Phasic asks for information about your body and your training, including some that counts as health data. This policy explains exactly what is collected, why, who it is shared with, how long it is kept, and what you can require us to do with it.
The data controller is Phasic.
There is no statutory requirement for a Data Protection Officer at our size, so privacy questions go to the email address above.
Account data. Your email address, and an authentication record held by our hosting provider. We never see or store your password in readable form.
Health data. Body weight, height, age, sex at birth, dietary restrictions and food allergies, history of gastrointestinal symptoms and known triggers, and any weight entries you log over time.
Training and goal data. Your sport, weekly training volume, session durations and intensities, event dates, and fuelling preferences.
Technical data. Standard server logs kept by our hosting provider, including IP address and request metadata, used for security and debugging. We also count page views with Vercel Web Analytics, which uses no cookies and records only aggregate, anonymous statistics such as the page, referrer, country and device type.
Connected services. If you connect Strava, we receive your Strava name and the activities you record there (type, date, duration and average heart rate, from which we estimate intensity), plus the access tokens needed to sync them. We use them only to fill in your training sessions. You can revoke access at any time from Strava's settings, after which we can no longer sync.
If you complete the free quiz without creating an account, your answers are used to calculate the preview shown on screen and are not stored on our servers. They stay in your browser until you create an account or close the tab.
Your plans are produced by a large language model that receives your training and nutrition inputs. This is automated processing, but it does not produce legal or similarly significant effects: the output is a suggested nutrition plan, not a decision about you. A plan is a suggestion to be reviewed with a qualified professional, never a diagnosis or a prescription. You can edit, regenerate or ignore any plan.
We do not sell your data and we do not share it for advertising. We use the following processors, each only to run the service:
We may also disclose data where we are legally required to, or to establish or defend legal claims.
OpenAI, Resend and Vercel are US-based and some processing happens outside the European Economic Area. Those transfers rely on the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework. You can request a copy of the safeguards in place by writing to the address above.
Data is encrypted in transit and at rest by our hosting provider, access is restricted to the accounts that need it. No system is perfectly secure, and we will tell you and the supervisory authority without undue delay if a breach affects your data.
Under the GDPR you have the right to:
To exercise any of these, email phasic@pedronpg.xyz. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.
If you think we have mishandled your data, please tell us first so we can put it right. You also have the right to complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt, or to the authority in your own EU country of residence.
Phasic is not intended for anyone under 18 and we do not knowingly collect data from children. If you believe a minor has created an account, contact us and we will delete it.
We use only the cookies needed to keep you signed in. We do not use advertising or third-party tracking cookies. Full detail is in our Cookie Policy.
If we make a material change we will update the date at the top of this page and, where the change affects how we use your data, tell you by email before it takes effect.
Questions about this Privacy Policy? Email phasic@pedronpg.xyz.