Privacy Policy

TechTwin (“TechTwin”, “we”, “us”) builds a personalised physiological model from the health, training, and genetic information you choose to provide. That is sensitive data, and this policy is written to tell you exactly what happens to it — what we collect, who it reaches, how long we keep it, and what you can make us do about it. It applies to our website and application (the “Service”).

1. Who we are

TechTwin is the data controller for the information described here. You can reach us about anything in this policy at hello@techtwin.ai. We have not appointed a Data Protection Officer, as we are not required to.

We are based in the UK and the Service is available to people in the EEA, so both the UK GDPR and the EU GDPR can apply to you depending on where you live.

2. Information we collect

We collect what you enter, what you connect, and what the Service derives from those:

• Account & profile — name, email, a profile photo if you add one (kept private: only you see it), and the profile details you enter: date of birth or age, sex, height, weight, body composition, fitness level, goal, sport, training availability, race times, time zone, and your units and display preferences.
• Health & biometric data — training and workout logs, heart-rate variability, resting and workout heart rate, sleep (including naps and sleep stages), VO₂max, blood oxygen, respiratory rate, overnight wrist or skin temperature, steps and distance, weight and body fat, body measurements (muscle and lean mass, other body-composition values, and tape measurements such as waist and hips — typed in, read from Apple Health, or read from a body-scan report you upload), blood-biomarker results you upload, menstrual-cycle data if you use it, and your menopause stage if you tell us.
• Nutrition & lifestyle — meals and their descriptions, food photos you submit, calories and macros, hydration, caffeine, supplements, allergies and dietary exclusions, and any injury, illness or health notes you write.
• Substance use — alcohol, smoking, vaping and nicotine-pouch intake, and how long you have used them, where you choose to log these.
• Genetic data — trait values derived from a DNA file you upload (e.g. 23andMe/AncestryDNA). See the highlighted section below, which explains precisely what is and is not stored.
• Your conversations — the messages you send to the AI coach and protocol builder, and the replies, are stored against your account so you can return to them. Photos and files you attach to a message are sent with it, but we keep only their names.
• Connected sources — data imported from services you link, such as Apple Health, Google Health, Strava, Oura, Fitbit, WHOOP, or a device export file (for example Garmin). This can be two-way: with your permission, water and meals you log in TechTwin can be written back into Apple Health.
• Derived and inferred data — readiness scores and bands, training load, a detected fitness level, physiological parameters fitted to your own history, and forecasts. See “Automated profiling” below.
• Plan outcomes and feedback — when a plan ends, on its end date or earlier, we record when and how it ended and, once your readings up to that day are in, a summary comparing your recent readings with what its forecast predicted. We also ask a few optional questions: how accurate the forecast was, how your results compared with it, how helpful the plan was, how the training felt, how much of the plan you followed and, if it ended early, why — chosen from a short list that includes illness or injury. You can close the questions without answering any of them.
• Device & technical data — a push-notification token if you enable notifications, your time zone, sync timestamps, and server logs needed to operate, secure and debug the Service.
• Product analytics — pages viewed and coarse device information while you are signed in; and, only if you accept analytics and advertising cookies, the pages you visit and the buttons and links you use on our website and in the app, and the website pages you visit and a few actions there for our advertising on Meta. See “Cookies, analytics and on-device storage”.
• Waiting-list contact details — if you register interest before an account exists, we hold the name and email you gave us so we can tell you when the Service opens.

How your DNA is handled

Your raw genetic file is parsed entirely in your browser and is never uploaded to or stored on our servers. The file is read on your device, a small set of trait values is computed from it, and the raw genotype data is discarded when you leave the page. We never receive it, and there is no way for us to ask for it.

What we do save to your account is a set of derived trait values — for example an aerobic-response score, a caffeine-clearance category, or an iron-overload risk category — together with a list of which marker IDs your file did not cover. We want to be precise about two things people often assume:

• This derived data is not anonymous. It is stored against your account and is personal data about you, in the special category covering health and genetics.
• Some of these values can be worked backwards. Several traits are computed from a single named marker, so someone who knows our method and sees the stored number could infer your genotype at that specific marker — for example your ACTN3 power variant, your CYP1A2 caffeine variant, or your HFE iron variant. We cannot rebuild your genome, and the great majority of it never reaches us at all, but we will not claim these scores are unlinkable to the genetics they came from.

You can delete your derived genetic data without closing your account by contacting us, and we will stop using genetic information in your model from that point.

