Last updated: 25 October 2026 · version 2.1

Personal Data Processing Policy

1. General provisions

This Policy governs the processing of personal data in the SkolCoach service (the “Service”) and has been adopted in accordance with Russian Federal Law No. 152-FZ “On Personal Data” dated 27 July 2006.

Personal data controller: sole proprietor Mikhail Lvovich Poverenny, taxpayer ID 591112097040, state registration number 316595800051952, address: 53, Building 80, Komsomolsky Prospekt, Perm, Perm Krai, 614010, Russian Federation. Contact address for personal data matters: privacy@skolcoach.ru.

This Policy applies to all data received by the Service from users during registration and use of the web application and Telegram bot. By using the Service, you confirm that you have read this Policy. Consent to personal data processing is given through separate actions (consent checkboxes) during registration and in the Service settings.

This Policy also applies to data that users, including those not registered with the Service, send to the Telegram bot @skolcoach_razbor_bot to receive a free data review (the “pre-payment review”). Consent to personal data processing in this flow is given through a separate action (a button) in the bot before any data is submitted.

2. Data we process

Identification data: email address, display name and Telegram ID (when the bot is connected).
Biographical data: date of birth and sex.
Health data (a special category under Article 10 of Federal Law No. 152-FZ): uploaded medical documents and test results, medical restrictions, heart rate variability (HRV), sleep, resting heart rate and body weight. This data is processed solely on the basis of separate explicit consent.
Training data: training volume and duration, power, heart rate, heart-rate zones, thresholds (LTHR/FTP), training plans and completion data, selected races and goals.
Food diary data (when the relevant integration is connected).
Conversation content from conversations with the AI coach in the web application and Telegram bot.
Technical data: activity logs, synchronisation statuses for external services, IP address, browser and device type.
Pre-payment review data: Data for the pre-payment review: Telegram ID, questionnaire answers (goals, health information and restrictions, schedule and wellbeing), and submitted files or links to archives of training and wellness data. This data is processed solely on the basis of separate explicit consent given in the bot.

3. Processing purposes

Providing the Service’s functionality: personal training plans, analysis of workouts and metrics, interpretation of medical documents and AI coach responses.
Assessing fitness, recovery and the risk of excessive training load.
Technical support and account security.
Sending notifications about workouts and important events.
Improving the quality of the Service — using only de-identified data and only with separate consent to model training and improvement.
Preparing a free data review for the user who submitted the data and responding to their enquiries.

4. Legal grounds

The data subject’s consent (Articles 6 and 9 of Federal Law No. 152-FZ); for health data, separate consent to the processing of special-category personal data (Article 10 of Federal Law No. 152-FZ); and performance of the user agreement (public offer).

5. Disclosure to third parties and cross-border transfers

We do not sell your data or disclose it to third parties for marketing purposes. Processing is delegated only to the technical contractors required to operate the Service:

AI coach: conversation text is transferred to Moonshot AI (People’s Republic of China). Before transmission, all requests undergo automatic de-identification: names, email addresses, telephone numbers, organisation names and dates of birth are removed or replaced. Until this technical debt is resolved, uploaded scans of medical documents may be transferred in their original form.
Infrastructure: database — Supabase Inc. (USA); application hosting — Vercel Inc. (USA). In October 2026, the database is being migrated to infrastructure within the Russian Federation (Yandex Cloud); this section will be updated once the migration is complete.
Integrations: at your initiative, the Service synchronises with external services (intervals.icu, WHOOP, Garmin, Polar, Oura, FatSecret and Google Drive). The scope of transferred data is determined by those services’ API terms; access can be revoked at any time under “Integrations”.
Other disclosures are made only as required by the laws of the Russian Federation.

6. Storage and retention

Data is stored until the processing purposes have been achieved, consent is withdrawn or the account is deleted.
When consent is withdrawn or an account is deleted, data is erased within 30 days, except for data that the law requires us to retain.
Backups are encrypted and rotated; backup retention does not exceed 14 days.
Files and archives submitted for the pre-payment review are deleted after the review is prepared and, in all cases, no later than 7 days after receipt.
Questionnaire answers and the review bot interaction log are stored for no more than 3 months after receipt and are then deleted automatically.
Pre-payment review data is deleted upon the /delete_data command in the bot or a request to privacy@skolcoach.ru, within 7 days.

7. Your rights

You may at any time:

Obtain information about the processing of your personal data.
View all your data in your account and export it.
Request that data be corrected, blocked or destroyed.
Withdraw any consent in the Service settings or by emailing privacy@skolcoach.ru.
Disconnect integrations and delete associated data.
Delete your account completely, in which case all data will be permanently erased.
Challenge the controller’s actions before Roskomnadzor or in court.

We respond to requests within 30 days of receipt.

8. Safeguards

User-level data isolation (Row Level Security).
Data transmission exclusively over HTTPS/TLS.
Access tokens for third-party services are encrypted (Vault) and inaccessible to administrators.
De-identification of requests sent to external AI services.
Role-based data access restrictions; appointment of a person responsible for organising personal data processing; and logging of personal data operations.

9. Cookies

We use only technical cookies required for authentication and operation of the Service. No third-party analytics or advertising cookies are used.

10. Changes to this Policy

The current version of this Policy is published on this page. We will notify you of material changes by email or through the Service interface.

11. Contact

For all questions about personal data processing, contact privacy@skolcoach.ru (sole proprietor Mikhail Lvovich Poverenny).