Endyoro Privacy Policy

Endyoro is operated by Endyoro Sports Technologies Private Limited, a company incorporated in India on 7 September 2026 (CIN U62011RJ2026PTC117713), with its registered office at G-12A, Dhawas Road, Janki Vihar, Heerapura, Jaipur, Rajasthan 302021, India.

In this policy, "Endyoro", "we" and "us" mean that company. "You" means the person using the platform — our athlete web and mobile apps, the coach portal, the connected watch apps, and endyoro.com.

Under the Digital Personal Data Protection Act, 2023 ("DPDP Act") we are the Data Fiduciary for the personal data described here, and you are the Data Principal. Where the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 still apply to health-related data, this policy also serves as our privacy policy under those Rules.

This policy covers three groups:

• Athletes — people training on the platform, with or without a coach.
• Coaches — people who prescribe training to athletes through the coach portal.
• Visitors — people who browse endyoro.com or join the waitlist.

Age

Endyoro is for adults. You must be 18 or older to create an account. We do not knowingly collect personal data from anyone under 18, and we do not carry out behavioural tracking, profiling or targeted advertising towards children. If we discover that an account belongs to someone under 18, we will delete it and the data associated with it.

We collect only what the platform needs to do its job. Some of it you type in, some arrives from your watch or a service you connect, and some is written by your coach.

Much of this is health-related data about your body and your training. We treat all of it as confidential, whether or not a particular law classifies it as sensitive.

Each purpose below is the reason we ask for your consent. We do not use your data for anything outside this list without telling you and asking again.

What we never do

• We do not sell your personal data, and we never have.
• We do not share it with advertisers, data brokers or insurers.
• We do not use your training or health data to target advertising.
• We do not use identifiable athlete data to train AI models, and the paid Gemini API behind our assistant does not either.
• We do not let one athlete see another athlete's data.

We process your personal data on the basis of your consent, which you give when you create an account and again each time you connect a device or a third-party account. A short notice describing the purpose is shown at each of those points.

A small amount of processing happens without consent where the DPDP Act permits it as a "legitimate use" — for example, complying with a legal obligation or a court order.

Withdrawing consent

You can withdraw consent at any time, in whole or in part:

• Disconnect a device or account — sync stops immediately and the stored access token is deleted.
• Remove your coach — your coach's access to your data ends from that point.
• Delete your account — see section 9.
• Email privacy@endyoro.com for anything else.

Withdrawing consent does not make our earlier processing unlawful. It does mean parts of the platform stop working — without training data there is no readiness score, no compliance report and nothing for a coach to review.

Your coach

If you accept a coach, that coach can see your athlete profile, your training and strength sessions, your nutrition logs, your wellness and recovery entries, your compliance against the plan they set, and any notes exchanged between you. That access is the point of a coached account. Your coach cannot see your sign-in codes, or your conversations with the training assistant — those threads belong to you alone.

A coach's access ends when you remove them. Historical notes they wrote remain on your timeline unless you delete them.

Service providers

We use a small number of processors, each bound by contract to use your data only on our instructions:

We send the training assistant only the question you asked and the training and nutrition data needed to answer it. We use the paid tier of the Gemini API, under which Google does not use those prompts or responses to improve its models.

PostHog receives which screens you open and which actions you take, tied to an account identifier. It does not receive your training, nutrition, health or coaching content, and we do not record your screen.

Legal and safety

We disclose personal data to a public authority only where the law requires it, or where it is necessary to establish, exercise or defend a legal claim, or to protect someone's life or safety.

If the business changes hands

If Endyoro is acquired or merged, your data may transfer to the acquirer. We will tell you before that happens and you will be able to delete your account first. The acquirer is bound by this policy until it gives you notice of a new one.

Where you grant access to Apple Health (iOS) or Android Health Connect, we make these specific commitments, in addition to everything else in this policy:

• We read only the data types you have permitted, and only to run the features you have turned on.
• We never use health-store data for advertising, marketing or any similar purpose.
• We never sell it, and we never disclose it to data brokers or to anyone other than your coach and the processors listed above.
• We do not use it for any purpose not described in this policy.
• If you delete a record in your health store, we process that deletion and remove the record we derived from it.
• If you revoke permission, syncing stops and we delete the data obtained through it.

