Privacy policy
Last updated: October 13, 2026
Draft — to be reviewed by a lawyer before publication. This text accurately describes how Kratheos currently works, but it has not yet been reviewed by a legal professional. Passages in square brackets are still to be completed.
This page is a translation. In case of any discrepancy between language versions, the French version prevails. Read the French version
This policy explains what data the Kratheos app and this website process, why, who it is shared with and how to exercise your rights.
1. Who is responsible for your data?
The data controller is Iabsis Sàrl, a limited liability company under Swiss law, Chemin des Préjins 18, 1218 Le Grand-Saconnex, Switzerland (UID CHE-314.116.461) (“Kratheos”, “we”), publisher of the Kratheos app and of the kratheos.com website. For any question about your data or to exercise your rights: privacy@kratheos.com. [contact details of the data protection advisor or officer, if appointed]
As we are established in Switzerland, we are subject to the Swiss Federal Act on Data Protection (FADP), in force in its revised version since 1 September 2023. As Kratheos is also offered to people located in the European Union and the European Economic Area, the General Data Protection Regulation (GDPR) also applies to the processing of their data (Article 3(2) GDPR). The legal bases given in this policy are those of the GDPR; we apply the same level of protection to everyone who uses Kratheos.
Our principle: collect only what serves your coaching, never sell your data, never use it for advertising, and let you retrieve or erase everything from the app.
2. Representative in the European Union
As Iabsis Sàrl is not established in the European Union, it designates a representative in the Union in accordance with Article 27 GDPR. Data subjects and supervisory authorities may contact the representative, in addition to or instead of us, on any question relating to the processing of data:
- IABSIS SARL, a French company separate from Iabsis Sàrl, 762 route de la Marlot, 74140 Saint-Cergues, France (SIREN 479 380 255), represented by its managing director, Olivier Bitsch;
- contact: privacy@kratheos.com, with “EU representative” in the subject line.
[representation mandate to be signed]
3. The data we process
| Category | Details | Source |
|---|---|---|
| Account | Email address (possibly Apple’s “Hide My Email” relay address), display name, Apple or Google account identifier, language, time zone, units (kg/lb, km/mi), sign-up date, Premium status, scheduled deletion date. If you sign in with Apple: an encrypted Apple authorization token, used only to revoke Kratheos’ access to your Apple ID when your account is deleted. | Apple or Google at sign-in, you |
| Sports profile | Goals and target dates, weekly availability, constraints you express (injuries, pain, preferences), training location, available equipment and load increments. | You, through the coach |
| Training | Plans and blocks, planned workouts and their changes, completed workouts (sport, times, perceived exertion, feeling, notes, statistics), sets (reps, loads, durations, distances, rest, reasons for deviations), favorite routes. | You, the app, the Apple Watch |
| Health and location data | Heart rate (average, maximum, zones), active calories, distance and elevation, GPS route of outdoor sessions, measured by the Apple Watch during your workouts. | Apple Health / Apple Watch, with your permission |
| Daily data from Apple Health | Step count, active energy of the day, resting heart rate, heart rate variability, respiratory rate, estimated VO2 max, sleep (bedtime and wake-up time, durations and stages, awakenings), workouts and body measurements recorded by other apps, calories and macronutrients eaten recorded by other apps, with the name of the app they come from. | Apple Health, with your permission |
| Food and hydration | Your answer about how active your days are and the needs computed each day (expenditure, advised calories and macronutrients, water target). The meals you log (day, time of day, name, foods and quantities, calories, protein, carbohydrates, fat, entered by hand or estimated by the coach), your recipes and personal drinks, your favourite foods, your personal portions and the values you chose for a food, what you drink (volume, name of the drink) and your usual containers. | You; the coach when you describe a meal to it |
| Body profile | Sex (female, male, other, prefer not to say), date of birth or year of birth only, height, current weight, target weight and body composition goal (weight loss, cut, lean bulk, recomposition, maintenance, none). Every answer is optional. | You, through the coach at sign-up or in your profile |
| Body tracking | History of your weigh-ins and, if you enter them, body composition (body fat percentage, muscle mass, body water percentage, visceral fat index, for example from a smart scale) and tape measurements (waist, hips, chest, arms, thighs, calves, neck). Day and time chosen for the weigh-in reminder. | You |
| Progress photos | Photos of your torso (front, side, back) that you take or import, with their date and the date of your consent. | You, only if you have turned it on |
| Conversation with the coach | Your messages (typed or dictated, dictation being transcribed by your device), the coach’s answers, the suggestions accepted or declined and the app screen you are writing from. | You, the coach |
| Notifications | Push notification token of your device and platform (iOS, Android), notifications received in the app and whether they were read. | Your device |
| Subscription | Store, product, transaction identifier, status and expiry date sent by Apple or Google. No banking data. | App Store, Google Play |
| AI usage log | For each coach answer: provider and model used, number of tokens, estimated cost, duration, success or technical error. Not the content of the messages. | Our servers |
| Exports and emails | Export archives you request, service emails (export ready, deletion scheduled or cancelled, deletion confirmation from the website). Delivery events of our emails (address, event type such as a hard bounce or a spam complaint, date), so we can stop writing to addresses that cannot receive them. | Our servers, our email delivery provider |
| Technical data | IP address and server technical logs (security, abuse prevention, diagnostics). | Your device, your browser |
The data you allow Kratheos to read in Apple Health (heart rate, sleep, heart rate variability, steps, body measurements) is health data too. You choose in the settings of your device, data type by data type, what Kratheos may read. What you eat and drink is logged by you: nothing requires it, and the app works without it.