Google Health data

If you connect Google Health, we read four categories of data from your Google account and no others: sleep (bedtime, time asleep, stages, and how often you woke),health metrics and measurements (heart-rate variability, resting heart rate, breathing rate, blood oxygen, skin temperature, weight and body fat), activity and fitness (steps, distance, active calories, and workouts you recorded),nutrition (calories, protein, carbohydrate, fat, water and caffeine from meals you have logged in other apps). Our permission is read-only in every one of them: we never write to, or alter, anything in your Google Health record — including your food diary, which this API would allow us to write to and which we deliberately do not request permission for.

We use it only to run the features you can see. It feeds your sleep scores, readiness and recovery, biological age, training load, your calorie and macro targets, and the forecasts your plans are built on. We do not use it for advertising of any kind, and we do not sell it or hand it to anyone else for their own purposes.

No one reads it. Nobody at TechTwin looks at data obtained from Google APIs unless you have specifically asked us to — for example when you report a problem and ask us to investigate — or it is necessary for security, or the law requires it, or the data has been aggregated and stripped of anything identifying for internal work such as checking our own calculations.

Where the connection is kept. Unlike our other wearable connections, the keys for Google Health are held on our server rather than on your device. That is deliberate: it lets the connection renew itself, it follows you to a second device, and it means disconnecting genuinely ends our access rather than forgetting a key on one phone.

TechTwin's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

It never replaces what you logged yourself. Where a figure already exists because you typed it — a meal, a weight — the imported value is discarded rather than written over it.

You can disconnect at any time in Settings → Devices, which stops all further access, and you can revoke it directly from your Google account at myaccount.google.com/permissions. Data already synced stays in your TechTwin account until you delete it.

WHOOP data

If you connect WHOOP, we read four kinds of data from your WHOOP account and no others: recovery (heart-rate variability, resting heart rate and blood oxygen, measured overnight), sleep (bedtime, time asleep, stages, wake-ups and breathing rate), workouts (each session's duration, heart rate, energy and distance) and daily step counts. We do not read your WHOOP profile, name or email, and we never write anything to WHOOP.

We ask for your explicit consent first, because WHOOP requires it: to store this data, to use it for your own forecasts, readiness and plans, and to share it with the third-party AI services that run the AI features in section 6. We never use WHOOP data to develop or test our models for other people (it is left out of the accuracy work described in section 3), and we never sell it or use it for advertising.

You can disconnect at any time in Settings → Devices, which also cancels our access at WHOOP. Data already synced stays in your TechTwin account until you delete it, unless WHOOP ends our access to its service, in which case WHOOP's terms require us to delete the WHOOP data we hold.

Your calendar (iPhone app)

If you turn on the training calendar in Settings, the iPhone app asks iOS for full access to your calendars and uses it in two ways, both on your iPhone:

• It reads when you are busy in your other calendars, as start and end times only, so it can fit your sessions around your day. It never reads what an event is called, where it is, who is invited or any notes. Those times are used on your iPhone and then dropped: they are never sent to us, stored or shared.
• It keeps a calendar of its own, called “TechTwin”, with your plan's sessions for the next two weeks: each event has the session's name, length and steps. It changes or deletes only events in that calendar. If your calendars sync with iCloud or another account, that calendar syncs with them like any other.

Nothing from your calendar reaches us. The one thing the feature sends is a session's date, when you tap “Move it” for a day with no free time, so your plan can move that session. You can turn it off in Settings, which removes the TechTwin calendar from your iPhone, or withdraw access at any time in your iPhone's Settings → TechTwin → Calendars.

3. How we use your information

• To build and continuously calibrate your digital twin, and to generate forecasts, insights, readiness scores and protocol recommendations.
• To power AI features — both those you invoke directly (such as estimating a meal's nutrition or writing a report) and scheduled background processing described below.
• To send you notifications you have enabled, which can include your own health figures.
• To operate, secure, maintain, debug and improve the Service, and to measure our own AI processing costs.
• To measure how accurate our forecasts turned out to be, and to make future forecasts more accurate, for you and for other people who use the Service, using the outcome of plans that have ended and any answers you give about them.
• To communicate with you about your account and respond to your requests.

This is part of providing and improving the Service, not research. If we want to use your data for research or a formal validation study, we will ask for your explicit consent to that specific purpose first, and you can decline without losing access to the Service.

We never use your health or genetic data for advertising or marketing, and we do not sell your data. The only advertising use is the Meta pixel on our website, and only if you accept it (section 7).

4. Automated profiling and forecasts

The Service is built on automated processing, and you should know what that means in practice. From your health data we automatically compute and store characteristics about you — a daily readiness score and band, an inferred fitness level, physiological parameters fitted to your own history, and forward-looking forecasts. Some of this runs on a schedule, without you opening the app, and the results shape what the Service then recommends to you.

