Gard Pro App Privacy Policy
OVERVIEW
This Privacy Policy explains how we collect, use, share and protect personal information when you use the GARD PRO mobile application, your GARD PRO smartwatch, the GARD PRO Coach feature, and your GARD PRO account (together, the "App Services").
This policy covers the App Services only. If you buy a product from our online store, that is covered by our separate Store Privacy Policy. The two are deliberately kept apart because the information involved, and the legal basis on which we handle it, are different.
Data controller. RSF Group B.V., trading as GARD PRO ("GARD PRO", "we", "us", "our"), Chocoladeweg 6, 1381 DA Weesp, The Netherlands. Chamber of Commerce number 92424392. Contact: support@gardpro.com.
UK representative. , appointed under Article 27 UK GDPR as our representative for users in the United Kingdom.
Washington residents. If you are a Washington State resident, our Consumer Health Data Privacy Policy applies to you in addition to this policy.
1. THE COMMITMENTS THAT GOVERN THIS POLICY
The following commitments apply to all processing described in this Policy and prevail over any inconsistent statement elsewhere in it.
1.1 We do not use your health and fitness data for advertising or marketing. Not for our own marketing, not for personalised advertising, not for lookalike audiences, not for any use-based data mining.
1.2 We do not sell your health and fitness data, and we do not share it with advertising networks, data brokers or marketing partners.
1.3 We collect health and fitness data only with your explicit consent, and you can withdraw that consent at any time.
1.4 Your health and fitness data is not stored in iCloud and is not written to any general-purpose consumer cloud storage service.
1.5 Conversations with GARD PRO Coach are not used to train any artificial intelligence model. This restriction is imposed contractually upon our AI service provider. Section 4.2 sets out how conversation data is processed.
2. THE PERSONAL INFORMATION WE COLLECT
2.1 Account information
- Name
- Email address
- Password (stored only as a cryptographic hash)
- Country and language preference
- Date of birth
- Account creation date and account status
Date of birth determines which configuration of GARD PRO Coach applies to your account, as certain features are restricted to users aged 18 and over. Date of birth cannot be amended through the App. Requests to correct a date of birth recorded in error should be directed to support@gardpro.com.
2.2 Profile information you provide
Used to calculate personalised metrics such as heart rate zones and calorie estimates.
- Sex used for physiological calculations
- Height
- Weight
- Maximum heart rate, resting heart rate and heart rate zone boundaries, where you set these manually
- Activity or fitness goals you set
2.3 Health and fitness data
This is special category data under Article 9 GDPR and we collect it only with your explicit consent.
Collected by the sensors in your GARD PRO device and synced to the App:
Cardiovascular
- Heart rate, continuous and spot measurements
- Resting heart rate
- Heart rate variability
- Heart rate zone distribution and time in zone
- Heart rate recovery
- Blood oxygen saturation (SpO2)
- Respiration rate
- Blood pressure trend values
Sleep
- Sleep and wake times
- Sleep duration
- Sleep stages (awake, REM, light, deep)
- Skin temperature and deviation from your personal baseline
Activity and movement
- Steps
- Distance travelled
- Floors or elevation climbed
- Active and total energy expenditure (calories)
- Movement and accelerometer data used for activity recognition
- Sedentary and stand time
Workouts
- Activity type and start and end time
- Duration, distance, pace and speed
- Cadence, stride length and running form metrics (ground contact time, vertical oscillation, vertical ratio, running power) on models with a gyroscope
- Swimming metrics: length count, stroke type, stroke count, SWOLF, distance per stroke
- Strength metrics: set count, set and rest duration, and, where you follow a plan, exercises, repetitions and weights that you have logged
- Interval and round breakdowns
- Elevation gain and loss, gradient and altitude
- GPS route and location data recorded during an outdoor workout
- Water temperature and ambient temperature where the device records it
- Session effort rating, which you provide or confirm
- Derived values including training load, load status, recovery time, training effect, cardio fitness (VO2 max) estimate, recovery score, readiness score, stress score and intensity minutes
Content you add
- Session names, notes and photographs you attach to a workout
2.4 GARD PRO Coach conversation data
Where you use GARD PRO Coach, we process the messages you submit and the responses generated in reply. Conversation content constitutes data concerning health for the purposes of Article 9 GDPR and is treated as the most sensitive category of information processed under this Policy.
