Privacy Policy

1. Who are we?

ONAtrail® is the web platform developed as part of the MAGIC-Trail project (ManaGing Illness, Injuries and Challenges in Trail running), led by Dr. Nicolas Bouscaren at the Centre Hospitalier Universitaire de La Réunion (CHU de La Réunion).

The project is co-funded by the European Union and the Région Réunion: Europe is committed to Réunion Island through the European Regional Development Fund (ERDF/FEDER).

The platform provides trail runners with race preparation, performance analysis, pace optimization and training monitoring tools related to trail running and running in general.

2. Data controller and data protection officer

3. Purposes of processing and legal bases

This information is provided in accordance with Article 13 of the General Data Protection Regulation (GDPR).

Pursuant to Articles 6 and 9 of the GDPR, processing activities rely on the following legal bases:

• Creation and management of your account, operation of the platform, display and analysis of your activities → consent (Art. 6(1)(a) GDPR).
• Personalized training, pacing and performance recommendations → consent (Art. 6(1)(a)).
• Training and improvement of our artificial intelligence models internal to the ONAtrail project → consent (Art. 6(1)(a)). Your consent is collected separately and prior to any processing for this purpose.
• Security, fraud prevention and technical maintenance → legitimate interest (Art. 6(1)(f) GDPR).

4. Data collected

The following data is collected depending on the services you use. Data marked * is mandatory for the operation of the service.

Access restricted to adults. Registration on ONAtrail is restricted to individuals aged 18 and over. The date of birth collected at registration is used to verify this condition. ONAtrail does not knowingly collect data relating to minors; if an account created by a minor were identified, it would be deleted.

• Account data: first name*, last name*, email address*, date of birth*, sex*.
• Sports activity data: distance, duration, elevation gain, training load and other performance indicators.
• Access to your Garmin® and Strava® data: to synchronize your data from Garmin Connect or Strava, ONAtrail receives an access token — a temporary code provided by these services that authorizes us to access your data on your behalf and with your authorization, without ever knowing your username or password. This data notably includes GPS tracks, pace and heart rate during exercise. Data source: Garmin Connect and/or Strava.
• User profile: first name*, last name*, date of birth*, sex*, country, department of residence, sports activity data. Data source: Garmin Connect and/or Strava.
• Technical connection data: IP address, connection logs, session identifier. This data is collected automatically when the platform is used, independently of any cookie being placed. The platform also uses technical cookies strictly necessary for its operation (session maintenance, security); these cookies do not collect any data for advertising or analytics purposes.

5. Use of artificial intelligence

ONAtrail uses, or may use, after obtaining your consent, your personal data (activity data, age, sex) in two distinct contexts involving artificial intelligence:

Personalized recommendations

Our models analyze your data to provide you with pacing recommendations, injury risk estimation and training load analysis. This processing relies on the performance of the contract for standard activity data, and on your consent for the health data involved.

Training and improvement of models

Your data may be used to train, improve or evaluate our algorithms. This processing goes beyond the service directly provided to you and relies exclusively on your prior and explicit consent, collected separately.

Origin of the data used for artificial intelligence. Only data from Garmin Connect (as well as data you enter directly on ONAtrail) may be used for artificial intelligence purposes.

In accordance with the Strava API terms of use, which prohibit the use of Strava data in artificial intelligence systems, data from Strava is never used for personalized recommendations or for training our AI models; it is used exclusively for the display and performance analysis features described in Section 4.

In both cases, no automated decision is made on the basis of these processing activities. You may withdraw your consent to the use of AI for the analysis of your data at any time from your account settings, without affecting access to the platform's essential features.

6. Data recipients

Depending on the purposes described above, your data may be processed by the following organizations, all located in France or in the European Union:

• CHU de La Réunion (France) — Data controller. Hosts the data during the phases of analysis and work on data from the platform.
• Mezcalito (France) — Web development provider and main host of the ONAtrail platform. Involved in the maintenance, technical evolution and hosting of the platform's data.
• Skezi (France) — Provider responsible for collecting and hosting responses to research questionnaires. Involved only in the context of research projects in which you have chosen to participate.
• Garmin and Strava (EU) — External data sources. These platforms transmit your data to ONAtrail via their APIs, within the limits of the authorizations you have granted them. They operate under their own terms of use and privacy policies.

No personal data is transferred outside the European Union.

We do not sell your personal data.

7. Garmin Data

This section specifically describes how data retrieved via the Garmin Connect Application Programming Interface (API) is collected, used, processed, stored and shared.

Collection

ONAtrail collects data from your Garmin Connect account exclusively via the official Garmin Connect API, and only after you have explicitly granted authorization through Garmin's OAuth authentication system. The data collected may include activity data (distance, duration, pace, elevation gain, GPS tracks, heart rate), depending on the authorizations you have granted.

