Atlas Optimised is a private performance coaching service. This policy explains what personal data we collect when you use the Atlas app, dashboard and connected services, why we collect it, where it is stored, who we share it with, and the rights you have over it. It sits alongside the Terms of Service.
1. Who we are
Atlas Optimised is a trading name of Harry Johnson Limited (registered in England and Wales, company number 14222435, registered office Unit 8 The Courtyard, Gaulby Lane, Stoughton, Leicester, LE2 2FL). Harry Johnson Limited is the data controller. Harry Johnson is the coach. Contact: [email protected].
This policy applies to the Atlas web app at app.atlasoptimised.com, the Atlas iOS app, and the emails and push notifications we send you.
2. What data we collect
From you directly
- Account and profile: name, email address, phone number, date of birth, sex, height, weight, location (country or region), timezone, profile photo.
- Onboarding answers: training history, goals, availability, injury history, sleep, stress and life context, dietary preferences and restrictions, travel patterns.
- Health context: medical history, current medications, supplements and compounds you already take, allergies, pregnancy status, your doctor's contact details, blood panel history.
- Reproductive health, only if you choose to share it at onboarding and give separate consent: whether you are pregnant or breastfeeding, cycle status, contraception or hormone therapy, the date of your last period and usual cycle length, symptoms around your period or menopause, and related diagnoses.
- Subjective inputs: weekly check-ins, journal entries, readiness and mood ratings, session notes, illness reports, questions you ask the Concierge, feedback and bug reports.
- Wellbeing screens: two short questions about mood every few weeks, a yearly sleep check (snoring, tiredness, restless legs, broken sleep, neck measurement) and, for women in or after the menopause transition, a monthly symptom check. Answers are stored on your check-in. Any total derived from them is for your coach only and is never shown to you or used to change your training automatically.
- Safety notes: when something you tell us needs a person to act on it (a symptom worth a GP conversation, or a message that suggests you may be at risk), your coach records that it was raised, when, and what happened. This log is coach-only and is never shared or used for marketing.
- Photos: meal photos for nutrition estimation, progress photos for your coach, and blood or lab reports uploaded as PDF or image.
From your use of Atlas
- Training data: sessions logged, exercises, sets, reps, loads, tempo, RPE, rest periods, cardio and circuit logs.
- Nutrition data: meals logged, macronutrients and micronutrients, hydration, ingredient detail.
- Supplement and protocol adherence: logged takes and completed routines.
- Biomarkers: blood, gut, DEXA, VO2max and metabolic rate results uploaded by you or your coach, and the values extracted from them.
- Derived metrics: recovery and readiness scores, training load, trends and baselines calculated from the data above.
- Device and usage data: app version, device type, push notification token, sign-in timestamps and basic request logs for security.
From connected services (only if you connect them)
- WHOOP: recovery, sleep, strain, heart rate, HRV, resting heart rate, respiratory rate, skin temperature.
- Oura: sleep stages, readiness, HRV, resting heart rate, temperature deviation, activity.
- Garmin: activity, workouts, steps, heart rate, sleep.
- Withings: body composition (weight, body fat, lean mass, visceral fat), optionally activity and sleep.
- Cronometer: food diary entries, macronutrient and micronutrient breakdowns.
- Apple Health (iOS app): steps and workouts, where you grant permission on your device.
- Continuous glucose monitor (FreeStyle Libre), where connected: glucose readings.
WHOOP, Oura, Garmin, Withings and Cronometer data reaches Atlas through Junction, a wearable data aggregator, using each service's own authorisation. We never see your passwords for those services. You can disconnect any of them at any time in Settings.
3. Why we use your data, and the legal basis
Your data is used solely to deliver the coaching program you have contracted for:
- Building and adapting your training, nutrition, supplement, routine and recovery protocols.
- Reading your wearable, nutrition, training and test data daily and writing your weekly performance review.
- Answering your questions through the Concierge, grounded in your own data.
- Flagging signals for coach review: illness risk, overreach, out-of-range markers, adherence drops, travel.
- Booking your tests and calls, shipping your kit, and taking payment.
- Sending you reminders, check-in prompts and coach messages by push and email.
- Keeping the service secure and keeping the records the law requires.
Under UK GDPR we rely on: performance of a contract (Article 6(1)(b)) for delivering the program; your explicit consent (Article 9(2)(a)) for health data, which you give at onboarding and again when you connect a device or upload a result; legitimate interests (Article 6(1)(f)) for security, fraud prevention and service improvement; and legal obligation (Article 6(1)(c)) for financial and tax records.
You can withdraw your health-data consent at any time. Withdrawal ends our ability to deliver the program but does not affect processing that already happened.
Your data is not used for advertising, is not sold, and is not shared with anyone outside the coaching relationship except the providers listed in section 6.
4. AI processing
Atlas uses Anthropic's Claude models to power the Concierge, Atlas Recommends, protocol drafts, the weekly review draft, blood report extraction and meal photo analysis. When a feature runs:
- The relevant slice of your data (for example the week's training, sleep, nutrition and check-in, or the uploaded report) is sent to Anthropic's API to generate the output.