We do not extract structured health information from conversation content. Where a message refers to a medication, symptom or medical condition, that information is not recorded as a field within your profile.
2.5 Safety information
The following categories are processed for safety purposes rather than to deliver a feature.
- Disclosures made by you. Where you disclose that you have or have had an eating disorder, or that you are pregnant, we record the fact of that disclosure and apply it to restrict features that would be inappropriate. No detail of the disclosure is recorded. Such disclosures are never inferred from your behaviour or from data processed about you.
- Pattern indicators on accounts held by users under 18. Where an account is held by a user under 18, we monitor for behavioural patterns associated with disordered eating, including repeated queries concerning calorie restriction and successive downward revisions to a goal weight. Where such a pattern is identified, the relevant features are disabled automatically. Section 10 sets out this processing in full.
Safety information is held separately from other categories of personal information, is subject to enhanced internal access controls, is not transmitted to our AI service provider, and is excluded from all analytics processing.
2.6 Location data
- Precise location (GPS) is collected only while an outdoor workout that uses GPS is recording, and only if you have granted location permission. It is used to calculate distance, pace, elevation and your route.
- We do not collect continuous background location outside a recording workout.
- Location data is never sent to our AI provider.
- You can revoke location permission at any time in your phone's settings. Outdoor distance and route features will not work without it.
2.7 Data imported from connected services
Where you connect Strava or Komoot, we import the activities you elect to share. Imported activities may include heart rate, cadence, power, route and elevation data, and may relate to periods preceding the creation of your GARD PRO account. Imported data becomes subject to this Policy from the point of receipt.
2.8 Device and technical information
- Device model, operating system and version, app version, firmware version
- Device identifiers used to associate a watch with your account
- Bluetooth pairing information used to connect your watch and phone
- Battery level and charging state of the watch, used for sync and diagnostics
- IP address, used for security and to determine approximate region
- Time zone and locale
2.9 Usage and diagnostic information
- Features used, screens viewed and in-app actions, collected in pseudonymised form and not linked to your health data
- Crash reports, error logs and performance data
- Sync events and failures
Health data, conversation content and safety information are excluded from crash reports, error logs, analytics events and general application logs. This exclusion is enforced by a technical redaction control applied at the logging boundary.
2.10 Support communications
- The content of messages you send to support, and our replies
- Any diagnostic information you choose to attach
3. HOW WE USE YOUR INFORMATION, AND THE LEGAL BASIS FOR EACH USE
| Purpose | Information used | Legal basis (GDPR) |
|---|---|---|
| Create and manage your account; authenticate you | Account information | Article 6(1)(b) — performance of a contract |
| Sync data between your watch and the App; store your history | All categories | Article 6(1)(b) — performance of a contract |
| Record, calculate and display health and fitness metrics, trends, scores and insights | Health and fitness data, profile information | Article 9(2)(a) — explicit consent, with Article 6(1)(a) |
| Provide GARD PRO Coach guidance | Health and fitness data, profile information, conversation content | Article 9(2)(a) — explicit consent, with Article 6(1)(a) |
| Send data to our AI provider so GARD PRO Coach can respond | Derived values and conversation content, pseudonymised | Article 9(2)(a) — explicit consent, given separately |
| Operate safety features, including refusals and automatic feature disabling | Safety information, conversation content, age | Article 9(2)(a) — explicit consent, and Article 6(1)(f) — legitimate interests in user safety |
| Send data to a third-party service you have connected | The categories you select | Article 9(2)(a) — explicit consent, given per integration |
| Provide customer support | Account information, support communications, diagnostic data | Article 6(1)(b) and 6(1)(f) — legitimate interests |
| Maintain security, prevent fraud and abuse | Account, device, technical and usage information | Article 6(1)(f) — legitimate interests |
| Diagnose faults, fix bugs and improve reliability | Diagnostic and usage information | Article 6(1)(f) — legitimate interests |
| Improve and develop features | Aggregated or de-identified data | Article 6(1)(f) — legitimate interests |
| Send service messages about your account, security or these policies | Account information | Article 6(1)(b) and 6(1)(c) |
| Comply with legal obligations and respond to lawful requests | As required | Article 6(1)(c) — legal obligation |
Consents are given separately. Distinct consents are obtained for the processing of health data, for transmission of data to our AI service provider, for location processing, for each connected service, and for marketing. Each consent may be withdrawn independently of the others. Consents are not bundled.
