KENRAS health

Privacy Policy

Version: 1.1 (draft)  ·  Last updated: October 3, 2026

1. Who we are

Kenrashealth ("Kenrashealth," "we," "us," or "our") operates a personal health and training analytics platform available at [FILL IN — site URL]. This policy explains what data we collect, where it comes from, how we use it, and the choices and rights you have.

If you have questions about this policy or your data, contact us at [FILL IN — support/privacy email address].

2. What data we collect

We collect data in two ways: data you provide directly, and data we receive from third-party fitness and health services you choose to connect to your Kenrashealth account.

2.1 Data you provide directly

  • Account information: name, email address, password (stored as a salted hash, never in plain text), and any profile details you add.
  • Anything you type into the platform directly (notes, goals, manually logged entries, etc., if applicable).

2.2 Data from connected third-party services

Kenrashealth integrates with the services below, which you connect voluntarily. How we connect differs by provider, and so does what we store — described accurately per service below rather than as one blanket statement, since it isn't the same for all of them:

  • Strava and Withings use each provider's own OAuth authorization flow: authorization happens directly between you and the provider, and we receive only an access/refresh token, never your password for that service. Strava provides activity and performance data; Withings provides body composition, weight, and related health-device data.
  • Garmin Connect doesn't offer a comparable OAuth flow for this kind of integration, so connecting it means providing your Garmin email and password directly to us. We store these encrypted at rest (see Section 8) and use them only to authenticate to Garmin's own service on your behalf when syncing; we never use them for anything else. Garmin sync covers activity data (GPS, pace, distance, duration), heart-rate and heart-rate-zone data, power/training-load metrics, sleep, stress, Body Battery, respiration, and related all-day wellness metrics, depending on which Garmin data your account makes available.
  • Cronometer works the same way as Garmin — no public OAuth flow for this data, so we store your Cronometer email and password, encrypted at rest, to sync your nutrition and dietary intake data on your behalf. [FILL IN/CONFIRM — Cronometer credentials are currently a single set shared across the whole app rather than per-user; update this once/if that changes to per-user credentials, and confirm whether this should instead be described as an owner-level integration for now.]
  • TrainingPeaks has no supported login flow for this integration at all — connecting it means providing a session cookie value copied from your own logged-in TrainingPeaks browser session, which we store encrypted at rest and use to fetch your structured training plans, workouts, and training-load metrics. This cookie expires periodically and has to be refreshed by you when it does. [FILL IN/CONFIRM — same owner-vs-per-user note as Cronometer above.]
  • A coaching nutrition plan, if your account has one configured: we read a JSON file from a Google Drive folder you (or your coach) share with a Google service account we control, to get your day-by-day planned calorie/macro/workout targets. We don't access anything else in your Google account or Drive — only the specific shared folder. [FILL IN/CONFIRM — this is currently one shared folder configured at the app/owner level, not a per-user connection; revisit this description once/if that becomes a per-user setting.]

We only request the specific data scopes/permissions needed for the features you use, and only after you explicitly authorize each connection. You can disconnect any of these integrations at any time from your account settings; see Section 7.

2.3 Data we generate

We derive and store analytics, trends, and visualizations computed from the data above (for example, training-load trends across sources). This derived data is treated with the same protections as the source data it's built from.

2.4 Automatically collected technical and usage data

We collect a small amount of technical and usage data automatically, for security, reliability, and to understand how the service is used. All of it is collected by our own systems; we do not use any third-party analytics, advertising, or error-tracking service.

  • Last activity. The approximate time (rounded to the hour) your account last made a signed-in request, which lets us count how many accounts are active each day, week, and month.
  • Feature-use events. A simple record of which account loaded the dashboard, opened a dashboard tab (Calendar, Charts, Nutrition, Plan, Sources), or viewed a settings page, and when. These records contain no page content and none of your health, fitness, or nutrition data, and are tied to your account so we can count distinct users. They are deleted after 180 days.
  • Sync history. For each attempt to sync a connected service: which service, when, how long it took, whether it succeeded, how many records it retrieved, and any error message, so we can fix problems.
  • Server request statistics. Aggregate counts and response times per page type (for example, how many requests the dashboard received and how long they took), kept in memory and not linked to any account. When a request fails with a server error or is unusually slow, a line noting the page type, status, and duration is written to our server logs. Our hosting provider and web server may also log technical details such as IP address and browser/device type for security and abuse prevention.

Usage figures are reviewed by the administrators of the service, mainly as totals and counts rather than as profiles of individual people. They are not sold, shared with advertisers, or used to build advertising profiles.

3. How we use your data

We use the data described above to:

  • Provide the core product: aggregating and visualizing your training, health, and nutrition data across connected sources.
  • Maintain and secure your account.
  • Diagnose and fix technical problems, including alerting us when a connected service repeatedly fails to sync for an account.
  • Understand how the service is used (for example, how many accounts are active and which features are used) so we can keep it reliable and decide what to improve.
  • Communicate with you about your account or material changes to the service.

