Privacy policy

Who we are (data controller)

Hermacles is a free, invitation-only beta of a training coach for endurance and strength athletes. The controller of your personal data (in Mexico, the "responsable") is Gear 5 Agentic AI Solutions ("we", "us"), Cancún, Quintana Roo, México. Website: https://gear-5.com.

Postal address: C. Arroyo, Mz 2, Lt 2, Casa 20 B, C.P. 77535, Cancún, Quintana Roo, México.

Privacy contact, which also acts as our personal data department: contacto@gear-5.com. Write to this address for any question or request about your data.

This policy covers the Hermacles web app and its API and, once released, the Hermacles iOS app. During the beta nothing is charged and no payment details are collected.

What we collect

Account: your email address, the display name you choose, a bcrypt hash of your password (never the password itself) and the date the account was created.

Health and fitness data, which is sensitive personal data: sleep (duration, stages and timing), heart rate variability, resting heart rate, heart rate and other measurements recorded during workouts, body weight, body composition and height, workouts and activities (type, date, duration, distance, pace, load and title), readiness and training-status values reported by your devices, and the original records received from connected services.

What you enter: goals, availability, equipment, training constraints you type, daily check-ins (effort, soreness, motivation, life stress and an optional note) and your messages to the coach.

Connected services: the access tokens that let us read the data you authorize from services you connect, and the ingest token you give to Health Auto Export. Records received from a device can include data the device adds, such as the approximate location of its weather report; we do not ask for your location.

Consent records: which consent you gave, the version you accepted and when you gave or withdrew it.

Product events: a closed list of first-party event names (for example "opened the daily summary") with the date. Events never contain health values or message text.

AI usage records: for each AI reply, the model used, token counts and cost. Never the text.

Reply checks: when our wellness-language guard rewrites or blocks a coach reply, we record the date, where it happened, the rule identifiers and the action. Never the text.

Invitation: which beta invitation you used and when (we store only a hash of the code). On account deletion the invitation stays used but is no longer linked to you.

Technical data: our servers process your IP address and request details to deliver the service, to limit abuse (rate limits) and in platform logs. Your browser keeps your session token and your language choice in its local storage. We use no advertising or tracking cookies.

We do not collect payment details, contacts, photos or government identification numbers through the app.

Your consent for health data and for AI

Health data is sensitive personal data under Mexican law and special-category data under the GDPR. We process it only after you give your express consent, electronically and after signing in, separately from these documents: the "health processing" consent. Without it the app cannot show summaries or plans, and our API refuses every health-data request.

Sending data to an AI provider is a second, optional consent ("AI processing"). If you give it, a summary of your relevant data and your question is sent to Anthropic, PBC (United States), the company behind the Claude model, to write the coach reply. If you do not, the coach answers from built-in templates and nothing is sent.

You can withdraw either consent at any time in Account → Privacy and consent. Withdrawal stops the processing from that moment; it does not undo processing already done. Withdrawing the health consent does not delete your data: delete the account to erase it.

When a change to this policy affects what you agreed to, the app asks for your consent again before it continues.

Why we use your data

Primary purposes, which are necessary for the service you asked for: (a) create, secure and sign in to your account; (b) receive, store and analyse the health and fitness data you send or connect; (c) calculate daily summaries, trends, personal patterns and training plans; (d) answer your messages to the coach, with templates or, only with your AI consent, with the AI model; (e) send a workout to your device when you confirm it; (f) let you export and delete your data; (g) keep the service secure and working, and meet legal obligations; and (h) measure whether the beta is useful and keep AI spending within its caps, using only product events and token counts, never health values or text.

Secondary purposes: none. We do not use your data for marketing, advertising or profiling for others. We do not sell or rent your data, share it with data brokers, or use third-party analytics or advertising SDKs. If we ever want a secondary purpose, we will ask first and you will be able to refuse without losing the service.

We do not train AI models on your data, and we do not combine data across users.

Automated processing

Summaries, patterns and training plans are produced automatically from your data. They are suggestions with no legal effect: a new plan replaces your active plan only when you accept it, and nothing is sent to your watch without your confirmation.

A personal pattern is shown only with its sample size and a statistical test corrected for multiple comparisons, and it describes an association, not a proven cause.

You can object to this automated processing at any time by withdrawing the health consent or by writing to us (see "Your rights").