Your body profile, weigh-ins, body composition, tape measurements and progress photos are data concerning health, that is, sensitive data within the meaning of Article 9 GDPR and Article 5(c) FADP. The coach asks you these questions during sign-up to adapt loads, heart rate zones, energy needs and progression, but you do not have to answer any of them: coaching also works without them.
Progress photos are entirely optional and subject to a separate explicit consent, which you give by turning on the option in the app (we record the date of this consent). They are stored in Switzerland, with Infomaniak, in private storage that is never publicly accessible, and are displayed only through short-lived signed links. File metadata (EXIF, including GPS location) is removed on upload. They arenever sent to the artificial intelligence provider or to any other third party.
We use no advertising tools, no third-party analytics trackers and no advertising identifier in the app.
4. Why, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and manage your account, build and adapt your plan, track your workouts and progress | Performance of the contract (Terms), Article 6(1)(b) |
| Estimate your energy and water needs, track what you eat and drink | Performance of the contract (Terms), Article 6(1)(b); for the health data used in this calculation (weight, height, Apple Health data), your explicit consent |
| Process your health data (heart rate, calories, sleep, steps) and the health information you share with the coach (injuries, pain) | Your explicit consent (Article 9(2)(a) GDPR; Article 6(7) FADP), given the first time you sign in and, for the data of the Health app, in the settings of your device; you can withdraw it at any time in Profile › Account › My consents |
| Send your messages and the data useful to your coaching to the AI provider, to run the AI coach | Your explicit and separate consent (Articles 6(1)(a) and 9(2)(a) GDPR; Article 6(7) FADP), asked the first time you use a feature of the AI coach; you can withdraw it at any time in Profile › Account › My consents |
| Process your body profile, weigh-ins, body composition and tape measurements to adapt your plan and the coach’s advice, and show you your progress | Your explicit consent (Article 9(2)(a) GDPR; Article 6(7) FADP), given by entering this data, which you can withdraw at any time by deleting it or editing your profile |
| Store your progress photos and show them to you so you can track your progress | Your separate explicit consent (Article 9(2)(a) GDPR; Article 6(7) FADP), given by turning on the option in the app, which you can withdraw at any time |
| Manage the Premium subscription and complimentary access | Performance of the contract; accounting and tax obligations (Article 6(1)(c)) |
| Send service notifications and emails (workout reminders, weekly weigh-in reminder, export ready, account deletion) | Performance of the contract; for push notifications, your permission in the device settings |
| Track AI costs, apply the free message quota, secure the service and prevent abuse | Our legitimate interest in controlling our costs and protecting the service (Article 6(1)(f)) |
| Let you know when Kratheos launches (waitlist, with confirmation of your address by double opt-in) | Your consent (Article 6(1)(a)), which you can withdraw at any time through the unsubscribe link in every email |
| Track the delivery of our emails (bounces, spam complaints) so we stop writing to invalid addresses | Our legitimate interest in ensuring our emails are delivered properly and not writing to invalid addresses (Article 6(1)(f)) |
| Answer your help requests and requests to exercise your rights | Legal obligation (Article 6(1)(c)) and performance of the contract |
The coach builds suggestions automatically, but no decision producing legal effects is imposed on you: every significant change to the plan is presented to you and you remain free to accept it or not.
5. The AI coach and its processors
To answer you, the coach relies on an artificial intelligence model hosted by a provider chosen by Kratheos, acting as a processor: Infomaniak Network SA (Switzerland), Anthropic (United States) or OpenAI (United States), the last two only if they are configured. Only one provider is active at any given time; the one currently in use is Anthropic (United States).
Nothing is sent to this provider without your consent. You are asked for it the first time you use a feature of the AI coach, and you can withdraw it at any time in Profile › Account › My consents: the AI coach then stops for your account, and the rest of the app keeps working.
