Endyoro Privacy Policy

Endyoro is operated by Endyoro Sports Technologies Private Limited, a company incorporated in India on 7 September 2026 (CIN U62011RJ2026PTC117713), with its registered office at G-12A, Dhawas Road, Janki Vihar, Heerapura, Jaipur, Rajasthan 302021, India.

In this policy, “Endyoro”, “we” and “us” mean that company. “You” means the person using the platform — our athlete web and mobile apps, the coach portal, the connected watch apps, and endyoro.com. We call all of that the Platform.

Under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) we are the Data Fiduciary for the personal data described here, and you are the Data Principal. Where the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 still apply to health-related data, this policy also serves as our privacy policy under those Rules.

This policy sits alongside our Terms of Use, our Cookie Policy, our Data Retention Schedule, our Grievance Redressal Policy, our Minors and Parental Consent Policy and our Health and Safety Disclaimer. Coaches are additionally bound by the Coach Agreement and the Coach Data Processing Agreement. Ask us for any of them at privacy@endyoro.com and we will send it to you.

This policy covers three groups:

• Athletes — people training on the Platform, with or without a coach.
• Coaches — people we have approved to prescribe training to Athletes through the coach portal.
• Visitors — people who browse endyoro.com or join the waitlist.

A small number of Endyoro staff hold Administrator access. What they can and cannot do is set out in section 11.

Where you must be

At launch, Endyoro accepts accounts from India only. If you are outside India you can read endyoro.com and join the waitlist, but you cannot create an account. To keep this rule, when you create an account we look up the country of your internet address and ask you to confirm that you live in India. We store that country with your account. We may make exceptions for people we invite to test Endyoro. When that changes we will publish the terms that apply in your country before we accept your signup.

Age

Endyoro is for adults. You must be 18 or older to create an account of any kind. Under the DPDP Act a child is anyone who has not completed 18 years of age, and processing a child's data requires verifiable parental consent. We do not knowingly collect personal data from anyone under 18, and we do not carry out behavioural tracking, profiling or targeted advertising towards children. We ask for your date of birth when you sign up. If it shows you are under 18 we do not create your account, and anything you entered is deleted. If we later learn that an account belongs to someone under 18, we delete it and the data associated with it, without the 30-day pause that applies when you delete your own account.

If your account was created before 17 September 2026, we ask for your date of birth and ask you to confirm where you live the next time you sign in. You cannot use Endyoro until you answer.

Our Minors and Parental Consent Policy explains the age check, what happens on discovery, and why a Coach may not enter data about a minor.

We collect only what the Platform needs to do its job. Some of it you type in, some arrives from your watch or a service you connect, and some is written by your coach.

Two things in that table are stored in a form we cannot reverse: your one-time sign-in codes and the pairing token of a watch. We hold only a hash of each, so even we cannot read the original.

Much of this is health-related data about your body and your training. We treat all of it as confidential, whether or not a particular law classifies it as sensitive.

If you coach on Endyoro, we hold the following about you. This is separate from, and additional to, anything held about you as an Athlete if you also train here.

There is no coach directory. Endyoro has no list of coaches and no way to browse them. An Athlete reaches you only by entering your exact email address, and only while you are accepting new Athletes. Your display name and photograph are then shown to that Athlete with the request. Nothing about you is public.

Private notes are not private from the Athlete. You can mark a coach note private, and the Athlete will not see it in the app. It is still personal data about that Athlete, and an Athlete who makes an access request under the DPDP Act will receive it. Write nothing you would not stand behind.

Each purpose below is the reason we ask for your consent. We do not use your data for anything outside this list without telling you and asking again.

What we never do

• We do not sell your personal data, and we never have.
• We do not share it with advertisers, data brokers or insurers.
• We do not use your training or health data to target advertising.
• We do not use identifiable athlete data to train AI models, and the paid model APIs behind our features do not either.
• We do not let one athlete see another athlete's data.
• We do not use your data for any purpose outside the table above without telling you and asking again.

We process your personal data on the basis of your consent. Before each of the following, we show you a short, standalone notice setting out what data is involved, what it is for, what it enables, and how to withdraw:

1. Creating an account.
2. Connecting each device or health platform — separately, one at a time.
3. Accepting each coach — separately, with the full scope of that coach's access stated in words.
4. The first time you use the training assistant.
5. The first time you photograph or describe a meal for us to read.
6. The first time you share a session image.
7. Joining the waitlist.
8. Sending your plan to your Garmin Connect account.
9. Letting AI features use figures that came from Garmin.
10. Sending your plan to your COROS account.
11. Letting AI features use figures that came from COROS.

