Atlas Optimised

Privacy Policy

Last updated: 29 October 2026

Atlas Optimised is a private performance coaching service. This policy explains what personal data we collect when you use the Atlas app, dashboard and connected services, why we collect it, where it is stored, who we share it with, and the rights you have over it. It sits alongside the Terms of Service.

1. Who we are

Atlas Optimised is a trading name of Harry Johnson Limited (registered in England and Wales, company number 14222435, registered office Unit 8 The Courtyard, Gaulby Lane, Stoughton, Leicester, LE2 2FL). Harry Johnson Limited is the data controller. Harry Johnson is the coach. Contact: [email protected].

This policy applies to the Atlas web app at app.atlasoptimised.com, the Atlas iOS app, and the emails and push notifications we send you.

2. What data we collect

From you directly

Account and profile: name, email address, phone number, date of birth, sex, height, weight, location (country or region), timezone, profile photo.
Onboarding answers: training history, goals, availability, injury history, sleep, stress and life context, dietary preferences and restrictions, travel patterns.
Health context: medical history, current medications, supplements and compounds you already take, allergies, pregnancy status, your doctor's contact details, blood panel history.
Reproductive health, only if you choose to share it at onboarding and give separate consent: whether you are pregnant or breastfeeding, cycle status, contraception or hormone therapy, the date of your last period and usual cycle length, symptoms around your period or menopause, and related diagnoses.
Subjective inputs: weekly check-ins, journal entries, readiness and mood ratings, session notes, illness reports, questions you ask the Concierge, feedback and bug reports.
Wellbeing screens: two short questions about mood every few weeks, a yearly sleep check (snoring, tiredness, restless legs, broken sleep, neck measurement) and, for women in or after the menopause transition, a monthly symptom check. Answers are stored on your check-in. Any total derived from them is for your coach only and is never shown to you or used to change your training automatically.
Safety notes: when something you tell us needs a person to act on it (a symptom worth a GP conversation, or a message that suggests you may be at risk), your coach records that it was raised, when, and what happened. This log is coach-only and is never shared or used for marketing.
Photos: meal photos for nutrition estimation, progress photos for your coach, and blood or lab reports uploaded as PDF or image.

From your use of Atlas

Training data: sessions logged, exercises, sets, reps, loads, tempo, RPE, rest periods, cardio and circuit logs.
Nutrition data: meals logged, macronutrients and micronutrients, hydration, ingredient detail.
Supplement and protocol adherence: logged takes and completed routines.
Biomarkers: blood, gut, DEXA, VO2max and metabolic rate results uploaded by you or your coach, and the values extracted from them.
Derived metrics: recovery and readiness scores, training load, trends and baselines calculated from the data above.
Device and usage data: app version, device type, push notification token, sign-in timestamps and basic request logs for security.

From connected services (only if you connect them)

WHOOP: recovery, sleep, strain, heart rate, HRV, resting heart rate, respiratory rate, skin temperature.
Oura: sleep stages, readiness, HRV, resting heart rate, temperature deviation, activity.
Garmin: activity, workouts, steps, heart rate, sleep.
Withings: body composition (weight, body fat, lean mass, visceral fat), optionally activity and sleep.
Apple Health (iOS app): steps and workouts, where you grant permission on your device.
Continuous glucose monitor (FreeStyle Libre), where connected: glucose readings.

WHOOP, Oura, Garmin and Withings data reaches Atlas through Junction, a wearable data aggregator, using each service's own authorisation. We never see your passwords for those services. You can disconnect any of them at any time in Settings.

Garmin workouts (only if you connect it)

If you connect Garmin workouts in Settings, Atlas sends the cardio sessions in your programme to your Garmin Connect calendar so you can run them from your watch. For this, Garmin gives Atlas your Garmin user ID, the permissions you granted, and the IDs of the workouts Atlas creates. We use these only to send, update and remove those workouts. They are stored on Cloudflare (your Garmin sign-in) and Airtable (workout IDs). We never sell your data, from Garmin or anywhere else. Data from this connection is not processed by AI and is never used to train AI models. Disconnect any time in Settings or in Garmin Connect. Atlas then removes its workouts from your calendar where it can and deletes what it stored. Deleting your Atlas account does the same.