These are modelled estimates, not medical findings, and they produce no legal or similarly significant effect: nothing is decided about you, no access is granted or refused, and you remain free to ignore any recommendation. You can ask us to explain how a figure was derived, contest it, or object to this processing using the contact details below.

5. Legal bases

Under the UK and EU GDPR we rely on:

• Your explicit consent (Article 9(2)(a)) for processing special-category data — health, genetic and, where you log it, substance-use information. This is the basis for the core of the Service.
• Performance of our contract with you (Article 6(1)(b)) to create and run your account and deliver the Service you asked for.
• Our legitimate interests (Article 6(1)(f)) in operating, securing, debugging and improving the Service — including measuring and improving the accuracy of our forecasts — and product analytics. You can object to processing on this basis at any time.
• Consent (Article 6(1)(a)) for optional extras such as push notifications, waiting-list contact, Google Analytics cookies and the Meta pixel on our website.

You can withdraw consent at any time, and withdrawing it is as easy as giving it. Withdrawing consent for health and genetic processing means we can no longer provide the Service, so in practice it means closing your account — see “Your rights”.

6. AI processing

Several features send your information to Anthropic, our AI provider, which returns the result. So that you can judge this properly, the inputs can include: your profile and training history, your biometric and sleep data, blood-biomarker results including text extracted from a blood-test PDF you upload, a body-composition report you upload (an InBody, DEXA or scale report, as a PDF or a photo), traits derived from your genetic data (referred to by gene name), menstrual-cycle information and menopause stage, lifestyle and substance-use history, allergies and any health notes you have written, meal descriptions, food photos, and what you type into the coach, including any photos or files you attach to a message.

These inputs are processed under contractual confidentiality, are used only to generate your output, and are not used to train the provider's models. Food photos are used only to produce the nutrition estimate, and body-composition reports only to read the measurements you then choose to save; neither file is stored by us afterwards. Some of this processing is triggered by you; some runs on a schedule to prepare insights and notifications.

Separately, when you ask the coach a research-backed question, it may search a public scientific literature database (PubMed, operated by the US National Library of Medicine) using search terms derived from your question. No account identifier is sent with that search.

7. Cookies, analytics and on-device storage

Cookies. We use a small number of strictly necessary cookies to keep you signed in, set by our authentication provider. With your permission we also use Google Analytics and Meta cookies: we ask the first time you visit on each device, and they are set only if you accept.

Analytics. We use Vercel Web Analytics to understand which features are used. It records page views and coarse technical details and, according to its provider, does not set cookies or store identifiers on your device; it does not receive your name, email or health data. We enable it only when you are signed in — visitors who are not signed in are not measured. You can switch it off under Settings → Privacy, and the change takes effect the next time the app loads.

Google Analytics. If you accept analytics cookies, we also use Google Analytics to see how people use our website and app: the pages you visit, the buttons and links you use, how long you spend on a page, and coarse technical details such as your device type, browser and approximate location. It stores cookies on your device (named _ga) to recognise a returning visit, for up to two years. It never receives your name, email address, health or genetic data: pages are recorded by their address, and in the app a click is recorded only under a fixed name we chose or the page it leads to, never what is written on the screen. Its advertising features are switched off. You can change your choice at any time with “Cookie settings” at the bottom of our website, or under Settings → Privacy in the app; if you withdraw it, we delete its cookies from that device and it measures nothing more.

Meta pixel. If you accept, our public website (not the app, and not our iPhone or Android apps) also uses Meta's pixel, so we can measure our ads on Facebook and Instagram and show TechTwin ads to people who have visited our website. It tells Meta which of our website pages you visit and a few things you do there: viewing parts of the page or the demo, clicking a main button or an email link, scrolling most of the way down, starting the sign-up or waiting-list form, joining the waiting list, and creating an account. It stores cookies on your device (named _fbp) and Meta may link this to a Facebook or Instagram account you use. It never receives your name, email address, anything you type, or any health or genetic data, and nothing from inside the app. We do not sell this data. You can change your choice in the same places as for Google Analytics; if you withdraw it, we delete its cookies from that device and it sends nothing more.

On your own device. To keep the app fast and usable offline, it stores things in your browser or app storage: a cached copy of your dashboard, your current day's plan, your most recent insight report, sync timestamps, notification tokens, which events the training calendar added to your TechTwin calendar, and the access keys for your Strava and Fitbit connections. Google Health, Oura and WHOOP are the exceptions — their keys are held on our server, never in your device's storage, so the connection can renew itself and keep syncing without the app open (see “Google Health data” above). We delete them when you disconnect or delete your account, and at that point we also ask Oura and WHOOP to cancel their keys. None of this is used for advertising or shared with third parties. It is cleared when you sign out, clear the app's storage, or uninstall the app.

