Privacy

Last updated: 9 November 2026

This page has two parts. Part A covers this website and is in force now. Part B covers the Recovery Trends app and applies from the day the app opens to users. The app is in development and not open yet: today the only health data it processes is my own, for testing.

Who is responsible

The controller of your personal data is Private Entrepreneur Anna Kohut (FOP), Lviv, 79039, Ukraine. Contact for anything on this page: privacy@anniekohut.com. More details are on the Contact page.

AI is your choice

Recovery Trends can use an AI model to help word the text of your report. This is off unless you switch it on.

• What the AI does. It turns facts that the service has already calculated into readable sentences. It does not calculate your numbers, and the service checks every number in the text against its own calculations.
• What it receives. Aggregated facts about the report period, such as averages, ranges, counts of nights and associations between measures. It does not receive your raw nightly records, your name, your email address or your Garmin account details.
• Who provides it. Anthropic, through its Claude API. Details are in Who receives data.
• Your consent. The app asks for this separately from your consent to the analysis itself. Nothing is sent to the AI provider before you agree.
• Without AI. You get the same report, with the same numbers and charts. The text then comes from the service itself, without AI.
• Changing your mind. You can switch AI off in the app settings at any time. It applies from your next report.

The AI is not used to make decisions about you, and your data is not used to train AI models.

Part A. This website

What the website collects

The public pages have no cookies, no analytics, no forms and no content loaded from other companies. Fonts and images come from this server.

• Server logs. When you open a page, the server records your IP address, the time, the page address and your browser's description (user agent). I use this to keep the site secure and working. Legal basis: legitimate interest (GDPR Art. 6(1)(f)). Logs are deleted after 14 days.
• Email. If you write to me, I receive your email address and whatever you include in the message. I use it to answer you. Legal basis: legitimate interest in answering, or a legal obligation when you make a data rights request. I keep correspondence for up to 5 years after the last message, unless the law requires longer.

Please don't send health information by email.

Links to other sites

The site links to LinkedIn and Instagram. Nothing is sent to them unless you follow the link. Their own privacy policies apply there.

Part B. Recovery Trends app

This part describes how the app will handle data once it opens. It will be updated before launch if the design changes.

What the app collects

• Data from Garmin Connect, after you authorise the connection on Garmin's own pages:
  • heart rate variability (HRV): nightly and weekly averages, baseline range and status;
  • sleep: duration, sleep stages, sleep score and wake-up time;
  • daily summaries: resting heart rate, Body Battery, average stress level and intensity minutes;
  • activities: start time, type, duration, distance, average heart rate and training load.
• Account data: the details needed to run your account, such as your email address, your report language and settings, and the identifier of your Garmin connection.
• Consent records: what you agreed to, which version of the text, and when you gave or withdrew consent.
• Technical logs: IP address, time and the request made, for security. Logs never contain health values.

The app never asks for your Garmin password. You connect through Garmin's own authorisation, and I never see your Garmin login details.

Why, and on what legal basis

• To build your recovery reports from the data above. This is health data, so it is processed only with your explicit consent (GDPR Art. 6(1)(a) and Art. 9(2)(a)), which the app asks for before any data is collected.
• To word the report with AI, only if you opt in. This is a separate explicit consent.
• To run your account and provide the service under the Terms (Art. 6(1)(b)).
• To keep the service secure and to be able to show that consent was given (Art. 6(1)(f) and Art. 7(1)).

Your data is used only for these purposes. It is not sold, not used for advertising, and not combined with data from other sources.

How long data is kept

• Health data is kept until you disconnect Garmin or delete your account, and never longer than 1 year and 1 month: each day's data is deleted once it is that old. Whichever comes first applies.
• After you disconnect, delete your account or withdraw consent to the analysis, your health data is deleted without undue delay and within 30 days at the latest.
• Account data is kept until you delete your account.
• Consent records are kept for as long as needed to show that consent was given.
• Technical logs are deleted after 14 days.

Who receives data

These companies process data on my behalf, under their data processing terms. No one else receives your data unless the law requires it.

Hostinger: server hosting and email

• Who: Hostinger International Ltd., 61 Lordou Vironos str., 6023 Larnaca, Cyprus. Data protection contact: gdpr@hostinger.com.
• Purpose and method: the website and the app run on a virtual server rented from Hostinger, in a data centre in Lithuania (EU). All data listed on this page is stored and processed there. Hostinger also hosts the mailbox for privacy@anniekohut.com and my other addresses at this domain.
• Data: website logs now; from launch, all app data; emails you send to my addresses at this domain.
• Where: the server is in Lithuania (EU). Hostinger does not state where mailboxes are stored. Its privacy policy says data may be processed in the UK, the Netherlands, Lithuania, Cyprus and, for some servers, outside the EU, under standard contractual clauses.
• Retention: as set out above. Hostinger deletes customer data within 30 days after the hosting contract ends.

Anthropic: AI wording of the report, only if you opt in

• Who: Anthropic, PBC, 548 Market St, PMB 90375, San Francisco, CA 94104, United States. Privacy contact: privacy@anthropic.com.
• Purpose and method: for each report, the service sends the aggregated facts to Anthropic's Claude API over an encrypted connection and receives the text back.
• Data: aggregated facts about the report period. No raw records, name, email address or Garmin account details.
• Retention: Anthropic states that it deletes API inputs and outputs within 30 days, except where it must keep them longer to enforce its usage policy or to comply with the law. Under its commercial terms, Anthropic may not train its models on this data.

Namecheap: domain registration and DNS

• Who: Namecheap, Inc., 4600 East Washington Street, Suite 300, Phoenix, AZ 85034, United States.
• Purpose and method: Namecheap registers the domain and answers the DNS lookups that point it to the server. It does not handle email or the content of your visits.
• Data: the domain registration. No app data.

Garmin

Garmin is where your data comes from, not a recipient: the app does not send your data or your reports to Garmin. Garmin handles the data in your Garmin account under its own privacy policy. Recovery Trends is an independent project and is not affiliated with or endorsed by Garmin.

Transfers outside the EU

• United States. If you opt in to AI, the aggregated facts go to Anthropic in the United States. Anthropic's data processing addendum includes the European Commission's standard contractual clauses for such transfers. Email sent to me is stored by Hostinger, which may process it outside the EU under standard contractual clauses.
• Ukraine. I am based in Ukraine and manage the server from there. App data itself is stored in the EU.

Security

Connections to the site and the app are encrypted. Stored health data is encrypted, and only I have access to the server. Reports are shown only to the account they belong to.

Automated decisions

The app calculates statistics and describes them. It does not make decisions that have legal or similarly significant effects on you, and it does not build a profile of you for anyone else.

Age

The app is for adults aged 18 or over.

Your rights

You can ask for access to your data, a copy of it, correction or deletion, and you can withdraw consent at any time. Withdrawing consent does not affect processing that happened before. How to do each of these is on the Data rights page.

You can also complain to a data protection authority: in the EU, the authority of the country where you live; in Ukraine, the Ukrainian Parliament Commissioner for Human Rights.

A representative in the EU (GDPR Art. 27) will be named here before the app opens to people in the EU.

Changes to this page

When this page changes, the date at the top changes. If a change affects how your health data is used, the app will tell you before it takes effect and ask for your consent again where consent is needed.

Recovery Trends is a wellness tool. It is not a medical device and does not provide medical advice, diagnosis or treatment.