Your data is stored in a managed PostgreSQL database hosted on Amazon Web Services infrastructure in the Tokyo, Japan region (ap-northeast-1). Backups are held in the same region. Your email address and the content of emails we send you pass through Brevo, and product analytics events are held by PostHog — both store data in the European Union. Questions you put to the training assistant are processed by Google.

This means personal data collected in India is processed outside India. Section 16 of the DPDP Act permits transfers to any country the Central Government has not placed on a restricted list. Neither Japan nor any European Union member state is on that list as at the effective date of this policy. If that changes, we will move the affected data to a permitted region and update this page.

Deleting your account

You can delete your account from the app, or by emailing privacy@endyoro.com. We erase your personal data within 30 days of the request, except records we must keep by law. Data already written to encrypted backups is purged as those backups roll off, within 35 days.

If your account sits unused, we email you at 24 months of inactivity. If you do not sign in during the six months after that, we delete the account — the DPDP Act requires us to erase data we no longer need.

The measures we take include:

• No direct database access. The database refuses connections from browsers and apps outright. Every read and write passes through our API, which checks on each request that you are the athlete the record belongs to, or a coach that athlete has assigned.
• Encryption in transit (TLS) and at rest. Access tokens for the accounts you connect are separately encrypted with AES-256-GCM before they are stored.
• Passwordless sign-in using one-time email codes, so there is no reusable password to steal.
• Role-based access for athletes, coaches and administrators, with administrative actions written to an audit log.
• Restricted production access — a named, minimal set of people.
• Private media storage — uploaded files are never publicly addressable; links are signed and expire within minutes.

No system is perfectly secure. If a personal data breach occurs, we will notify you and the Data Protection Board of India in the form and time the DPDP Act requires.

As a Data Principal under the DPDP Act you have the right to:

• Access — a summary of the personal data we hold about you, what we do with it, and the other Data Fiduciaries and processors we have shared it with.
• Correction and completion — have inaccurate or incomplete data fixed or updated.
• Erasure — have your data deleted where we no longer need it for the purpose you consented to, and the law does not require us to keep it.
• Withdraw consent — as described in section 5.
• Grievance redressal — a readily available route to complain, described in section 12.
• Nominate — name another person to exercise these rights on your behalf if you die or become incapable of exercising them yourself.

Most of this you can do yourself in the app. For anything else, email privacy@endyoro.com. We respond within 30 days and charge nothing.

The DPDP Act also places duties on you: give us accurate information, do not impersonate anyone, and do not file false or frivolous complaints — the Act provides penalties for that.

If something about the way we handle your data troubles you, write to our Grievance Officer:

Nikitesh Joshi, Grievance Officer
Endyoro Sports Technologies Private Limited
G-12A, Dhawas Road, Janki Vihar, Heerapura
Jaipur, Rajasthan 302021, India
privacy@endyoro.com

We acknowledge every grievance and respond within 30 days. If you are not satisfied with our response, or we do not respond in time, you may complain to the Data Protection Board of India.

Inside the app we use cookies and browser storage to keep you signed in and to remember how you have set up your pages. These are necessary for the platform to work and cannot be switched off while you use it. We also run PostHog, which sets a cookie so it can recognise return visits and show us which parts of the app get used. PostHog does not record your screen, and we never send it your training, nutrition, health or coaching content.

On the public pages of endyoro.com we use Google Analytics to count visits and see which pages get read. It sets its own cookies. You can decline them when you first arrive, change your mind later, or install Google's opt-out browser add-on at https://tools.google.com/dlpage/gaoptout. Declining changes nothing about the app.

We do not use advertising cookies, retargeting pixels, or any tracking that follows you to other websites.

When we change this policy we update the "last updated" date at the top. If the change materially affects how we use your data, we will tell you in the app or by email before it takes effect, and where the law requires it, ask for your consent again. Earlier versions are available on request.

Questions about privacy, data or this policy: privacy@endyoro.com

General support: support@endyoro.com