8. Who we share your information with

We do not sell your personal data. Apart from the Meta pixel on our website, which runs only if you accept it (section 7), we do not share it for advertising. We share it with the following providers, who act on our instructions under data-protection agreements, and only so far as they need it:

• Supabase — database and authentication; holds your account and health data.
• Railway — hosting for our application server, which processes your data and holds operational logs.
• Vercel — hosting for our website and app, and the product analytics described above.
• Google — Google Analytics, only if you accept analytics cookies, as described in section 7.
• Anthropic — AI processing, as described in section 6.
• Apple — delivery of push notifications, where you enable them. Notification text can include your own health figures, which means it passes through Apple's servers and appears on your lock screen.
• Our email provider — sending account emails such as sign-in confirmation and password resets.
• Services you connect yourself — Apple Health, Google Health, Strava, Oura, WHOOP, Fitbit and similar, which exchange data with us because you authorised them to. For Google Health and WHOOP the exchange is one-way: we read, and never write.

Meta. If you accept advertising cookies, Meta Platforms Ireland Limited receives the website information described in section 7. Meta and we are jointly responsible for collecting it on our website and sending it to Meta; what Meta then does with it is covered by Meta's own privacy policy.

We may also disclose information where the law requires it, or to establish or defend legal claims.

9. International transfers

Some of our providers process data outside the UK and EEA, including in the United States — this is the case for our AI processing and, if you accept the cookies, for Google Analytics and Meta. Where personal data is transferred internationally we rely on appropriate safeguards, such as the UK International Data Transfer Addendum and the European Commission's standard contractual clauses. You can ask us for details of the safeguards that apply.

10. How long we keep it

We keep your health and account data for as long as your account exists — we do not delete it on a schedule, because the value of the model depends on your history. Two things do expire automatically: our internal record of AI processing volume is deleted after 90 days, and device push tokens are removed once they stop working.

When you delete your account we permanently erase your login record, and that cascades to every table holding your profile, training, sleep, biometric, blood, cycle, genetic-trait, meal, plan, plan-feedback and conversation data. Two things are not covered automatically and we will remove them on request: a waiting-list entry submitted before you had an account, and operational logs held by our hosting providers. We may retain limited records where the law requires it.

11. Security

Data is encrypted in transit. Access to your records is restricted to your own authenticated account: in the app this is enforced by database row-level security, and on our own server — which necessarily holds broader credentials in order to run the model — by application controls that scope every request to the signed-in user. We limit internal access.

Some information is held on your own device, as described in section 7, including the access keys for wearable services you have connected. Anyone with access to your unlocked device may be able to reach it. No system is perfectly secure, but we work to protect your information using industry-standard measures, and we will tell you and the relevant regulator about a breach where the law requires it.

12. Your rights

You have the right to access your data, correct it, receive a copy in a portable form, have it erased, restrict or object to how we process it, and withdraw consent. Where we can, we have built these into the product:

• Correct it — edit your profile in Settings, and edit or delete individual entries in the Log.
• Export it — Settings → Privacy gives you a JSON copy of your profile, daily logs, meals, blood panels, cycle logs, protocols, plan outcomes and feedback, and genetic traits. Some records, including your coach conversations, are not yet in that file — email us and we will send you everything we hold.
• Delete it — Settings → Privacy permanently deletes your account and the data described in section 10. If you cannot sign in, or you want the full picture of what deletion does and does not cover, see Delete your account. Access you granted to Strava, Oura, WHOOP, Fitbit or Google Health is controlled by those services, so revoke TechTwin there too if you want the connection fully closed — for Google that is myaccount.google.com/permissions.
• Everything else — email hello@techtwin.ai.

We respond within one month, which can be extended by two further months for complex requests; we will tell you if that happens. We may ask you to confirm your identity first.

You also have the right to complain to a data protection supervisory authority. In the UK this is the Information Commissioner's Office (ico.org.uk, 0303 123 1113). In the EEA it is the authority where you live or work.

13. Children

The Service is not intended for anyone under 18 and you must confirm you are 18 or over to use it. We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

14. Changes to this policy

We may update this policy as the Service evolves. We will revise the “Last updated” date and, for material changes, take reasonable steps to notify you before they take effect.

15. Contact

Questions or requests about your privacy? Email hello@techtwin.ai.