- Identifying details are minimised in the payload where the feature does not need them.
- Anthropic does not train on API inputs and acts as our processor under its commercial terms.
- Generated outputs are stored alongside your coaching data. Recent Concierge turns are cached for a short period so follow-up questions make sense, then expire.
- Every protocol that reaches you has been reviewed by your coach. No decision with a legal or similarly significant effect on you is made by automated processing alone.
Two further providers handle specific features. When you dictate a note or use voice input, the audio you record is sent to OpenAI or to Deepgram to be transcribed into text, and is used only to return that transcript. Illustrative images used in the app's libraries are generated by OpenAI from a text description, with no personal data in the request. Neither provider trains on our inputs, and both act as our processors.
Recovery, readiness, training load and signal detection run on Atlas's own algorithms and do not leave our infrastructure.
5. Where your data is stored
- Primary data store: Airtable (Formagrid, Inc., United States). Access is restricted to the coach.
- Compute and API layer: Cloudflare Workers and KV (global edge network). Runs the application logic and short-lived caches.
- Files: meal photos, progress and profile photos, gut and lab reports and breathwork audio in Cloudflare R2 object storage.
- App hosting: Cloudflare Pages (static files only) and the Apple App Store for the iOS app.
- Connected-service tokens are stored encrypted at rest (AES-GCM) with a key held only in Cloudflare's secret store.
6. Third-party services we rely on
| Service | Purpose | Data shared |
|---|
| Airtable | Primary data storage | All data in section 2 |
| Cloudflare | Hosting, compute, caches, file storage | All data passing through the app; files listed in section 5 |
| Anthropic (Claude) | AI features (section 4) | The data slice needed for each feature |
| OpenAI | Voice note transcription; illustrative image generation | The audio you dictate; no personal data in image requests |
| Deepgram | Voice note transcription | The audio you dictate |
| Junction | Wearable and nutrition data aggregation | Your connection tokens for WHOOP, Oura, Garmin, Withings, Cronometer; the synced data |
| WHOOP, Oura, Garmin, Withings, Cronometer | Data sources, if connected | Authorisation token only |
| Apple | App Store distribution, push notifications, Apple Health on device | Push token; Health data stays on your device until the app sends steps and workouts to Atlas |
| Stripe | Payments | Name, email, card details (held by Stripe, not Atlas), payment status |
| Resend | Email delivery | Email address, message content |
| Cal.com | Call and test booking | Name, email, timezone, booking times |
| Marek Health (US), Randox (UK), Genova, partner DEXA, VO2max and RMR labs | Testing | Name, contact details, date of birth, sex, as required to book; results come back to Atlas |
| Supplement and kit suppliers | Shipping your bundle, scale and tech kit | Name, shipping address, phone |
| Skool | Atlas community group, if you join | Name, email |
| Meta (WhatsApp Business Platform) | Only if you message Atlas on WhatsApp | Phone number, message content |
Each service operates under its own privacy terms. Links are available on request.
7. International transfers
Several providers above are in the United States. Transfers of your data outside the UK are made under the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or otherwise under the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
If you are a US client, your data is held in the same systems. UK GDPR applies to how we handle it because Atlas is a UK controller, and you keep any rights your state law gives you.
8. Retention
- Active clients: all coaching data is retained for the duration of your program.
- After your account ends: you have 30 days to request an export. We then delete your personal data within 90 days.
- Financial records: kept for 6 years as UK law requires.
- Security and operational logs: up to 12 months.
- AI caches and Concierge context: short-lived, expiring within hours to days.
- Connected-service tokens: revoked immediately on disconnect or account deletion.
9. Your rights
You have the right to:
- Access the personal data we hold about you and receive a copy.
- Correct anything inaccurate.
- Delete your data (subject to the retention periods in section 8).
- Export your data in a portable format.
- Withdraw consent for health-data processing at any time.
- Object to, or ask us to restrict, processing based on legitimate interests.
- Disconnect any connected service at any time in Settings.
- Complain to the Information Commissioner's Office at ico.org.uk. We would rather you raise it with us first.
To exercise any of these, email [email protected]. We respond within 30 days.
10. Security
All data is encrypted in transit. Connected-service tokens are encrypted at rest. Access to your data is limited to your coach and the systems that deliver the program. Sign-in uses a time-limited session token; the iOS app stores it on your device only.
11. Children
Atlas is for adults. We do not knowingly collect data from anyone under 18.
12. Changes to this policy
Material changes are notified by email and in the app, and reflected here with an updated date at the top. Material changes to how we handle your health data require your explicit acceptance before they apply.
13. Contact
Harry Johnson Limited, trading as Atlas Optimised
Unit 8 The Courtyard, Gaulby Lane, Stoughton, Leicester, LE2 2FL, United Kingdom
Privacy and legal: [email protected]
Support and data requests: [email protected]