Privacy policy

Last updated: 2026-10-06T00:00:00.000Z

Mitovo is a training and wellness coach for iPhone. To coach you, it processes personal data, including health data. This policy explains what we process, why, who helps us, how long we keep it and what rights you have. The German version is legally binding; this English version is provided for convenience.

Who is responsible

The app

Your account

• Email address, to send you login codes and important messages about your account. Mitovo has no passwords.
• Sign in with Apple: if you use it, we receive an identifier from Apple and the email address you chose to share (possibly an Apple relay address).
• Name (optional), so the coach can address you.
• Device information at login (device model, app version) and login tokens, to keep you signed in securely.

Health and fitness data (special categories, Art. 9 GDPR)

With your explicit consent, Mitovo processes:

• From Apple Health, only the types you allow: workouts (type, time, distance, energy, heart rate during the workout), heart rate, heart-rate variability, resting heart rate, heart-rate recovery, VO₂max estimates, sleep, body measurements (such as weight and height), active and resting energy, and workout effort ratings. You choose the data types in the iOS Health settings and can change them at any time.
• What you enter: goals, available time and equipment, experience, current performance levels, injuries and illnesses, answers to the health check (for example medication that affects heart rate, recent surgery), daily check-ins, strength sessions, food logs, body weight, supplements, fitness test results and lab values.
• Your conversations with the coach and the plans, assessments and explanations it creates.

Workout routes (GPS) are read and shown on your iPhone only. They are never uploaded.

Mitovo writes to Apple Health only what you log in Mitovo: strength sessions and effort ratings.

How the AI coach works

The coach uses AI models from Anthropic (Claude). To create or change your plan, answer your questions, review workouts or read a food description, the relevant data (for example your recent training, recovery values, goals, injuries and your first name) is sent to Anthropic for processing. Your email address and login details are never sent. Anthropic processes the data on our behalf and does not use it to train its models.

The coach proposes plans and changes; you decide whether to accept them. No decision with legal or similarly significant effect is made automatically (Art. 22 GDPR).

Voice input and barcode scanning

When you log food by voice, Apple’s speech recognition turns your speech into text; Mitovo receives the text. When you scan a barcode, our server looks the product up in the Open Food Facts database. Only the barcode is sent, nothing about you.

Legal bases

• Running the app and your account: performance of the contract (Art. 6(1)(b) GDPR).
• Health data: your explicit consent (Art. 9(2)(a) GDPR), which you give in the app before any health data is processed.
• Security, error tracking and preventing abuse: our legitimate interest in a secure, working service (Art. 6(1)(f) GDPR).

You can withdraw your consent at any time, for example by revoking Mitovo’s access in the iOS Health settings or by deleting your account. Withdrawal does not affect processing that took place before it.

The website and the waitlist

• Hosting: this website is served by Cloudflare. When you visit it, Cloudflare processes your IP address and technical request data to deliver the page and protect it from attacks (Art. 6(1)(f) GDPR).
• Analytics: we use Cloudflare Web Analytics to count page views. It sets no cookies and builds no profiles of individual visitors.
• Waitlist: if you join the waitlist, we store your email address, your language and the time you signed up and confirmed. We send you one email to confirm your address (double opt-in), and later your invitation. Legal basis: your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time with the link in every email or by writing to us.

Who helps us (processors)

We work with these service providers. Each processes data only on our instructions under a data processing agreement.

For transfers to the USA we rely on the EU-U.S. Data Privacy Framework where the provider is certified, and otherwise on the EU Standard Contractual Clauses (Art. 46 GDPR).

We do not sell your data, show advertising or use tracking SDKs in the app.

How long we keep data

• Account and health data: until you delete your account. Deleting your account in the app (Profile › Delete account and all data) removes your data from our database immediately. Encrypted backups are overwritten on a rolling basis and are gone after 30 days at the latest.
• Login codes expire after 10 minutes. Login tokens expire after 90 days without use.
• Sync records (when the app synced, without health values) are kept for 30 days.
• Waitlist entries: until you unsubscribe or receive your invitation, at most 24 months after you signed up. Unconfirmed sign-ups are deleted after 7 days.

Security

Data is transferred encrypted (TLS). The database is not reachable from the internet. Backups are encrypted before they leave the server. Uploaded documents are stored encrypted. Error reports are stripped of health values, email addresses and tokens.

Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interest (Art. 21). Write to support@mitovo.app; we will also send you a copy of your data on request.

You also have the right to lodge a complaint with a supervisory authority, for example the one responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart.

Age

Mitovo is intended for people aged 16 and over.

Changes

We update this policy when the app or our providers change. For significant changes in the app, we will ask you to confirm again.