Privacy Policy

Last updated: 8 November 2026

This Privacy Policy describes how Cortix (“we”, “us”, “our”) collects, uses, and shares information when you use our services (the “Service”). By using the Service, you agree to the practices described below. We process personal data in accordance with applicable data protection laws, including the EU General Data Protection Regulation (GDPR) as implemented in Norwegian law.

1. Information we collect

We collect information to operate, maintain, and improve the Service. The categories we collect include:

• Information you provide: account details (name, email, password), profile and training preferences, content you submit (such as workout notes, feedback, and messages to our AI coach), and communications with us.
• Information from connected services: when you connect a third-party fitness platform such as Wahoo, COROS or Suunto, we receive the activity data you authorise that service to share with us. This may include heart rate, power, pace, GPS traces, and similar performance data.
• Information from Apple Health or Health Connect: when you connect one in the app, we read your rides and runs: their time, heart rate, power, cadence, speed, distance and energy, the route on iPhone, and the app and device that recorded them. We read nothing else from it and never write to it. We use this data to coach you, and to train Cortix's own coaching models only if you opt in (Section 4). Never for advertising, and we never sell it.
• How you use your plan: when a planned session is created, changed, moved, skipped or done, and whether you, a plan or the coach made the change; when you rate a session; when you open the app; and changes to your subscription. We keep this history to run the Service and, only if you opt in, to train Cortix's own coaching models (Section 4).
• Information from service providers: our payment processor shares limited subscription and billing status information with us. We never receive or store your full payment card details.
• Information collected automatically: usage and interaction data, device and browser information, approximate location derived from IP address, and similar technical data collected through cookies and similar technologies.

2. How we use information and legal basis

We process personal data only where we have a lawful basis to do so. For each processing purpose we rely on one of the following bases under GDPR:

Where we rely on legitimate interests, we have balanced our interest against your privacy rights. You can object to this processing at any time (see Section 8).

3. Health and fitness data

Some of the information we process, particularly heart rate and other physiological metrics from your sessions, and what you tell the coach about injuries, illness or how you feel, may constitute “data concerning health” under Article 9 GDPR. We process this information only with your explicit consent, which you give in the app. We use it to provide you with training analytics, plan generation, and coach feedback, including analysis by our AI provider as described in Section 4, and, only if you opt in, to train Cortix's own coaching models.

You can withdraw it at any time by deleting your account. Disconnecting a platform stops new imports; sessions already imported stay until you delete them or your account. For Apple Health and Health Connect, Delete imported sessions under Connections in the app deletes every session they brought in.

When you connect a platform we import your training history there, as far back as the platform allows, and keep the original file of each session in private storage in the EU. Disconnecting a platform deletes its original files.

Menstrual cycle data

If you choose to turn on cycle coaching, we process the situation you pick (regular, irregular, hormonal contraception or no periods), the start dates of the periods you log, your short answers about how each one affected your training, and anything you tell the coach about it. This is data concerning health and therefore a special category of personal data under Article 9 GDPR.

• Purpose: the only thing we use it for is training. From your logged dates we estimate when your next period is likely, and from your answers we build a short summary of how periods tend to affect your training. Plan generation, plan adjustments and coach responses receive that estimate and summary as background, to explain or anticipate when it is relevant. It is never used for advertising, profiling unrelated to training, or shared with anyone outside the service providers listed in Section 6.
• Legal basis: your explicit consent under Article 9(2)(a) GDPR, given through the dedicated consent control shown when you enable cycle-aware coaching. The feature is off by default and is never enabled for you. Consent is entirely optional. Every other part of the Service works without it.
• Withdrawing consent: turn cycle-aware coaching off at any time, in the app under Profile → Menstrual cycle or on the web under Settings. Withdrawal takes effect immediately, is as easy as giving consent, and does not affect the lawfulness of processing carried out before it.
• Deletion: turning the feature off erases every logged period, your answers and your situation in the same action. Backups may retain the values for up to 30 days, after which they are gone. Deleting your account removes them along with the rest of your data.

4. Automated decision-making and AI

The Service uses large language models to generate training plans, coach responses, and analytics summaries based on data you provide and data imported from connected services. These outputs are produced by automated processing.

How our AI coach uses your data

Our AI coach, Context, runs on a large language model from an external AI model provider. To coach you, we send the provider the information it needs, such as your training profile, your workouts and session data, and your messages to the coach. The provider processes it only on our behalf and does not use it to train its models. The provider is located in the United States (see Section 7).

We train Cortix's own coaching models only on data from athletes who opt in. The opt-in is separate from your other consents, optional, and you can withdraw it at any time; after that, your data is not used for new models. Training data never includes your name or email.

We ask for your consent to this in the app.

Garmin Connect

If you connect Garmin Connect, our AI coach analyses the sessions Garmin sends us, with the consent you give when connecting. Section 15 says how we handle that data and how to withdraw your consent at any time.

You are not subject to decisions based solely on automated processing that produce legal or similarly significant effects on you. Every AI-generated plan, recommendation, and message can be reviewed, modified, rejected, or deleted by you before it takes effect. In addition, you have the right to:

• Request human review of any automated output by emailing support@cortix.no
• Express your view on any recommendation
• Contest any decision you believe was made incorrectly

See also our Terms of Service for important disclaimers about the nature and limitations of AI-generated content.

