PRIVACY POLICY

Introduction

Hybrid Racing Platform Ltd ("Hybrid Racing Platform", "HRP", "we", "us", or "our") operates the Hybrid Racing Platform at hybridracingplatform.com and associated mobile applications (collectively, the "Platform"). We are committed to protecting your personal data and respecting your privacy rights under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and all applicable data protection legislation.

This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use our Platform. It also explains your rights and how you can exercise them.

By using the Platform, you confirm that you have read and understood this Privacy Policy. If you do not agree with this Policy, please do not use the Platform.

Who We Are — Data Controller

Hybrid Racing Platform Ltd is the data controller for personal data processed through the Platform. If you have any questions about how we process your personal data, please contact us at:

Email: privacy@hybridracingplatform.com
Website: hybridracingplatform.com

Where we act as a processor on behalf of an organisation (such as a gym, run club, or team that uses our Organisation features), that organisation is the data controller for its members' data and we process it on their behalf.

Personal Data We Collect

3.1 Account and Profile Data

When you create an account, we collect:

• Name and email address
• Username and password (stored in hashed form)
• Profile photo (if provided)
• Date of birth and nationality (optional)
• Social media handles (optional)
• Organisation membership details

3.2 Biometric and Health Data

If you choose to provide it, we collect:

• Height and weight (used to personalise nutrition and hydration guidance)
• Heart rate data (from FIT files or connected fitness devices)
• Training load and fitness metrics derived from activity data

3.3 Race and Performance Data

• Official HYROX race results (sourced from publicly available official results data)
• Hybrid Games results (sourced from publicly available official results data)
• Simulation event results (entered by you or your organisation)
• Split times, station times, and run pace data
• Claimed results linked to your account

3.4 Training Data — Strava Integration

If you connect your Strava account, we collect and process:

• Activity summaries (distance, duration, type, date)
• Per-GPS-point data including: latitude/longitude, time, altitude, speed, heart rate, cadence, and distance
• Lap and segment data
• Activity titles and descriptions

We access only the data necessary to provide our training analytics features. We do not access your Strava social connections, kudos, or non-activity data.

3.5 Training Data — Garmin Integration

If you connect your Garmin account, you first give HRP a separate, explicit consent that names the data and the purposes, and are then redirected to Garmin's own authorisation page where you grant Garmin's permissions. We take part in the Garmin Connect Developer Program and use its Activity API (activities you record) and Training API (workouts we send to your device). We do not collect Garmin daily wellness data (sleep, HRV, stress, Body Battery) unless you later enable that feature with its own consent. We collect and process:

• Activity summaries (type, start time, duration, distance, average and maximum heart rate)
• The activity file (FIT) including per-second heart rate, GPS, cadence, respiration rate, laps and elevation
• Device-reported maximum and threshold heart rate, used to set your training zones
• Workouts and training plans we publish to your Garmin calendar at your request (Training API)
• Historical activities, only if you tick the backfill option when connecting
• Daily wellness data (resting heart rate, HRV, sleep, stress) only if you separately enable the readiness feature, which is off by default

Data we send to Garmin. If you turn on "sessions to my Garmin", HRP sends the planned sessions from your training block to your Garmin Connect calendar as workouts (session name, steps, durations and heart-rate or pace targets). Nothing else is sent. You are shown this before the first push and give express consent; you can turn it off at any time on your Training page, after which no further workouts are sent. Data you send to Garmin Connect is then handled under Garmin's Connect privacy notice. It is your responsibility not to upload data to your Garmin Connect account if you are restricted from doing so.

Garmin's role. Data you submit to HRP is submitted to Hybrid Racing Platform Ltd, not to Garmin. Garmin has no responsibility or liability for data held by HRP, and HRP's use of Garmin data does not mean Garmin endorses HRP. Garmin and Garmin Connect are trademarks of Garmin Ltd. or its subsidiaries.

Garmin data is accessed through the Garmin Connect Developer Program using OAuth 2.0. We use it to attach your recordings to your race and simulation results, to build your Race Debrief and Race Prep documents, to calculate your training zones, load and plan progress, and to send workouts to your device. We access only the data necessary for those features. We do not access payment information, device purchase history, personal communications, or social connections from your Garmin account. We do not sell, share, or distribute your Garmin data to any third party for commercial purposes.

You may disconnect your Garmin account at any time via Settings > Integrations. Upon disconnection:

• We immediately revoke our OAuth access token and stop receiving new data from Garmin
• All Garmin-sourced activity files, traces and wellness data are permanently deleted from our systems within 30 days; summary values already blended into anonymous benchmarks cannot be traced back to you and are retained in that anonymous form
• You may request immediate deletion of all Garmin-sourced data at any time by contacting privacy@hybridracingplatform.com or via the data deletion process described in Section 10
• Disconnection does not affect any data held by Garmin — please refer to Garmin's own privacy policy for their data practices

3.6 FIT File Data

You may upload FIT files directly to the Platform. FIT files may contain GPS coordinates, heart rate, cadence, speed, altitude, and device identifiers at per-second resolution. We use FIT file data solely to provide personalised training analysis features. We keep the original file in private storage for up to 24 months so your analysis can be rebuilt as our methods improve; you can delete it at any time.