Use

Garmin data is used to provide you with performance analysis, training monitoring and race preparation tools within the ONAtrail platform. It is also used by our AI infrastructure, only after obtaining your explicit consent, to generate personalized recommendations (pace prediction, injury risk estimation, training load analysis, etc.).

No third-party artificial intelligence provider has access to your Garmin data.

Processing

Garmin data is processed exclusively within the ONAtrail infrastructure. No Garmin data is transmitted to any third-party service, external platform or artificial intelligence provider external to the ONAtrail platform.

Storage

Garmin data is hosted on Mezcalito's servers. Security measures, notably including encryption of data in transit and at rest, are implemented in accordance with applicable contractual and regulatory requirements.

Sharing with third parties

Garmin data is neither sold, nor rented, nor shared with third parties for purposes other than those described in paragraph 3 of the ONAtrail platform's privacy policy.

To exercise your rights over the data retrieved from your Garmin account (access, rectification, deletion, portability), use the contact details in Section 2. You may also disconnect your Garmin account from the ONAtrail platform at any time from the "My Account" section, which will end any further collection and delete all previously collected data, in accordance with Garmin's privacy policy.

8. Strava Data

This section specifically describes how data retrieved via the Strava Application Programming Interface (API) is collected, used, processed, stored and shared.

Collection

ONAtrail collects data from your Strava account exclusively via the official Strava API, and only after you have explicitly granted authorization through Strava's OAuth authentication system. The data collected may include activity data (distance, duration, pace, elevation gain, GPS tracks, heart rate), depending on the authorizations you have granted. In accordance with the Strava platform's rules, this data is accessible only to you within ONAtrail and is never displayed to other users.

Use

Strava data is used exclusively to provide you with performance analysis, training monitoring and race preparation tools within the ONAtrail platform.

Important. In accordance with the current Strava API terms of use, data from Strava is never used to feed our artificial intelligence models, whether to generate personalized recommendations or to train, improve or evaluate our algorithms. Only data from Garmin Connect may, subject to your explicit consent, be used for these purposes (see Section 5).

No third-party artificial intelligence provider has access to your Strava data.

Processing

Strava data is processed exclusively within the ONAtrail infrastructure. No Strava data is transmitted to any third-party service, external platform or artificial intelligence provider external to the ONAtrail platform.

Storage

Strava data is hosted on Mezcalito's servers. Security measures, notably including encryption of data in transit and at rest, are implemented in accordance with applicable contractual and regulatory requirements.

Sharing with third parties

Strava data is neither sold, nor rented, nor shared with third parties for purposes other than those described in paragraph 3 of the ONAtrail platform's privacy policy.

To exercise your rights over the data retrieved from your Strava account (access, rectification, deletion, portability), use the contact details in Section 2. You may also disconnect your Strava account from the ONAtrail platform at any time from the "My Account" section, which will end any further collection and result in the deletion, within 30 days, of all previously collected Strava data, in accordance with Strava's privacy policy.

9. Data hosting

All of your personal data collected by ONAtrail is hosted in France or in the European Union. The ONAtrail platform and its data are hosted by Mezcalito, a development and hosting provider.

The CHU de La Réunion may host data as part of the phases of analysis and work on the data.

10. Data retention

Your account data is retained for the entire duration of your registration on the ONAtrail platform and deleted within 30 days following the closure of your account.

You may request the deletion of your account and associated data at any time. To exercise your rights over the data retrieved from your Garmin or Strava account (access, rectification, deletion, portability), use the contact details in Section 2.

11. Your rights

In accordance with the GDPR, you have the following rights:

• Right of access to your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to portability of your data (only for processed data whose purpose relies on consent)
• Right to withdraw your consent at any time

Requests may be sent to the contact details provided in Section 2. We undertake to respond within one month, which may be extended to three months for complex requests, in accordance with Article 12 of the GDPR.

If you consider that your rights are not being respected, you may lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL): 3 Place de Fontenoy – TSA 80715 – 75334 Paris Cedex 07 — www.cnil.fr

12. Data security

Technical and organizational measures are implemented to protect your data against any unauthorized access, disclosure, alteration or destruction:

• Encryption of data in transit and at rest
• Strict access controls
• Logging and traceability of access to health data
• Secure authentication procedures
• Regular backups
• Physical access controls

13. Changes to this policy

This privacy policy may be updated.

Any substantial change affecting the purposes of processing or requiring renewed consent — notably regarding the use of artificial intelligence technologies — will be communicated to you by email and by notice on the website, in addition to the publication of the updated version on this page.