Olexyn Systems

Coaching Platform Privacy Policy

Last updated:

Olexyn Systems LLC runs a platform for running and trail coaches. Coaches use it to plan their athletes' training, follow up on WhatsApp and collect their fees. This page explains what data the platform handles, who sees it, which providers take part and how to have it deleted.

It covers the coach's panel, the athlete portal, the assistant and the connections with Google, Garmin and Strava. A coach's public website, such as hernanogas.com, runs on the same platform. Its own privacy page is for the people who visit it; what the platform does with the data of athletes and of people who ask about training is explained here.

1. Who is responsible

  • Olexyn Systems LLC, a Wyoming company (United States), runs the platform. It is responsible for the platform itself: its security, its providers and the data that comes from Garmin.
  • Each coach is responsible for the data of their own athletes. The coach decides whom to train and what to ask. The platform handles that data on the coach's behalf and only to provide the service.
  • A coach never sees another coach's athletes.

2. What data the platform handles

Account and contact

Name, phone number, email address and country. The WhatsApp or Telegram number linked to the account. If the athlete signs in with Google, the name and email address Google shares. For coaches and their team: name, email address, role and a password, stored only as a hash that cannot be turned back into the password.

Training

The plan the coach writes. The sessions the athlete marks as done or not done, with effort and comments. Photos or screenshots the athlete sends, links to their activities or to their Strava profile, target races and strength loads. The strength classes and their recordings.

Health, only with a separate permission

Pain or discomfort flagged in a session, test results (VAM, heart rate and paces), the answers to the end-of-plan check and to the post-race form, and the alerts the athlete sends from the portal. Without the athlete's health permission the platform does not save them. Sharing them with a nutritionist, physiotherapist or doctor needs a second permission, also separate. The athlete can withdraw the health permission from the portal at any time; from then on nothing new about health is saved.

Messages are different. If an athlete tells the assistant that something hurts, that they got injured or that they feel unwell, the message stays in the conversation like any other, and the coach gets a priority notice to read it, with or without the health permission. The notice may carry a summary of up to 500 characters. That way the coach finds out in time.

Messages

The text, audio and images that an athlete or a prospect exchanges with the coach's WhatsApp number or with the assistant in the portal chat, and the replies.

Payments

Fees, amounts, due dates, the status of each payment, the payment method chosen and the receipts the athlete sends. Card details are entered on Mercado Pago or Stripe and never reach the platform. For online courses a coach sells: the buyer's name, email address, phone number and the amount paid.

Prospects

People who ask about training leave their name, phone number, email address and goal and, if they came from an ad, that campaign's tags.

Technical data

A session cookie that keeps the account signed in. When someone gives or withdraws a permission, the date, the version of the text they read and a code computed from their IP address (a hash), kept as proof. That code can be traced back to the address, so it is protected like the address itself. Error logs, deleted after 30 to 90 days. And the short-lived access logs of the hosting provider.

3. What the data is used for

  • To provide the service: show the plan, record sessions, answer messages, remind and collect fees, and alert the coach.
  • To bill coaches: the platform counts athletes, assistant usage and which athletes came from the platform's own ads, because part of what a coach pays depends on it.
  • To keep the platform working and safe: find errors and stop abuse.

The platform does not sell data, does not use it for advertising and does not build profiles of athletes for anyone.

4. The assistant and AI

Athletes' messages, on the coach's WhatsApp number or in the portal chat, are answered first by an assistant that uses Google Gemini. To answer, Gemini receives:

  • the athlete's name, the message and the latest messages of that conversation; if there is an audio or an image, that too, to transcribe or read it;
  • the athlete's plan and recent sessions, fee status and how to pay, target races, strength loads, the team's notices and events, and the links to their portal and spreadsheet;
  • their test results (VAM and maximum heart rate), if they were saved with the health permission.

The coach and their team can also ask the assistant about an athlete, on WhatsApp, on Telegram or in the panel. Gemini then receives what that person can see about the athlete: contact details, plan, all their conversations and pending tasks and, only for the roles that see health data, the end-of-plan and post-race answers and the open alerts.

Gemini never receives data from Garmin. The assistant does not replace the coach or a doctor, and the coach can take over any conversation.

5. Garmin

Connecting a Garmin account is optional. The connection is between the athlete and the platform, so Olexyn Systems LLC is responsible for the data that comes from Garmin.

What the athlete authorizes

Before connecting, the athlete reads in the portal what is sent to Garmin and accepts it. The date and the version of the text they read are saved. Then they sign in on Garmin's own page. Garmin shows the permissions the platform asks for, and the athlete can turn off any of them. The platform asks for two:

  • Send workouts to the athlete's Garmin Connect calendar.
  • Read the activities the athlete records.

It does not ask for daily health data such as sleep, stress, steps or women's health.

What the platform sends to Garmin

The workouts the coach plans: date, name, steps with their duration or distance, and the coach's notes for that session. If the athlete has test results, each step carries their own pace or heart-rate range, so the watch shows the athlete's zones. Garmin Connect adds the workouts to the calendar, and the watch gets them when it syncs. The platform does not send the athlete's name, phone number or any other health data. From then on Garmin handles the workouts under its own policy: Garmin Connect privacy.

