Privacy Policy

Nextmind Advisors LLC ("Nextmind," "we," "us") is a Pennsylvania limited liability company based in Philadelphia. We run nextmindadvisors.com and build software for athletes, coaches and fitness businesses, including apps that connect to your fitness platforms so you and the coaches you choose can see and analyze your training.

This policy covers our website and every application or service we operate that links to it (together, the "Services"). When we build an application for a business that runs it under its own name, that business's privacy policy may also apply.

Information you give us. Your name, email address and password or sign-in details, profile details such as age, sex, height, weight, sport and goals, and anything you enter yourself, such as workout notes, races, training plans and messages to us or to your coach.

Data from platforms you connect. When you connect an account from Garmin Connect, COROS, Wahoo, WHOOP, Strava, Oura, Polar, Suunto, Apple Health and similar services, we receive the data you authorize on that platform's consent screen. Depending on the platform and what you allow, this can include:

• Activities and workouts: type, date, duration, distance, pace, speed, elevation, GPS route, heart rate, power, cadence, laps, training load, and original activity files such as FIT files
• Daily health and wellness: steps, calories, resting heart rate, heart rate variability, stress, Body Battery or recovery scores, respiration, blood oxygen (SpO2) and intensity minutes
• Sleep: duration, sleep stages and sleep scores
• Body measurements: weight and body composition
• Women's health data, such as menstrual cycle tracking, only if you choose to share it
• Planned workouts, training plans, courses and routes
• Basic profile information from the platform, such as your user ID and units

Payment information. Payments are handled by Stripe. We receive a record of the purchase, but never your full card number.

Usage information. Like most websites, we collect basic technical information such as your browser, device, pages visited and how you arrived (for example, from a link in our newsletter). We use cookies and similar tools for sign-in and for analytics. You can block cookies in your browser, but some features may not work.

• You sign in with the platform, not with us.Connections use the platform's own authorization process, such as OAuth. We never see or store your password for that platform.
• You choose what to share. The platform shows you what we are asking to access, and you can approve or decline. We only request the data a feature needs.
• You can disconnect at any time,from inside our app or from the platform's own settings. When you disconnect, we stop receiving new data and delete the data we received from that platform as described in Retention and deletion.
• We follow each platform's rules.Every platform has its own API terms. Where those terms are stricter than this policy, for example on who may view the data, how long it may be kept or how it may be processed, we follow the platform's terms for the data that came from it.
• Sending data to a platform.If you ask us to send something to a platform, such as a planned workout or route to Garmin Connect, that platform's privacy policy applies to it once it is there. For Garmin, see the Garmin Connect privacy policy.
• Garmin, COROS, Wahoo, WHOOP, Strava, Oura, Polar, Suunto and Apple are trademarks of their respective owners. They do not operate our Services and are not responsible for them.

• To provide the Services you sign up for: syncing your data, building your dashboards, analyzing your training, and generating insights and plans you ask for
• To share your data with the coaches, teammates or other people you choose to share it with
• To run your account, process payments and send service messages, such as sign-in emails, receipts and notices about changes
• To provide support when you contact us
• To keep the Services secure, prevent fraud and abuse, and fix problems
• To improve our website, using analytics about how pages are used
• To send our newsletter or updates, only if you sign up, with an unsubscribe link in every email
• To comply with the law

We use health and fitness data only to provide the Services you asked for and the sharing you authorized, not for marketing.

• We never sell your personal information or your health and fitness data
• We never use your health and fitness data for advertising, or share it with advertisers, data brokers, insurers or employers
• We never use data from connected platforms, or anything derived or aggregated from it, to train, fine-tune or improve artificial intelligence or machine learning models
• We never use your data to make decisions about credit, insurance or employment
• We never show your data to another person unless you have chosen to share it with them
• We never store Apple Health (HealthKit) data in iCloud

Some of our applications let athletes share their training with a coach or team.

• Athletes are in control.A coach can see an athlete's data only after the athlete connects their own accounts and accepts the coach's invitation or adds the coach. The athlete can see who has access and remove a coach at any time, which ends that coach's access to new and past data.
• Coaches see what they need to coach.Coaches may use an athlete's data only to coach that athlete, and may not sell it, copy it out of the Services for unrelated purposes, or share it with anyone the athlete has not approved.
• Some data stays with the athlete. Some platforms do not allow their data to be shown to anyone other than the account owner. That data is visible only to the athlete, even when a coach is connected.
• Teams and organizations. When a club, team or business gives you access to one of our applications, the organization may control coach accounts, but each athlete still decides whether to connect their own platforms and can disconnect at any time.