Screen Time (iOS app, stays on your iPhone)

If you connect Screen Time, the Atlas app reads your app usage on your iPhone to show it against your day and your sleep, and can lock apps you choose before bed. This data stays on your iPhone. Atlas does not collect it, does not store it on our servers, and does not share it with your coach or anyone else. You can disconnect it at any time in your iPhone's Settings under Screen Time.

3. Why we use your data, and the legal basis

Your data is used solely to deliver the coaching program you have contracted for:

Building and adapting your training, nutrition, supplement, routine and recovery protocols.
Reading your wearable, nutrition, training and test data daily and writing your weekly performance review.
Answering your questions through the Concierge, grounded in your own data.
Flagging signals for coach review: illness risk, overreach, out-of-range markers, adherence drops, travel.
Booking your tests and calls, shipping your kit, and taking payment.
Sending you reminders, check-in prompts and coach messages by push and email.
Keeping the service secure and keeping the records the law requires.

Under UK GDPR we rely on: performance of a contract (Article 6(1)(b)) for delivering the program; your explicit consent (Article 9(2)(a)) for health data, which you give at onboarding and again when you connect a device or upload a result; legitimate interests (Article 6(1)(f)) for security, fraud prevention and service improvement; and legal obligation (Article 6(1)(c)) for financial and tax records.

You can withdraw your health-data consent at any time. Withdrawal ends our ability to deliver the program but does not affect processing that already happened.

Your data is not used for advertising, is not sold, and is not shared with anyone outside the coaching relationship except the providers listed in section 6.

4. AI processing

Atlas uses Anthropic's Claude models to power the Concierge, Atlas Recommends, protocol drafts, the weekly review draft, blood report extraction and meal photo analysis. When a feature runs:

The relevant slice of your data (for example the week's training, sleep, nutrition and check-in, or the uploaded report) is sent to Anthropic's API to generate the output.
Identifying details are minimised in the payload where the feature does not need them.
Anthropic does not train on API inputs and acts as our processor under its commercial terms.
Generated outputs are stored alongside your coaching data. Recent Concierge turns are cached for a short period so follow-up questions make sense, then expire.
Your coach reviews most protocols before they reach you. Some are applied straight away and your coach reviews them afterwards: the short supportive-care protocol Atlas builds when you tell it you are unwell, a Pack you start yourself, and supplement changes you ask Atlas to make to your own stack. Concierge replies reach you directly and are not reviewed first. No decision with a legal or similarly significant effect on you is made by automated processing alone.

Two further providers handle specific features. When you dictate a note or use voice input, the audio you record is sent to OpenAI to be transcribed into text, and is used only to return that transcript. Illustrative images used in the app's libraries are generated by OpenAI from a text description, with no personal data in the request. Neither provider trains on our inputs, and both act as our processors.

Recovery, readiness, training load and signal detection run on Atlas's own algorithms and do not leave our infrastructure.

5. Where your data is stored

Primary data store: Airtable (Formagrid, Inc., United States). Access is restricted to the coach.
Compute and API layer: Cloudflare Workers and KV (global edge network). Runs the application logic and short-lived caches.
Files: meal photos, progress and profile photos, gut and lab reports and breathwork audio in Cloudflare R2 object storage.
App hosting: Cloudflare Pages (static files only) and the Apple App Store for the iOS app.
Connected-service tokens are stored encrypted at rest (AES-GCM) with a key held only in Cloudflare's secret store.

