Privacy Policy

Last edited: 25 April 2026

This Privacy Policy explains how life:)on (hereinafter "we", "the Platform") collects, uses, stores, and protects users' personal data. It complies with the requirements of the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and the Law of Ukraine "On Protection of Personal Data".

1. Who we are

life:)on is a digital platform for athletes, coaches, event organisers and sports institutions. We are a personal data operator within the meaning of GDPR and an owner/controller in accordance with Ukrainian legislation.

The legal entity operator's details are provided upon request at the address privacy@life-on.com.ua They will be published on this page after the official registration is completed.

Contact for privacy and data subject rights inquiries: privacy@life-on.com.ua

2. Data we collect

We may collect the following categories of personal data:

2.1 Data you provide to us

Contact information: first name, surname, email address, telephone number
Profile data: photo, biography, specialisation (for coaches), qualifications and certificates (for coaches and specialists)
Account details: login, password (stored encrypted using modern hashing algorithms)
Payment information: card details are processed exclusively through secure payment systems in accordance with PCI DSS, we do not store full card details on our servers

2.2 Data collected automatically

Technical data: IP address (anonymised), browser type, operating system, application version, browser language
Usage data: pages you visited, session times, click sequences, in-app actions
Cookies and similar tracking technologies (more details in Section 5 and separate Cookie Policy)
Geolocation: approximate location (with your permission) to find trainers and events nearby

2.3 Data from third parties

Social logins: Google, Apple, Meta (Facebook) - if you chose this registration option. We only receive email, name and public avatar
Public information from social profiles is only that which you have expressly permitted to be shared during OAuth authorisation.

2.4 Health and biometric data (special category)

A platform of your choice can process data that, according to GDPR (Article 9) and the Law of Ukraine «On Personal Data Protection» (Article 7), belongs to special categories personal data

Anthropometric indicators: weight, height, body circumferences, body fat percentage
Physical activity data: type, duration and intensity of workouts, load
Health and fitness goals (weight loss, muscle gain, rehabilitation, etc.)
Biometric data from fitness gadgets (Garmin, Apple Watch, Polar, Fitbit and others): heart rate, heart rate variability, saturation, sleep quality, step count, calories burned
Dietary restrictions and food preferences that you voluntarily state
Health restrictions that you disclose to the trainer or enter into your profile

Legal basis: We process this data solely on the basis of your explicit consent (explicit consent— Article 9(2)(a) GDPR. You provide separate consent when setting up a profile or connecting an integration with a fitness gadget. Consent can be withdrawn at any time in the account settings, which will lead to the deletion of the relevant data within 30 days.

We do not use this data for:

Advertising and Marketing
Transmissions to advertising partners
Profiling with legal consequences for you
Transfers to insurance companies, employers, or other third parties

Health data is stored in encrypted form with restricted access only for technical staff on a principle «necessary to know». Access to health records is logged.

3. Purposes for which we use your data

Provision of Platform services: finding coaches, registering for events, maintaining a training diary
Personalisation: recommendations for coaches, events, and content based on your preferences and activity
Communication: launch announcements, service updates, event notifications
Security: account protection, fraud detection, and malicious activity
Analytics: Improving Platform Performance Based on Anonymised Metrics
Marketing: showing relevant advertisements (only with your explicit consent, without using health data)
Fulfilling legal obligations: tax, accounting, responding to official enquiries

4. Legal basis for processing (GDPR)

Consent (Art. 6(1)(a)) — for marketing communications, geolocation, analytical and advertising cookies, synchronisation with fitness gadgets
Specific consent (Art. 9(2)(a)) — for processing health and biometric data
Performance of the contract (Art. 6(1)(b)) — to provide the essential services of the Platform in accordance with the Terms of Use
Legitimate interest (Art. 6(1)(f)) — for service improvement, security, fraud detection, basic technical analytics
Legal obligation (Art. 6(1)(c)) — when required by law (tax, accounting, law enforcement requests)

5. Cookies and similar technologies

We use the following cookie categories:

Strictly Necessary (Essential) — for the operation of the site, authorisation, security. They do not require consent
Analytical — Google Analytics 4 (GA4), Microsoft Clarity. They help understand how the website is used. Consent is required.
Marketing — may include Google Ads, Meta Pixel, and other advertising platforms (connected selectively when launching relevant campaigns). Require consent
Functional — remembers your settings (language, theme, search preferences)

You can manage cookie settings through the consent banner on the website or your browser settings. A full list of cookies with their name, provider, duration, and purpose is provided below Cookie Policy.

6. To whom we transfer your data

We Not for sale your personal data. We transfer a limited volume of data to the following categories of recipients:

6.1 Technical and analytical service providers

Google LLC (USA) — Google Analytics 4, Google Sign-In, Google Maps
Microsoft Corporation (USA) — Microsoft Clarity (behaviour analytics with masked sensitive fields)
Anthropic PBC (USA) — Claude API for translation and content processing in a sports science newsletter digest
Apple Inc. (USA) — Sign in with Apple (if you chose this sign-in method)
Meta Platforms Inc. (USA/Ireland) — Facebook Login (if you selected this login method)

6.2 Infrastructure and Hosting

Backend services and the main website are hosted in Ukrainian data centres. A list of specific providers is available upon request at privacy@life-on.com.ua.

