Privacy Policy & GDPR Statement
Last updated: 15 July 2026 (version 2026-07-15)
MIT-OX gives you nutrition guidance built around your actual training. To do that we have to process health data about you — your body, your workouts, and how hard you train. That is sensitive, and we treat it that way.
We only ask for what a recommendation actually needs. Health data is encrypted before it is stored. We never sell your data, and we do not use your health data for advertising.
You are in control: you can export everything we hold, correct it, withdraw your consent, or delete your account and data — from your account page, or by emailing legal@mit-ox.com, at any time.
1. Who we are
MIT-OX Nutrition System S.A. (“MIT-OX”, “we”, “us”) is the data controller for the personal data described in this policy. That means we decide why and how your data is processed, and we are responsible to you for it.
- Controller: MIT-OX Nutrition System S.A.
- Registered address: —
- Company registration number: —
- Privacy contact: legal@mit-ox.com
- Data Protection Officer: you can contact our DPO directly at legal@mit-ox.com
This policy explains what we do with your data, why we are allowed to, and the rights you have under the EU General Data Protection Regulation (GDPR).
2. The data we process
We group your data by what it is and why it exists. We only store what a recommendation, an order, or your account actually requires.
| Category | What it includes | Where it comes from |
|---|---|---|
| Account data | Email address, password (stored only as a salted hash — we never see it), sign-in method, account creation date. | You, when you register. |
| Profile & health data | Sex, age, body weight, height, sport, session duration and intensity, training environment, gut tolerance and gut-training status, estimated or measured sweat rate. | You, as you answer the profile questions. |
| TrainingPeaks profile | Name, surname, email, date of birth, body weight and height, and your training zones/thresholds (e.g. FTP, threshold heart rate). | TrainingPeaks, only if you choose to connect your account. |
| Training & biometric data | Planned and completed workouts: sport type, date and time, duration, distance, planned interval structure, intensity factor and training load (TSS), power, heart rate, cadence, speed, elevation, energy and temperature — the kind of data typically found in a workout (FIT) file. | TrainingPeaks, if connected. |
| Location data | The training location you tell us (as an approximate latitude/longitude) and your usual training time of day. Used only to look up the expected temperature for a session, because heat changes fluid and sodium needs. | You. We do not track your device location in the background. |
| Fueling records | The recommendations we generate for you, and a record of what we wrote to your TrainingPeaks calendar (the date, the carbohydrate total, and an identifier for the nutrition entry or comment we created). | Generated by us. |
| Consent records | What you consented to, which version of this policy you agreed to, and when — plus when you withdrew it, if you did. | Generated by us, to prove we asked properly. |
| Security & audit logs | Security-relevant events such as sign-ins, connecting or disconnecting TrainingPeaks, data exports, and account deletion. | Generated by us. |
| Order & payment data | Your order history and the payment confirmation we receive. Card details are handled by our payment provider and never reach our servers. | You and our payment provider. |
3. Health data and your explicit consent
Most of what makes MIT-OX useful — your weight, heart rate, training load, sweat rate — is “data concerning health” under Article 9 of the GDPR. This is a special category of data with extra protection, and we are only allowed to process it on a narrow set of grounds.
We rely on your explicit consent (Article 9(2)(a) GDPR). We ask for it clearly, before we store health data against your account, and we record which version of this policy you agreed to. If you do not consent, you can still use the protocol builder without an account — we simply will not store anything about you.
You can withdraw your consent at any time. Withdrawing it does not make our earlier processing unlawful, but it does stop us processing your health data going forward — and because health data is the core input to a recommendation, withdrawing it effectively ends the personalized service.
4. Why we use your data, and our legal basis
Under the GDPR we need a lawful basis for every purpose. Here is ours, purpose by purpose.
| Why we process it | What we use | Legal basis |
|---|---|---|
| To build your personalized fueling plan and write it to your training calendar | Profile, health, training, structure and location data | Your explicit consent for the health data (Art. 9(2)(a)); performance of our contract with you (Art. 6(1)(b)) |
| To create and run your account, and to keep you signed in securely | Account data | Performance of our contract (Art. 6(1)(b)) |
| To process your orders and payments | Order and payment data | Performance of our contract (Art. 6(1)(b)) |
| To keep invoices and accounting records | Order and payment data | Compliance with a legal obligation (Art. 6(1)(c)) |
| To keep the service secure, prevent abuse, and investigate incidents | Security and audit logs, rate-limiting data | Our legitimate interests in securing the service (Art. 6(1)(f)) |
| To understand how the app is used and improve it | Analytics data (see “Cookies and analytics”) | Your consent (Art. 6(1)(a)) |
| To prove we obtained consent properly | Consent records | Compliance with a legal obligation (Art. 6(1)(c)) and our legitimate interest in demonstrating compliance (Art. 6(1)(f)) |
We do not sell your personal data, we do not share it with data brokers, and we never use your health or training data for advertising or profiling for marketing purposes.
