Privacy Policy

1. Who is responsible for your data

Revio is used by sports clubs and organisations to support athlete training, monitoring and wellbeing. This means responsibility for your data is split:

• Your club or organisation is the data controller for training, performance and health information recorded about you as part of your participation with them. They decide what is collected, who on their staff can see it, and how long they keep it.
• Revio Health AS (“Revio”, “we”) acts as a data processor on the club’s behalf for that information, processing it under a written data processing agreement and only on the club’s instructions.
• Revio is the data controller for a narrow set of data we need to run the service itself: your account credentials, app diagnostics, and support correspondence.

If you want your training or health data corrected or erased, the fastest route is usually your club. You can also contact us at the address in section 16 and we will coordinate with them.

Controller details: Revio Health AS, Thorvald Meyers gate 7, 0555 Oslo, Norway. Norwegian company registration number 937 028 628.

2. What data we collect

Account and profile

• Email address and authentication credentials
• Name, preferred name, and profile photo
• Date of birth, sex, nationality, language
• Phone number and postal address, where you provide them
• Your role and team membership within your organisation

Health and wellbeing data

• Wellness and readiness questionnaire answers you submit (for example sleep quality, soreness, mood, perceived availability)
• Records of physical discomfort or movement limitation, recorded by you or your club’s staff
• Documents you upload to your Health Vault, including medical documents, blood test results and urine test results
• Body composition measurements, including InBody scan results, which reach Revio as a report uploaded by you or your club’s staff
• Height, weight and other body metrics
• Sleep data, where your club uses a sleep monitoring integration

Training and performance data

• GPS and movement data from wearable tracking units used by your club (for example distance, speed, acceleration, training load)
• Session ratings of perceived exertion, workout records and attendance
• Physical test results, such as sprint, strength and jump testing
• Training and nutrition plans assigned to you, and what you record against them, including logged meals
• Goals set by you or your coaches
• Calendar events, sessions and matches relating to you
• Notes recorded about your training day by your club’s staff

Data from your device

• Apple Health data, only if you explicitly grant permission (see section 4)
• Data from connected wearables you choose to link
• Push notification tokens, so we can deliver notifications
• Technical diagnostics such as app version, device model, operating system version and crash information

Content you send to Revio’s AI features

• The messages you send to the in-app assistant, and the responses generated

3. Special category (health) data

Much of the data above is health data, which EU and Norwegian data protection law treats as a special category requiring stronger protection. We only process it where one of the following applies:

• Your explicit consent, which you give when you connect a health data source or upload documents to your Health Vault, and which you can withdraw at any time
• Your club’s lawful basis under its agreement with you, for example occupational health and athlete welfare obligations for professional players
• Your vital interests, in the rare case that a medical emergency requires it

4. Apple Health

If you choose to connect Apple Health, Revio reads activity, heart rate, sleep and workout data to show your training and activity information alongside the rest of your record, and can write workout summaries back so your activity rings stay accurate.

• Apple Health data is only read after you grant permission in the iOS permission dialog, and you can revoke it at any time in iOS Settings → Privacy & Security → Health
• We never use Apple Health data for advertising, marketing or data mining
• We never sell Apple Health data or disclose it to data brokers, and we do not share it with third parties without your permission
• Apple Health data is not stored in iCloud
• Apple Health data is only visible to you and to the club staff your organisation has authorised

5. How we use your data

• To provide your account and authenticate you
• To show you and your authorised club staff your training, activity and recorded health information
• To calculate training load and performance metrics
• To generate training and nutrition suggestions, including via AI features
• To send notifications about sessions, events and requests that concern you
• To keep the service secure, diagnose faults, and prevent abuse
• To meet our legal obligations

We do not use your data for advertising, and we do not sell it.

6. AI features

Revio includes an AI assistant and AI-assisted plan generation. When you use these features:

• Your message, and the relevant subset of your training and health data needed to answer it, are sent to our AI provider for processing
• Prompts and responses are logged so we can monitor quality, debug failures and improve the service
• Your data is not used to train third-party foundation models
• AI output is generated automatically and may be incomplete or wrong. It describes recorded activity and performance data; it is not medical advice and must not be relied on as a diagnosis or treatment decision — see section 12 and our Medical Disclaimer

7. Who we share data with

Your data goes to three places, and it is worth being precise about which is which. An athlete’s data is visible to their club’s coaching and support staff who your organisation has authorised — that is the purpose of the platform. Beyond your club, we use a small number of service providers to run Revio. And some of the data in your record was not collected by Revio at all: it was read from equipment your club already owns.

Providers we engage

These process data on our behalf, under our own contracts, for the purposes below and nothing else. In data protection terms they are our sub-processors, and this table is the current list:

Every provider in this table is engaged under a written agreement requiring it to protect your data to the same standard this policy sets out — processing it only on our instructions, only for the purpose named, under confidentiality, and with appropriate security measures. None of them is permitted to use your data for their own purposes, to sell it, or to use it for advertising.

