Draft v0.1, 31 October 2026, for legal review. Highlighted items in brackets must be completed before publishing. This draft is not legal advice; have it reviewed by a Thai lawyer familiar with the PDPA.
Privacy Policy
This policy explains how [Company legal name] ("Velolian", "we", "us") collects, uses, shares and protects your personal data when you use the Velolian Fuel Planner: the companion web app, our Connect IQ apps and data field on Garmin devices, and our website. We act as the data controller under Thailand's Personal Data Protection Act B.E. 2562 (2019) ("PDPA") and, where it applies to you, the EU General Data Protection Regulation ("GDPR").
- Who we are
- Data we collect
- Health data and your consent
- How we use data and why
- Data from Garmin Connect
- Sharing with our training plan service
- Who else receives data
- Transfers outside Thailand
- How long we keep data
- Security
- Your rights
- Children and young athletes
- Cookies
- Nutrition guidance
- Changes to this policy
1Who we are
[Company legal name], company registration no. [number], [registered address], Thailand.
Privacy contact and Data Protection Officer: [name or role], [privacy@company-domain], [phone].
2Data we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account | Name, email address, password (stored as a hash by our sign-in provider), language | You |
| Athlete profile | Body mass, body fat %, sex, age, sport, goal (maintain, lose or gain), season phase, tolerated carbohydrate per hour, sweat rate, REDs warning-sign screen | You; body mass, sex and age can be prefilled from your Garmin device profile |
| Training plan | Planned sessions, races, training phases and thresholds | You, or our AI Training Plan service with your consent (section 6) |
| Activities and health summaries | Completed activities and FIT files (time, duration, distance, heart rate, power, calories, GPS track), daily summaries (steps, calories, resting heart rate) | Garmin Connect, after you connect your account (section 5) |
| Device and session data | Device model and identifier, app version, feed prompts shown, session summaries, the intake you confirm | Our Connect IQ apps and data field |
| Nutrition data | Daily targets we calculate, food and drink you log, recovery intake | Our service and you |
| Technical data | IP address, request logs, error reports | Your browser and devices |
| Communications | Support requests and your messages to us | You |
We do not collect your payment card numbers. [If paid plans are sold, name the payment provider and what it collects.]
3Health data and your consent
Body composition, heart rate, REDs warning signs and similar information are health data, a sensitive category under PDPA section 26 and a special category under GDPR article 9. We process them only with your explicit consent, which you give in the app before any targets are calculated. Each consent is separate: for health data, for connecting Garmin Connect, and for sharing with our training plan service.
You can withdraw any consent at any time in Settings. Withdrawing does not affect processing done before, but without health-data consent we cannot calculate personalised targets.
4How we use data and why
| Purpose | Legal basis |
|---|---|
| Calculate daily carbohydrate, protein, fat and energy targets, and before, during and after-session fueling | Contract; explicit consent for health data |
| Prompt feeds and drinks during activities on your Garmin device | Contract; explicit consent |
| Recalculate targets after Garmin sends a finished activity | Contract; explicit consent |
| Apply safety rules (energy-availability floor, protections for under-18s and athletes reporting REDs warning signs) and suggest seeing a sports dietitian or doctor | Explicit consent; vital interests where needed |
| Keep the service secure, prevent abuse, fix errors | Legitimate interests |
| Improve our rules using statistics that cannot identify you | Legitimate interests (anonymised data only) |
| Answer support requests | Contract; legitimate interests |
| Meet legal, tax and accounting duties | Legal obligation |
We do not sell personal data, use it for advertising, or use it to make decisions that have legal or similarly significant effects on you. Targets are calculated automatically by published nutrition rules; you can always ask a person to review them.
5Data from Garmin Connect
If you connect your Garmin account, Garmin sends us the activity and health data listed in section 2 through the Garmin Connect Developer Program. You choose what to share on Garmin's consent screen. We use this data only to provide the Velolian service to you; we do not use it for anything else, sell it, or pass it to third parties except our processors (section 7) and our training plan service if you consent (section 6).