6. Third-party services we rely on

Service	Purpose	Data shared
Airtable	Primary data storage	All data in section 2
Cloudflare	Hosting, compute, caches, file storage	All data passing through the app; files listed in section 5
Anthropic (Claude)	AI features (section 4)	The data slice needed for each feature
OpenAI	Voice note transcription; illustrative image generation	The audio you dictate; no personal data in image requests
Junction	Wearable data aggregation	Your connection tokens for WHOOP, Oura, Garmin, Withings; the synced data
WHOOP, Oura, Garmin, Withings	Data sources, if connected	Authorisation token only
Garmin (workouts)	Sending your cardio sessions to your Garmin Connect calendar, if you connect Garmin workouts	Your scheduled cardio sessions (steps, heart-rate targets, dates); Garmin returns your Garmin user ID, your permissions and the workout IDs
Apple	App Store distribution, push notifications, Apple Health on device	Push token; Health data stays on your device until the app sends steps and workouts to Atlas
Stripe	Payments	Name, email, card details (held by Stripe, not Atlas), payment status
Resend	Email delivery	Email address, message content
Cal.com	Call and test booking	Name, email, timezone, booking times
Marek Health (US), Randox (UK), Genova, partner DEXA, VO2max and RMR labs	Testing	Name, contact details, date of birth, sex, as required to book; results come back to Atlas
Supplement and kit suppliers	Shipping your bundle, scale and tech kit	Name, shipping address, phone
Skool	Atlas community group, if you choose to join with your own Skool account. We send you the link; we do not send Skool your details	What you give Skool when you join
Meta (WhatsApp Business Platform)	Only if you message Atlas on WhatsApp	Phone number, message content

Each service operates under its own privacy terms. Links are available on request. We never sell your personal data or share it for advertising.

7. International transfers

Several providers above are in the United States. Transfers of your data outside the UK are made under the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or otherwise under the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

If you are a US client, your data is held in the same systems. UK GDPR applies to how we handle it because Atlas is a UK controller, and you keep any rights your state law gives you.

8. Retention

Active clients: all coaching data is retained for the duration of your program.
After your account ends: you have 30 days to request an export. We then delete your personal data within 90 days.
Financial records: kept for 6 years as UK law requires.
Security and operational logs: up to 12 months.
AI caches and Concierge context: short-lived, expiring within hours to days.
Connected-service tokens: revoked immediately on disconnect or account deletion.

9. Your rights

You have the right to:

Access the personal data we hold about you and receive a copy.
Correct anything inaccurate.
Delete your data (subject to the retention periods in section 8).
Export your data in a portable format.
Withdraw consent for health-data processing at any time.
Object to, or ask us to restrict, processing based on legitimate interests.
Disconnect any connected service at any time in Settings.
Complain to the Information Commissioner's Office at ico.org.uk. We would rather you raise it with us first.

To exercise any of these, email [email protected]. We respond within 30 days.

10. Security

All data is encrypted in transit. Connected-service tokens are encrypted at rest. Access to your data is limited to your coach and the systems that deliver the program. Sign-in uses a time-limited session token; the iOS app stores it on your device only.

11. Children

Atlas is for adults. We do not knowingly collect data from anyone under 18.

12. Cookies

The Atlas app uses only what it needs to keep you signed in and remember your settings. It sets no advertising cookies.

Our application, trial and summit pages can use Meta cookies to measure our ads, but only if you choose Accept on the banner. If you choose Reject, the Meta Pixel does not load and we do not send your details to Meta. You can change your choice at any time with the Cookie settings link at the foot of those pages. Your choice is remembered for six months.

13. Changes to this policy

Material changes are notified by email and in the app, and reflected here with an updated date at the top. Material changes to how we handle your health data require your explicit acceptance before they apply.

14. Contact

Harry Johnson Limited, trading as Atlas Optimised
Unit 8 The Courtyard, Gaulby Lane, Stoughton, Leicester, LE2 2FL, United Kingdom
Registered with the Information Commissioner's Office, registration number C2050658

Privacy and legal: [email protected]
Support and data requests: [email protected]