1. Who is responsible for your information?
This website and the ENDUUR platform are operated under the name ENDUUR (referred to here as “ENDUUR”, “we”, “us” and “our”). We are the point of contact for personal data processed to operate the platform and our own coaching services. Contact us about privacy through the contact form and state “Privacy request” as the subject or goal.
Independent coaches using ENDUUR may have separate responsibilities for their own client coaching relationships, communications and payment arrangements. Ask your coach about their separate privacy practices where relevant. This policy covers the ENDUUR platform itself; it does not replace an independent coach’s own privacy notice.
2. Information we collect
Depending on how you use the platform, this may include:
- Account and contact details: name, email address, account identifiers, role, sign-in information, contact preferences and enquiries.
- Coaching profile and goals: experience, available training days, race entries and targets, estimated pace, training history, intake responses and information you choose to tell your coach.
- Training activity: planned and completed sessions, distance, duration, personal bests, race goals, session changes, recorded effort, feedback and training calendar entries.
- Wellbeing and performance: optional recovery check-ins, fatigue, sleep, soreness, injury concerns, heart rate, heart-rate variability, VO₂ max, steps, pace, splits and uploaded FIT or TCX workout measurements, when supplied.
- Communications and business administration: coach–runner messages, service enquiries, workspace branding, subscription status and transaction references.
- Technical information: information needed for authentication, security, operation and troubleshooting, such as device/browser details and service request records, where recorded by our providers.
We obtain information from what you enter, what your assigned coach enters for your training, and from any third-party integration or file import you deliberately enable. You do not need to connect a wearable or upload health information simply to browse the public website.
3. Why we process personal information
- To provide your account, subscriptions, training plans, calendars, progress tracking and coaching services.
- To let you communicate with an assigned coach and, where applicable, allow them to manage your agreed training programme.
- To show relevant running statistics and performance trends using the data you choose to record or import.
- To process or verify payments, respond to enquiries, provide requested notifications and deliver customer support.
- To prevent abuse, secure accounts, investigate technical faults and comply with applicable legal obligations.
We do not sell or rent identifiable athlete data to data brokers or advertisers, and we do not use connected fitness data to target third-party advertising. Any future materially different purpose will require an updated notice and any permission required by law.
4. UK GDPR legal grounds and sensitive health information
We rely on performance of a contract to deliver a requested account, coaching tools or paid service; legitimate interests for proportionate platform security, service administration and support; legal obligations where records must be retained by law; and consent where you choose optional data imports, sharing or communications that require it.
Some recovery notes, health measurements, injury concerns and wearable metrics may reveal special-category health data. Where explicit consent is legally required to handle that information for optional wellness or performance features, we must obtain it through a separate clear affirmative choice before processing it for that purpose. You can withdraw optional sharing or stop an integration, and you can request deletion or restriction of the data where applicable. Withdrawing consent does not retrospectively invalidate processing undertaken while consent was valid.
ENDUUR is a coaching and fitness service, not a clinical provider. Training suggestions and wellness indicators are not medical diagnoses.
5. Connected fitness services, uploads and Garmin
Strava (existing optional connection)
If you authorise Strava, the platform can receive activity information such as the activity name, type, date, distance, duration and average pace, and use it within your own training log. The Strava account connection uses access credentials to enable synchronisation. Under the current design, the connected Strava activity records are private to the runner, not visible to their assigned coach. You can disconnect Strava in your account; please also review or revoke permissions in Strava if needed. Strava’s own processing is governed by its privacy policy .
Apple Health and native iPhone integration (optional)
The ENDUUR website does not directly read Apple HealthKit. The optional native iPhone app under development can request your explicit Apple Health read permission for selected fitness measurements: steps, resting heart rate, HRV, VO₂ max, exercise minutes, walking/running distance and basic workout summaries. If approved by you, these measurements can be sent over HTTPS to the ENDUUR account associated with your iPhone's secure sync credential. The iPhone stores the credential in the device Keychain, and HealthKit can notify the native app of updates in the background when iOS permits.
Alternatively, you can configure Health Auto Export as a separate third-party iPhone automation. Apple Health imports are private to the runner and are not automatically shared with a coach, used for advertising or sold. The Apple Health settings pagelets you revoke the receiving key and delete imported Apple Health records held in ENDUUR. Revoking the key does not delete information from Apple's Health app. You may also change Health permissions in iPhone Settings.