Marketing. If you choose to receive marketing from us about GARD PRO products, we will use your name and email address only, on the basis of your consent, which you can withdraw at any time. Your health and fitness data is never used to target, personalise, segment or inform any marketing or advertising.
4. HOW WE SHARE YOUR INFORMATION
4.1 Service providers (processors)
These third parties operate the App Services for us. They act on our instructions under a data processing agreement, may only use the data to provide their service to us, and may not use it for their own purposes.
| Purpose | Provider | Data location |
|---|---|---|
| Cloud hosting and data storage | Hetzner Online GmbH | Germany, EU |
| AI processing for GARD PRO Coach | OpenAI | EU regional processing where available; otherwise United States |
| Crash reporting and diagnostics | Sentry | European Union |
| Product analytics | PostHog | European Union |
| Push notifications, Android | Google (Firebase Cloud Messaging) | United States |
| Push notifications, iOS | Apple (APNs) | United States |
| Transactional email | Resend | United States |
| Customer support | Richpanel | [REGION TO CONFIRM] |
| File and object storage | Cloudflare R2 | [REGION TO CONFIRM] |
Push notification providers receive the content of each notification transmitted. For that reason, notification content excludes physiological figures and any statement concerning your health.
4.2 Processing by our AI service provider
GARD PRO Coach operates using a large language model provided by OpenAI. The following controls apply to that processing:
- Identifying information is removed prior to transmission. Name, email address, exact date of birth and account identifiers are withheld. Requests are transmitted under a rotating pseudonymous reference rather than a persistent identifier.
- Transmission is limited to the minimum necessary, comprising derived values and the conversation context required to generate the relevant response. Full account history is not transmitted.
- Data transmitted is not used to train any model. This restriction is imposed as a contractual term.
- Zero data retention is enabled. Prompts and responses are not retained by the provider following delivery of the response.
- Location data, safety information and account information are not transmitted.
- Regional processing within the European Union is used where supported by the provider.
- Coaching context is stored by GARD PRO within the European Union and not by our AI service provider.
4.3 Services you connect
If you connect Apple Health, Google Health Connect, Strava or Komoot, we share the categories of data you select, only after you enable the connection.
Strava and Komoot act as independent controllers and not as our processors. The consequences of that distinction are as follows:
- Upon receipt, your data is processed under their privacy policy and for their purposes.
- Deletion of your GARD PRO account does not delete data previously transmitted to them. Deletion must be requested from Strava or Komoot directly.
- We are unable to alter their retention periods, retrieve data transmitted, or control onward disclosure by them.
- Disconnection prevents further sharing. It does not recall data already transmitted.
- Route data may disclose your home, workplace or place of study by reference to recurring start and end points. Both services provide privacy zone functionality, the use of which is recommended.
Data we read from Apple Health or Health Connect is used only to display and calculate your metrics in the App. It is never used for advertising or marketing, is not shared with any third party, and is not used for any purpose other than your health and fitness management.
