Privacy Policy — EXE

1 — Introduction

This Privacy Policy (the "Policy") describes how EXE collects, uses, shares and protects your personal data when you use the Platform (www.exefit.app and the iOS/Android mobile applications).

It applies to the two distinct components of the service:

• Component 2 — Coach Marketplace: EXE acts as a technical intermediary between Coaches and Athletes. EXE is the controller for platform data and joint controller (GDPR Article 26) with Coaches for data shared within the coach–athlete relationship.
• Component 1 — EXE Premium (B2C with AI agent): EXE is the sole controller. The AI agent processes data concerning health (GDPR Article 9) and produces automated recommendations (Article 22). See the dedicated Section 5 below.

Any reference to "you" means the user of the Platform (Athlete or Coach, depending on the context).

Version: v1.1 — 6 September 2026.

2 — Controller and Contact Details

• Legal name: Younes Beaila, sole trader (entrepreneur individuel)
• Trading name: EXE
• SIRET: 951 233 576 00010
• Address: 50 boulevard Charles Stoessel, 68200 Mulhouse, France
• General contact: support@exefit.app
• Data protection contact point: dpo@exefit.app
• Supervisory authority: Commission nationale de l'informatique et des libertés (CNIL, the French data protection authority), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr

EXE has not appointed a data protection officer, as such an appointment is not required at this stage (GDPR Article 37); the contact point above serves that purpose.

3 — Summary Table of Processing Activities

4 — Data Concerning Health (GDPR Article 9)

EXE collects and processes data concerning health within the meaning of Article 4(15) and Recital 35 of the GDPR, mainly under Component 1 (EXE Premium / AI agent) but also occasionally under Component 2 (body measurements shared with a Coach, dietary restrictions, medical history):

• sleep (duration, subjective quality);
• subjective fatigue, stress level and RPE level;
• muscle soreness (DOMS), pain areas, location and intensity;
• body measurements (weight, waist circumference, body composition) and progress photos;
• metrics from Apple Health or Google Fit where you choose to connect them (sleep, heart rate variability, resting heart rate, steps, calories);
• exercise photos voluntarily submitted in the AI Agent chat;
• dietary restrictions, allergies, intolerances;
• medication, medical notes and history entered voluntarily (e.g. "my knee has hurt for 2 years").

4.1 — Legal Basis

The processing of this data is based on explicit, freely given, specific, informed and unambiguous consent within the meaning of Article 9(2)(a) of the GDPR, collected through a dedicated checkbox, separate from acceptance of the Terms of Use (CGU), when health data is first entered (the "measurements and injuries" step of onboarding, the health sheet in your personal space).

Activation of the AI Agent (Component 1) is additionally subject to a dedicated consent screen before first use, covering the processing of your data by Anthropic and the automated recommendations described in §5.4.

4.2 — Withdrawal of Consent

You may withdraw your consent at any time:

• from the mobile application (Profile › Preferences › AI Assistant) for the AI Agent;
• by email to dpo@exefit.app for any withdrawal.

Withdrawal:

• does not affect the lawfulness of processing carried out before withdrawal;
• results in the immediate deactivation of the dependent AI features (Component 1);
• results in the deletion of the health data concerned, unless a legal retention obligation applies.

4.3 — Minors

Health data of minors is not collected: the service is reserved for adults. No parental consent can override this contractual limitation.

4.4 — Register and Risk Assessment

EXE keeps a register of its processing activities and assesses the risks relating to health data; a formal data protection impact assessment (GDPR Article 35) will be carried out before any large-scale processing.

5 — Specific Processing: EXE AI Assistant (Component 1)

5.1 — Purposes

• Generation of personalised sessions, programmes and nutrition plans
• Analysis of fatigue and recovery
• Technical feedback on exercise photos voluntarily submitted in the chat
• Suggested adjustments (deload, volume, RPE, meal plan)
• Conversational communication (agent chat)

5.2 — Data Processed

• Identification data (name, email)
• Health data (see §4)
• Exercise photos voluntarily submitted in the chat
• Usage data (sessions completed, loads, RPE, performance)
• Dietary preferences, allergies
• Chat conversation history

5.3 — Legal Basis

Declining automated recommendations amounts to not activating the AI Agent; you may request human intervention at any time at support@exefit.app.