With each message, we send this provider, through its application programming interface (API):
- the history of your conversation with the coach and the screen you are writing from;
- a summary of your training context: display name, units, goals, availability, constraints and injuries you have reported, equipment, current plan, missed workouts, recent workouts and sets with perceived exertion and notes;
- if you have entered them, your body profile (sex, age or year of birth, height, body composition goal), your latest weight, its recent trend and your target weight, as well as a summary of your latest tape measurements and body composition. The coach uses this health data to adapt loads, heart rate zones, energy and progression.
- if you use these features: a summary of your energy of the day and of your food (estimated expenditure, advised calories and macronutrients, what you ate and drank today and over the last seven days), the meals you describe to the coach so that it estimates them, and, for a Premium account, a summary of your steps, your sleep and your recovery of the day.
We do not send it your email address, your Apple or Google identifiers, or raw Apple Health measurements (heart rate, calories, GPS routes), or any of your progress photos. Anthropic’s commercial terms forbid it to train its models on the data sent through its API. It keeps that data for a limited time only, for security and abuse prevention. [retention periods at the provider and references of the data processing agreements (DPA) to be checked]
We do not sell your data and never use it for advertising, nor to train our own models.
6. Who receives your data
Your data is accessible only to the people at Kratheos who need it (support, technical administration). It is shared, as far as each is concerned, with the following processors:
- hosting of the servers, the database, the exports, the progress photos and the kratheos.com website: Infomaniak Network SA, Geneva (Switzerland), on a cloud server;
- artificial intelligence provider (see the previous section);
- sending push notifications: Expo (650 Industries, United States), which relays to the Apple Push Notification service or Firebase Cloud Messaging (Google);
- sending service emails and managing the waitlist: Brevo (Sendinblue SAS, Paris, France), which processes the data in the European Union;
- sign-in: Apple (Sign in with Apple) and Google (Google Sign-In), which send us your identity when you sign in;
- map background of outings and routes in the app: Apple Maps (iOS) or Google Maps (Android), which provide the map images of the area shown; your GPS track is drawn on your phone and is not sent to them;
- subscriptions: Apple and Google, which collect payments as separate data controllers.
We may also disclose data to the authorities when required by law.
When you add a product to the food catalogue, propose values, vote for values or translate a name, that contribution is shared with all Kratheos users and published under an open licence that lets anyone reuse it. It never appears in the catalogue with your name or your e-mail address: the service that hosts the catalogue only receives a technical identifier that does not allow you to be recognised. We ask for your consent the first time; you can withdraw it at any time in Profile › Account › My consents: you will then no longer be able to contribute, and what you have already shared will remain published. Searching for a food, scanning a barcode, logging your meals and keeping favourites do not require this consent and remain private. Kratheos keeps the link between your account and what you contributed to the catalogue, so that it can remove what an abusive account added; this link is never published.
7. Transfers outside Switzerland and the European Union
We host your data in Switzerland, with Infomaniak. For people located in the European Union, Switzerland benefits from an adequacy decision of the European Commission: it is recognised as ensuring an adequate level of protection. Brevo processes e-mail addresses in the European Union, whose member states are recognised by the Swiss Federal Council as providing adequate protection.
Some subprocessors located in the United States (Expo, and Anthropic or OpenAI only if one of them is configured as the active AI provider) process data outside Switzerland and the Union. These transfers rely on the EU–U.S. Data Privacy Framework and its Swiss extension (Swiss–U.S. Data Privacy Framework), recognised as adequate by the European Commission and the Swiss Federal Council respectively for certified companies or, failing that, on the European Commission’s standard contractual clauses, recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC). You can ask us for a copy.
8. How long we keep it
| Data | Retention |
|---|---|
| Account, profile, training, food and hydration, data read from Apple Health, conversation, notifications | As long as your account exists, then permanently erased 7 days after your deletion request |
| Unused account | After 12 months without any use of the app, we warn you by email; without a sign-in in the following month, your account and all its data are deleted. An account whose subscription is still running is not deleted: we only remind you to cancel it in the store. |
| Body profile, weigh-ins, body composition, tape measurements | Until you delete or edit them, or until your account is deleted (permanent erasure 7 days after your request) |
| Progress photos | Until you delete them (one by one or all at once), or until your account is deleted: the files are then erased at the end of the 7-day period |
| Export archive | 7 days after it is prepared, then deleted automatically; download link valid for 15 minutes |
| Push notification token | Until the device signs out, the account is deleted or the token is invalidated |
| AI usage log | Linked to your account as long as it exists; on deletion, it is anonymized (no longer linked to you in any way) and kept for cost tracking [period to be set, for example 10 years as accounting records] |
| Subscription data | Duration of the subscription, then archived for the period of accounting obligations [period to be confirmed] |
| Server technical logs | [period, for example 12 months maximum] |
| Links sent by email | Deletion confirmation from the website: 24 hours; cancellation of a deletion: 7 days |
| Waitlist | Until launch, then deleted if you do not create an account; you can unsubscribe before then at any time through the link in every email |
| Email delivery events | [period, for example 13 months maximum] |
9. Your rights and how to exercise them
You have the right to access, rectify, erase, restrict, object to and port your data, the right to withdraw your consent at any time and the right to set instructions regarding what happens to your data after your death.