3.7 Live Heart Rate at Partner Gyms

Some partner gyms run HRP Live: a receiver in the gym picks up the heart-rate signal that your watch or chest strap already broadcasts (over ANT+ or Bluetooth) and shows it on the gym screen during simulation events and classes. This only happens for devices you have registered, and only with your consent. The receiver ignores every signal it has not been told to listen for.

For each gym you use, you choose separately whether HRP may (a) record your heart rate during sessions there, and (b) show it on the gym screen, and if so whether as your first name, your initials, or an anonymous number. Coaches running a class can see the live zone of members who consented to recording. You can change or withdraw either choice at any time in the app or at the gym desk, and the change takes effect immediately.

• Second-by-second readings taken during a session are used to build your session summary and, for simulation events, your result recording, and are then deleted within 24 hours
• Session summaries (zone minutes, effort points, average and peak heart rate) are kept with your training history
• The gym is the controller for the classes it runs and HRP processes the data on its behalf under a written data processing agreement; the gym is responsible for making participants aware of the display and for recording a guardian's consent for members under 18
• Members under 18 are never shown on a gym screen without a recorded guardian consent, and wellness features are not available to them

Heart-rate zones, load and readiness shown anywhere on the Platform are training guidance, not medical advice, and HRP is not a medical device. If you have a heart condition or feel unwell during exercise, stop and seek medical help.

3.8 Community and Social Data

If you participate in community features, we collect:

• Workout feed posts and associated images
• Reactions and interactions with other users' posts
• Blog post comments
• Challenge submissions and proof images
• Community post content within organisations

3.9 Usage and Technical Data

• IP address and device identifiers
• Browser type and version
• Pages visited and features used
• Error logs and performance data
• Anonymous page view analytics (session-based, no personal identifiers)

3.9 Payment Data

Subscription payments are processed by Stripe. We do not store your payment card details. We receive from Stripe: subscription status, billing history, and a tokenised customer identifier.

Event booking payments are processed through Stripe Connect. The payment goes directly from you to the host gym's Stripe account; HRP never holds the funds. We receive metadata about the booking (category, price paid, expected finish time, payment status) so we can confirm your spot and assign you to a wave. The host gym receives your name, email, expected finish time, partner emails, and wave details so they can run the event.

3.10 Push Notification Data

If you enable push notifications in our iOS or Android apps, we collect a device push token, your device platform (iOS/Android), and app version, linked to your account, so we can deliver notifications to your device. You can disable push notifications at any time via Settings > Notifications or your device's system settings; your token is deleted when you disable notifications or delete your account.

3.11 Event Photo & Video Submissions

Hosts and attendees of a sim event may be sent a time-limited upload link inviting them to submit photos or videos from that event. This link does not require an HRP account or sign-in — no personal profile data is collected as part of the upload itself, only the file and, where provided, an email address the link was sent to. Before any file is accepted, the person uploading must explicitly tick a checkbox confirming they agree to HRP using and sharing what they submit on social media and in marketing. Uploads are stored against the specific event and are only used for that stated purpose; we do not use them to build a profile of the uploader or match them to any other account.

How We Use Your Personal Data

4.1 Providing the Platform

We process your data to create and manage your account, display and analyse your race results and splits, provide global benchmarking, power the Split Planner and pacing calculator, show achievements and tier progression, and enable result claiming and profile management.

4.2 Training Analytics

We process your Strava, Garmin, live heart-rate and FIT file data to attach recordings to your results, calculate training zones anchored to your own race data, training load (acute and chronic), aerobic minutes against your plan, effort points in classes, readiness where enabled, and race-week guidance before registered races. Heart-rate data is health data and we process it only on the basis of your explicit consent, which you can withdraw at any time.

4.3 AI-Generated Content

We use artificial intelligence to generate personalised race day strategies, weekly training summaries, pre-race intelligence reports, nutrition and hydration guidance, and mental preparation content. AI-generated content is produced using your race data, training data, and biometric information as inputs.

Important: AI-generated content is not medical, clinical, nutritional, coaching, or psychological advice. It should not replace professional guidance. Data passed to AI providers is governed by our data processing agreements and is not used to train their models.

4.4 Organisation Features

If you are a member of an organisation on the Platform, we share your performance data with your organisation's administrators for member dashboards, race day planning, within-organisation benchmarking, and gym challenge participation. You can opt out via Settings > Privacy.

4.5 Public Race Results, Athlete Profiles, and SEO

Your race results sourced from official HYROX and Hybrid Games results are publicly available data. We display these on publicly accessible pages including athlete profile pages, leaderboards, and records pages which may be indexed by search engines.

