Privacy Policy

1. Who we are (Responsible Party)

For the purposes of POPIA, CORE3 is the "responsible party" that determines how and why your personal information is processed.

• Operator: CORE3 Technologies (Pty) Ltd, registration number 2026/509830/07, a private company incorporated in the Republic of South Africa, trading as CORE3.
• Registered address: 5 Kite Close, Kenrock Country Estate, Valley Road, Hout Bay, Western Cape, 7806, South Africa
• Information Officer: Keegan Kelly
• Email: info@coreiii.com

2. Information we collect

• Account details: name, email address and a securely hashed password.
• Profile and athlete data: date of birth or age, sex, height, weight, training history, performance benchmarks (such as FTP, threshold pace or heart-rate zones), goals and preferences.
• Nutrition data: meals, foods, macronutrient and calorie targets, and related logs.
• Communications: messages you send to support, feedback, and chats with the in-app AI coach.

If you choose to connect a third-party platform (Garmin, Wahoo, Hammerhead, Zwift and Ōura), we receive data from that platform via its API once you authorise the connection. This may include workouts and activities, GPS routes, power, pace, heart rate, cadence, sleep, recovery and other health and fitness metrics. We only request the data needed to operate the Service, and you can disconnect a provider at any time.

• Device and technical data: device type, operating system, app version, browser, language and approximate region.
• Usage data: features used, pages viewed, and interactions, collected through analytics tools (see our Cookie Policy).
• Location: with your permission, your device location is used to provide local weather and conditions for outdoor sessions. You can decline or revoke this in your device settings.
• Cookies and similar technologies on the website (see the Cookie Policy for detail).

3. How we use your information and our lawful basis

We process your personal information for the following purposes, relying on the POPIA justifications shown in brackets:

• To create and manage your account and provide the Service (performance of our contract with you).
• To generate adaptive training plans, nutrition targets and recovery guidance using your data, including AI-assisted analysis (your consent and performance of our contract).
• To sync and display data from connected services you authorise (your consent).
• To process health and fitness "special personal information" for coaching insights (your explicit consent under sections 26–27 of POPIA).
• To communicate with you about the Service, including service notices and, where permitted, product updates (legitimate interest / your consent).
• To send direct marketing where you have opted in, and to measure and improve our marketing (your consent).
• To understand and improve the Service, troubleshoot, and keep it secure (legitimate interest).
• To comply with legal obligations and to establish, exercise or defend legal claims (legal obligation / legitimate interest).

4. AI-assisted coaching

CORE3 uses automated analysis and third-party large-language-model providers to turn your training, nutrition and recovery data into plans, insights and answers from the in-app coach. Where data is sent to an AI provider to generate a response for you, it is processed under contract and is not used by that provider to train its general models without an appropriate basis.

AI-generated guidance is informational and is not medical, dietary or professional advice. See the Terms & Conditions for the health and safety disclaimer.

5. Who we share information with (Operators)

We do not sell your personal information. We share it only with service providers ("operators") who process it on our behalf under written agreements, and with others as described below:

• Hosting and infrastructure providers that run our applications, databases and APIs.
• AI / large-language-model providers used to generate coaching insights and chat responses.
• Connected fitness and health platforms you authorise (Garmin, Wahoo, Hammerhead, Zwift and Ōura), to enable data sync.
• Analytics and marketing providers, including Google services such as Google Analytics, Google Ads and Google Search Console, to measure usage, understand reach and run and measure advertising. See the Cookie Policy for the cookies these set and how to control them.
• Email and communications providers used to send account and support messages.
• Professional advisers, and authorities or acquirers, where required by law, to protect our rights, or in connection with a merger, sale or reorganisation.

6. Garmin Connect data

This section describes specifically how CORE3 collects, uses, processes, stores and shares data obtained from Garmin Connect through the Garmin Connect Developer Program APIs. It applies in addition to the rest of this policy, and applies only if you choose to connect a Garmin Connect account.

We receive Garmin data only after you connect your Garmin Connect account to CORE3 and grant permission on Garmin's own consent screen. We never ask for, receive or store your Garmin Connect username or password. Garmin issues us an access token bound to your consent, and Garmin then delivers your data to our servers automatically as push notifications when new data becomes available. If you ask us to import your existing history, Garmin delivers that history the same way. We request only the permissions the Service needs.

• Garmin Activity API — activity summaries and detailed activity data: sport type, start time, duration, distance, GPS route, elevation, speed and pace, power, heart rate, cadence, calories and other metrics recorded by your device.
• Garmin Health API — daily wellness summaries: steps, resting and daily heart rate, sleep stages and duration, stress, Body Battery, respiration, pulse ox, heart-rate variability, training readiness and related recovery metrics.
• Garmin Training API — the identifiers Garmin returns for structured workouts that you ask us to send to your Garmin Connect calendar, so that we can later update or remove them.
• Your Garmin user identifier and the set of permissions you granted, used solely to match incoming Garmin data to your CORE3 account and to stop processing when you revoke a permission.