- Access and portability: Profile › Account › Export my data. You receive a ZIP archive containing all your data (JSON, CSV readable in a spreadsheet, routes as GeoJSON and GPX), including your body profile, weigh-ins and measurements (JSON and CSV) and your progress photos (in a dedicated folder), once every 24 hours.
- Rectification: directly in your profile (Profile › My body for your body data), or by asking the coach.
- Erasure: Profile › Account › Delete my account, or without the app from the Delete my account page. You have 7 days to change your mind. Deleting your account erases all your body data, including your progress photo files.
- Withdrawing consent for body data: in Profile › My body, you can clear each answer of your body profile and delete your weigh-ins and measurements. You can delete your progress photos one by one or all at once, and turn off the photo option: no new photo can then be added, and you remain free to delete the existing ones. The weekly weigh-in reminder is turned off in the same place.
- Withdrawing your consents: in Profile › Account › My consents, you find each consent you gave, with its date. There you can withdraw your consent to the AI processing (the AI coach then stops for your account) and your consent to the processing of your health data: since the app cannot work without it, this withdrawal schedules the deletion of your account, with 7 days to change your mind.
- Withdrawing Health consent: in your iPhone settings, Health › Data Access & Devices › Kratheos. Notifications can be turned off in Settings › Notifications › Kratheos.
- Any other request: write to privacy@kratheos.com from your account’s address. We reply within one month, which may be extended by two months for complex requests.
10. Security
- Encrypted connections (HTTPS) between the app, the website and our servers.
- Revocable sessions: requesting account deletion immediately signs out all your devices.
- Exports stored out of any public access and downloadable only through a short-lived signed link.
- Progress photos stored in Switzerland in private storage, displayed only through short-lived signed links, stripped of their metadata (EXIF, GPS location) on upload and never sent to an AI provider.
- Access keys to AI providers encrypted in the database; restricted administrative access.
- In case of a data breach presenting a risk, we notify the Swiss Federal Data Protection and Information Commissioner (FDPIC), the competent supervisory authority in the European Union where the GDPR requires it and, if necessary, the people concerned.
11. This website, cookies and waitlist
- The kratheos.com website sets no cookies and uses no trackers: no analytics, no advertising, fonts hosted on the website itself.
- Waitlist: your email address, entered voluntarily, is used only to let you know about the launch. It is sent to Brevo, which emails you a confirmation: you are only added once you click the link (double opt-in). On our side, we also keep your address, your language, the form used and the sign-up date, as proof of your consent. To limit abuse, we temporarily keep (24 hours at most) a fingerprint of your address and your IP address, as for the account deletion form. Legal basis: your consent, which you can withdraw at any time through the unsubscribe link in every email. Retention: until launch, then deleted if you do not create an account.
- Account deletion form: the address you enter is used only to send you the confirmation link. To limit abuse, we temporarily keep (24 hours at most) a fingerprint of this address and your IP address in a technical memory store.
- The confirmation pages opened from our emails (cancellation or confirmation of a deletion) use a technical security cookie (protection against cross-site request forgery), strictly necessary and exempt from consent. Their fonts are hosted on our own servers: no third party is contacted.
12. Minimum age
Kratheos is reserved for people aged 16 or over. If you believe a minor under 16 has sent us data, write to us: we will delete the account.
13. Changes to this policy
We will update this policy if our processing changes (new processor, new data category). In case of a significant change, you will be notified in the app or by email before it takes effect. The date of the last update is shown at the top of the page.
14. Contact and complaints
For any question or request about your data: privacy@kratheos.com, or by post to Iabsis Sàrl, Chemin des Préjins 18, 1218 Le Grand-Saconnex, Switzerland. If you are in the European Union, you can also contact our representative (section 2).
If, after contacting us, you believe your rights are not being respected, you can lodge a complaint:
- in Switzerland, with the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, edoeb.admin.ch;
- in the European Union or the European Economic Area, with the data protection authority of your country of residence, place of work or place of the alleged infringement, for example the CNIL in France (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr). The list of authorities is available on the website of the European Data Protection Board.