Privacy Policy & Data Protection Statement

Ba Dinh Cares | badinhcares.org | Effective: March 27, 2025

1. Introduction

Ba Dinh Cares ("we", "our", "us") operates the AthleteSync platform — a digital service helping athletes, coaches, and fitness professionals plan, track, and analyse athletic training across running, cycling, triathlon, swimming, strength training, and team sports.

This Privacy Policy describes how we collect, use, store, share, and protect personal and health-related data when you use our website, application, or APIs. By registering, you consent to the practices described herein.

2. Data Controller

Ba Dinh Cares
Website: badinhcares.org
Privacy enquiries: privacy@badinhcares.org

3. Scope

This Policy applies to:

Individual athletes with a personal account
Coaches and trainers managing athlete groups
Organisation or club administrators
Visitors browsing our website without an account

This Policy does not apply to third-party platforms (e.g. Garmin Connect, COROS, Strava) you may connect to the Service.

4. Information We Collect

4.1 Account & Identity

Full name, email address, phone number (optional)
Account type (Athlete or Coach)
Password (stored as a salted cryptographic hash — never plaintext)

4.2 Athletic & Health Data

Body metrics: height, weight, resting heart rate (RHR), maximum heart rate, LTHR
Fitness indicators: VO2max estimates, VDOT scores, FTP
Recent race results used to calibrate training zones
Training preferences: workout days, target race, goal finish time, weekly volume

4.3 Activity & Performance Data

GPS route and location data
Duration, distance, average pace or speed
Heart rate data: average, maximum, zone distribution
Cadence, stride length, power output (sport-dependent)
Workout compliance metrics (planned vs. actual pace and distance)

4.4 Device & Third-Party Integration Data

When you connect a fitness platform (e.g. Garmin, COROS), we receive only data scopes you explicitly authorise. OAuth tokens are encrypted at rest using AES-256.

4.5 Technical & Usage Data

IP address, browser type, operating system
Pages visited, features used, timestamps
Error logs and crash reports

5. How We Use Your Information

Generate personalised training plans based on your goals and physiological profile
Calculate training pace zones (VDOT-based or heart-rate-zone-based)
Push structured workouts to connected wearable platforms on your behalf
Retrieve completed activity data to evaluate training compliance
Display weekly mileage, effectiveness scores, and trend charts
Allow coaches to view progress of athletes who have granted explicit access
Send transactional emails (account approval, invitations, summaries)
Analyse anonymised usage patterns to improve the Service

6. Legal Basis for Processing (GDPR)

Contract performance: Processing required to deliver the Service
Legitimate interests: Security, fraud prevention, product improvement
Consent: Health and biometric data — may be withdrawn at any time
Legal obligation: Compliance with applicable laws

7. Data Sharing & Disclosure

With your coach: Training plan and compliance data only — raw GPS and detailed health metrics are not shared unless explicitly authorised
Sub-processors: Cloud hosting, email delivery, AI plan generation — all contractually bound to process data as instructed
Wearable platforms: Only workout data you choose to push — we do not share your data for third-party marketing
Legal requirements: Disclosed only when required by law or court order
No sale of data: We do not sell, rent, or trade your personal data

8. Data Retention

Account and profile data: Retained for account lifetime plus 90 days after deletion
Activity and performance records: Up to 3 years from date of recording
OAuth tokens: Deleted immediately upon disconnection or account deletion
System logs: Up to 90 days
Anonymised analytics: May be retained indefinitely

9. Security Measures

All data in transit encrypted using TLS 1.2 or higher
Sensitive tokens encrypted at rest using AES-256
Passwords hashed using bcrypt with a unique per-user salt
Role-based access controls on all production systems
Database-level Row Level Security ensures users access only their own records
No third party can access another user's data through the Service

To report a security concern: security@badinhcares.org

10. Your Rights

Access: Request a copy of all personal data we hold
Rectification: Correct inaccurate data via account settings or by contacting us
Erasure: Request deletion of your account and all personal data (processed within 30 days)
Data portability: Export your activity data in JSON or CSV format
Restrict processing: Pause processing while a dispute is resolved
Object: Object to processing based on legitimate interests
Withdraw consent: Withdraw consent for health data processing at any time

To exercise these rights: privacy@badinhcares.org — we respond within 30 days.

11. Cookies

Strictly necessary: Session authentication and security tokens — cannot be disabled
Functional: User preferences such as language and display settings
Analytics: Anonymised usage statistics — opt-out available

12. International Data Transfers

Our service and sub-processors may process data outside your country of residence, including the United States. Where data is transferred outside the EEA or UK, Standard Contractual Clauses approved by the European Commission are in place.

13. Children's Privacy

The Service is not directed to children under 16. We do not knowingly collect data from users under 16. Athletes aged 16–17 may use the Service only with verified parental consent.

14. Third-Party Platforms

The Service integrates with platforms such as Garmin Connect, COROS, Strava, and Apple Health. These are governed by their own privacy policies. We are not responsible for their privacy practices.

15. Changes to This Policy

Material changes will be notified via email or in-app notice at least 14 days before taking effect. Continued use after the effective date constitutes acceptance.

16. Contact

Privacy Team, Ba Dinh Cares
Email: privacy@badinhcares.org
Website: badinhcares.org/privacy