5. Who we share it with
We share data only with the providers we need to run the service. Each acts under a contract that restricts what they may do with it. We do not give any of them permission to use your data for their own purposes.
| Provider | What it receives | Why |
|---|---|---|
| TrainingPeaks, LLC (United States) | Your authorisation, and the fueling we write back: a daily nutrition entry and a fueling comment on the relevant workout. We read your profile, zones and workouts from it. | Only if you connect your TrainingPeaks account, so your plan can be built from your real sessions and delivered where you train. You can disconnect at any time. TrainingPeaks is an independent data controller for the data in your TrainingPeaks account — its own privacy policy governs what it does with it. |
| Stripe Payments Europe, Limited (Ireland) | Your payment and order details. Card numbers go directly to Stripe and never reach our servers. | To take payment securely. Stripe Technology Company, Limited (Ireland) is Stripe's main establishment in Europe for data protection purposes. |
| Google Analytics (Google Ireland Limited) | Usage and device data, such as pages viewed and approximate region. | To understand how the app is used and improve it. Only runs if you accept analytics cookies. |
We run our own servers in Barcelona, Spain, and your account and health data live there. There is no third-party cloud provider holding it, and it does not leave the EU except in the cases listed above.
We may also disclose data if the law requires it (for example, a valid court order), or to establish, exercise or defend legal claims.
6. Sending data outside the EEA
Some of our providers are based in, or store data in, the United States. When your data leaves the European Economic Area, we rely on the safeguards the GDPR requires — either the provider's certification under the EU–US Data Privacy Framework, or the European Commission's Standard Contractual Clauses, together with additional technical measures such as encryption.
| Provider | Where your data goes | The safeguard protecting it |
|---|---|---|
| TrainingPeaks | United States | Standard Contractual Clauses approved by the European Commission; a copy is available from TrainingPeaks at privacy@trainingpeaks.com. TrainingPeaks, LLC is a US company and an independent controller, so its own privacy policy also governs your TrainingPeaks account. |
| Stripe | Ireland, with onward transfers to the United States | EU–US Data Privacy Framework, with the Standard Contractual Clauses as a fallback. |
| Google Analytics | Ireland, with onward transfers to the United States | EU–US Data Privacy Framework, plus the Standard Contractual Clauses for certain transfers. |
You can ask us for a copy of the safeguards we rely on by writing to legal@mit-ox.com.
7. How long we keep it
| Data | Retention |
|---|---|
| Account, profile, health, training and fueling data | For as long as your account is active. If you delete your account it leaves the service immediately, is blocked, and is destroyed once the blocking period ends — see “What happens when you delete your data”. |
| Blocked data (after you delete your account) | Up to three years, locked away and unusable by us, available only to judges, courts, the Public Prosecutor or the AEPD (Art. 32 LOPDGDD). Then destroyed. |
| TrainingPeaks access tokens | Until you disconnect TrainingPeaks or delete your account, whichever comes first — then erased immediately. |
| Invoices, orders and accounting records | Six years from the last accounting entry, which is what the Spanish Commercial Code (Art. 30) requires of us. Spanish tax law (Art. 66 General Tax Act) sets a shorter four-year period, so the six-year rule is the one that governs. We keep these even after you close your account, because we have no choice. |
| Consent records | For as long as your account is open, and then five years — long enough to show a court or the regulator that we asked for your consent properly, matching the five-year limitation period for personal claims under Art. 1964 of the Spanish Civil Code. |
| Security and audit logs | Twelve months. No Spanish statute fixes this period for a service like ours; we chose it as the shortest span that still lets us investigate a security incident, and we record that decision in our processing register. |
When a retention period ends, we delete the data or irreversibly anonymise it so it can no longer be linked to you.
8. Your rights under the GDPR
These rights are yours, they are free to use, and using them will never cost you the service you paid for. We will respond within one month; if a request is genuinely complex we may extend that by two further months and will tell you why.
| Your right | What it means in practice |
|---|---|
| Access (Art. 15) | Get a copy of the personal data we hold about you, and an explanation of how we use it. Go to your account page and choose “Export my data” — you get the full record as a JSON file, immediately. |
| Rectification (Art. 16) | Correct anything inaccurate or incomplete. You can edit your profile answers directly in the app; if something is wrong that you cannot edit, email us and we will fix it. |
| Erasure — “right to be forgotten” (Art. 17) | Have your data deleted. Your account page has a one-click “Delete my account and data”. Your account, profile, health data, recommendations and TrainingPeaks tokens disappear from the service straight away and nobody at MIT-OX can reach them again. Spanish law then requires a final step rather than an instant wipe — see “What happens when you delete” below. |
| Data portability (Art. 20) | Receive the data you gave us in a structured, commonly used, machine-readable format — and take it elsewhere. Our export is JSON, which is exactly that. Ask us and, where technically feasible, we will send it directly to another provider. |
| Restriction (Art. 18) | Ask us to pause processing — for example while we check data you say is inaccurate. We keep the data but stop using it. |
| Objection (Art. 21) | Object to processing we base on our legitimate interests. We will stop unless we can show compelling grounds that override your interests. |
| Withdraw consent (Art. 7(3)) | Withdraw your consent to health-data processing, or to analytics cookies, at any time — as easily as you gave it. This does not affect processing carried out before you withdrew. |
| Automated decisions (Art. 22) | Ask for human involvement in, and contest, any decision made solely by automated means that significantly affects you. See “Automated recommendations” below. |
To exercise any right, use your account page or email legal@mit-ox.com. We may need to verify your identity first — we will only ask for what is necessary to be sure it is really you.