4.4 Legal and safety
We may disclose personal information where required by law, to respond to a valid legal process, to enforce our terms, or to protect the rights, property or safety of GARD PRO, our users or the public.
4.5 Corporate transactions
If GARD PRO is involved in a merger, acquisition or sale of assets, personal information may be transferred. We will notify you before your information becomes subject to a different privacy policy, and your health and fitness data will remain subject to at least equivalent protection.
4.6 What we never do
We do not sell your personal information. We do not share your health and fitness data with advertising networks, data brokers, marketing partners or social platforms. We do not use it for behavioural advertising, audience building or any use-based data mining.
5. INTERNATIONAL TRANSFERS
Your data is stored in the European Union. Some of our service providers process data in the United States.
Where we transfer personal information out of the European Economic Area or the United Kingdom, we rely on an adequacy decision, on the EU-US Data Privacy Framework where the recipient is certified, or on the European Commission's Standard Contractual Clauses (or the UK International Data Transfer Agreement or Addendum, as applicable), together with any supplementary measures required.
You may request a copy of the relevant transfer mechanism by contacting support@gardpro.com.
6. HOW LONG WE KEEP YOUR INFORMATION
| Data | Retention |
|---|---|
| Account information | For as long as your account is open |
| Raw sensor readings | 24 months |
| Derived scores and trends | 36 months |
| Workout and location records | 24 months |
| GARD PRO Coach conversation content | 12 months |
| Safety information | For as long as your account is open |
| After account closure | Deleted within 30 days |
| After you withdraw consent to health data processing | Health and fitness data deleted within 30 days |
| Crash and diagnostic logs | 90 days |
| Support communications | 24 months |
| Records we must keep by law | For the period the law requires |
Backups operate on a 35-day rolling cycle. Data deleted from live systems is removed from backups within that period. Deletion therefore completes within 35 days.
Derived scores are retained for a longer period than the underlying sensor readings because the App's function is comparison of trends over time, for which the underlying readings are not required.
7. YOUR RIGHTS
Depending on where you live, you have some or all of the following rights.
- Access — obtain confirmation of whether we process your personal information and a copy of it.
- Rectification — have inaccurate information corrected.
- Erasure — have your personal information deleted.
- Restriction — ask us to limit how we process your information.
- Objection — object to processing based on our legitimate interests.
- Portability — receive your data in a structured, commonly used, machine-readable format. You can export your data directly from within the App.
- Withdraw consent — withdraw any of your consents at any time, in the App under Settings, or by contacting us. Withdrawal does not affect the lawfulness of processing before withdrawal.
Two rights are subject to specific handling, for the reasons stated.
Date of birth. Date of birth cannot be amended through the App, as it determines which safety measures apply to your account. Requests to correct a date of birth recorded in error should be directed to support@gardpro.com.
Safety information. Safety information is deleted in all cases upon closure of your account. Where you request correction or removal of a safety indicator while your account remains open, the request will be considered by a member of our staff rather than determined automatically, and you will be notified of the outcome.
Effect of withdrawal of consent. Health and fitness data is the basis upon which the App Services operate. Upon withdrawal of consent, we will cease collecting and processing that data and will delete the data held within the period stated above. Your account will remain open and you will continue to be able to export your data and close your account. Health, fitness, sleep, workout and coaching functionality will cease to operate.
How to exercise your rights. Contact support@gardpro.com. We will respond within one month, extendable by two further months for complex requests, and we will tell you if we need an extension. We may need to verify your identity first. We will not discriminate against you for exercising your rights.
Complaints. If you are unhappy with how we have handled your personal information, please contact us first. You also have the right to complain to your local data protection authority. In the Netherlands this is the Autoriteit Persoonsgegevens. A list of EEA supervisory authorities is available from the European Data Protection Board. In the UK it is the Information Commissioner's Office.
