1. Who We Are and Who This Notice Applies To
The controller responsible for the processing of personal data described in this notice is Exakt Running GmbH, Römerstraße 58A, 83435 Bad Reichenhall, Germany. We are registered with the Local Court of Traunstein under HRB 35543. If you have questions about data protection or wish to exercise your rights, you can contact us at info@exaktrunning.com or by post at the address above.
This notice explains how we process personal data when you use the Exakt mobile app, the website exakthealth.com, the associated account and subscription services, and our support services. Exakt Running offers general running, movement and fitness programmes to promote strength, mobility, endurance and well-being. Here, prevention means general physical fitness and does not refer to medical prevention, diagnosis, treatment or rehabilitation aimed at specific diseases or injuries.
This notice informs you about our data processing. It does not constitute a transfer of a contract or blanket consent. In particular, agreeing to a contract transfer or to our Terms and Conditions does not replace consent to optional analytics or advertising. We obtain such consent separately.
2. Change of Operator
Exakt Running GmbH is expected to take over the operation of Exakt from Exakt Health GmbH at the end of October 2026. The transfer notice and your available choices will be displayed directly in the app on the migration screen.
This notice applies to our processing from the time we become responsible for the relevant data. Publishing this notice in advance does not, by itself, transfer your account or your data.
If an account is lawfully transferred, we will receive from Exakt Health GmbH the necessary account and subscription data, as well as evidence of your decision regarding the transfer of the contract. We will not receive previous injury, pain, symptom or rehabilitation data, or other health-related history data. This also includes related plan selections, notes and identifiers insofar as they reveal such information. This history will therefore not be available to you under the new operator; we will not ask you to provide such information again for the new service.
The transfer notice and your available choices can be viewed directly in the app on the migration screen. It explains the account data concerned, the date of the change of operator, the services to be offered in future, how existing subscriptions will be handled, and your options to agree or decline. A technical transfer of the app does not replace any required contractual consent. The decision not to transfer previous health data applies regardless of whether you agree to the account transfer.
Where the processing of ordinary account and subscription data is necessary to perform a contract validly transferred to us or concluded with us, it is based on Article 6(1)(b) GDPR. We retain necessary evidence of contractual acceptance to document and enforce the contract on the basis of Article 6(1)(f) GDPR; our legitimate interest is to ensure that the contractual relationship can be traced. We process evidence of data protection consents and their withdrawal to meet our obligations to demonstrate compliance under Article 6(1)(c), in conjunction with Articles 5(2) and 7(1) GDPR. We do not obtain consent to transfer previous health data because such data will not be transferred.
Exakt Health GmbH remains responsible for data that is not transferred and for its other processing activities. This includes handling requests for access and erasure, as well as legally required retention. Not transferring data does not automatically mean that it will be deleted immediately by the previous operator. Its separate transfer notice explains access arrangements before the change, as well as deletion or retention.
3. What Information We Collect and Where It Comes From
Account information includes your email address, account identifier, login details or identifiers from a sign-in service, language settings, preferences and other profile details that you choose to provide. We receive this information from you or, if you select an available sign-in service, from that provider.
Training information includes the general fitness goals and programmes you select, completed exercises, duration, training frequency and progress. It is used to organise and display your training. We do not ask for diagnoses, injuries, pain, symptoms or rehabilitation history, and we do not use such information to adapt programmes. Training data linked to an account is personal data; internal identifiers do not make it anonymous.
Where the relevant feature is available and you activate it, recordings and connections may include the date and duration of a session, distance, pace, cadence, route or GPS data. Connection tokens and provider identifiers enable the requested synchronisation. The specific fields exchanged and the direction of the exchange will be explained before the connection is made. Health information is not imported merely because you connect a fitness platform; the restrictions in Section 5 also apply to such connections.
Subscription information includes the product, purchase and renewal dates, subscription status, transaction or receipt identifiers, and your entitlement to access paid features. We receive purchase confirmations from the relevant app store or payment service provider. Support information includes your messages, contact details, attachments and the steps taken to handle your request.
Technical information includes IP addresses, access times, browser or device type, operating system, app version, language, error reports and security events, as well as usage events and device or advertising identifiers where activated with the required consent. We also record consent decisions, withdrawals and objections, including the time and the version of the notice shown.
4. How We Use Your Information
We use account data to register and authenticate you, save your settings and provide the service you request. We use subscription data to verify purchases, restore access and manage entitlements to paid features. The legal basis is Article 6(1)(b) GDPR. The information needed for an account or paid service is necessary to provide that service; optional profile details are not required.
We use your general fitness goals, selected programmes and permitted training information to provide the training features you request, adapt programmes within the agreed scope and display progress. Where this is necessary to perform the contract, Article 6(1)(b) GDPR applies. We do not make diagnoses, create individual disease or injury risk profiles, or provide therapy recommendations based on pain or injury. Processing for additional voluntary purposes takes place only on the legal basis described for the relevant purpose.
