App privacy notice

This is a translation of the Italian version, which prevails in case of discrepancy.

Notice pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) for users of the Digital Twin app (my.digital-twins.app and the iPhone and Android apps). Version 2026-10, last updated: 21 October 2026. For the waiting list on the landing page, the landing page privacy notice applies.

Data controller

Klinika di Francesco Giuseppe Falbo. Contact for any request about your data: info@digital-twins.app.

What data we process

• Account: email, password (stored only as a hash, never in plain text), registration date, consents and the version of the texts they refer to.
• Personal details: first name, last name, date of birth, sex, height, weight, disciplines.
• Health and physical activity data (special categories, Art. 9 GDPR): physiological profile (critical power, W', maximum and resting heart rate, body mass), training activities (read from intervals.icu or from the .FIT files you upload) with their power, heart rate, speed, temperature and position streams, wellness data (sleep, HRV, resting heart rate), planned workouts, races and saved routes, model reliability measurements.
• Connection to intervals.icu: the API key or authorisation token, stored encrypted.
• Connection to Garmin Connect (optional, coming soon): the authorisation tokens, stored encrypted, and the data Garmin sends us after your consent: cycling activities with their files (power, heart rate, speed, altitude and position series) and, only if you choose, sleep, HRV and resting heart rate.
• Connection to Strava (optional): the authorisation tokens, stored encrypted, and the public analysis pages you choose to create (charts and metrics of an activity, without route or name), reachable by anyone with the link until you revoke them.
• Problem reports: if you use Report a problem, we keep the text you write and, if you choose so, the app version, platform and language, to reply to you and fix the problem.
• Technical data: device session tokens (only as a hash) and, to limit login attempts, a cryptographic fingerprint of IP and email kept for 24 hours. Server errors go to a technical log, without your personal data, kept for 30 days.

Why and on what basis

• Providing the app (account, synchronisation, simulations, calendar, connection with a coach you choose): performance of the contract (Art. 6(1)(b) GDPR) and, for health data, your explicit consent (Art. 9(2)(a) GDPR), given at registration.
• Security (email verification, attempt limits, password recovery): legitimate interest (Art. 6(1)(f)).
• Research: Digital Twin is a prototype that originated in a research setting. Your data enters a study only if you give the optional research consent, separate from this one, which you can give or withdraw at any time from Me › Research: see the research notice.

We do not use the data for advertising, we do not sell it and we do not share it with third parties beyond what is stated here.

Who processes the data on our behalf

• IONOS SE: hosting of the app, database and email, in data centres in the European Union.
• Google Cloud (europe-west1 region, Belgium): a service that estimates a training load suggestion from your history of adherence to plans, wellness and form. It receives this data without name or email; the app labels the estimate as a demonstration.

Garmin Connect (optional connection, coming soon; it applies only once available): we ask for your authorisation from your Garmin account and receive from Garmin only the data you authorise, to calibrate your twin and show you forecasts. Garmin is an independent provider with its own terms. You can revoke the connection at any time, from the app or from your Garmin account: if you revoke it from Garmin we stop receiving data and delete the data received from Garmin. We do not use Garmin data for advertising and do not share it with third parties.

Strava is used only to write, at your request, into the description of an activity you have already uploaded: the app does not import activities from Strava and keeps nothing of its data beyond the activity identifier. You can revoke the connection at any time, also from Strava.

intervals.icu is the service from which the app reads, at your request, activities, wellness, calendar and settings: it is an independent provider with its own terms, and you can revoke the connection at any time, also from intervals.icu.

If you connect a coach, they will be able to view and edit your physiological profile and upload workouts, races and routes for you. You can revoke this from the app.

Minimum age

The app is reserved for people aged at least 14. For health data of minors between 14 and 18 we nevertheless recommend involving a parent.

How long

As long as the account exists, problem reports included. You can delete it at any time from Me › Delete account (instructions): the account and data are deleted from the service immediately; they remain only in the database backups, which are kept for 30 days and then deleted. If you do not confirm your email address within 30 days of registering, the account is deleted automatically. Expired session tokens are deleted automatically.

Your rights

Access, rectification, erasure, restriction, portability, objection and withdrawal of consent at any time (without affecting processing already carried out), by writing to info@digital-twins.app. Withdrawing consent to health data means you can no longer use the app: in that case we delete the account. You can also lodge a complaint with the Italian data protection authority (garanteprivacy.it) or with the authority of your country.

Security

Encrypted connections (HTTPS), passwords and tokens stored only as hashes, intervals.icu and Strava credentials encrypted, nightly database backups accessible only to the data controller.