• To display your activities, health and recovery metrics back to you in the Service, attributed to Garmin as their source.
• To calculate your training load, fitness and fatigue trends, zones and performance benchmarks.
• To generate adaptive training plans, nutrition targets and recovery guidance, including AI-assisted analysis and the answers given by the in-app coach (see below).
• To send structured workouts you have planned in CORE3 back to your Garmin Connect calendar, where you have granted that permission.

We do not sell Garmin data, do not use it for advertising or advertising measurement, and do not disclose it to any party other than the operators described immediately below.

Garmin data is processed on our behalf by the operators listed below, each under a written agreement that limits them to processing it for us. CORE3 remains responsible for it.

• Hosting and application infrastructure: Vercel Inc. (application and API hosting) and Upstash, Inc. (background job queue used to process Garmin push notifications).
• Database and storage: Supabase, Inc., which hosts the managed PostgreSQL database and file storage in which Garmin data is stored.
• Third-party AI / large-language-model providers: Google LLC (Gemini), Anthropic PBC (Claude), OpenAI, L.L.C., xAI Corp. (Grok) and Moonshot AI (Kimi). Where you have consented to AI-assisted coaching, summarised Garmin activity, health and recovery data for your account is sent to one of these providers so that it can generate your plan, insight or coach response. It is sent only to produce output for you, it is not sent under your name or email address, and it is processed under contractual terms that prohibit its use for training those providers’ general models.

Garmin data is transmitted over TLS and stored in our managed PostgreSQL database, isolated per user by row-level access controls so that one account cannot read another’s data. Access tokens issued by Garmin are stored server-side only and are never exposed to the app or the browser. Our infrastructure and AI operators process data on servers outside the Republic of South Africa; those transfers are made on the basis described in "International transfers" below.

• You can disconnect Garmin at any time in Settings in the app, or revoke CORE3’s access from your Garmin Connect account. Either action stops all further processing.
• When you disconnect, or when Garmin notifies us that you have deregistered or withdrawn a permission, we delete the Garmin data held for your account and the tokens associated with it.
• Deleting your CORE3 account deletes your Garmin data along with the rest of your personal information.

7. International transfers

Some of our operators (including hosting, AI and Google services) store or process information on servers outside the Republic of South Africa. Where we transfer personal information across borders, we do so in accordance with section 72 of POPIA — for example because the recipient is subject to laws or binding agreements that provide an adequate, comparable level of protection, or because you have consented to the transfer, or it is necessary to perform our contract with you.

8. Cookies and similar technologies

Our website uses cookies and similar technologies for essential functionality, to remember your preferences, to measure usage with analytics, and to support advertising. We set non-essential cookies (including Google Analytics and Google Ads cookies) only with your consent. Full detail, including how to manage your choices, is in our Cookie Policy.

9. Direct marketing

We will only send you electronic marketing (such as promotional emails) where you have consented or where otherwise permitted by law. Every marketing message includes an easy way to opt out, and you can unsubscribe at any time by contacting us at info@coreiii.com. Opting out of marketing does not stop essential service messages about your account.

10. How long we keep your information

We keep your personal information for as long as your account is active and as needed to provide the Service. Training and activity history is retained so your long-term trends and analytics remain accurate; we do not routinely purge it. When you disconnect a third-party provider, we stop syncing from it and delete the data sourced from that provider. When you delete your account, we delete or anonymise your personal information, except where we must retain certain records to meet legal obligations or resolve disputes.

11. How we protect your information

We take appropriate, reasonable technical and organisational measures to safeguard your personal information against loss, unauthorised access and misuse, including encryption in transit, hashed passwords, access controls and reputable infrastructure providers. No method of transmission or storage is completely secure, but we work to protect your information and will notify you and the Information Regulator of a compromise where the law requires.

12. Your rights

Subject to POPIA, you have the right to:

• Be told what personal information we hold about you and to access it.
• Request correction or deletion of personal information that is inaccurate, irrelevant, excessive, out of date or unlawfully obtained.
• Object, on reasonable grounds, to the processing of your personal information.
• Withdraw consent you have given (for example for health-data processing or marketing), without affecting processing already carried out.
• Not be subject to a decision based solely on automated processing that has legal or similarly significant effects, except as permitted by law.
• Lodge a complaint with the Information Regulator.

You can exercise most of these rights in the app, or by emailing us at info@coreiii.com. We may need to verify your identity before acting on a request.

• Information Regulator (South Africa)
• JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
• Email: complaints.IR@inforegulator.org.za
• Website: https://inforegulator.org.za

13. Children

The Service is not intended for children. You must be at least 18 years old (or the age of majority where you live) to create an account. We do not knowingly collect personal information from children without the consent of a competent person; if you believe a child has provided us information, contact us so we can remove it.

14. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version with a new "Last updated" date and, where changes are material, take reasonable steps to notify you. Your continued use of the Service after an update means you accept the revised policy.

15. Contact us

Questions about this policy or your personal information? Contact our Information Officer at info@coreiii.com.