Privacy Policy
Last updated: September 2026
1. Who We Are
Structur ("we", "us", "our") is a fitness coaching platform that enables coaches to create structured training plans and distribute them to athletes, and to sync activity and health data from connected sources such as Garmin (via SweatStack), COROS (via Stridee) and Apple Health.
The data controller for your personal data is STRUCTUR LTD.
- Trading name: Structur
- Legal name: STRUCTUR LTD
- Company number: 17444896
- Registered in: England and Wales
- Registered office: 1 Apple Tree Place, Kirkman Road, Loscoe, Heanor, DE75 7LH
- Jurisdiction: United Kingdom
- ICO registration: ZC242055
- Privacy contact: privacy@structur.fit
2. Who This Policy Applies To
This policy applies to all users of the Structur platform, including coaches and athletes. Structur is not intended for use by persons under the age of 18. By creating an account, you confirm that you are 18 years of age or older. If we become aware that a user is under 18, we will promptly delete their account and associated data.
3. What Data We Collect
We collect the following categories of personal data:
Account Data
Name, email address, and hashed password collected when you register. Club name and sporting discipline provided during onboarding.
Profile Data
Profile picture uploaded voluntarily.
Training Data
Workouts created by coaches, workout assignments, training schedules, and fitness activity and health-metric data (such as activities, resting heart rate, heart-rate variability, sleep, and body composition) synced from connected sources.
Health Data (special category)
Where a coach uses the Physical Activity Readiness Questionnaire (PAR-Q), we collect the health information you provide in it — including answers to health-screening questions and any injuries, medical conditions, medications and allergies you choose to disclose. This is "special category" personal data under UK GDPR Article 9, and we process it only on the basis of your explicit consent (Article 9(2)(a)), which you give when submitting the form and can withdraw at any time. See "Your Rights" below.
Device Connection Data
When you connect a device, we sync data on your behalf through an integration partner rather than connecting to the manufacturer ourselves. Which partner depends on the device:
- Garmin – through SweatStack. You authorise Structur by signing in to SweatStack, and we store the OAuth access and refresh tokens needed to sync. We never see or store your Garmin or SweatStack password.
- COROS – through Stridee (Zürich, Switzerland). You authorise on a screen Stridee host, then on COROS's own consent screen. Stridee hold the COROS tokens; we hold no credential of yours at all for this connection, only Stridee's identifier for you. Your activity files and daily wellness summaries are delivered to us encrypted.
- Apple Health – directly on your device. Nothing leaves your phone until you grant the categories, and Apple does not give apps a way to revoke that themselves.
Neither partner is given your Structur password, and neither is told anything about you beyond the identifier we use to match their deliveries to your account.
Apple Health Data (iOS app)
If you use the Structur iOS app and grant permission, the app reads workout and health-metric data from Apple Health (HealthKit) on your device and sends it to Structur to display your training. You control this permission on your device and can revoke it at any time in the iOS Settings app.
Communications Data
Messages sent between coaches and athletes within the platform.
Usage Data
We use PostHog to collect data about how users interact with the platform, including pages visited, session duration, and device type. PostHog processes and stores this data on servers in the European Union. On this website these analytics cookies load only after you accept them in our cookie consent banner.
Our iOS and Android apps send the same kind of usage data — which screens you open and which features you use. You can turn this off at any time in the app under Profile → Security → Share usage data. The apps set no advertising identifier and we do not track you across other companies' apps or websites.
We also record events on our own servers when you sign up, sign in, subscribe, cancel, or connect a device. These are records of your account activity rather than information read from your browser, and they are kept whichever analytics choice you make.
We never send health or fitness measurements — heart rate, heart-rate variability, sleep, weight, body composition or your training figures — to any analytics provider, on any platform.
Technical Data
IP address, browser type, and access logs collected automatically by our hosting infrastructure.