How the AI coach works

Only if you give the separate AI consent, Hermacles sends Anthropic, PBC (United States), the company behind the Claude model, the minimum it needs to write a reply: your question, recent turns of the conversation, and a summary prepared by Hermacles of what is relevant (for example last night's sleep, recovery markers, recent activities and their titles, check-in notes, your goals, availability and constraints, and this week's plan). Anthropic is our only AI provider.

Your email address, display name and password are never sent, and neither are the original records from your devices nor any location: the model receives summaries and daily values that Hermacles calculates (for example daily heart rate variability, resting heart rate, sleep and weight for up to 180 days).

Messages outside training and recovery (for example code, essays, travel, or medical questions) get a short fixed reply, and the model is not called. The AI spend has daily and monthly caps; past a cap, the coach answers from templates.

The numbers in a reply are calculated by Hermacles; the AI model only explains them. Every reply is checked against wellness-language rules before you see it.

According to Anthropic's Commercial Terms as of 5 November 2026 (https://www.anthropic.com/legal/commercial-terms), Anthropic may not train models on customer content from its API.

According to Anthropic's privacy center as of 5 November 2026 (https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data), Anthropic automatically deletes API inputs and outputs within 30 days of receipt or generation, unless it must keep them longer to enforce its Usage Policy or to comply with the law, or a different arrangement has been agreed. Content flagged by Anthropic's safety systems as violating its Usage Policy may be kept for up to 2 years. Hermacles does not store the text sent to Anthropic in its logs; it records only token counts and cost.

You can withdraw the AI consent at any time in Account. From then on nothing more is sent and the coach answers from built-in templates. Data already sent is handled under Anthropic's retention terms above.

Wearables and health apps

When you connect a service, such as Garmin Connect, Oura, or Apple Health through the Health Auto Export app (and, once released, the Hermacles iOS app), we receive only the data you authorize there, and we use it only to provide Hermacles to you. We do not use it for advertising, sell it, or show it to other users.

Garmin today: until Garmin approves our access to its official API, connecting a Garmin account works only for accounts we have explicitly allowed (the operator's own test account), and sending workouts to Garmin devices is turned off in production.

Where sending workouts is enabled, a workout reaches your device only after you confirm that exact push in the app, and our server only sends workouts from the plan you accepted.

Each connected service handles your data under its own privacy policy. You can revoke our access in that service's settings at any time; deleting your Hermacles account deletes the access tokens we hold.

With the iOS app, raw Apple Health samples stay on your phone; only the summaries the coach needs are sent. Apple Health data is never used for advertising and never stored in iCloud by Hermacles.

Before we add a new source (for example WHOOP), we will list it here.

Who processes your data for us

Microsoft Azure (Microsoft Corporation, United States) hosts our API servers, database, encryption keys (Azure Key Vault) and platform logs in its West US 2 region (United States). The web app's static files are hosted in East US 2 and served globally, and our code's container registry is in East US 2; neither holds your personal data.

Anthropic, PBC (United States), the company behind the Claude model, only with your AI consent, to write coach replies (see "How the AI coach works").

Both act on our instructions under their data processing terms. Under Mexican law they are processors ("encargados"), and sending data to them is not a transfer to a third party.

Google Fonts (Google LLC, United States): the web app loads its typefaces from Google, which receives your IP address and browser details. It never receives health data. The public legal pages do not load them.

MET Norway (the Norwegian Meteorological Institute, api.met.no, Norway), a public weather service: if your connected Garmin account reports a weather location, our server sends those coordinates, rounded to about 1 km, and nothing else, to fetch the forecast that helps schedule the cooler hours of the day. The request comes from our server, so MET Norway sees our server's IP address, not yours, and keeps it with the rounded coordinates in its logs. No name, email or health data is sent.

The services you connect send data to us at your request, and when you confirm a workout push, we send that workout to Garmin.

We do not transfer your personal data to third parties for their own purposes. We disclose data to authorities only when the law requires it. If that changes, we will update this policy and, where the law requires, ask for your consent first.

Security

All connections use HTTPS (TLS 1.2 or later), and browsers are told to use only HTTPS.

Each user has a separate area of the database. The most personal content is also encrypted with a key unique to you (AES-256-GCM): your messages to and from the coach, check-in notes, the constraints you type, activity titles, the original records received from devices, and the records of workouts sent to a device. Your key is itself encrypted with a master key kept in Azure Key Vault.

Numeric series (sleep, heart rate, workouts) are stored in your database area, encrypted at rest by Azure and accessible only with our database credentials, over TLS. Passwords are stored as bcrypt hashes. Secrets live in Azure Key Vault, not in our code.