5.4 — Automated Decisions (GDPR Article 22)

The AI agent makes certain decisions in a fully automated manner:

• recommending an active recovery period ("deload");
• automatically adjusting the training volume of a session or a week;
• suggesting an RPE target or a target intensity;
• proposing a meal plan or a category of foods to favour.

Underlying logic: these decisions are produced from:

• the data you declare (sleep, fatigue, muscle soreness);
• your session history (loads, volume, RPE);
• your goals and constraints;
• training standards from the scientific literature, applied through Anthropic's AI models.

No profiling for advertising or price-differentiation purposes is carried out.

Your rights (GDPR Article 22(3)):

• the right to obtain human intervention from a member of the EXE team on any automated decision;
• the right to express your point of view;
• the right to contest the decision.

To exercise these rights, write to support@exefit.app. The decision is reviewed within 30 days (GDPR Article 12(3)).

5.5 — Processor: Anthropic PBC

To provide the service, EXE uses the artificial intelligence models of Anthropic PBC, established in the United States (548 Market Street, San Francisco, CA 94104), acting as a processor within the meaning of Article 28 of the GDPR. Models used as at the date of this Policy: Claude Sonnet 4.6 and Claude Haiku 4.5.

Anthropic acts as a processor under its commercial terms and its Data Processing Addendum, which exclude the use of customer data to train its models; the transfer to the United States is governed by the Standard Contractual Clauses (Decision 2021/914) incorporated into that DPA.

5.6 — Transfers Outside the European Union

Data processed by the AI models is transferred to the United States (Anthropic). The transfer is governed by the Standard Contractual Clauses adopted by the European Commission (Implementing Decision (EU) 2021/914, controller-to-processor modules), incorporated into Anthropic's Data Processing Addendum.

5.7 — Photos Submitted to the AI Agent

Photos that you voluntarily attach to a chat message are:

• processed exclusively for the purpose of providing you with technical feedback on the exercise;
• retained with the conversation to which they belong, and deleted together with your Account or upon simple request to dpo@exefit.app;
• accessible only to you and to the AI engine.

You warrant that you hold the rights to the images submitted and that no third party appears in them without their consent.

5.8 — AI Act Information

As at the date of this Policy, the EXE AI agent is classified as a limited-risk AI system within the meaning of Article 50 of Regulation (EU) 2024/1689 (the AI Act). A clear and persistent notice in the chat interface informs you that you are interacting with an artificial intelligence system. EXE acts as a deployer within the meaning of Article 3(4) of that Regulation.

6 — Processors and Partners

EXE uses the following processors within the meaning of Article 28 of the GDPR to provide the service. This list constitutes EXE's reference list of processors and is kept up to date in this section.

None of these hosting providers publishes a telephone number for the public; their contact details are available on their respective websites (vercel.com/contact, railway.com/contact, supabase.com/support, aws.amazon.com/contact-us).

Third-party services connected at your request. If you choose to connect Apple Health or Google Fit, data flows from those services to EXE only after you have granted authorisation in the service concerned; EXE retains the access tokens required for synchronisation and does not transmit any data to those services, other than writing your sessions to Apple Health / Google Fit when you enable that option. You may revoke access at any time from the settings of the service concerned or from your EXE profile. Other connected services may be offered; they will be added to this list before activation.

EXE notifies users in advance of any substantial change to this list.

7 — Retention Periods

Retention periods depend on the nature of the data and the purpose. Your Account may be deleted at any time, on a self-service basis, from the account settings (web) or the profile of the mobile application: deletion permanently erases your profile, your health and wellness data, your photos and your conversations. Only the data listed below as subject to a legal obligation is retained.