9. What happens when you delete your data
When you delete your account, Spanish data protection law (Article 32 of the LOPDGDD) does not allow us to wipe everything on the spot. It requires us to block the data first. That protects you: if you ever complained about how we handled your data, the evidence still has to exist for a regulator or a judge to look at.
Blocking means exactly what it sounds like. Your data is locked away and put beyond use: it leaves the service immediately, no one at MIT-OX can use it or even look at it, and it cannot be processed for any other purpose — no recommendations, no analytics, no marketing, nothing.
The only people it can be made available to are judges, courts, the Public Prosecutor and the competent authorities — in particular the AEPD — and only to determine whether we handled your data lawfully. Once the time limit for holding us responsible has passed, we destroy it for good.
| Stage | What it means for you | How long |
|---|---|---|
| Immediately | Your account and data leave the service. You can no longer sign in, and we can no longer use your data for anything. | The moment you confirm deletion. |
| Blocked | Locked away and unusable by us. Released only to judges, courts, the Public Prosecutor or the AEPD, and only to check whether we processed your data lawfully. | Up to three years — the longest period in which we can still be held responsible for how we handled your data (Art. 78 LOPDGDD). |
| Destroyed | Gone permanently. | As soon as the blocking period ends. |
Invoices and accounting records are a separate matter: tax and commercial law oblige us to keep them for six years, so they are not deleted with your account. They are kept for that purpose alone.
10. Complaining to a regulator
If you think we have handled your data badly, please tell us first — we would rather fix it. But you always have the right to complain to a data protection supervisory authority, either in the country where you live, where you work, or where the problem happened.
- Our lead supervisory authority is the Spanish Data Protection Agency — Agencia Española de Protección de Datos (AEPD), www.aepd.es.
11. Automated recommendations
Your fueling protocol is generated automatically. A deterministic engine reads your profile and your planned session — its duration, intensity and interval structure — and applies fixed, documented rules written by a sports physiologist to produce carbohydrate, fluid and sodium targets and the timing of gels.
Every recommendation is shown together with the reasoning behind it, the assumptions it had to make, and the scientific basis it rests on. It is guidance for you to use or ignore; it produces no legal effect and we do not consider it a decision that significantly affects you in the sense of Article 22. Even so, you can always ask a human at MIT-OX to review a recommendation — just email us.
MIT-OX provides sports-nutrition guidance. It is not medical advice, and it is not a substitute for a doctor or a registered dietitian.
12. How we protect your data
- Health and profile data is encrypted before it is written to the database (AES-256-GCM), so it is not readable in a raw database dump.
- TrainingPeaks access tokens are encrypted at rest and are erased the moment you disconnect or delete your account.
- Passwords are stored only as a salted Argon2 hash — we cannot read them, and neither can anyone who steals the database.
- All traffic runs over HTTPS, with strict transport security and hardened response headers.
- Access to production data is limited to the people who need it, and security-relevant events are written to an audit log.
- Sensitive endpoints are rate-limited to resist brute-force and abuse.
No system is perfectly secure. If a breach ever puts your rights at risk, we will notify the supervisory authority within 72 hours as the GDPR requires, and we will tell you directly when the law requires that too.
13. Cookies and analytics
We use a small number of strictly necessary cookies to keep you signed in and to protect the service. These are required for the app to work and do not need your consent.
We also want to understand how the app is used so we can improve it, using Google Analytics. Analytics cookies are optional: they are only set after you accept them, and you can change your mind at any time. If you decline, the app works exactly the same.
14. Children
MIT-OX is not intended for children. You must be over 16 years old to create an account — we do not offer the service to anyone younger, even with a parent's permission. If we learn that we have collected health data from someone under 16, we will delete it promptly.
15. Changes to this policy
If we change how we use your data, we will update this policy, publish a new version identifier and date, and — where the change is material and affects health-data processing — ask for your consent again rather than assume it. We will not quietly widen what we do with data you already gave us.
16. Contact
Questions, requests, or complaints about privacy: legal@mit-ox.com.