Privacy policy

Phylax is provided by Joel Garrett, an accredited exercise physiologist, through Joel Garrett EP and S&C. I am responsible for the information described here. Contact me about privacy at phylaxapp@gmail.com.

• Account details: your name and email address. Passwords are handled by the sign-in provider and are never visible to me.
• Training data you add or connect: activity files and summaries, such as time, distance, pace, speed, power, heart rate, cadence, elevation, and GPS routes and locations, including data from services you choose to connect, such as Garmin Connect.
• Wellness check-ins, if you choose to complete them: sleep quality, fatigue, soreness, stress, mood, how ready you feel to train, resting heart rate, and whether you are unwell.
• What you enter: race goals and results, training plans and changes to them, bike and swim thresholds, and settings such as your time zone, privacy zones and weather location.
• Feedback you send from the app: your message, the page you were on and your browser type.

Much of this is health information, which is sensitive information under the Privacy Act 1988 (Cth). Phylax only collects it with your consent, which you give by adding it or connecting a service, and only uses it for the purposes below.

If you are also a client of my exercise physiology practice, records from your sessions are kept separately under my professional obligations and are not part of Phylax.

• To show you your training, analysis, race predictions, readiness and training plans.
• To send planned workouts and routes to your watch or bike computer when you ask.
• To keep Phylax secure and working, and to fix problems.

Your information is never sold or rented, never used for advertising, and never used, including any data from Garmin, to train artificial intelligence models.

• You. Your account is private by default.
• A coach you choose to share with. If you accept a coach's invite link, they can see your sessions (including notes and maps), training load, readiness and check-ins, plans, programs, gym sets, race predictor efforts, profile tests and zone settings. They see it read-only: they can't change, add to, delete or share anything of yours. You can stop sharing at any time on the Coaching page, and their access ends straight away.
• Other users, only for routes you choose to share. Shared routes have the start and finish (500 m by default) and any privacy zones removed, and show your name only if you turn that on.
• Anyone with a workout link you create. When you share a workout, the link shows a summary you chose (with your notes and the map only if you include them; the map has the start, the finish and your privacy zones removed). It never includes your raw GPS or second-by-second data. Links can't be searched for or listed, and stop working as soon as you stop sharing.

These companies process information on Phylax's behalf, under their own security and privacy terms:

• Supabase: database, sign-in and private file storage, hosted in Sydney, Australia.
• Oracle Cloud: the server that runs the app. Your data passes through it, encrypted in transit, but is stored in Supabase.
• Google (Gmail): sends account emails, such as sign-up confirmations and password resets. It receives your email address and the email, nothing about your training.
• Open-Meteo, and MET Norway (the Norwegian Meteorological Institute) when Open-Meteo is unavailable: weather for heat-adjusted paces. They receive only a location rounded to about 10 km and a date and time, with nothing that identifies you.
• OpenFreeMap: the map images shown in your browser. It receives the map area you are viewing, not your activities.

Open-Meteo, MET Norway, OpenFreeMap and Google may handle requests outside Australia, for example in Europe or the United States. No other company receives your data. No artificial intelligence (AI) or analytics providers process your data, and Phylax uses no AI systems on it.

If you connect Garmin Connect, Phylax receives the activities your Garmin device records from then on: summaries, second-by-second data such as heart rate, pace, speed, power, cadence and GPS location, and the activity file. Phylax sends to your Garmin device only the workouts and courses you choose to send.

How Garmin data is used: only to show you your own training (analysis, training load, best efforts, readiness and plans), and to show it to a coach if you choose to share with one. It is stored in Supabase in Sydney and processed on the Oracle Cloud server. For weather-adjusted paces, a location rounded to about 10 km and the session's time may be sent to Open-Meteo or MET Norway; your browser fetches map images for the area you view from OpenFreeMap. No other third party receives Garmin data.

Never sold or shared: Garmin data is never sold, rented or shared with any third party for their own use, never used for advertising, and never processed by AI systems or used to train, evaluate or improve AI models.

Stopping: disconnect Garmin in Phylax's Settings or in your Garmin Connect account at any time, which withdraws your consent: Phylax then receives nothing further. Activities already received stay in your account until you delete them; you can delete them one at a time, or everything at once (Settings, then Your data). The same applies to any other device service you connect.

Information is encrypted in transit. Each account can read only its own data (and a coach only the athletes who chose to share with them, read-only), enforced in the database itself, and original activity files are stored privately. No system is perfectly secure; if a data breach is likely to cause you serious harm, I will tell you and the Office of the Australian Information Commissioner as the law requires.

Your data is kept while your account is open. When you delete your account (Settings, then Your data), your data and uploaded files are deleted straight away. You can also email me to delete it, and I will do so within 30 days.

To protect against loss, a copy of the database is made each night and kept on an encrypted computer I control: daily copies for 14 days and weekly copies for 10 weeks, after which they are deleted. Data you delete leaves these copies as they age out.

• Access and export: see your information in the app, and download all of it at any time (Settings, then Your data, then Download my data). Individual activities can also be downloaded as GPX files.
• Correct: edit your details in Settings and each activity's title, sport and notes on its page.
• Delete: delete activities one at a time, or your whole account and all its data (Settings, then Your data, then Delete my account).
• Withdraw consent: disconnect Garmin or another service, stop sharing with a coach, stop wellness check-ins or leave them out of readiness, at any time.
• Or email me at phylaxapp@gmail.com for any of these.

If you have a concern, please contact me first and I will respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

If this policy changes, this page and the date at the top will be updated, and account holders will be emailed about significant changes.