We handle support requests relating to your contract on the basis of Article 6(1)(b) GDPR. We handle other correspondence under Article 6(1)(f) GDPR, based on our interest in responding to enquiries. Please do not send medical findings, diagnoses or other health information; our support team does not provide medical advice. We do not use health information sent to us unsolicited for training personalisation, analytics or advertising. We restrict access and promptly remove sensitive content that is not required. Where specific information is necessary to establish, exercise or defend legal claims, its restricted further processing is governed by Article 6(1)(f) and Article 9(2)(f) GDPR.
We use necessary access and security logs under Article 6(1)(f) GDPR to operate the service, investigate misuse and protect accounts. We balance our interests in security, availability and fraud prevention against your rights. We process records needed to meet tax, accounting or data protection obligations under Article 6(1)(c) GDPR, in particular in conjunction with applicable German commercial and tax law. Where necessary to establish, exercise or defend legal claims, we process ordinary data under Article 6(1)(f) GDPR; for health data, the requirements of Article 9(2)(f) GDPR must also be met.
Optional analytics, advertising measurement, newsletters and promotional notifications are explained below. A general statement about “improving our services” is not used as a blanket basis for every further use of your data.
5. Training Tracking and Connected Services
If you activate an available training-tracking feature, we use location or movement data for the function you requested, for example to display route, distance or pace. We request the necessary device permissions in the relevant context. Article 6(1)(b) GDPR applies to ordinary personal data necessary for the service; voluntary additional processing takes place on the basis of the consent obtained for it under Article 6(1)(a) GDPR. Access to your device is also subject to the requirements explained in Section 8.
Providers also process data under their own privacy notices. A device or provider permission alone does not authorise us to process health information that is excluded from our service.
You can revoke device permissions and disconnect services through the available settings in the app or with the provider. Disconnecting stops future synchronisation but does not automatically delete information that has already been imported. To request deletion of that information or withdraw your consent, use the relevant app settings or contact us. Connecting such a service is not required to maintain an Exakt account.
5.1 Artificial Intelligence
We do not share users’ personal data with external artificial intelligence providers or third-party AI services, or permit those services to process it. This includes data obtained through the Garmin Connect APIs.
Garmin-derived data is not submitted to external AI services for analysis, personalised recommendations, model training or any other purpose.
6. Purchases and RevenueCat
Apple and Google process purchases through their stores under their respective applicable terms and privacy notices. We receive the information we need to determine and maintain your entitlement to use the service.
We use RevenueCat to verify and manage subscription entitlements and to communicate with the stores. This involves processing app user identifiers, transaction and subscription information, and necessary technical information. These identifiers may be associated with an account and are personal data. The legal basis for processing necessary to provide the paid service is Article 6(1)(b) GDPR. Injury or rehabilitation information and corresponding subscriber attributes are not part of the permitted transfer scope.
RevenueCat’s role as our processor and the applicable safeguards must be covered by our data processing agreement. You can find its privacy notice at https://www.revenuecat.com/privacy/. We do not need full payment card details to verify an app store purchase.
Deleting an Exakt account does not automatically cancel a subscription billed through Apple or Google. Cancellation must be completed through the relevant store’s functions; our support team can help you find the appropriate method.
7. Hosting, Communications and Other Services
Authorised employees and service providers are given only the access they need for their assigned purposes. Processors act under data processing agreements in accordance with our documented instructions. Providers acting independently, including app stores and connected fitness platforms in relation to their own services, are responsible for their own processing activities.
Google Cloud and Firebase provide app hosting, databases, authentication and related infrastructure. Firebase Messaging and Apple Push Notification service support the delivery of notifications you have enabled. Processing necessary to provide the service is based on the legal basis applicable to the account or requested feature. Analytics and crash reports are separate uses explained in Section 8.
Vercel provides website hosting; Sanity and Contentful provide content for the website or app. When a page, image or video is accessed, technical request data such as an IP address may be transmitted to the content provider. We will continue to use SproutVideo and Wibbi/Physiotec to provide video and exercise content. Technical data and usage data may be processed when using these services to the extent necessary to provide the relevant content.
Health-related user profiles or rehabilitation data are not provided to these services for use by Exakt Running under the operating model described here.
Brevo supports email delivery and, where newsletter delivery has been enabled with the appropriate consent, newsletter distribution. Section 4 applies to necessary support and service messages; Section 9 applies to advertising.
We may disclose necessary information to professional advisers, authorities or courts where required by law or where necessary for the lawful establishment, exercise or defence of legal claims. The additional requirements set out in Section 4 apply to any health information exceptionally required in legal proceedings. After the transfer, the previous operator will not have unrestricted access to your account.
8. Cookies, Analytics and Diagnostics
Our website and app may store or access information on your device. This includes cookies, local storage and identifiers used by software development kits (SDKs). Where German law applies, we obtain consent under Section 25(1) TDDDG unless access is strictly necessary under Section 25(2) TDDDG for a service you have expressly requested or for the transmission of a message. Processing personal data also requires the legal basis under the GDPR described in this notice.