That notice is in English. We will offer it in each language in the Eighth Schedule to the Constitution before the law requires it.

A small amount of processing happens without consent where the DPDP Act permits it as a “legitimate use” — for example, complying with a legal obligation or a court order.

Withdrawing consent

You can withdraw consent at any time, in whole or in part:

• Disconnect a device or account — sync stops immediately. A paired watch is revoked and its stored token deleted; an access token for a connected account is deleted. You then choose what happens to the data already synced from that source. See section 9.
• Remove a coach — that coach's access to your data ends from that point.
• Turn off the training assistant, or meal reading — nothing further is sent to a model.
• Turn off “Send my plan to Garmin” — nothing further is sent to Garmin, and we ask Garmin to remove the upcoming workouts and courses we put there.
• Turn off “Use my Garmin data in AI” — nothing more is sent to a model; the training assistant and the dashboard summary stay off while your account holds Garmin data.
• Turn off “Send my plan to COROS” — nothing further is sent to COROS, and we cancel the upcoming runs we put on your COROS calendar.
• Turn off “Use my COROS data in AI” — nothing more is sent to a model; the training assistant and the dashboard summary stay off while your COROS account is linked.
• Delete your account — see section 12.
• Email privacy@endyoro.com for anything else.

Withdrawing consent does not make our earlier processing unlawful. It does mean parts of the Platform stop working — without training data there is no readiness score, no compliance report and nothing for a coach to review.

Aggregate figures

We may publish aggregate totals about Platform activity — for example, total distance logged across all athletes over a year. These are never broken down to a level at which an individual could be identified, are never sold or supplied to anyone else, and are never used to target advertising at anyone. We compute them only from sessions recorded in Endyoro itself — what you entered or imported, and what the Endyoro app on your watch recorded — and never from anything we read out of Apple Health, Android Health Connect, COROS, a Garmin Connect account or any other platform.

The shared food catalogue

When you log a food that is not already in our catalogue, the food's name, unit and nutrition figures are added to Endyoro's shared food catalogue, where other athletes can find it. Nothing that identifies you goes with it — not your name, not your account, not the meal it came from, not the time you logged it. An entry that already exists is never overwritten by yours; your entry only fills a gap. If you would rather a food you logged were not in the catalogue, email privacy@endyoro.com and we will remove that entry.

Your coaches

You may assign one coach per discipline — run, strength and nutrition. Three slots. Each assignment is separate, separately accepted and separately revocable.

A coach assigned to any one discipline can see your whole training record — running, strength, nutrition, wellness, recovery, body measurements and your compliance against the plan. This is deliberate rather than incidental: a run coach cannot set load safely without seeing your fuelling and your sleep, and a nutrition coach cannot set intake without seeing your training volume. You are shown this in full before you accept a coach. An athlete who does not want a given coach to have that view does not assign them.

Within that:

• Prescribed sessions are visible to all of your coaches, because a run coach has to know a heavy strength session is scheduled the same day.
• Coach notes are visible only to you and the coach who wrote them. Your other coaches cannot read them. This is enforced in our API, not merely hidden in the interface.
• A coach can prescribe, annotate, write notes, and record body measurements on your behalf.
• A coach cannot see your sign-in codes, cannot reset your credentials, cannot delete your records, and cannot read your training assistant conversations. Those belong to you alone.

Removing a coach ends their access immediately. Notes they wrote stay on your timeline unless you delete them; the link is marked revoked with a timestamp, and history is never destroyed.

Your account does not depend on your coach. If your coach's account is suspended or closed, you keep your account and your entire training record, and you may assign another coach. You can also remove a coach and assign a different one at any time, without needing the departing coach's cooperation. A coach cannot hand your account to another coach — only you can assign one.

Service providers

We use a small number of processors, each bound by a written contract to use your data only on our instructions:

The current list is published at www.endyoro.com/subprocessors and updated whenever it changes. If a change materially affects how your data is handled, we will tell you before it takes effect.

PostHog receives which screens you open and which actions you take, tied to an account identifier. It does not receive your training, nutrition, health or coaching content, and we do not record your screen.

AI models

Five features send data to a model. Each is off until you turn it on.

We use the paid tier of these APIs, under which Google does not use your prompts or responses to improve its models. Google retains API prompts and responses for a limited period, solely to detect and prevent abuse of its services; Google's terms do not state a fixed number of days. We never send your name, email address or account identifier to a model. Endyoro staff do not read your training assistant conversations.

The figures sent for the training assistant and the dashboard summary are read from your Endyoro record, so they can include figures that arrived from a source you connected — for example sleep from Health Connect.

You can always check and correct what was read before you save it.