What the platform receives from Garmin

The summary of each activity: date and start time, sport, the name the athlete gave it, duration, distance, elevation gain and the device model, plus Garmin's identifiers for the activity and for the athlete's account. Average and maximum heart rate are kept only if the athlete also gave the health permission. The platform uses this summary to match each activity with that day's session, so the athlete and the coach can compare what was planned with what was done. It does not download the activity file or the GPS route. To stay connected, it keeps the access keys Garmin gives it, encrypted, and the list of permissions the athlete gave.

Who sees it

The athlete, their coach and the team members the coach allows. Olexyn Systems staff, only to give technical support. Every screen that shows this data says it comes from Garmin and names the device when Garmin reports it.

What the platform does not do with Garmin data

  • It does not sell it or use it for advertising.
  • It does not send it to Gemini or any other AI.
  • It does not copy it to the coach's Google spreadsheet, does not share it with nutritionists, physiotherapists or doctors, and does not pass it to anyone else.

It is stored with the rest of the platform's data, in the Supabase database (São Paulo, Brazil), and in the encrypted backups on GitHub.

Disconnecting and deleting

  • The athlete can disconnect from the portal or from the connected apps of their Garmin Connect account. The platform then asks Garmin to stop sending data and stops receiving it at once. If the athlete disconnects from the portal, the platform also removes from the Garmin calendar the upcoming workouts it had sent. Everything else on that calendar stays until the athlete deletes it in Garmin Connect.
  • On a disconnection, the platform deletes at once everything that came from Garmin: the connection and its access keys, the activities and the record of workouts sent. After a deletion request or the athlete leaving their coach on the platform, it does the same within 5 business days. Only a technical log stays (connections, permissions, dates and errors; never activity data, health data or keys), which keeps the latest 300 entries per coach. Whatever is left in the encrypted backups disappears when they expire, within 90 days at most.
  • The athlete's own record stays: whether the session was done, and their comment. It belongs to the athlete, not to Garmin.
  • To get a copy of the data that came from Garmin, write to hello@olexynsystems.com. We send it within 10 calendar days.

6. Who sees the data

  • The athlete sees their own plan, sessions, payments and messages in the portal.
  • The coach sees their athletes. Each member of the coach's team sees only what their role allows: for example, trainers and administrative staff do not see health data.
  • Olexyn Systems staff access data only to give support, fix errors or meet a legal obligation.
  • A specialist, such as a nutritionist, gets health data only with the athlete's separate permission.

7. Providers

The platform uses these providers. Each one handles data only for its task.

  • Supabase: the database and the private files, in São Paulo, Brazil.
  • Vercel: runs the panel, the portal and the assistant, in its São Paulo region.
  • Meta (WhatsApp Business): sends and receives the WhatsApp messages.
  • Google: Gemini for the assistant (never with Garmin data); Google Sheets and Drive when the coach keeps plans in a spreadsheet; and sign-in with Google.
  • Resend: emails, such as sign-in links and notices.
  • Mercado Pago: payments in Argentine pesos, from athletes to their coach, from buyers of a coach's online courses and from coaches to the platform.
  • Stripe: payments in US dollars, from coaches to the platform and from buyers of online courses.
  • Telegram: only when a coach or an athlete uses it as a channel.
  • Strava: connecting a Strava account is turned off; today the platform only keeps the links the athlete pastes. Before it is turned on, this page will say what it keeps and for how long.
  • Garmin: only if the athlete connects it (see section 5).
  • YouTube: the strength class videos shown in the portal.
  • GitHub: stores the encrypted backups.

Several of these providers are in the United States, so data may be processed outside the athlete's country. Each one handles it under its own terms.

8. How long data is kept

  • Account, training, messages and payments: while the coach uses the platform, unless deletion is requested earlier. A coach can download a spreadsheet with their athletes, plans, sessions, payments, inquiries and conversations at any time; we send the rest, including health data, on request. Payment records may be kept longer when a law requires it.
  • Data from Garmin: see section 5.
  • Error logs: 30 to 90 days.
  • Encrypted backups: 90 days at most. The old copy of the database that stayed in Singapore after the move to São Paulo was deleted on November 8, 2026.

9. Your rights

Athletes can see, correct or delete their data, and withdraw any permission. The fastest way is to ask the coach. You can also write to hello@olexynsystems.com: we pass the request to the coach and resolve it together within the deadlines of Argentina's Personal Data Protection Law (Law 25,326): 10 calendar days to give access, and 5 business days to correct or delete. Deletions are done by the platform's team. The record of each permission given or withdrawn (who, when and which text) is kept as proof, even after a deletion.

In Argentina, the authority is the Agency for Access to Public Information (AAIP). If you live in another country, you also have the rights your local law gives you.

10. Security

Connections are encrypted (HTTPS). Passwords are stored only as hashes. Links to the portal are personal and expire. Each team member sees only what their role allows, and backups are stored encrypted.

11. Minors

The platform is meant for adults. A coach who wants to add someone under 18 must first have the consent of their parent or guardian.

12. Changes and contact

If this policy changes, we will update this page and the date at the top.

Olexyn Systems LLC, Wyoming, United States. hello@olexynsystems.com