This Privacy Policy explains how HealthHub collects, uses, shares, and protects your personal information when you use the dashboard at health-hub.xyz (the "Service"). We process personal data in accordance with the EU General Data Protection Regulation (GDPR). HealthHub is a multi-platform health and fitness dashboard: you connect one or more third-party services (such as Garmin Connect, with support for additional platforms planned) and HealthHub brings that data together with a nutrition diary in one private account.
The Service is operated by a registered self-employed business (autónomo) under Spanish law. This business, not a private individual acting privately, is the data controller responsible for your personal data:
Aleksandr Andrienko — operating as a self-employed business (autónomo)
NIE: Z0502310H
Barcelona, Spain
Privacy contact: privacy@health-hub.xyz
Support: support@health-hub.xyz
Given the scale of the Service, we are not legally required to appoint a Data Protection Officer (GDPR Art. 37) and have not done so; privacy requests are handled directly at the address above.
When you choose to connect a third-party health or fitness platform (currently Garmin Connect; other platforms such as Fitbit, Apple Health, or Whoop may be supported in future), we collect the data you authorize that service to share, which may include:
We compute metrics from the above to power your dashboard — for example heart-rate training load (Banister TRIMP), basal metabolic rate, a daily energy budget, and macronutrient targets. These derived values are stored in your account alongside the source data.
An authentication token stored in your browser to keep you signed in. We do not use advertising or third-party tracking cookies, analytics SDKs, tracking pixels, or Google Analytics, and we do not build a browsing profile of you.
Health data — special category. Much of the connected-service and nutrition data above is health data (GDPR Article 9). We process it only with your explicit consent and only to provide the Service to you. We never sell it, never use it for advertising or marketing profiling, never use it to train AI models, and never disclose it to third parties except the infrastructure providers needed to run the Service (Section 5). You can delete it at any time.
We do not use your data for advertising, marketing, marketing profiling, or sponsored content.
We do not sell or rent your personal data, do not share it with advertisers, and do not license or share aggregated or de-identified versions of it with anyone. We rely on a small number of infrastructure sub-processors strictly to operate the Service, each bound by GDPR-compliant terms and acting only on our instructions:
We may also disclose data where strictly necessary to comply with a legal obligation (such as a court order, warrant, or subpoena), or to prevent death, serious bodily injury, or other significant harm.
Your data is stored and processed within the European Union (Supabase EU region; Hetzner, Germany). We do not transfer your personal data outside the EU/EEA in the normal operation of the Service. Connected platforms from which you sync data operate under their own privacy terms; when you authorize a connection, data may flow from that platform's own infrastructure, which may be outside the EU and is governed by that platform's policy.
Under GDPR you have the right to:
Many of these you can exercise directly in the app (view, edit, export, or delete entries; delete your account). For anything else, contact privacy@health-hub.xyz and we will respond within 30 days. You also have the right to lodge a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos (AEPD).
You can withdraw your consent to health-data processing at any time by disconnecting the source platform, deleting the data in the app, or closing your account. Withdrawal stops future processing but does not affect the lawfulness of processing already carried out before withdrawal.
HealthHub computes metrics automatically (e.g. your energy budget), but we do not use automated decision-making or profiling that produces legal or similarly significant effects on you. The computed values are informational and under your control.
We keep your data for as long as your account is active. You can delete your account at any time. On deletion (or an erasure request), we remove your personal data from our active systems within 30 days; residual copies in encrypted backups are purged on the normal backup-rotation cycle. Deletion is permanent and cannot be reversed.
You can view all your data in the dashboard. To obtain a full export or a machine-readable copy, contact privacy@health-hub.xyz and we will provide it.
We apply administrative and technical safeguards appropriate to the data: encrypted transport (TLS/HTTPS), per-user authentication with signed tokens, database row-level security so each user can access only their own records, and EU-based hosting. No system is perfectly secure, but we work to protect your data against unauthorized access, loss, or misuse.
If a personal-data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the AEPD within 72 hours where required (GDPR Art. 33) and inform affected users without undue delay where the breach is likely to result in a high risk (Art. 34).
The Service is not directed to children under 16, and we do not knowingly collect their data. If you believe a child has provided us personal data, contact us and we will delete it.
We may update this policy; material changes will be reflected by the "Effective date" above. Continued use of the Service after an update constitutes acceptance of the revised policy.
Privacy questions or to exercise your rights:
privacy@health-hub.xyz.
General support: support@health-hub.xyz.