4. How We Use Your Data
| Purpose | Legal Basis (UK GDPR) |
|---|---|
| Creating and managing your account | Contract performance |
| Delivering workouts to athletes | Contract performance |
| Syncing workouts and activity/health metrics to and from connected sources | Contract performance / Consent |
| Health screening (PAR-Q) to assess readiness to train | Explicit consent (Art. 9(2)(a)) |
| Sending transactional emails (invites, notifications) | Contract performance / Legitimate interests |
| Coach-athlete messaging | Contract performance |
| Improving the platform via analytics | Consent |
| Complying with legal obligations | Legal obligation |
5. Third Parties We Share Data With
We do not sell your personal data. We share data only with the following third-party service providers, solely for the purpose of operating the platform:
- Vercel – Cloud hosting and infrastructure (EU/US)
- Neon – Serverless PostgreSQL database (EU)
- Stripe – Subscription billing and payment processing
- Resend – Transactional email delivery (EU)
- SweatStack – Wearable device data sync, including Garmin activity and health data, via OAuth
- Stridee (Zürich, Switzerland) – Wearable device data sync for COROS: activity files and daily wellness summaries, delivered encrypted. Processes within the European Economic Area under an Article 28 processing agreement.
- Anthropic – AI processing that powers certain in-app features (e.g. parsing and generating training content)
- PostHog – Product analytics, processed in the European Union, loaded only after you accept analytics cookies
All third-party providers are required to handle your data in accordance with applicable data protection law and are subject to appropriate data processing agreements.
6. International Data Transfers
Some of our third-party service providers may process data outside the UK. Where this occurs, we ensure appropriate safeguards are in place, such as UK International Data Transfer Agreements (IDTAs) or adequacy decisions, in accordance with UK GDPR Chapter V.
Named, because health data deserves the specifics rather than the category: Stridee, who carry your COROS data, are established in Switzerland and process within the European Economic Area. Switzerland and the EEA both hold UK adequacy decisions, so no additional transfer mechanism is required for that route.
7. Data Retention
We retain your personal data for as long as your account is active. When you delete your account (in-app or by request):
- Your personal data — including training, health and message data — is deleted, and any active subscription is cancelled.
- An anonymised audit record of the deletion (no health data) is retained for up to 30 days for legal-compliance purposes, after which it is removed.
- We delete the device-connection tokens we hold, and end the connection with our integration partner so no further data is delivered.
- We cannot revoke the authorisation on SweatStack's side — to fully remove Structur's access to your Garmin data, revoke Structur in your SweatStack account settings.
- For COROS, disconnecting ends Stridee's delivery to us immediately. The underlying authorisation at COROS is torn down once no other service is relying on it.
- For Apple Health, Apple provide no way for an app to revoke its own access. Disconnecting stops Structur using it; to revoke it fully, open Health → Sharing → Apps → Structur on your iPhone and turn the categories off.
- If you withdraw consent for a PAR-Q, the health information in it is deleted and the record is marked as withdrawn.
8. Your Rights Under UK GDPR
You have the following rights regarding your personal data:
- Right of access – request a copy of the data we hold about you
- Right to rectification – request correction of inaccurate data
- Right to erasure – request deletion of your data ("right to be forgotten")
- Right to restrict processing – request we limit how we use your data
- Right to data portability – receive your data in a structured, machine-readable format
- Right to object – object to processing based on legitimate interests
- Right to withdraw consent – where processing is based on consent, withdraw it at any time
Some of these you can exercise directly in the app:
- Erasure — delete your account from your profile settings; this removes your data as described in "Data Retention" above.
- Withdraw consent — for a PAR-Q, use the "withdraw consent" option on the questionnaire to delete the health information you provided. For analytics, change your choice in the cookie banner.
For any other right — including access to a copy of your data — contact us at privacy@structur.fit. We will respond within 30 days.
STRUCTUR LTD is registered with the Information Commissioner's Office under registration number ZC242055.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
9. Cookies
We use essential session cookies necessary for authentication and platform operation; these do not require consent under UK GDPR. We also use non-essential analytics cookies (PostHog), which load only after you accept them via our cookie consent banner — you can decline, and your choice is remembered. A dedicated cookie policy with the full list of cookies will be published alongside this policy.
10. Security
We implement appropriate technical and organisational measures to protect your personal data, including password hashing, encrypted data transmission (HTTPS), and access-controlled infrastructure. No system is entirely secure, and we cannot guarantee absolute security of data transmitted over the internet.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Where changes are material, we will notify you by email or via a notice within the platform. The "last updated" date at the top of this page will always reflect the most recent version.
12. Contact Us
For any questions, concerns, or data subject requests relating to this Privacy Policy, please contact:
STRUCTUR LTD (company number 17444896, registered in England and Wales)
Data Controller: STRUCTUR LTD
ICO registration: ZC242055
Email: privacy@structur.fit
Registered office: 1 Apple Tree Place, Kirkman Road, Loscoe, Heanor, DE75 7LH