8. SECURITY
We use technical and organisational measures appropriate to the sensitivity of health data, including:
- Encryption in transit using TLS 1.3, and encryption at rest for databases, file storage, backups and logs
- Encryption keys held in a dedicated key management service, with key access separated from data access
- Access controls limiting employee access to what is necessary, with stricter controls on safety information
- Logging of every access to identifiable health data, with periodic review
- Separation of production data from development and testing environments
- Independent penetration testing before launch
- Monitoring and alerting for unusual access or export activity
No system is perfectly secure. If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, and we will notify the relevant supervisory authority within 72 hours as required by Article 33 GDPR. Where United States law applies, we will also notify affected users and the Federal Trade Commission within 60 days as required by the Health Breach Notification Rule.
9. AGE AND YOUNGER USERS
The App Services are available to users aged 13 and over.
Users under 18. Certain features are unavailable to users under 18. GARD PRO Coach does not provide guidance concerning fasting, weight-loss targets, body composition or supplements to accounts held by users under 18, and the guidance provided operates within limits established for younger users.
Parental consent. Where required by applicable law, the consent of a parent or guardian is required for the processing of a user's personal information. The age at which a user may consent on their own behalf varies by country, and ranges from 13 to 16 across the countries in which we operate. Where the law of your country requires parental consent and such consent has not been obtained, we will not process your personal information and an account should not be created.
We do not knowingly collect personal information from any person under 13. Where you believe that a person under 13 has created an account, please contact support@gardpro.com and the account will be deleted.
10. AUTOMATED DECISION-MAKING
Most of what the App produces is an automated calculation: training load, recovery time, cardio fitness estimates, sleep staging and similar. These are informational outputs that inform your own decisions. They do not produce legal effects concerning you and do not significantly affect you within the meaning of Article 22 GDPR. They are not used to make decisions about insurance, employment, credit, or access to any service.
Two features involve automated decision-making and are described below.
Eligibility for restricted features. Where you are under 18, access to calorie and goal-weight features is determined automatically by reference to your responses to a short set of questions presented when those features are first enabled.
Automatic restriction of features. Where you are under 18, we monitor for behavioural patterns associated with disordered eating. Where such a pattern is identified, calorie, weight and body-composition features are disabled automatically on your account. This measure is applied because continued access in those circumstances presents a material risk of harm.
In respect of both decisions, you may contact support@gardpro.com to obtain human intervention, to express your point of view, and to contest the decision. A restriction applied for safety reasons will not be reversed on request alone; the matter will, however, be considered by a member of our staff.
11. UNITED STATES STATE PRIVACY RIGHTS
Washington State. Our separate Consumer Health Data Privacy Policy describes how we handle consumer health data under the My Health My Data Act, including how to exercise your rights and how to withdraw consent.
California. This policy is our online privacy policy for the purposes of the California Online Privacy Protection Act. It describes the categories of information we collect, the purposes for which we use them, the categories of third party with whom we share them, your choices, and how we notify you of changes. We do not sell or share personal information as those terms are defined in California law.
Other states. Where your state gives you rights to access, delete, correct or port your personal information, or to opt out of targeted advertising, you may exercise them by contacting support@gardpro.com. We honour Global Privacy Control signals where required.
12. CHANGES TO THIS POLICY
We may update this Privacy Policy. Where a change is material, in particular any change to the categories of health data we collect, the purposes for which we use them, or the parties we share them with, we will notify you in advance and, where the change requires it, ask for your consent again.
We will post the updated policy here and update the "Last updated" date. We keep a record of which version of this policy you consented to and when.
13. CONTACT
RSF Group B.V., trading as GARD PRO Chocoladeweg 6 1381 DA Weesp The Netherlands
Email: support@gardpro.com Chamber of Commerce (KvK) number: 92424392 VAT number: NL866038577B01
UK representative:
For the purposes of applicable data protection law, RSF Group B.V. is the data controller of the personal information described in this policy.
Last updated: 28-08-2026