Privacy Policy

Who is responsible for your data

The data controller is MB Clearstack Labs, a private limited company (mažoji bendrija) registered in Vilnius, Lithuania. You can reach us about anything in this policy at [email protected].

We have not appointed a statutory Data Protection Officer. Privacy questions go to the address above and are handled by the founder.

What we collect

Account data: your email address, a hashed form of your password, and your language preference.

Wearable and health data, once you connect a source: workouts and activities (type, start time, duration, distance, average and maximum heart rate, calories), daily metrics (resting heart rate, heart-rate variability, sleep duration and sleep score), and the model of the device that recorded them. If you connect Apple Health, the Bėga app reads this data on your iPhone with your permission and uploads it to Bėga. If you connect Garmin, you authorize Bėga in Garmin Connect and Garmin sends the data to Bėga directly. Bėga requests roughly 28 days of history when you first connect so the model is useful on day one.

Training inputs you provide: session effort ratings, manually logged strength sessions, and the feedback you give the coach when you accept, decline, or renegotiate a workout.

Feedback you send us: the comment you write, an optional screenshot you attach, and technical context (app version, device model, operating system, language, and the screen you were on) sent along with it so we can act on the report without writing back to you first. A screenshot may contain anything visible on your device at the time - be mindful of what you capture.

Coaching conversations: the messages you exchange with the AI coach, and the readiness context assembled for each reply.

Planned workouts Bėga generates and pushes back to your watch.

Technical data: IP address, browser or device user-agent, request timestamps, and server logs, collected automatically when you use the app or site.

Waitlist data: if you join the early-access list, your email address and chosen language, and nothing else.

Health data

Heart-rate variability, resting heart rate, sleep metrics, and the readiness scores derived from them are data concerning health under Article 9 of the GDPR.

We process this category of data only on the basis of your explicit consent, which you give when you connect a wearable, and only to produce your readiness signal and the coaching built on it. You can withdraw that consent at any time by disconnecting the wearable in the app, or for Garmin by removing Bėga from the connected apps in Garmin Connect; we then stop retrieving new data and delete or anonymise what we hold in line with the retention section below.

Why we process it, and our legal bases

To provide the service you asked for, reconciling your training load, producing readiness, coaching you, and writing workouts to your watch, on the basis of our contract with you (Article 6(1)(b)).

To process health data specifically, on the basis of your explicit consent (Article 9(2)(a)).

To keep the service secure, debug problems, prevent abuse, and improve the training model, on the basis of our legitimate interests in running a reliable product (Article 6(1)(f)); we use aggregated or de-identified data for model work wherever we can.

To contact you about early access, if you joined the waitlist, on the basis of your consent, which you can withdraw with one reply.

Who we share it with

We do not sell your personal data and we do not use it for advertising or profiling unrelated to coaching. We do not use your data for cross-app or cross-site tracking, and we do not share it with data brokers.

Data you receive from Garmin is used only to produce your own readiness signal, coaching, and training plan, and to send the workouts you accept back to your watch. Wherever Bėga shows it, we label it with Garmin and the device that recorded it.

Apple and Garmin are where your wearable data comes from, not processors acting for us. When you connect Garmin, Garmin also receives the planned workouts Bėga sends to your watch. Their own privacy policies cover what they do with your data.

We rely on a small number of processors who act on our instructions:

• A large-language-model provider generates the coach's replies. The messages you send the coach and the readiness context for each reply are transmitted to that provider's API. During the beta this is routed through OpenRouter to the model we have selected; the provider processes the text to return a response and does not use it to train its models under the API terms we rely on.
• Resend (Resend, Inc.) delivers transactional and waitlist email on our behalf - account verification, password resets, and product updates.
• Cloud hosting and infrastructure providers store and run the application and its database.

We may also disclose data where the law requires it, or to establish or defend legal claims.

International transfers

Some of the processors above are located outside the European Economic Area, including in the United States. Where data is transferred there, we rely on the European Commission's Standard Contractual Clauses or an applicable adequacy decision as the transfer mechanism.

How long we keep it

Account and training data are kept while your account is active. If you delete your account, we delete or irreversibly anonymise your personal data within 90 days, except where we must keep something longer to meet a legal obligation or resolve a dispute.

Server logs are kept for up to 12 months.

Feedback reports, including any screenshot, are kept for up to 12 months, or until your account is deleted, whichever comes first.

Waitlist emails are kept until the beta programme ends or you ask to be removed, whichever comes first.

Your rights

You can delete your account at any time from Settings in the app. If you no longer have the app installed, email [email protected] from your account's address and we will delete it for you - you do not need to reinstall the app or log in.

Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or provide it in a portable format. You can withdraw any consent you have given without affecting processing that already happened. Exercise any of these by emailing [email protected]; we respond within one month.

If you believe we have handled your data unlawfully you can complain to the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt), or to the supervisory authority where you live.

Automated decisions

Your readiness score and the workouts Bėga proposes are produced automatically. They are advisory: you can always override them, and none of them produces a legal or similarly significant effect on you within the meaning of Article 22 of the GDPR.

Children

Bėga is not intended for anyone under 16. We do not knowingly collect data from children; if you believe a child has used the service, contact us and we will delete the account.

Security

We encrypt data in transit, store passwords only in hashed form, and limit access to production data to people who need it. No system is perfectly secure, and during the beta you should not treat Bėga as a system of record for anything you cannot afford to lose.

Changes to this policy

We will post any changes on this page and update the date above. If a change materially affects how we use your data, we will tell you by email before it takes effect.

Kontaktai

MB Clearstack Labs, a private limited company registered in Vilnius, Lithuania, operating the Bėga app and bega.health.
[email protected]