Privacy Notice

Account and profile data

• Data: Name, email address, authentication identifiers, profile image URL, timezone, date of birth (optional), gender (optional), basic preferences (stored as JSON settings).
• Purpose: Create and manage your account; secure access; personalise your experience and longevity scoring.
• Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(f) GDPR (legitimate interests: security and fraud prevention).
• Note: Name and email are encrypted at rest using AES-256-GCM (see Section 11).

Habits, completions, and streaks

• Data: Habit names, descriptions, daily/weekly cadences, completion logs (dates, times, source), computed streaks and adherence statistics.
• Purpose: Habit tracking, analytics, and progress visualisation.
• Legal basis: Art. 6(1)(b) GDPR (contract).

Goals and milestones

• Data: Goal titles, target metrics and values, deadlines, status, linked habits; milestone titles, due dates, and completion status.
• Purpose: Goal management, automatic progression tracking, and milestone notifications.
• Legal basis: Art. 6(1)(b) GDPR (contract).

Challenges

• Data: Challenge participation records, check-in progress, leaderboard positions.
• Purpose: Optional motivational features you choose to participate in.
• Legal basis: Art. 6(1)(b) GDPR (contract).

Longevity and health-derived scores

• Data: Computed longevity scores across six dimensions (cardiorespiratory fitness, strength, stability, sleep quality, body composition, movement), weekly targets, training load metrics (ACWR, TRIMP), capacity modelling outputs, recovery context, and statistical associations.
• Purpose: Provide personalised longevity insights and progress tracking. These are derived metrics computed from your connected data sources — we do not collect additional raw data for this purpose.
• Legal basis: Art. 6(1)(b) GDPR (contract); where derived from health data, Art. 9(2)(a) GDPR (explicit consent).
• Important: Longevity scores and training analytics are informational tools, not medical advice. They do not constitute a diagnosis, treatment recommendation, or health assessment. See Section 14.

AI-generated insights

• Data: Aggregated, non-identifying metrics assembled from your account (see Section 4 for details on what is sent to our AI provider); generated outputs (weekly summaries, training context, habit patterns, observations); interaction metadata (timestamps, token counts, model version).
• Purpose: Provide personalised weekly synthesis reports and contextual insights.
• Legal basis: Art. 6(1)(b) GDPR (contract) for core functionality; Art. 6(1)(f) GDPR (legitimate interests) for service quality and safety monitoring.

Connected device and service data

• Data: Connected account identifiers, OAuth tokens (encrypted), connection status, device information; and — if you authorise — activity, health, sleep, and body composition metrics from Garmin, Strava, and/or Apple Health (see Section 3).
• Purpose: Import data from services you elect to connect.
• Legal basis: Art. 6(1)(b) GDPR (contract) to provide requested features; Art. 6(1)(a) and Art. 9(2)(a) GDPR (explicit consent) for health data.

Sharing and referral data

• Data: Share tokens (containing frozen snapshots of summary metrics and optional first name), referral codes, referral status, invited email addresses (for invite deduplication only, retained for 24 hours).
• Purpose: Enable you to share achievements and refer friends.
• Legal basis: Art. 6(1)(b) GDPR (contract); Art. 6(1)(a) GDPR (consent) for optional sharing of your name on shared content.
• Note: Shared content is anonymous by default ("A North user"). You must explicitly opt in to display your first name. Shared content never includes your surname, email, user ID, date of birth, raw biometrics, or body composition data. Share tokens expire automatically and can be revoked at any time.

Email communications

• Data: Email address, email delivery metadata, per-category preferences.
• Purpose: Transactional emails (welcome, streak milestones, goal completions, challenge invites, weekly digest, referral updates).
• Legal basis: Art. 6(1)(b) GDPR (contract) for transactional; Art. 6(1)(a) GDPR (consent) for optional categories.
• Control: You can manage preferences in-app or unsubscribe via one-click links in every email (RFC 8058 compliant).

Technical and usage data

• Data: IP address, device/browser information, timestamps, referrer URLs; limited diagnostic logs; audit trail records (for data export, account deletion, and connection changes).
• Purpose: Ensure security, prevent abuse, operate the service, comply with legal obligations, and maintain audit trail for GDPR accountability.
• Legal basis: Art. 6(1)(f) GDPR (legitimate interests: secure, functional service); Art. 6(1)(c) GDPR (legal obligation) for audit records.