Our logs never contain health values, your messages, prompts or AI replies; they record identifiers and counts only. Access tokens for connected services are kept on our servers and never written to logs.

Only the operator's administrators can access production systems, and only to run and repair the service. No system is perfectly secure; if a security breach significantly affects your rights, we will tell you as the applicable law requires.

Retention and deletion

We keep your account and your data while the account exists, so that your history can inform your coaching. You can export it at any time.

When you delete your account, deletion is immediate and permanent: we destroy your encryption key (crypto-shredding), delete your database area, the access tokens of connected services, your consents, product events, AI usage records, reply checks and the account itself, and unlink the invitation you used.

For up to 30 days after deletion, a database backup may still contain your data; backups are accessible only to our administrators, we never restore a deleted account, and they expire after 30 days.

Platform logs, which contain no health values, are kept for 30 days. Data sent to Anthropic with your AI consent is kept under Anthropic's terms (see "How the AI coach works").

Withdrawing a consent does not delete data; deleting the account does. Emails about your privacy requests are kept only as long as needed to show that we answered them.

Your rights (in Mexico: ARCO rights)

You can access, rectify and cancel (delete) your personal data, oppose its processing, withdraw your consent, and ask us to limit its use or disclosure.

In the app: Account → Download my data (a complete JSON file), Account → Delete my account, Account → Privacy and consent to withdraw either consent, and your profile and goals to correct what you entered.

By email, to contacto@gear-5.com, with the subject "Privacy request". Please include: your name and the email of your Hermacles account; a document that proves your identity, or your representative's identity and authority; the right you want to exercise and, except for access, a clear description of the data concerned; and anything that helps us locate it. For a correction, include the change and any document that supports it. We will also confirm the request from your account's email address.

We answer within 20 business days of receiving a complete request and, if the request is granted, make it effective within 15 business days after our answer. Either period can be extended once by the same length when justified, and we will tell you why. Requests are free; only reproduction or shipping costs, if any, may be charged.

If you are in Mexico and disagree with our answer, or we do not answer in time, you can file a data protection request with the Secretaría Anticorrupción y Buen Gobierno (SABG), the federal authority under the Federal Law on the Protection of Personal Data Held by Private Parties in force since 21 March 2025 (https://www.gob.mx/buengobierno).

If you are in the European Union, the EEA or the United Kingdom

The beta is invitation-only and not offered to the public in these regions. If you use it from there, the GDPR (or the UK GDPR) gives you the rights above plus restriction of processing and data portability; the export file serves portability.

Legal bases: the contract with you for your account; your explicit consent for health data and, separately, for AI processing; and our legitimate interest in keeping the service secure (rate limits and platform logs).

Your data is processed in the United States and in Mexico. We rely on your explicit consent and on our processors' data processing terms for that transfer. You can complain to your local data protection authority. We hold no certification under any privacy framework.

We answer GDPR requests within one month, extendable by two further months for complex requests, and we will tell you if we need the extension.

If you are in the United States

Some state laws protect consumer health data, for example Washington's My Health My Data Act. This policy is also our consumer health data privacy policy: it lists the health data we collect, why, where it comes from, who receives it and how to exercise your rights.

We collect consumer health data only with your consent, and we send it to the AI provider only with a second, separate consent. We do not sell consumer health data or any personal data, and we do not share it for targeted advertising.

You can confirm whether we hold your health data, get a copy, withdraw consent and have it deleted, including copies held by our processors and in backups as described above. We answer within 45 days, extendable once by 45 days when reasonably necessary. If we deny a request, you can appeal by replying to our answer; if you still disagree, you can contact your state attorney general.

Under California law, health data is sensitive personal information; we use it only to provide the service you asked for.

Not medical advice

Hermacles offers training guidance, not medical advice or diagnosis. Consult a doctor before changing your training if you have a health condition, and stop training and seek medical help if you feel unwell.

Age

Hermacles is only for adults aged 18 or older. It processes health data on the basis of a person's own express consent, and it is designed to become a paid service. We do not knowingly collect data from anyone under 18; if we learn that an account belongs to a minor, we delete it.

Changes to this policy

The version and effective date at the top identify this text. When a change affects what you consented to, the app asks for your consent again before it continues. For any other change, we publish the new text here with a new version and date.

Earlier versions are available on request at contacto@gear-5.com.