5. How long we keep information

We retain personal data for as long as your account is active and thereafter for a reasonable period necessary for legitimate business purposes, or longer where required by applicable law. For example, Norwegian bookkeeping law requires us to retain invoicing and accounting records for up to five years after the end of the accounting year.

When you delete your account, we erase your data right away: your profile, sessions, plans, messages and goals. We keep only what the law requires us to keep. Backups may retain data for up to 30 days after deletion from the live system.

6. Sharing and service providers

We do not sell your personal data.

We share information with trusted third-party service providers that help us operate the Service. These may include providers of hosting and cloud infrastructure, artificial intelligence model providers, product analytics, error tracking, payment processing, email delivery, customer support, and similar operational services. Each provider is subject to contractual commitments requiring appropriate confidentiality and security standards.

When you connect a third-party fitness platform such as Wahoo, COROS or Suunto, or Apple Health or Health Connect on your phone, we receive data from it based on your authorisation. Your use of those third-party platforms is governed by their own terms and privacy policies.

We may disclose information when required by law, regulation, or legal process, or when necessary to protect the rights, property, or safety of Cortix, our users, or others.

These are the service providers that process personal data for us:

7. International transfers

Some of our service providers may be located outside the European Economic Area, including in the United States. When we transfer personal data internationally, we rely on appropriate safeguards, including:

• Decisions of adequacy by the European Commission, such as the EU-US Data Privacy Framework where applicable
• The European Commission’s Standard Contractual Clauses
• Other lawful transfer mechanisms provided by GDPR

You can request further details about our transfer mechanisms and safeguards by contacting us.

8. Your rights

Subject to applicable law, you have the following rights in relation to your personal data:

• Access: request a copy of the personal data we hold about you
• Rectification: correct inaccurate or incomplete data
• Erasure: request deletion of your personal data (the “right to be forgotten”)
• Restriction: restrict our processing of your data in certain circumstances
• Objection: object to processing based on our legitimate interests, including objecting to any direct marketing at any time
• Portability: receive a machine-readable copy of your data, or request we transmit it to another provider
• Withdrawal of consent: where processing is based on consent, withdraw it at any time without affecting the lawfulness of processing before withdrawal
• Not to be subject to automated decision-making: as described in Section 4
• Complaint: lodge a complaint with your local data protection authority. In Norway, this is the Norwegian Data Protection Authority

To exercise any of these rights, email support@cortix.no. We respond within 30 days, or sooner when reasonably possible. Exercising these rights is free; we may charge a reasonable fee only for requests that are manifestly unfounded or excessive.

9. Cookies and similar technologies

We and our service providers use cookies and similar technologies to operate the Service, remember your preferences, and measure performance. Strictly necessary cookies, such as those required to keep you logged in, are set without your consent, as they are essential to the Service you have requested. Non-essential cookies, including those used for analytics, are set only if you provide consent through the cookie banner displayed on your first visit. You can change your preferences at any time.

10. Security

We apply appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. No online service can guarantee absolute security, but we work to maintain a level of protection appropriate to the risk.

11. Data breach notification

If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Norwegian Data Protection Authority without undue delay and, where legally required, inform affected users directly.

12. Children

The Service is not directed to individuals under 16 years of age, and we do not knowingly collect personal data from anyone younger. If you become aware that a child has provided us with personal data, please contact us and we will take appropriate action.

13. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the most recent change. If we make material changes, we will take reasonable steps to notify you, for example by email or an in-app notice. Continued use of the Service after changes take effect indicates your acceptance of the updated policy.

14. Data controller and contact

The data controller for personal data processed through the Service, and the point of contact for any privacy questions or requests, is:

Cortix AS (a private limited company registered in Norway)
Organisation number: 938 652 260
Camilla Colletts gate 6, 4020 Stavanger, Norway
Email: support@cortix.no

We aim to respond to privacy enquiries within 30 days.

15. Garmin Connect

If you connect Garmin Connect, this is how we handle the data Garmin sends us.

• What we receive: the sessions you record after connecting: the activity file (time, distance, speed and pace, power, heart rate, cadence, elevation and GPS route) and the name of the device that recorded it. We receive nothing recorded before you connect. In the other direction, we send your planned sessions to Garmin Connect so they reach your device.
• What we use it for: to coach you: to analyse your sessions, keep your training numbers (such as your FTP and threshold pace) up to date, and shape your plan and the coach’s messages.
• AI: our AI coach runs on a large language model from an external AI model provider in the United States. With the explicit consent you give when you connect, we send it the parts of your Garmin sessions it needs to coach you. The provider processes them only on our behalf and does not use them to train its models.
• Where it is stored, and who processes it: in our database, run by Neon, and in our application, hosted by Vercel. Beyond them, only the AI model provider, Sentry (error tracking, with personal data removed) and Expo (push notifications, which may be written in part from your sessions) process it. We do not sell Garmin data or share it with anyone else.
• How long we keep it, and how to withdraw: until you delete it or your account, as Section 5 describes. Delete Garmin data, under Garmin Connect in Settings, Integrations (in the app: Profile, Connections), withdraws your consent: it disconnects Garmin and deletes every session Garmin sent, and the coach no longer uses any of it. Disconnecting alone stops new sessions and keeps those already sent.