You may request removal of your personal details from public result pages via our contact address.

4.6 Communications

We may contact you by email or, if you enable them, push notification, with transactional communications, service updates, and marketing communications (only with your explicit consent). You may unsubscribe from marketing, or disable specific notification types, at any time via Settings > Notifications.

4.7 Event Photo & Video Promotion

Photos and videos submitted via an event upload link (see 3.11) are used to help promote that event and the Platform, including on our own social media channels and in marketing materials. We only use content where the uploader has ticked the consent checkbox at the point of submission.

Who We Share Your Data With

5.1 Service Providers

We have data processing agreements with all processors. We do not sell your data to any third party.

5.2 Organisations

If you are a member of an organisation on the Platform, we share relevant performance data with that organisation's administrators as described in Section 4.4, controlled by your privacy settings.

Event bookings: when you book a spot in a gym-hosted event, you and HRP are joint controllers with the host gym for the booking data (your name, email, expected finish time, partner emails, wave assignment). The gym uses this data solely to deliver the event. The gym is bound by our Gym Seller Agreement and may not use your data for unrelated marketing without separate consent.

5.3 Legal Requirements

We may disclose your data where required by law, court order, or to protect the rights, property, or safety of Hybrid Racing Platform, our users, or the public.

International Data Transfers

Some service providers are based outside the UK and EEA. Where we transfer personal data internationally, we ensure appropriate safeguards including Standard Contractual Clauses approved by the ICO and UK International Data Transfer Agreements (IDTAs).

Key transfers: Supabase infrastructure may be hosted in the United States. Anthropic's API services are operated from the United States. Garmin's Health API services are operated from the United States by Garmin International, Inc. Resend's email delivery infrastructure is operated from the United States. Lovable's AI gateway may route requests to model providers outside the UK/EEA. All operate under appropriate transfer mechanisms.

How Long We Keep Your Data

• Account data: duration of account plus 2 years following closure
• Race result data: retained indefinitely as part of our historical database. You may request removal of personal identifiers.
• Strava activity data: up to 3 years or until you disconnect and request deletion
• Garmin activity data: summaries for the duration of your account; 5-second training traces for 90 days then summary only; race and simulation recordings while the result exists; all deleted within 30 days of disconnecting
• FIT files (uploaded or received from Garmin): 24 months from receipt, or until you delete them
• Live heart-rate readings at partner gyms: deleted within 24 hours of the session; session summaries kept with your training history
• Wellness data (if the readiness feature is enabled): 12 months rolling
• Payment data: 7 years to comply with financial record-keeping obligations
• AI-generated content: duration of account plus 2 years
• Usage and technical logs: 12 months
• Push notification tokens: while your account is active and notifications remain enabled; deleted on disable or account deletion
• Community content: duration of account or until you delete it

Cookies and Tracking Technologies

We use CookieYes to manage cookie consent on the Platform. Cookies are categorised as follows:

• Strictly necessary cookies — required for the Platform to function (including Supabase authentication tokens). Cannot be disabled.
• Analytics cookies — help us understand usage. Only placed with your consent.
• Preference cookies — remember your settings. Only placed with your consent.
• Marketing cookies — only used with your consent.

You can manage cookie preferences via the consent banner on first visit, or at any time via the Cookie Settings link in the footer.

Your Rights Under UK GDPR

To exercise any right, contact us at privacy@hybridracingplatform.com. We will respond within 30 days. If you are unhappy with how we handle your data, you may complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

Account and Data Deletion

You may delete your account at any time via Settings > Account > Delete Account. Upon deletion:

• Your profile and personally identifiable information will be permanently deleted
• Your Strava and Garmin connections will be disconnected and synced data deleted
• Your claimed race results will be unclaimed — underlying result data remains but will no longer be linked to your identity
• AI-generated reports and training summaries will be deleted
• Your organisation memberships will be removed
• Your push notification token will be deleted
• Community posts and comments will be anonymised or deleted
• Payment records will be retained for 7 years as required by law

Account deletion is irreversible. If you have an active subscription, please cancel it before deleting your account.

Children's Privacy

The Platform is not directed at children under the age of 16 and we do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected data from a child under 16, please contact us immediately at privacy@hybridracingplatform.com.

Partner gyms may register members aged 16 or 17 for simulation events and classes. For those members, heart-rate recording and any on-screen display require a parent or guardian's consent recorded by the gym, and wellness features are not available.

Security

We implement appropriate technical and organisational measures including encryption of data in transit (TLS) and at rest, row-level security controls on our database, access controls, regular security reviews, and secure password storage using industry-standard hashing.

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the ICO within 72 hours as required by law.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by displaying a prominent notice on the Platform before the changes take effect. Your continued use of the Platform after changes take effect constitutes your acceptance of the updated policy.

Contact Us

Email: privacy@hybridracingplatform.com
Website: hybridracingplatform.com