Systems your club connects

Clubs run their own testing and tracking equipment, and Revio reads from it so the results appear in your record rather than in a separate system. Your club holds the account and the contract with each of these; Revio signs in using credentials your club supplies and reads the data your club has already collected about you.

Data flows one way, into Revio. We do not send your data to these systems. Because your club is the account holder, the questions of what it records there and how long it keeps it are your club’s to answer, and its own agreement with that supplier governs them — ask your club, or see section 1.

We may also disclose data where legally required, or to establish or defend legal claims.

8. International transfers

Revio is hosted in the European Union. Some of the providers we engage process data outside the EEA, including in the United States. Where that happens we rely on the European Commission’s Standard Contractual Clauses, together with the EU–US Data Privacy Framework where the provider is certified, and we apply additional technical measures such as encryption in transit and data minimisation.

For the systems your club connects, the transfer arrangements are part of your club’s own agreement with that supplier rather than ours. What Revio reads from them is stored in the European Union like the rest of your record.

9. How long we keep data

• Account data — for as long as your account is active
• Training and performance data — for the period your club sets in its own retention policy, as the controller of that data
• Health Vault documents — until you delete them, or until your account is deleted
• AI conversation logs — no longer than 12 months
• Diagnostics and security logs — no longer than 12 months

10. Deleting your account

You can delete your account yourself, at any time, in the app: Settings → Profile → Delete account. You confirm by typing your account email. Deletion cannot be undone, and your access is revoked immediately.

When you delete your account we permanently delete:

• Your sign-in credentials, so you can no longer log in
• Your name, contact details, date of birth, photo and address
• Your Health Vault documents and the underlying files, along with blood test, urine test and body composition results
• Your records of physical discomfort or movement limitation
• Your wellness and readiness questionnaire answers
• Your sleep data
• Your connected devices and integrations, including any Apple Health connection
• Your notifications, push subscriptions and app settings

Your club retains, with your name and identifying details removed, the training and performance record it collected during your time with them:

• GPS and training-load data from club sessions
• Physical test results
• Session ratings of perceived exertion, workout records and attendance
• Training and nutrition plans you were assigned, and what you recorded against them, including logged meals
• Goals and calendar entries
• Notes your club’s staff recorded about your training days

It keeps these because it is the controller of that data and has its own legitimate and contractual reasons to do so — deleting them would rewrite historical squad averages and match reports. Once your account is deleted, these records can no longer be linked back to you by anyone using the platform.

If your account owns shared team content that other people depend on — such as squads you manage, or sessions, plans or goals you created for other players — the app will tell you exactly what needs to be transferred to a colleague before deletion can proceed.

You can also ask us to delete your account by email; see section 16, and the Support page for written instructions.

11. Your rights

Subject to the controller/processor split in section 1, you have the right to:

• Access the personal data held about you
• Correct inaccurate data
• Delete your data (see section 10)
• Restrict or object to certain processing
• Receive your data in a portable format
• Withdraw consent you have given, such as an Apple Health connection
• Lodge a complaint with your data protection authority. In Norway this is Datatilsynet; elsewhere in the EEA it is your national supervisory authority

We respond to requests within one month. Requests concerning club-controlled training data may be forwarded to your club, and we will tell you when that happens.

12. Not a medical device

Revio is a training and performance support tool for athletes and their support staff. It is not a medical device, and it does not diagnose, treat, cure or prevent any disease, condition or injury. Training scores, activity summaries, AI-generated plans and every other output are informational only, describe recorded activity and performance data, and must not replace assessment by a qualified healthcare professional. Always seek medical advice for health concerns, and never disregard such advice because of something shown in Revio. See our full Medical Disclaimer.

13. Age

Revio accounts are for users aged 16 and over. Clubs must not create Revio accounts for players under 16.

14. Security

• All data is encrypted in transit using TLS, and encrypted at rest
• Access is authenticated and role-based: club staff only see athletes they are authorised for
• Health Vault files are stored in access-controlled object storage and served through short-lived signed links
• Access to production systems is restricted and logged

No system is perfectly secure. If we become aware of a breach affecting your data we will notify the relevant supervisory authority within 72 hours, and notify you and your club where the law requires it.

15. Changes to this policy

We will update this policy when our processing changes, and revise the version and date at the top. For material changes we will notify you in the app or by email before they take effect.

16. Contact

For privacy questions or to exercise your rights:

• Email: operations@reviohealth.com
• Telephone: +47 414 02 740
• Postal: Revio Health AS, Thorvald Meyers gate 7, 0555 Oslo, Norway
• Data protection officer: not appointed