Garmin data and AI

If you link a Garmin Connect account, we ask separately whether figures that came from Garmin may be used by the training assistant and the dashboard summary. While your account holds data from Garmin and you have not agreed, the assistant and the summary stay off, so nothing that came from Garmin, and no figure worked out from it, is sent to a model. You can turn it off at any time; you can still read past conversations, and they are never sent to a model again unless you agree again. We never use Garmin data to train any AI model, identifiable or not, and we never put it into a knowledge base.

COROS data and AI

If you link a COROS account, we ask separately whether figures that came from COROS may be used by the training assistant and the dashboard summary. While your COROS account is linked and you have not agreed, the assistant and the summary stay off, so nothing that came from COROS, and no figure worked out from it, is sent to a model. You can turn it off at any time; you can still read past conversations, and they are never sent to a model again unless you agree again. We never use COROS data to train any AI model, identifiable or not, and we never put it into a knowledge base.

Legal and safety

We disclose personal data to a public authority only where the law requires it, or where it is necessary to establish, exercise or defend a legal claim, or to protect someone's life or safety.

If the business changes hands

If Endyoro is acquired or merged, your data may transfer to the acquirer. We will tell you before that happens and you will be able to delete your account first. The acquirer is bound by this policy until it gives you notice of a new one.

How each source connects

The mechanism differs by source, and it matters, because it decides what we hold.

Garmin watch location is off until you agree. This is about the Endyoro app on your watch. After pairing, we ask once whether the watch may record your GPS route during runs you start. Until you agree, the watch does not switch on location and we store no position — runs still record time, heart rate, pace and wrist distance. You can turn it off any time in Watch settings; the watch stops recording location the next time its app connects, and routes already saved stay on those runs. Routes in sessions from a Garmin Connect account or a COROS account are different: the provider records them under the settings you chose there, and they reach us under the consent you give when you connect that account.

We never ask you for your Garmin, COROS, Apple or Google username or password. We have no way to use them and no reason to hold them. Where a source needs you to sign in, you do it at the provider, on the provider's own page.

Our commitments for every source

Where you connect Garmin, COROS, Apple Health or Android Health Connect, we make these commitments for every one of them, in addition to everything else in this policy:

• We read only the data types you have permitted, and only to run the features you have turned on.
• We never use the data for advertising or marketing — including our own.
• We never sell it, and we never disclose it to data brokers or to anyone other than the coaches you have assigned and the processors listed above.
• We never use it in any credit, lending, insurance or employment decision.
• We do not use it for any purpose not described in this policy.
• We do not use identifiable athlete data from it to train AI models. For Garmin we go further: we never use Garmin data to train any AI model, identifiable or not, and never put it into a knowledge base.
• We write no measured, derived or estimated data back into any health store, so a session your watch recorded is never duplicated by us.
• Where a source tells us you deleted a record there, we process that deletion and remove the record we derived from it.
• We notify the provider of a security incident affecting data obtained through their platform within 24 hours of confirming it, or sooner where their terms require (for Garmin, immediately for the Endyoro watch app; for a Garmin Connect account, within 24 hours of confirming a breach or a major security incident affecting systems or data that connect to Garmin).
• Where we show you a figure that came from Garmin, we say so beside it.

Two commitments specific to Apple Health: health data obtained from Apple Health is not stored in iCloud, and we request only the data types listed in section 3.

Sessions we send to your watch. Where a coach plans a session for you, or you plan one yourself, we can deliver it to your watch so you can run it. That payload carries target paces, durations, distances and heart-rate zones and nothing else — no health data, no measured results, and nothing read from any provider. It is built from the plan held in Endyoro. Data read from one provider is never sent to another. Where a planned run or race has a course attached, we also send the course’s route to your Garmin watch, and only when you have agreed to location tracking.

Sending your plan to your Garmin Connect account. If you link a Garmin Connect account and agree to it, we put the sessions in your plan, and any course in it, on your Garmin calendar so they reach your watch. We send each session's name, date, steps and targets, and for a course its route and name. A course's route can start near where you live. A course is a route you or your coach uploaded or drew in Endyoro, never a track read from any provider. When a session changes or is removed in Endyoro, we update or remove it at Garmin. Once Garmin has a session it handles it under its own terms, which let Garmin use workouts sent to it. Garmin's privacy notice is at https://www.garmin.com/en-US/privacy/connect/. You can turn sending off at any time.

Sending your plan to your COROS account. If you link a COROS account and agree to it, we put the runs in your plan on your COROS training calendar so they reach your watch. We send each run's name, date, steps and targets. When a run changes or is removed in Endyoro, we update or cancel it at COROS. Once COROS has a session it handles it under its own terms and privacy policy, which you agree to when you sign in to COROS. You can turn sending off at any time.