6.3 Payment systems and communications

Payment providers compliant with PCI DSS – for processing subscription and service payments
Transactional email and mass mailing services — for registration, payment, and important change notifications
Telegram FZ-LLC (UAE) — public channel @lifeon_digest for sports science reviews

6.4 Other recipients

Coaches and specialists — limited data (name, contact, selected training goals) required to organise training. Only after your explicit action (request, booking)
Event organisers — to process registrations (name, contact, if necessary – category/rank)
Government bodies — in cases provided for by law (requests from law enforcement, tax, or judicial authorities)
Advertising partners — Google Ads, Meta Ads (anonymised or hashed data only, with your consent)

With every external supplier that processes data on our behalf, we enter into a Data Processing Agreement (DPA).

7. International Data Transfers

Some of our service providers (Google, Microsoft, Anthropic, Apple, Meta, Telegram) are located outside the EU/EEA and Ukraine. In such cases, we ensure an appropriate level of protection through:

Standard Contractual Clauses of the European Commission
European Commission adequacy decisions (where applicable)
Supplier certifications under the EU-US Data Privacy Framework, ISO 27001, etc.
Additional technical measures: encryption in transit and at rest, pseudonymisation

8. Your Rights

8.1 GDPR Rights (EU/EEA Residents)

Right of Access
Right to Rectification
Right to Erasure ("Right to be Forgotten")
Right to Restriction of Processing
Right to data portability
Right to Object
The right to withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal
The right not to be subject to automated decision-making, including profiling, which produces legal effects concerning you (see section 10)
The right to lodge a complaint with your country's supervisory authority. Full list of European DPAs: edpb.europa.eu/about-edpb/about-edpb/members

8.2 Rights under CCPA/CPRA (California Residents)

Right to know what data is collected and how it is used
Right to delete personal data
Right to opt-out of the sale or sharing of personal data
Right to Non-Discrimination for exercising your rights
Right to Rectification
Right to Limit the Use of Sensitive Personal Information

8.3 Rights under Ukrainian Legislation

Right to know the sources of collection, location, and purpose of data processing
Right to receive information on the conditions for granting access to personal data
To submit a reasoned demand for the change or destruction of your personal data
Lodge complaints with the Verkhovna Rada Commissioner for Human Rights of Ukraine

To exercise your rights, send requests to: privacy@life-on.com.ua. We respond within 30 calendar days. In complex cases, this period may be extended by a further 60 days, with reasons provided.

9. Data Retention

We store personal data only for as long as is necessary to fulfil the purposes described in this Policy, or as required by law. Estimated retention periods:

Data category	Shelf life	Grounds
Account data (email, profile)	While the account is active + 3 years	Agreement, legal interest
Health and biometric data	While the account is active + 1 year (or until consent is withdrawn)	Special consent (Art. 9)
Payment documents	No less than 3 years (in accordance with tax legislation)	Legal obligation
Access and security logs	Up to 12 months	Legitimate interest (security)
Analytical cookies	Up to 26 months	Consent
Waiting list email	Before Platform launch or withdrawal of consent	Consent
Marketing communications	Until consent is withdrawn	Consent

After the storage period expires, the data is deleted or anonymised. If you wish to request deletion earlier, please contact privacy@life-on.com.ua.

10. Automated decision-making and profiling

The platform uses algorithms to personalise recommendations (trainer selection, relevant content, nearby events) based on your preferences, activity, and location. These algorithms not making decisions that have legal or significant negative consequences for you within the meaning of Article 22 GDPR.

You have the right to:

Get information about the logic behind personalisation
To express my point of view on algorithmic recommendations
Object to such processing and obtain recommendations without algorithmic personalisation

11. Data Security

We implement technical and organisational measures to protect your data:

Encryption in transit: TLS 1.2+ for all traffic
Encryption at rest: health data is stored encrypted
Password hashing with modern algorithms (bcrypt or equivalent)
Restricted access to data on a need-to-know basis«
Regular security checks and component updates
Two-factor authentication for administrative access
Logging of access to sensitive data

However, no data transmission system over the internet is absolutely secure. We cannot guarantee absolute security, but we do all that is reasonably possible to protect your data.

12. Security incident reporting

In the event of a personal data security breach that could create a high risk to your rights and freedoms, we will:

We will inform the supervisory authority within 72 hours of becoming aware of the incident (in accordance with Art. 33 GDPR)
We will inform you personally without undue delay by email or via a website notification if an incident concerns your data and poses a high risk
Let us describe the nature of the incident, the probable consequences, and the measures taken to mitigate the damage.

13. Children

Our Platform is not intended for individuals under 16 years of age. We do not knowingly collect children's data. If you believe a child has provided us with their data, please contact us at privacy@life-on.com.ua, we will promptly delete such data.

14. Amendments to this Policy

We may update this Policy. In the event of significant changes, we will notify you by email or through a site announcement at least 14 days before they come into effect. The date of the last revision is always indicated at the beginning of the document. Continued use of the Platform after updates signifies your acceptance of the new version of the Policy.

15. Contacts

For privacy-related inquiries, please contact:
Email: privacy@life-on.com.ua
Website: life-on.com.ua