Device files (FIT/TCX)
New manual FIT/TCX uploads are currently paused. Runners who previously imported original device files into the legacy performance view may still manage those existing records. We retain the extracted performance measurements required for charts rather than the original file. These records are private by default. A runner can explicitly share an individual imported workout with their currently assigned coach, stop sharing it, or delete it in previous workout imports.
Garmin Connect integration
Garmin has approved our developer access, and the Garmin Connect activity integration is live. Runners must separately choose to connect their Garmin account and grant Garmin's requested permissions before data is received.
Authorised Garmin activity summaries can include the activity name, date, type, duration, distance, pace, average heart rate and elevation gain. If the runner separately permits the Health API, we may receive limited daily summaries such as steps, resting heart rate, stress, sleep duration and Body Battery. We only keep these fields rather than raw GPS tracks or the whole Garmin payload. Imported Garmin data is private by default. Runners may explicitly enable coach sharing in Account Settings; only the currently authorised assigned coach can then view limited activity and daily health summaries.
Runners can disconnect Garmin in Account Settings. This requests revocation of Garmin authorisation and deletes the Garmin-imported records held by ENDUUR; it does not delete information in Garmin Connect. If Garmin's revocation endpoint is unavailable, runners should also remove ENDUUR's access in Garmin Connect. Data delivery is push-based after device syncing, where supported; connected runner accounts now receive new activity summaries after Garmin sends its push notifications.
Sending planned workouts to Garmin (optional)
Coaches may prepare structured running sessions containing warm-ups, repeats, distances, recovery times, optional heart-rate or pace targets and scheduled dates. Runners can authorise a single workout, approve a one-time bulk send of future workouts, or separately opt in to automatic rolling 14-day publishing. When rolling sync is enabled, ENDUUR checks periodically and sends newly eligible upcoming running workouts to Garmin Connect until the runner switches it off or loses eligibility. Turning it off prevents further automatic publishing but does not remove workouts already in Garmin Connect. Runners may also separately opt in to automatically update the existing Garmin workouts when an authorised coach changes a future session in the rolling 14-day period. Without that additional choice, existing workouts are only updated when the runner explicitly approves an individual update. Updates verify the existing Garmin workout and calendar references; uncertain outcomes are held for review rather than automatically retried. Every send or update uses the Garmin Training API and requires Workout Import permission. Coaches cannot activate the runner's Garmin connection or approve sends or updates on the runner's behalf. We retain private delivery records to prevent duplicate submissions and investigate uncertain acknowledgements. Garmin Connect controls transfer to compatible Garmin devices; acceptance by Garmin Connect is not proof of delivery to a watch.
Garmin data recipients, AI and your choices
ENDUUR receives authorised Garmin data from Garmin Connect and uses Base44(our application host, authentication service and database provider, together with its infrastructure subprocessors) to transmit, process and store the selected records needed for your private training calendar and Garmin account connection. Garmin remains the independent source provider. Garmin-derived activity and health data is not sold, provided to advertisers, transferred to payment provider Stripe, or automatically sent to Strava or unrelated users. Garmin coach sharing is optional and off by default. If you switch it on in Account Settings, the particular coach currently assigned to you can read up to 28 days of Garmin activity summaries (name, date, type, distance, duration, pace, average heart rate and elevation) and available daily health summaries (sleep duration, resting heart rate, steps, stress and Body Battery). Newly synced summaries become accessible while sharing remains on. Direct access to your original Garmin API records stays private. Switching the option off blocks further coach reads, without disconnecting Garmin or deleting your own records. If your assigned coach changes, sharing does not carry across: the new coach requires a new opt-in. Information a coach already viewed or saved outside the platform cannot be recalled.
AI transparency: Our current Garmin connection uses programmed data mapping and database operations, not machine-learning or generative AI services to analyse Garmin-sourced activity or health data. Garmin-sourced records are not used to train or evaluate AI models. If we propose optional AI-powered features involving Garmin data in the future, we will first explain the AI provider, information processed and purpose, obtain explicit informed consent where required, and provide an easy way to withdraw that consent without losing unrelated app access.
To view your Garmin-imported activities, open your private training calendar or Garmin card. You may correct inaccurate source measurements in Garmin Connect, or request a correction to records held by us. To withdraw Garmin access and erase all Garmin-imported data in ENDUUR, use Disconnect & delete Garmin data in Account Settings. You may also request access to or export of your Garmin-derived account records, correction, restriction or deletion through our privacy contact form. We may verify your account before responding to access, export or correction requests.
