height, grip, jump, balance, push-ups, fitness, who measured and with what | Results and change between rounds. Also an aggregated evaluation of how accurate the measurements and watches are against a chest strap. |
| From Apple Health or Health Connect: sleep with stages, heart rate, resting heart rate, HRV, heart rate recovery, SpO₂, breathing, wrist temperature, steps, distance, exercise minutes, weight, body fat, VO₂max, workouts, food from other apps | Morning verdict, overviews and trends. Only daily summaries and workout summaries go to the server, not every heart rate sample. |
| Workouts, sets, goals, routines, weekly check-in | Workout log, records, load. |
| Food: text, protein, carbs, fat, calories, caffeine, alcohol, water | Food overview. We do not store food photos, they are only used for one estimate. |
| Messages to the coach | Coach answers and chat history. Your trainer does not see them. |
| Voice notes from your trainer, bookings | Contact with your trainer and arranging measurements. |
| Payment for a test with a trainer: amount, payment status, Stripe payment ID | Booking and paying the trainer. Card numbers never reach us, Stripe handles them. |
| Round plan: goal, training days and time, equipment, test results | Building a 13-week plan. With AI consent it is built by the Claude model, otherwise by rules only. |
| Data from an import you upload yourself (weights, runs, nights, tags, supplements, saved meals) | Your history in the app. Goes to AI only with AI consent. |
| Polar, Garmin and Oura through their APIs, when you connect them: sleep with stages, HRV, heart rate, breathing, temperature deviation, steps, workouts | Morning verdict and overviews. Disconnecting deletes the data from that source right away. |
| Blood results and other records: DEXA, InBody, lab VO₂max, blood pressure | Record and trend, no interpretation. Only with the Blood results consent. We do not store photos or PDFs of results. |
| Genetics: only two variants, ACTN3 (rs1815739) and CYP1A2 (rs762551) | A record and context from studies. Only with a separate consent, never to AI or your trainer, the plan does not change because of them. A DNA test file is read only on your phone and all other variants are discarded immediately. |
| Your own day tags, supplements, your own numbers | A diary and what it shows about your sleep. Your data, not proof of cause. |
| Sign in with Apple: Apple identifier, e-mail (may be hidden) and refresh token | Sign-in. We keep the token so that deleting your account can also revoke access at Apple. |
Only on your phone, never sent to us: cycle (the cycle day is calculated on the phone from Apple Health or Health Connect, only with a separate consent), body photos, the raw DNA test file, notifications and events in the Test Day calendar.
Workout details and routes (second-by-second heart rate, kilometres, laps, power, technique, map) are read by the app directly from Health on your phone only when you open the workout. We do not store them and neither your trainer nor AI gets them. Only a workout summary reaches us: type, time, duration, distance, average and maximum heart rate, minutes in heart rate zones and effort.
We do not use Apple Health data for advertising, we do not sell it and we do not give it to data brokers. We only write workouts logged in our app to Apple Health. The app has no advertising and no cross-app tracking.
Legal basis
- Account and measurements: performance of a contract.
- Health data: your explicit consent, Article 9(2)(a) GDPR.
- Evaluating the accuracy of measurements and watches: only in aggregates, without names or contacts.
Consents
You give each consent separately, nothing is pre-ticked and you can withdraw it at any time in the app under Account. Withdrawal does not apply retroactively.
- Processing of health data: the app does not work without it.
- Sending data to AI: the coach, food estimates, the round plan and weekly reviews. For questions about studies the coach may search the web, only the query goes to the search, never your data. Without it the coach answers with rules on the phone only and food photos cannot be estimated.
- Polar data and Garmin data to AI: each separately, off by default.
- Blood results and Results and AI: storing results and reading them from a photo or PDF.
- Cycle as context and Genetic variants: separately. Withdrawing the genetics consent deletes the genotype right away.
- Sharing with your trainer by category: workouts, sleep and HRV, food as goal completion, calories. The trainer who measured you always sees your test results. Extra sharing only applies to a trainer you confirm by name in the app, and you can switch it off in Account at any time. With the Measurement only option they see only the test result.
Who we share data with
| Who | For what | Where |
|---|---|---|
| Supabase | Database, sign-in, files, server functions | Frankfurt, EU |
| Anthropic PBC | AI coach, food estimates, round plan and reading results, Claude model. Only with consent. Your question, food description or photo, results file and the smallest possible daily summaries, never your name, e-mail or contacts. Never Oura data or genetics. | USA |
| Stripe | Payment for a test with a trainer (Stripe Checkout). You enter card details directly with Stripe. | EU (Ireland), partly processed in the USA |
| Polar, Garmin, Oura | Only if you connect them. We read data from them and send them nothing except the sign-in. | At the manufacturer: Polar and Oura Finland, Garmin USA |
| Apple | Sign in with Apple, if you use it. | USA |
| Resend | Sending sign-in codes by e-mail | EU (Ireland), US company |
| Expo | Building and updating the app | USA |
| Apple Health, Health Connect | The app reads from them. Apple or Google store the data on your phone under their own terms. | Your phone |
| Your trainer | Only what you allow, see Consents. Never Oura data, genetics, blood or records. | Czech Republic |
Transfers to the USA: the European Commission's standard contractual clauses in the data processing agreements with Anthropic, Stripe, Resend and Expo.
How long
As long as you have an account. Deleting your account deletes your profile, measurements, health summaries, workouts, food, messages, consents and voice notes. Backups at the database provider expire within 7 days. If a trainer deletes their account, your results stay yours. Clients of a deleted trainer who never created an account are deleted together with their results. Aggregated accuracy evaluations may keep a value with no link to you.
Oura: we keep data from the Oura API for at most 180 days and delete older data at every download. Oura's terms do not allow sending it to AI or passing it on, so neither AI nor your trainer gets it. Sleep that Oura itself writes to Apple Health follows your consents like other Health data.
Your rights
You have the right to access, rectification, erasure, restriction of processing, portability and withdrawal of consent. Just write to the e-mail above. You can delete your account and all data yourself in the app: Account, Delete account and data. You can download a copy of your data in Account, Download my data. You can lodge a complaint with the Czech Office for Personal Data Protection (uoou.gov.cz).
Children
Test Day is for adults aged 18 and over only.