Last updated: 12 October 2026. This notice covers the Athlete OS website and dashboard, and the Box Athlete iPhone app.
Box Nutrition & Performance Ltd ("Box", "we") runs Athlete OS. We are the controller of the personal data described here. Contact: info@boxnutrition.co.uk.
We do not sell your data, use it for advertising, or share it with other coaches or companies.
Apple Health data is used only to show your training and recovery on your own dashboard and to work out your zones and training load. It is shown to you and nobody else. It is never used for advertising or marketing, never sold, never given to data brokers, and never used to train AI.
AI transparency statement. Athlete OS never sends your recorded training, Apple Health data, Garmin data, Strava data or other wearable data to any AI service, and none of it is ever used to train, test or improve any AI model. The verdicts on your sessions, your weekly load, your gap and your readiness call all come from fixed rules, not AI. The only AI feature is Ask your coach, described below, which you choose to use and which sees only the summary described there.
Ask your coach (in your dashboard) answers your questions using Anthropic's Claude. Only when you ask a question, we send Anthropic your question, the last few messages of that conversation, and a summary from your dashboard: your test results, zones, goal race, training plan and the notes you have written. Never your recorded sessions or health data. Anthropic processes it to write the answer, acting for us, and under its commercial terms does not use it to train its models. We don't store your questions or the answers; we keep only a count of how many you've asked, for the daily limit.
The "Copy my numbers" and prompt features give you the same summary to paste into your own AI assistant if you prefer. What you paste there is between you and that provider, under their terms.
Box staff: Jack Braniff, as owner, can see accounts to provide support and add your Box test results. If you're a founding member, he also looks at your test results, goal race and the training synced from intervals.icu to do your one-off zone review, and writes the review into your dashboard. He never sees your Apple Health data. Box's social media assistant has no access to accounts, health data or payments.
Coached athletes: if Jack coaches you, you can switch on "Share my training with my coach" in the Box Athlete app or in your dashboard's settings. While it's on, your coach (Jack) sees your synced runs, including Apple Health workouts and heart rate, to write your plan and your weekly reviews. Switch it off at any time in the same place; after that he sees only your test results, zones and session verdicts. Strava data is never shared with your coach.
Railway (hosting), Neon (database, hosted in London), Anthropic (answers to Ask your coach, in the US), Stripe (payments, if you pay) and GoHighLevel (our email system: your email address, whether you opted in to emails, and simple labels such as "connected a watch", "used the pace calculator" or the name and date of your goal race; never your test results or training data. Only if you switch on session emails on your Today page: the name of each new session and its one-line verdict, such as "VO₂ intervals synced: half the hard work landed", so the email can be sent. For sessions from Apple Health the email says only that a session synced). They act on our instructions. intervals.icu, Oura and WHOOP are used only if you choose to connect them, under their own terms. Apple Health data stays on your phone until the app sends it to your dashboard; Apple does not receive it from us. [Confirm the Railway hosting region and add it here.]
Until you delete your account. You can delete your account and all your results at any time from inside your dashboard or the Box Athlete app. Disconnecting a source (Garmin, Strava, intervals.icu, Oura, WHOOP, or the app's "Disconnect and delete my Apple data") deletes everything we stored from it straight away. Training copies cover roughly the last 120 days for connected services and 400 days from the app. Payment records are kept by Stripe as the law requires.
You can access, correct, export or delete your data, object to how we use it, and withdraw your consent. Downloading and deleting are built into the dashboard. For anything else, email us. You can also complain to the Information Commissioner's Office at ico.org.uk.
We use one essential cookie to keep you signed in. The app uses the same kind of sign-in token, stored in your iPhone's keychain. We do not use advertising or analytics cookies. On the public pages we count visits, how far down the page people get, button and link clicks, which questions get opened, rough time on the page, and the channel people arrived from (such as Instagram). These are totals per day, with no cookies and no identifier, so they can't be linked to you.
Connections are encrypted, passwords are hashed with scrypt, and sessions can be ended at any time by logging out. No system is perfectly secure, and we will tell you promptly if a breach affects you.