Garmin remains independently responsible for data processed in Garmin Connect; see Garmin Connect’s privacy policy . ENDUUR is not affiliated with or endorsed by Garmin merely by applying to its developer programme.
7. Hosting, payment providers and international transfers
We use Base44 to host and operate the platform, including receiving and storing Garmin API data through authenticated backend services and the supporting hosting infrastructure. Garmin API data is not sent to our billing processors or to third-party AI platforms. Subscription billing and coach payment integrations may use Stripe and other payment arrangements selected by a coach. Payment processors handle card or payment details under their own terms; ENDUUR uses payment status and transaction identifiers as needed to administer subscriptions.
Other connected platforms, including Strava and Garmin (when its connection is enabled), and Health Auto Export, have their own terms and privacy policies. Providers may process information outside the United Kingdom. Where international data transfers are subject to UK GDPR restrictions, we must use an applicable adequacy decision or another legally recognised safeguard as required. You can contact us to request information about relevant transfers and safeguards.
8. How long data is kept
Account, coaching and activity information is generally kept while your account or coaching relationship remains active and for as long afterwards as necessary to administer the service, resolve disputes, meet legal obligations or handle valid requests. Garmin-imported data is removed from ENDUUR when a runner uses Garmin's disconnect and delete control, subject to any technical backup retention and overriding legal obligations. We review whether information is still required and do not retain it indefinitely merely because it can be collected.
You can delete individual FIT/TCX imported workouts within Performance Analytics, and you can remove all Apple Health import records using the Apple Health settings page. Disconnecting an integration stops future authorised collection through that connection but does not automatically remove other training information you entered separately. To request account-wide deletion, access or export, contact us. Some billing or legal records may need to remain for the period required by law; backups may take additional time to expire.
9. Your controls and data-protection rights
Subject to applicable law, you may ask us to access, correct, erase or obtain a portable copy of personal data we hold about you, object to certain processing, restrict it, and withdraw consent where processing relies on consent. We may verify your identity before acting on a request. If we cannot fully meet a request, we will explain why.
- Disconnect Strava: use the Strava card on your runner dashboard and review the authorisations in Strava.
- Stop Apple Health exports: revoke the sync key in Apple Health settings and disable any iPhone automation. The same page offers deletion of saved Apple Health data.
- Manage workout sharing: use previous workout imports to manage existing FIT/TCX uploads. New manual uploads are paused.
- Control recovery sharing: choose whether individual daily check-ins are shared with your assigned coach.
- Messages and notifications: change available notification preferences in the relevant app settings.
- Disconnect Garmin: use the Garmin card on your runner dashboard to revoke access and delete Garmin-imported records held in ENDUUR. You can also manage consent in Garmin Connect.
- Other privacy requests: use the contact form and include “Privacy request”.
We aim to respond to rights requests within the timescales required under UK data protection law, normally within one month, subject to permitted extensions and verification. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO).
10. Security, cookies and similar technologies
We use HTTPS connections, authenticated account access, server-side permission checks and restricted coach–runner access for relevant data. Optional Apple Health transfers require a per-runner receiving key. No online service can guarantee absolute security. Please keep your account credentials and any health-export key confidential, and contact us promptly if you suspect unauthorised access.
The website and underlying services may use session credentials, essential cookies or similar storage to keep you signed in, secure the service and remember necessary settings. Any non-essential tracking or marketing technologies that require prior consent under applicable law must not be enabled without that consent. Browser settings may allow you to manage cookies, although disabling essential storage may prevent sign-in.
11. Children, updates and automated decisions
ENDUUR is designed for coaching participants who can lawfully use the service and, where applicable, have valid parental or guardian authorisation. We do not knowingly seek sensitive information from children without an appropriate lawful basis.
We may update this policy as functionality, providers or legal requirements change. The latest version and its effective date will be published here. If changes materially affect optional health-data use or connected service permissions, we will provide any further notice or permission required by law.
The platform can calculate training trends and suggested sessions, but does not currently use a solely automated process to make legally significant decisions about you.
12. Contact us or make a complaint
For questions about this policy, the identity of the relevant controller for a particular service, permissions, access requests, withdrawals or deletions, please contact ENDUUR through our contact page and label your enquiry “Privacy request”. Include the email used for your account and sufficient information to identify your request; please do not send passwords or authentication tokens.
You may also complain to the Information Commissioner’s Office (ICO) . We welcome an opportunity to address your concern directly first.