We do not use your health or fitness data for advertising, and we do not build advertising profiles from it.

4. Legal basis for processing (for users in the EEA, UK, and similar jurisdictions)

Where applicable data protection law requires a legal basis for processing:

  • Processing your account data and connected-service data is based on your consent, given when you connect each integration and when you agree to this policy.
  • Some limited processing (e.g., security logging, fraud prevention) is based on our legitimate interest in operating a secure service.
  • You may withdraw consent at any time by disconnecting an integration or deleting your account (Section 7); this does not affect the lawfulness of processing carried out before withdrawal.

Some of the data described above — in particular health, fitness, and biometric data from Garmin, Withings, and similar sources — may be considered a special category of personal data under GDPR Article 9 or equivalent laws elsewhere. We process this data only with your explicit consent, given when you authorize each connection.

5. Who we share data with

We do not sell your personal data.

We share data only with:

  • The third-party services you connect (Section 2.2), to the extent needed for the integration to function (e.g., requesting your data via their API using the access token you authorized).
  • Infrastructure and processing providers we use to run the service:
    • Fly.io, our application hosting and database provider — both the application and its Postgres database run on Fly.io-hosted infrastructure, currently in the [FILL IN/CONFIRM — region, e.g. "iad" (Ashburn, Virginia, US)] region. [FILL IN — if data is ever replicated across multiple regions, say so here, since that affects the international- transfer language in Section 9.]
    • Resend, to deliver account-related email (verification, password reset). Resend processes your email address and the content of those messages; it doesn't receive any of your fitness/health/nutrition data.
    • Google (Google Drive API), only for accounts with a coaching nutrition plan configured (Section 2.2) — a Google service account we control reads a specific shared Drive folder to fetch that plan.
    • We use no third-party analytics or error-tracking providers; the usage and performance data in Section 2.4 stays on our own infrastructure (Fly.io, above). If that changes, we will list the provider here and update this policy first.
  • Law enforcement or regulators, only where required by law.
  • A successor entity, if Kenrashealth is ever acquired or merged — you'd be notified before any data transfer in that scenario.

Each connected service (Garmin, Strava, TrainingPeaks, Withings, Cronometer) has its own privacy policy governing how they handle your data on their end; we encourage you to review those directly. Garmin's is at https://www.garmin.com/privacy/connect.

6. Data retention

We retain your data for as long as your account is active. If you disconnect a specific integration (e.g., Garmin), we stop pulling new data from that source; previously synced data remains available in your account unless you request its deletion. Feature-use events (Section 2.4) are automatically deleted after 180 days regardless. If you delete your account, we delete your personal data within [FILL IN — e.g., 30 days], except where we're required to retain limited records for legal or security purposes.

7. Your rights and choices

Regardless of where you're located, you can:

  • Access the data we hold about you.
  • Correct inaccurate data.
  • Export your data in a portable format.
  • Delete your account and associated data.
  • Disconnect any third-party integration at any time from account settings, which revokes our access token for that service going forward.
  • Withdraw consent for a specific data source at any time.

If you're in the EEA, UK, California, or another jurisdiction with a statutory data-protection framework, these map to your rights under that law (e.g., GDPR Articles 15–22, CCPA/CPRA). To exercise any of these, contact [FILL IN — privacy email]. We will respond within the timeframe required by applicable law (generally 30 days under GDPR).

You also have the right to lodge a complaint with your local data protection authority if you believe we've mishandled your data.

8. Security

We use industry-standard technical and organizational measures to protect your data, including encryption in transit (TLS) and at rest, access controls limiting who on our team can view raw data, and [FILL IN — any additional measures: e.g., regular dependency/security scanning, encrypted backups]. No system is perfectly secure, and we can't guarantee absolute security, but we take reasonable steps to protect your information and will notify affected users and relevant authorities in the event of a breach as required by applicable law.

9. International data transfers

Kenrashealth is available to users regardless of location, and our infrastructure (Fly.io) may process or store data in [FILL IN — region(s)]. Where we transfer personal data from the EEA, UK, or Switzerland to a country not deemed to provide an adequate level of protection, we rely on appropriate safeguards such as the EU Standard Contractual Clauses. [FILL IN/CONFIRM once hosting regions are finalized — this section should be tightened with your actual infrastructure footprint, ideally with legal input, since it's a common area of GDPR enforcement risk.]

10. Children's privacy

Kenrashealth is not directed at, and is not intended for use by, anyone under 16 years old. We do not knowingly collect data from children. If you believe a child's data has been provided to us, contact [FILL IN — privacy email] and we'll delete it.

11. Changes to this policy

We may update this policy from time to time. If we make material changes, we'll notify active users (e.g., by email or in-app notice) before the changes take effect. The "Last updated" date at the top reflects the most recent revision.

12. Contact us

Kenrashealth
[FILL IN — mailing address, if you want one listed; not always required but common practice]
[FILL IN — privacy/support email]