Last updated
Some of what Uplabs holds is health data under laws such as Washington’s My Health My Data Act. This page sets out, for that data only, what we collect, why, from where, who processes it, and what you can do about it. The full picture is in our Privacy Policy.
What we collect
- Heart rate — average and maximum for each workout, your resting and maximum heart rate, and your heart-rate zones.
- Recovery — overnight HRV, resting heart rate, sleep duration, stages and score, Body Battery and stress, from Garmin, and any recovery answers you type in yourself.
- Effort — perceived exertion and Strava’s relative effort for each workout.
- Body — your weight, if you enter it or Strava holds it.
- Menstrual cycle — only if you turn it on: cycle length, period length and the start dates you log.
- Injury notes — anything you write to the coach about an injury or how you feel.
Why
To build and adjust your training plan, which is the service you asked for: your heart rate sets your zones, your recovery decides how hard the week should be, and your notes tell the plan what to work around. It is also used to draw your progress charts and to write your coach’s notes on a paid plan. Nothing else. It is never used for advertising, never sold, and never used to train an AI model.
Where it comes from
- You, when you enter it in the app.
- Garmin, if you connect it.
- Strava, if you connect it.
Who processes it for us
We do not sell health data or share it with anybody for their own use. These companies process it only to provide their part of Uplabs to us, under contract:
- Convex — stores it.
- Vercel — hosts the site it passes through on its way to your screen.
- Anthropic — on a paid plan, receives your recent figures to write your coach’s notes. Your cycle reaches it only as the phase you’re likely in, and only if you turned cycle tracking on.
- Anypost — delivers your morning note and weekly review, which can mention your recovery and training figures.
- Garmin — receives planned workouts, if you turn on sending them; no health data goes to it.
PostHog, Sentry, Stripe, Clerk, Cloudflare, Slack, Google and intervals.icu never receive it.
Your rights
- See it — ask whether we hold your health data, for a copy, and for the list of everybody above it has gone to.
- Delete it — all of it, by deleting your account from the Account page, or any part of it by asking. We delete it from our processors too. Disconnecting Garmin or Strava deletes what came from them; turning cycle tracking off deletes your cycle data at once.
- Withdraw consent — for cycle tracking, or for the coach’s use of your Garmin data, with the switch on the Account page, effective immediately.
Email hello@uplabs.fit with “Health data” in the subject. We answer within 45 days. If we turn a request down you can appeal by replying to that answer with “Appeal”; we decide an appeal within 45 days and tell you how to contact your state attorney general if you disagree.