Disconnecting a source

When you disconnect a device or health platform, sync stops immediately. A paired watch is revoked and the token identifying it is deleted; an access token for a connected account is deleted. We then ask you what should happen to the data already synced from that source, and you choose:

• Keep my history — the activities and wellness records already on your timeline stay there. They are part of your training record.
• Delete everything from this source — every record obtained through that connection is erased.

We record which you chose and when. If you revoke permission at the operating-system level instead of disconnecting inside Endyoro — by turning Endyoro off in Apple Health or Health Connect — syncing stops and we ask you the same question the next time you open the app. If you do not answer within 30 days, we delete the data obtained through that connection.

If you choose to delete, a session your coach planned that one of those records completed goes back to not done. A disconnected health platform does not send us data again until you reconnect it. Reconnecting syncs again whatever that platform still holds on your phone.

Garmin Connect account. When you disconnect it, we ask Garmin to remove the upcoming workouts and the courses we put on your Garmin account (past sessions stay in your Garmin calendar as your own history), end the link at Garmin, and delete the tokens. These calls happen first, in the same step. If Garmin does not answer, we delete the tokens anyway and tell you that some workouts may remain on your Garmin calendar, to delete in Garmin Connect. If you remove Endyoro from your Garmin account instead, Garmin tells us — our tokens then no longer work, so we cannot remove those workouts for you — sync stops, we delete the tokens, and we ask you the keep-or-delete question the next time you open the app. If you do not answer within 30 days, we delete the data obtained through that connection. Garmin does not resend data from before you reconnect.

COROS account. When you disconnect it, we cancel the upcoming runs we put on your COROS calendar (past sessions stay there as your own history), withdraw our access at COROS, and delete the tokens. If COROS does not answer, we delete the tokens anyway.

You can generate an image of one of your own runs and share it wherever you choose. The image can show distance, time, pace, heart rate, elevation, the date, the session's name and the shape of your route. It never includes a map or coordinates, but a session name can include a place.

• You start every share. Nothing is generated or shared automatically.
• The image goes only to the app you pick on your phone: the share sheet, Photos or Instagram. Endyoro does not post for you and does not send the image, or the data behind it, to any social platform.
• Endyoro branding stays on the image. It cannot be turned off.

Your route usually starts where you live. So on every share image we hide the first 200 metres and the last 200 metres of the route shape, measured along the route. This is always on. You can also turn the route off completely with the Show route switch before you share; your choice is remembered on this phone while you stay signed in. A run shorter than 1 kilometre is shared with no route shape at all. The distance, time and pace printed on the image are always your full, real figures, and nothing about your saved run changes.

Your data is stored in a managed PostgreSQL database (Amazon RDS) on Amazon Web Services in the Mumbai, India region (ap-south-1). Our API and cache run in the same region, and backups are held there too. Photos you upload are stored in the same region, in Amazon S3. Your email address and the content of emails we send you pass through Brevo, and product analytics events are held by PostHog — both store data in the European Union. If you sign in with WhatsApp, your mobile number and the one-time code pass through Gupshup and WhatsApp (Meta) to deliver the code. Questions you put to the training assistant, and meals you photograph or describe, are processed by Google.

This means some personal data collected in India is processed outside India. Section 16 of the DPDP Act permits transfers to any country the Central Government has not placed on a restricted list. Neither Switzerland, the United States nor any European Union member state is on that list as at the effective date of this policy. If that changes, we will move the affected data to a permitted region and update this page.

The measures we take

• No direct database access. The database refuses connections from browsers, apps and watches outright. Every read and write passes through our API, which checks on each request that you are the athlete the record belongs to, or a coach that athlete has assigned.
• Encryption in transit (TLS) and at rest. Access tokens for the accounts you connect are separately encrypted with AES-256-GCM before they are stored, so a database-level compromise does not yield a usable connection. A paired watch is identified by a hash of its token, never the token itself.
• Sign-in without a reusable password. You sign in with Google, or with a one-time code sent to your email address or on WhatsApp. One-time codes are stored hashed, expire in 10 minutes, allow five attempts, and can be used once. There is no password of ours to steal or reuse.
• Role-based access for athletes, coaches and administrators, enforced in our API rather than in the interface, with every administrative action written to an append-only audit log.
• Restricted human access. Production access is limited to a named, minimal set of people, each with multi-factor authentication. Staff do not browse athlete health data. Access to an individual account happens only where you have asked us to investigate something, where it is necessary to investigate abuse or a security incident, or where the law requires it.
• Photos. We remove location and camera details from photos when you upload them. Photos of your sessions can only be opened by you and a coach you have given the running role, and we check this every time one is opened. Your profile photo is shown to the people you are connected with, and can be opened by anyone who has its link.

