Nana Privacy Policy

At Nana, we attach great importance to your privacy and the protection of your data. In this privacy policy, we explain what data we collect, why we collect it, how long we retain it, and what rights you have as a user. Because our app processes health data, some of the data falls under the special categories of personal data (Art. 9 GDPR). We ask for your explicit consent for this.

The data controller for your data is:

3A. ACCOUNT DATA (PERSONAL DATA)

• Last name and first name
• Email address
• Date of birth
• Password (hashed and encrypted)

3B. HEALTH DATA

The data below are special categories of personal data within the meaning of Art. 9 GDPR. We process these exclusively on the basis of your explicit consent.

• Personal goals (performance improvement, health maintenance)
• Food allergies or intolerances/injuries or medical limitations (only what you enter yourself)

3C. DATA VIA WEARABLE INTEGRATION

When you link your wearable (e.g. Polar or Garmin) account, we receive the following data via the relevant API, but exclusively the categories for which you give consent. You can disconnect this integration at any time via the app settings or directly in your wearable account.

• Training activities (type, duration, intensity) and recordings (routes, pace, elevation profile)
• Heart rate measurement (resting and during training) and HRV (heart rate variability)
• Sleep data (sleep stages, duration and quality score)
• Activity data (steps, activity rings)
• Energy expenditure and recovery status (e.g. Polar Recovery Pro)

3D. TECHNICAL AND USAGE DATA

• IP address and device identification
• Operating system and app version
• Log data and crash reports (anonymised)
• In-app behaviour data (screens visited, features used) for UX improvements
• Push notification token (if you have enabled notifications)

You have the right to withdraw your consent at any time. If consent to collect health data is withdrawn, certain app functionalities may no longer be available.

Nana uses artificial intelligence (AI) and machine learning to improve its services. The AI engine processes both the data you provide directly and the data generated by your activity in the app.

The plans generated by Nana are recommendations, not binding decisions. You always have full control: you can reject, adjust, or ignore any suggested meal or training. They do not constitute medical advice, diagnosis, or treatment. Users with medical conditions are advised to consult a healthcare professional before following a plan.

Nevertheless, we apply the safeguards of Art. 22(4) GDPR as best practice:

• You can always request a human review of any algorithmically generated schedule. We do not derive characteristics unrelated to health, fitness, and nutrition. Any schedule that indicates a potential issue triggers a human-review alert, not an automated account restriction.
• We do not use black-box models for health-sensitive recommendations without human expertise and explanation. When third-party AI models are used, we disclose this in the relevant feature in the app.
• We do not use your data to train, fine-tune, or benchmark our AI models. All model training is carried out exclusively on anonymised, aggregated, or synthetic datasets.

We do not retain your personal data longer than necessary for the purpose for which it was collected, or as long as legally required. Specifically, we apply the following periods:

7.1 PROCESSORS

We use selected third parties who process data on our behalf. We conclude a Data Processing Agreement (DPA) with each of them in accordance with Art. 28 GDPR:

7.2 TRANSFER OUTSIDE THE EEA

No, all data is processed within the European Economic Area.

7.3 NO SALE OF DATA

We never sell your personal data to third parties, nor do we use it for third-party advertising.

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or disclosure.

In the event of a serious data breach that poses a risk to your rights and freedoms, we will notify you personally as soon as possible.

Under the GDPR, you have the following rights. A request to exercise these rights can be submitted via hello@nana.coach

The Nana app and website use cookies and similar technologies. We distinguish:

You can manage cookie preferences in the app or in your browser.

We may update this privacy policy from time to time, for example, if the app receives new features or if legislation changes. We will inform you of material changes via the app or by email.

The most up-to-date version is always available at https://nana.coach/privacy. The date of the last amendment is stated at the top of this policy.

Do you have questions about this privacy policy or about the processing of your personal data? Please contact us: hello@nana.coach