3.1 Garmin

• Connection method: OAuth 2.0 with Garmin Connect.
• Data imported: Daily health summaries (steps, distance, active calories, resting heart rate, stress levels, Body Battery); sleep data (duration, sleep stages, sleep score); body composition (weight, body fat percentage, BMI); user metrics (VO2 Max, fitness age); activities (type, duration, distance, heart rate zones, elevation, pace, device name); heart rate samples for zone derivation.
• Encryption: All health, sleep, body composition, and user metrics data is encrypted at rest using AES-256-GCM with authenticated additional data (AAD) bound to your user ID (see Section 11).
• Sync: Real-time via webhooks; initial backfill covers 21 days of health data and 30 days of activities.
• Disconnection: You can disconnect at any time in-app. OAuth tokens are immediately invalidated. Previously imported data remains until you request deletion.
• Garmin's role: Garmin is a separate, independent data controller for data within its ecosystem. We act as an independent controller for the data we import at your request.

3.2 Strava

• Connection method: OAuth 2.0 with Strava.
• Data imported: Activities (sport type, name, start date, elapsed time, distance, average/max speed, average/max heart rate, calories, elevation gain, device name, manual/upload flags). We request read-only access (read,activity:read_all scopes).
• Data NOT imported: Social data, followers, clubs, comments, kudos, photos, route/GPS coordinates, gear details.
• Sync: Real-time via webhooks; initial backfill covers 30 days of activities.
• Disconnection: You can disconnect at any time in-app or revoke access from Strava's settings. We honour Strava deauthorization webhooks after server-side verification.
• Strava attribution: Activity data imported from Strava is provided in compliance with the Strava API Agreement. Strava is a registered trademark of Strava, Inc.
• Strava's role: Strava is a separate, independent data controller. We act as an independent controller for the activity data we import at your request.

3.3 Apple Health

• Connection method: Apple HealthKit framework on your iOS device.
• Data imported: Workouts (activity type, duration, distance, energy burned, heart rate); sleep analysis (sleep stages and duration); quantity samples (steps, resting heart rate, body weight) as you authorise via iOS Health permissions.
• On-device processing: Apple Health data is read locally on your device. It is only transmitted to our servers when you explicitly initiate a sync from the mobile app.
• Data NOT imported: We do not access medical records, medications, reproductive health, or any Apple Health categories beyond those listed above.
• Disconnection: You can revoke North's access at any time in iOS Settings → Health → Data Access & Devices.
• Apple's requirements: We comply with Apple's HealthKit guidelines. Health data is never used for advertising, is not sold, and is not disclosed to third parties for purposes unrelated to providing the service.

3.4 Multi-source deduplication

If you connect multiple data sources, the same activity may be reported by more than one source. We use fingerprint-based deduplication (matching on start time and duration) to create a single canonical record per activity. Source provenance is tracked internally. This is an automated technical process that does not involve profiling or decision-making about you.

3.5 Lawful basis for health data

Health and activity data from all connected sources constitutes special category data under Art. 9 GDPR. We rely on your explicit consent under Art. 9(2)(a) and Art. 6(1)(a) GDPR to process this data. You may withdraw consent at any time by disconnecting the relevant source in-app. Withdrawal does not affect the lawfulness of processing before withdrawal.

4.1 What we send to our AI provider

Our weekly AI synthesis feature (available to Premium subscribers) uses Anthropic's Claude API to generate personalised insights. We send only pre-aggregated, non-identifying metrics — never raw data, never your name, email, or other directly identifying information. Specifically, we send:

• 7-day averages of health metrics (steps, distance, resting heart rate, sleep duration, VO2 Max, weight)
• Habit names, adherence rates, and streak counts
• Pre-computed training load indicators (ACWR, monotony, strain)
• Pre-computed recovery context score
• Longevity dimension aggregates (zone 2 minutes, strength sessions, high-intensity minutes)
• Goal titles, statuses, and milestone counts
• Pre-computed statistical associations between metrics
• Weekly target progress

4.2 What we do NOT send

• Your name, email, user ID, or any directly identifying information
• Raw daily health data records
• OAuth tokens or credentials
• Date of birth or gender
• GPS coordinates, location data, or device identifiers

4.3 Anthropic's data handling

• Anthropic acts as a data processor under a Data Processing Agreement (DPA).
• Under Anthropic's API terms, data sent via their API is not used to train their models.
• Prompts and responses are retained by Anthropic for up to 30 days for safety and abuse monitoring, then deleted.
• We cache AI outputs locally (in Redis for 7 days, and in our database) to minimise repeated processing.

4.4 Your control

AI synthesis is a Premium feature requiring separate consent. If you do not subscribe to Premium or have not granted AI processing consent, no data is sent to Anthropic. You can withdraw AI processing consent at any time in Privacy settings. AI prompts are encrypted at rest and automatically deleted after 30 days; AI outputs are encrypted and retained for 6 months. When you disconnect a data source, you can choose to also delete AI insights generated from that source.