We have not had an external penetration test or independent security audit. We are pre-launch, and we will say so here until that changes.

If something goes wrong

No system is perfectly secure. If a personal data breach occurs:

• We tell you without delay — what happened, its extent and timing, what it is likely to mean for you, what we have done about it, what you should do, and a named person to contact.
• We notify the Data Protection Board of India — an initial notice without delay, and a detailed report within 72 hours covering the circumstances and cause, the mitigation applied, our findings on who caused it, the remedial measures taken, and confirmation of the notices we gave you.
• We notify any affected device or health platform provider within 24 hours of confirming a breach affecting data obtained through their platform, or sooner where their terms require (for Garmin, immediately for the Endyoro watch app; for a Garmin Connect account, within 24 hours of confirming a breach or a major security incident affecting systems or data that connect to Garmin).

Our Data Retention Schedule sets this out in more detail, including what each period is for.

Someone invited you and you never joined

A coach can invite an athlete by email address. Until you accept, we hold that email address and nothing else, for 90 days, solely to deliver the invitation. If you never accept, it is deleted and you were never an account. You can have it removed sooner by emailing privacy@endyoro.com.

Deleting your account

You can delete your account from the app, at www.endyoro.com/delete-account, or by emailing privacy@endyoro.com. When you delete your account, we pause it for 30 days so you can change your mind, then permanently erase your personal data, except records we must keep by law. Encrypted backups clear within 35 days of the erasure.

Our account deletion page explains exactly what goes, what stays, and what happens to your coach's view of you.

If your account sits unused

We email you at 24 months of inactivity. If you do not sign in during the six months after that, we delete the account — the DPDP Act requires us to erase data we no longer need.

As a Data Principal under the DPDP Act you have the right to:

• Access — a summary of the personal data we hold about you, what we do with it, and the other Data Fiduciaries and processors we have shared it with. This includes any coach note about you that a coach marked private.
• Correction and completion — have inaccurate or incomplete data fixed or updated. Figures that came from a connected device are corrected at the source; tell us and we will re-read the corrected value.
• Erasure — have your data deleted where we no longer need it for the purpose you consented to, and the law does not require us to keep it.
• Withdraw consent — as described in section 6.
• Grievance redressal — a readily available route to complain, described in section 14.
• Nominate — name another person to exercise these rights on your behalf if you die or become incapable of exercising them yourself. You can do this by emailing privacy@endyoro.com with your nominee's name and contact details. We confirm every nomination to you in writing.

Most of this you can do yourself in the app. For anything else, email privacy@endyoro.com. We respond within 30 days and charge nothing.

The DPDP Act also places duties on you: give us accurate information, do not impersonate anyone, and do not file false or frivolous complaints — the Act provides penalties for that.

Our regulatory status

Endyoro has not been designated a Significant Data Fiduciary, so the additional obligations that designation carries — appointing a Data Protection Officer, running a data protection impact assessment, and submitting to an annual audit — do not currently apply to us. Health data held at volume is a candidate for designation, and if it happens we will say so here.

If something about the way we handle your data troubles you, write to our Grievance Officer:

We acknowledge every grievance within three working days and respond within 30 days. If you are not satisfied with our response, or we do not respond in time, you may complain to the Data Protection Board of India. Our Grievance Redressal Policy sets out the full procedure.

Inside the app we use cookies and browser storage to keep you signed in and to remember how you have set up your pages. These are necessary for the Platform to work and cannot be switched off while you use it. We also run PostHog, which sets a cookie so it can recognise return visits and show us which parts of the app get used. PostHog does not record your screen, and we never send it your training, nutrition, health or coaching content. Your theme and text-size preferences are stored on your device and never leave it.

On the public home page of endyoro.com we use Google Analytics to count visits and see which pages get read. It sets its own cookies. You can decline them when you first arrive, change your mind later, or install Google's opt-out browser add-on at tools.google.com/dlpage/gaoptout. Declining changes nothing about the app.

We do not use advertising cookies, retargeting pixels, or any tracking that follows you to other websites.

Our Cookie Policy lists every cookie by name and purpose.

When we change this policy we update the “last updated” date at the top. If the change materially affects how we use your data, we will tell you in the app or by email before it takes effect, and where the law requires it, ask for your consent again. Every previous version stays available at www.endyoro.com/privacy, with the dates it was in force.

Questions about privacy, data or this policy: privacy@endyoro.com

General support: support@endyoro.com