Optional usage analytics, advertising measurement and voluntary diagnostic reports remain disabled until you activate the relevant purpose. Declining them does not prevent you from using the basic account and subscription services. Necessary server security logs are handled separately from optional analytics.
If you enable usage analytics, Google Analytics on the website and Google Analytics for Firebase in the app may process usage events, device and app information, identifiers and an approximate location derived from the IP address. This helps us understand how features are used. The legal basis is Article 6(1)(a) GDPR. Identifiers linked to an account are pseudonymous and not necessarily anonymous.
If you enable voluntary crash reports, Firebase Crashlytics processes diagnostic information such as app and device versions, installation identifiers and technical crash logs under Article 6(1)(a) GDPR in order to investigate errors. Under the planned configuration, we limit the information included to what is necessary and exclude health information from diagnostic data.
You can change or withdraw your optional settings at https://www.exakthealth.com/en/cookie-policy and in the app under Settings > Legal. Any tracking permission required at device level also applies. An up-to-date list of cookies and SDKs, including providers, purposes and durations, is available at https://www.exakthealth.com/en/cookie-policy]. Withdrawal ends future collection that depends on consent; you may also request deletion of personal data already collected.
9. Email and Notifications
We send account, security, purchase and service messages where necessary to perform the contract, comply with legal obligations or protect the security of the service. These are distinct from advertising messages. Delivery of push notifications also depends on your device permissions and settings.
For newsletters and voluntary promotional messages, this draft provides for separate registration and consent under Article 6(1)(a) GDPR and the applicable rules on electronic advertising. We document registration and confirmation of consent. You can unsubscribe using the link in the message or by emailing info@exaktrunning.com. Necessary service messages will not be unsubscribed as a result.
A previous newsletter consent does not automatically apply to every advertising activity of the new company.
10. International Processing
Some providers or their authorised employees may process personal data outside the European Economic Area, particularly in the United States. Hosting data in the EU does not necessarily rule out access by support teams abroad or processing by other services.
Where a transfer is covered by an applicable European Commission adequacy decision, we may rely on it. Otherwise, we use a valid transfer mechanism, such as the European Commission’s Standard Contractual Clauses, assess the conditions in the recipient country and implement additional safeguards where necessary. Reliance on the EU–US Data Privacy Framework requires verification of the specific recipient’s current certification and whether it covers the relevant data.
You can request information or a copy of the applicable safeguards by emailing info@exaktrunning.com. We will protect confidential information belonging to third parties where necessary.
11. How Long We Keep Information
We retain information for the stated purpose and then delete or anonymise it, unless a specific legal obligation or legitimate legal claim requires restricted further retention. A user identifier used instead of a name is not anonymisation if the person can still be identified.
We retain account, programme and training information for as long as it is necessary for your account and the history you want to keep. When an account is closed or a valid erasure request is made, we remove data whose further processing is no longer necessary or permitted. We retain support records for handling requests and for a reasonable period to deal with follow-up questions or legal claims; sensitive information that is not required is removed beforehand. The applicable statutory retention periods under commercial and tax law apply to accounting records. We do not receive previous health and rehabilitation histories and do not retain them in anticipation of future purposes.
We retain records of consent, withdrawal and objection for as long as necessary to document compliance with your choices, meet legal obligations and address relevant legal claims. Security, analytics and diagnostic data are each subject to limited retention periods. Backups are replaced in controlled cycles. Deleted information is not restored from them for active use without implementing the deletion requirements again.
12. Your Rights and Choices
Subject to the conditions set out in the GDPR, you can request access to your data and a copy, have inaccurate information corrected, and request erasure or restriction of processing. You have a right to data portability under the statutory conditions where processing is automated and based on consent or a contract. You can withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
Where we rely on legitimate interests under Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests or the data is needed for legal claims. You may object at any time to processing for direct marketing, including related profiling; we will then stop processing for that purpose.
Contact us at info@exaktrunning.com or write to the address in Section 1. To verify your identity, we may request reasonable information, but no more than is necessary. We generally respond within one month. If a legally permitted extension is necessary due to the complexity or number of requests, we will inform you within that month and explain the reasons.
You may lodge a complaint with a competent data protection supervisory authority, particularly where you live or work or where the alleged infringement occurred. For a private company based in Bavaria, Germany, you can contact the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Postfach 1349, 91504 Ansbach, Germany. Contact and complaint information: https://www.lda.bayern.de/de/kontakt.html and https://www.lda.bayern.de/de/beschwerde.html.
13. Personalisation and Changes to This Notice
Programmes may be adapted based on general fitness goals, permitted training information and the settings you select. No adaptation is made based on diagnoses, pain or injuries, and no medical recommendations are derived.
We update this notice when our processing changes. The current version and effective date appear at the beginning. We will inform you of material changes in an appropriate manner. Where required, we will obtain new consent before carrying out changed processing. Continued use of Exakt does not constitute consent to new optional processing.