You can disconnect at any time in Velolian Settings or in Garmin Connect. When you disconnect, Garmin notifies us and we stop receiving data immediately. Data received from Garmin is deleted within 30 days of disconnecting or of deleting your account. Garmin's own handling of your data is covered by Garmin's privacy policy.
6Sharing with our training plan service
Velolian can work with our AI Training Plan service, operated by [the same company / name of the operating entity]. With your consent, the training plan service sends your planned sessions, races and phases to Velolian, and Velolian sends back nutrition status, such as whether you fuelled a session as planned and your energy availability, so the plan can adjust. Neither service shares data with the other without this consent, and you can turn it off in Settings.
7Who else receives data
- Amazon Web Services hosts our backend and stores data in the Asia Pacific (Singapore) region, as our processor under a data processing agreement.
- Garmin receives the data needed to deliver our apps and, in a later version, structured workouts you choose to send to your device.
- [Email delivery provider] sends account and service emails.
- [Any other processor: support desk, payment provider]
- Authorities, when the law requires it, and professional advisers under a duty of confidentiality.
- A buyer or successor if our business is sold or merged; we will tell you before your data falls under a different policy.
We do not let third-party analytics, advertising or AI platforms process Garmin data or health data.
8Transfers outside Thailand
Our servers are in Singapore, and Garmin data originates from Garmin's systems. When data leaves Thailand we rely on PDPA section 28 and 29 safeguards: transfers to countries with adequate protection where determined, standard contractual clauses with our processors, or your consent. For users in the EU or UK we use the European Commission's standard contractual clauses. Contact us for a copy of the safeguards.
9How long we keep data
| Data | Kept for |
|---|---|
| Account, profile, plan and nutrition history | While your account is open; deleted within 30 days of closing it |
| Raw FIT files from Garmin | [12 months], then deleted; summaries are kept with your history |
| Data received from Garmin after you disconnect | Deleted within 30 days |
| Backups | Up to 35 days, then overwritten |
| Security and request logs | [90 days] |
| Records we must keep by law (for example invoices) | As long as the law requires |
10Security
We encrypt data in transit (TLS 1.2 or later) and at rest. Garmin access tokens are encrypted with managed keys, staff and systems get only the access they need, devices use short-lived tokens, and the service has an independent security test before launch. If a breach is likely to put your rights at risk, we will notify the Personal Data Protection Committee within 72 hours and tell you without undue delay.
11Your rights
Under the PDPA (and the GDPR where it applies) you can:
- access your data and get a copy, including how we obtained data you did not give us;
- receive your data in a machine-readable format or have it sent to another controller;
- correct inaccurate or incomplete data;
- ask us to delete or anonymise data;
- ask us to restrict use of your data;
- object to processing based on legitimate interests;
- withdraw consent at any time.
Use Settings → Privacy in the app to export or delete your data, or email [privacy@company-domain]. We reply within 30 days. You can also complain to the Office of the Personal Data Protection Committee (PDPC), Thailand, www.pdpc.or.th, or to your local data protection authority.
12Children and young athletes
The service is meant for athletes aged [13] and over. Under Thai law, a person under 20 who has not reached legal majority needs the consent of a parent or guardian, and we ask for it during sign-up. For athletes under 18 the app always switches off weight-loss deficits, train-low sessions and supplement advice, and these protections cannot be turned off. If you believe a child has used the service without the required consent, contact us and we will delete the data.
13Cookies
Our web app uses only cookies and local storage that are strictly necessary to sign you in and keep your settings. We do not use advertising or tracking cookies. [If analytics are added later, list them here and ask for consent first.]
14Nutrition guidance
Velolian gives general sports-nutrition guidance, not medical advice. Our rules are reviewed by a sports dietitian. If you have a medical condition, an eating disorder or REDs warning signs, please see a doctor or registered dietitian.
15Changes to this policy
We will post any change here with a new effective date. If a change affects how we use health data or Garmin data, we will tell you in the app first and ask for consent again where the law requires it.