1. Who we are

Quevita AG, Industriestrasse 78, 4600 Olten, Switzerland ("Quevita", "we") is the controller for the personal data processed through 2PEAK – the website 2peak.com and the 2PEAK mobile apps for iOS and Android.

This policy supplements our Terms and Conditions. We process personal data under the Swiss Federal Act on Data Protection (FADP) and, where it applies to you, the EU General Data Protection Regulation (GDPR).

2. What data we process

• Account data – name, e-mail address, username, password (stored hashed), language and, if you sign in with Google or Apple, the identifier and the basic profile information of that account.
• Profile data – date of birth, sex, height, weight, resting and maximum heart rate, threshold values (e.g. FTP, threshold pace), your sports, goals, races and available training time, time zone and preferred units.
• Training and activity data – planned and completed sessions in running, cycling, triathlon, cross-country skiing and other sports, with date, time, duration, distance, elevation, pace, speed, heart rate, power, cadence, GPS route, perceived exertion, equipment used and your comments, as well as the training load and recovery values we calculate from them.
• Data from connected apps and devices – see section 5.
• Payment data – subscriptions, order history and the type of payment method. Card details are processed by our PCI-compliant payment providers and never reach our systems.
• Communication data – support requests and messages and, if you have consented, whether you opened a newsletter or clicked a link in it.
• Technical data – IP address, internet service provider, device and browser type, operating system, app version, language, referring page, timestamps, usage events, log files, crash and error reports, and session or device identifiers.

Only your account data and the information needed to create a training plan are required. Everything else is voluntary; without it, some features may be less accurate.

3. Health and fitness data

This section explains how we handle health and fitness data, including data from Apple Health and connected wearables and platforms.

What we treat as health data. Height, weight, resting and maximum heart rate, heart rate and heart-rate-derived values during training, threshold values, power and pace data, GPS routes, perceived exertion, the training load and recovery values we calculate, and your exercise and activity sessions. This is sensitive personal data under the FADP and a special category of personal data under Art. 9 GDPR. We protect your date of birth and sex in the same way, because combined with the above they allow conclusions about your health.

Why we process it. Only to deliver the features you use:

• to calculate and continuously adapt your personal training plan, including the analysis of training load and recovery after each session;
• to show your activities, statistics, progress and race predictions;
• to help you when you contact support.

Who receives it. Only the processors listed in section 4 that are needed to run the service, in particular hosting. Our processors act only on our instructions under written data-processing agreements and may not use the data for their own purposes.

Staff access. Our staff do not routinely view your health data. Access is limited to authorised employees and only where necessary to provide support you requested, to investigate a technical fault or to meet a legal obligation.

Retention and deletion. We keep health and fitness data while your account exists. You can delete individual activities at any time and disconnect any device or app, which stops further transfers. If you delete your account – in your account settings or by e-mail to [email protected] – all your personal data, including health and fitness data, is permanently deleted within 30 days. Backups are overwritten on a regular frequency. We never use health data for advertising.

Anonymised data. We may anonymise training data and use it in aggregated form to improve our training algorithms and for statistical or scientific purposes. Anonymised data is no longer personal data and may be kept.

4. Who receives data

Processors. These providers act only on our instructions under data-processing agreements. We operate the wearable and health data gateway (qwg.quevita.com) ourselves.

Independent controllers. The following receive data for their own purposes and under their own privacy policies:

• Google and Apple if you use them to sign in;
• Apple (App Store) and Google (Google Play) for in-app purchases;
• Google for website analytics (see section 6). Google never receives health or fitness data.

running.COACH and viRACE. These products are also operated by Quevita AG. If you use them with your 2PEAK account, we share your account and profile data with them. Health and training data is shared only if you activate this and consent.

Other disclosures. We disclose personal data where the law requires it, or to establish, exercise or defend legal claims. If our business is sold or reorganised, data may pass to the acquirer, who remains bound by this policy; we will inform you in advance.

5. Connected apps and devices

You can connect 2PEAK to services such as Garmin, Polar, Suunto, Coros, Wahoo, Fitbit, Strava, Zwift and Apple Health.

When you connect a service, we receive the data you authorise – typically activities and workouts with duration, distance, pace, speed, heart rate, power, cadence, elevation and GPS route, and, depending on the service, body measurements such as weight. We use this data only to fill in and adapt your training plan and to show your activities and statistics. With some services, we can also send planned workouts to your watch, bike computer or training platform. The connected service's own privacy policy applies to its processing.

Apple Health. With your permission, we read and write from and to Apple Health. This data is used only for your training plan and activity display. It is never used for advertising, never sold and never shared with data brokers. You can manage our access at any time in the Health app on your iPhone.

Revoking access or disconnecting a service in your 2PEAK settings stops all further transfers. Data imported before remains in your account until you delete the activities or your account.

6. Cookies, analytics and advertising

Our website uses cookies and similar technologies that are necessary to run the site and keep you logged in during your visit.

We also use Google Analytics 4 (Google Ireland Ltd.) to understand how our website and apps are used. Google Analytics receives technical and usage data such as device and browser information and the pages you visited and, if you are logged in, an internal identifier for your account. It never receives health, fitness, training or GPS data, nor any data from Apple Health or a connected device.

You can block Google Analytics through your browser or device settings, for example with a tracking-blocker add-on.

Our mobile apps use analytics tools to help us understand how the apps are used. They do not contain advertising trackers.

7. International transfers

We are based in Switzerland. Our recipients process data in Switzerland, the EU/EEA and the United States.

The EU/EEA offers an adequate level of data protection. For transfers to the United States, we rely on the recipient's certification under the EU–US and Swiss–US Data Privacy Framework where it exists; otherwise on the European Commission's Standard Contractual Clauses with the Swiss addendum, plus additional safeguards where necessary.

You can request a copy of these safeguards at [email protected].

8. Your rights

You have the right to:

• obtain information about the personal data we hold about you and a copy of it;
• have inaccurate data corrected;
• have your data deleted;
• restrict processing, or object to processing based on our legitimate interests;
• object at any time to the use of your data for direct marketing;
• receive the data you provided in a common, machine-readable format, or have it transferred to another controller;
• withdraw any consent you have given, with effect for the future;
• request human review of automatically generated results (see section 9).

To exercise these rights, write to [email protected]. We may need to verify your identity and will reply within 30 days.

9. Automated processing

Your training plan, the analysis of your training load and recovery, and your race predictions are generated automatically by our training algorithm from your profile and activity data, so the plan fits you.

10. Security

We protect your data with TLS encryption in transit, encrypted storage of access tokens for connected services, hashed passwords, role-based access controls, access logging and regular backups. No system is perfectly secure, but we review our measures regularly. We notify you and the competent authority of a data breach where the law requires it.

11. Children

2PEAK is intended for people aged 16 and over. We do not knowingly process data of children under 16. If we learn that we hold such data, we delete it.

12. Changes and contact

We may amend this privacy policy. The current version is always available via the "Privacy" link. We will inform you of material changes in advance by e-mail or in the app. If a change requires your consent – for example, a new purpose for your health data – we will ask for it.

Quevita AG
Industriestrasse 78
4600 Olten
Switzerland
[email protected]