Some features use AI to analyze your training, for example to summarize a week, answer a question about your data or suggest adjustments. To do that, the relevant data is sent to our AI provider, Anthropic, which processes it to produce the response and is not permitted to use it to train its models. AI output can be wrong. It is information, not medical advice. Talk to a qualified professional about medical questions, injuries or health conditions. Our Services are not medical devices and are not intended to diagnose, treat or prevent any disease.

We share personal information only in these cases:

• With people you choose, such as a coach, teammate or organization you authorize
• With service providers who run parts of the Services for us, under contracts that limit their use of your data to providing those services:
  • Vercel: Hosting for our website and applications
  • Supabase: Database and authentication
  • Anthropic: AI analysis you request, such as coaching insights and summaries of your training
  • Stripe: Payment processing. We never see or store your full card number
  • Resend: Account and service emails
  • beehiiv: Our newsletter, if you subscribe
  • PostHog: Website analytics, such as which pages are visited
• With a platform you connect, only when you ask us to, for example to send a planned workout or route to your device
• For legal reasons, when required by law or to protect the rights, safety and security of our users and others
• In a business transfer, such as a merger or acquisition, in which case this policy continues to apply to your data and we will tell you before it becomes subject to a different policy

• We keep your data only as long as we need it to provide the Services to you, which is generally while your account is active and you remain connected. Some platforms limit how long their data may be stored or cached, and we follow those limits.
• When you disconnect a platform,we stop receiving data from it and delete the data we received from it within 30 days, or sooner where that platform's terms require, for example within 72 hours for Oura data.
• When you delete an activity or data on the platform itself, we remove our copy when the platform tells us, within 48 hours where the platform requires it.
• When a platform tells us you revoked access or deleted your account there,we stop syncing right away and delete that platform's data on the same schedule.
• When you delete your account, we delete your personal information within 30 days. Copies in encrypted backups are overwritten within a further 30 days. We will confirm the deletion in writing if you ask.
• We may keep limited records where the law requires, such as payment and tax records, and only for as long as required.

We protect your data with encryption in transit (HTTPS) and at rest, access controls that limit who on our side can reach it, and secure storage of the tokens that connect your platforms. No system is perfectly secure. If a breach affects your personal information, we will notify you and the relevant authorities as the law requires.

Wherever you live, you can:

• See the personal information we hold about you and get a copy of it
• Correct information that is wrong
• Delete your account and your data
• Disconnect any platform or remove any coach, at any time
• Withdraw your consent to us processing your health data, which ends the features that rely on it
• Unsubscribe from marketing emails

Depending on where you live, laws such as the California Consumer Privacy Act, other US state privacy laws and the GDPR may give you additional rights, including the right to appeal a decision we make about your request. We will not treat you differently for using any of these rights. To make a request, email kevin@nextmindadvisors.com. We will verify your identity and respond within 30 days, or within the time your local law requires. If you are in the EEA or UK, you can also complain to your local data protection authority.

This section applies to residents of states with consumer health data laws, including Washington, Nevada and Connecticut. The health and fitness data described in Information we collect is consumer health data. We collect it only with your consent, from you and from the platforms you connect, and use it only to provide the Services you request. We share it only with the people you authorize and the service providers listed above, and we never sell it. You can see, delete or withdraw consent for it at any time using the rights described above. The full details are in our Consumer Health Data Privacy Policy.

The Services are not directed to children under 13, and we do not knowingly collect personal information from them. Athletes aged 13 to 17 may use the Services only with the permission of a parent or guardian, and where a team or club provides access, with its permission too. In the EEA and UK, users under 16 need the consent of a parent or guardian. If you believe a child under 13 has given us personal information, contact us and we will delete it.

We are based in the United States and store data in the United States. If you use the Services from outside the US, your information will be transferred to and processed in the US. Where the GDPR applies, we rely on your consent for health data and on our contract with you to provide the Services.

We will update this policy as the Services and the platforms we connect to change. The effective date at the top shows when it last changed. If a change materially affects how we use your data, we will tell you by email or in the Services before it takes effect, and ask for your consent where the law requires.

Questions or requests about your privacy go to kevin@nextmindadvisors.com.

Nextmind Advisors LLC
Philadelphia, Pennsylvania, USA