• Account identifiers and data: duration of the Account, deleted on closure;
• Health data, body measurements and wellness: duration of the Account, deleted on closure or upon request;
• Photos (progress photos, photos submitted to the AI Agent): duration of the Account, deleted on closure or upon request;
• Conversations with the AI Agent: duration of the Account; the oldest messages in a conversation are progressively summarised (compacted) for continuity of service; everything is deleted together with the Account;
• Payment data and invoices: 10 years (article L123-22 of the French Commercial Code + tax obligations), retained by Stripe and EXE;
• Consent log: 5 years (proof of consent, Article 2224 of the French Civil Code — five-year general limitation period);
• Login sessions: 30 days;
• Technical logs: limited period set by the hosting provider;
• DSA moderation data: 5 years;
• Cookies and audience-measurement identifiers: 12 months.

8 — Your Rights (GDPR Articles 12 to 22)

You have the following rights with regard to your personal data:

• Right of access (Art. 15): to obtain confirmation and a copy of your data;
• Right to rectification (Art. 16): to correct inaccurate data;
• Right to erasure ("right to be forgotten", Art. 17): subject to any legal retention obligation;
• Right to restriction of processing (Art. 18);
• Right to data portability (Art. 20): to retrieve your data in a readable format;
• Right to object (Art. 21): to processing based on legitimate interest (including audience measurement, see §9) or for direct marketing purposes;
• Right to withdraw consent (Art. 7(3)): at any time, without retroactive effect;
• Rights relating to automated decisions (Art. 22(3)): human intervention, expressing your point of view, contesting the decision;
• Right to lodge a complaint with the CNIL (Art. 77) or any competent supervisory authority.

Deletion of your Account is available on a self-service basis from the account settings (web) or the profile of the mobile application.

To exercise your other rights, write to dpo@exefit.app. The response time is one (1) month from the request, extendable by two (2) months in complex cases (Art. 12(3)). Proof of identity may be requested in case of reasonable doubt.

9 — Cookies, Trackers and Audience Measurement

On the web application, EXE sets the following cookies:

• Strictly necessary cookies: session cookie (30 days) and signed cache of session data (5 minutes), issued by our authentication system; sidebar display preference (7 days). They do not require consent (Article 82 of the French Data Protection Act, loi Informatique et Libertés).
• Audience measurement: EXE uses PostHog (PostHog Inc., data hosted in the European Union) to measure use of the Platform: page views and clicks on the web, screens viewed and key events on mobile, server-side business events. Session recording ("session replay") is disabled. No data is used for advertising purposes, sold or cross-referenced with other websites. The audience-measurement cookie is retained for 12 months.

Audience measurement is based on EXE's legitimate interest (GDPR Article 6(1)(f)). You may object at any time from the Cookie Policy page, which contains an opt-out button; your choice is stored in your browser.

10 — Security

EXE implements appropriate technical and organisational measures to ensure the security of your data (GDPR Article 32):

• TLS encryption in transit; encryption at rest provided by the hosting providers;
• application-level access controls per user and per role, restricted access to file storage;
• strong authentication (optional two-factor authentication);
• logging and monitoring;
• password hashing (scrypt algorithm);
• breach notification procedure (Articles 33–34) with a single point of contact for the CNIL.

In the event of a data breach likely to result in a risk to your rights and freedoms, EXE notifies the CNIL within 72 hours and informs you directly if the risk is high.

11 — Minors

The service is reserved for adults (aged 18 or over). Age is declared at registration and the registration flow rejects persons under 18. EXE does not knowingly collect data from minors; if a report is received, the account is immediately closed and the data deleted.

The French threshold of 15 years (Article 8 of the GDPR, implemented by Law No. 2018-493 of 20 June 2018 — Article 45 of the French Data Protection Act, loi Informatique et Libertés) does not apply here, as registration is contractually reserved for adults.

12 — Changes to the Policy

EXE may amend this Policy to reflect regulatory or functional developments. Any substantial change (new processing activity, new processor, change to retention periods) is notified by email and results in a new dated version at the top of the document. In the event of a material change to the bases for consent (Article 9 or Article 22), new explicit consent is required.

13 — Contact and Complaints

• For any GDPR question: dpo@exefit.app
• For customer service: support@exefit.app
• To lodge a complaint with the supervisory authority: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr/fr/plaintes