Legal

Privacy Policy

Effective October 23, 2026 · Last updated October 23, 2026

1. Who we are

AnyWatch (anywatch.space, app.anywatch.space and api.anywatch.space) is operated by SOLIT TECH SAS, a company organized under the laws of the Oriental Republic of Uruguay, with its registered office in Montevideo, Uruguay ("SOLIT TECH", "we", "us").

AnyWatch is used by coaches, clubs, apps and athletes around the world. We apply this policy to everyone, wherever they live, and we comply with the data protection laws that apply to our users, including the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act as amended by the CPRA (CCPA), US state consumer health data laws such as the Washington My Health My Data Act, Brazil's LGPD, Canada's PIPEDA, and Uruguay's Law No. 18.331. Where these laws differ, we follow the stricter rule.

2. Our role

AnyWatch is used in two ways, and our role differs between them.

• Clients. Coaches, clubs, gyms and app developers ("Clients") create an account in the AnyWatch portal and invite their athletes or members. For the data of those athletes, the Client decides why and how the data is used, and we process it on the Client's behalf and on its instructions. The Client's own privacy policy also applies.
• Our own service. For Client account data, website visitors, and the operation and security of the service, SOLIT TECH decides how data is used and is the data controller.

If you are an athlete or member and have questions about how your coach, club or app uses your data, contact them first. We will help them answer your request.

3. Data we collect

Data you or your Client give us

• Client account data: name, email address, company name and password (stored only as a hash).
• Athlete profile data entered by the Client or by you: name or an identifier chosen by the Client, email address, and optional details such as date of birth, sex, height and weight.

Data from devices and health apps you connect

When you connect a device or service such as Garmin, Oura, Whoop, Polar, Suunto, COROS, Strava, Fitbit, Withings, Ultrahuman, Google Health, Apple Health, Samsung Health or Health Connect, we receive the data that you authorize that provider to share. Depending on the provider and the permissions you grant, this may include:

Much of this data is health data. It is "special category" data under the GDPR, "sensitive personal information" and "consumer health data" under US state laws, and sensitive data under most other privacy laws. We treat it with additional care everywhere.

Technical data

• Logs needed to run and secure the service: IP address, browser or app version, request time, error reports.
• The portal uses only cookies that are needed for sign-in and security. Our website does not use advertising or cross-site tracking cookies.

4. How we use data

• To connect your devices and sync, normalize and store your data in one consistent format.
• To show your data to the Client that invited you, and to deliver it to the Client's apps through our API, webhooks and integrations they configure, including AI assistants they connect.
• To calculate derived metrics such as sleep and recovery scores.
• To send service emails, such as invitations, security notices and changes to this policy.
• To keep the service secure, prevent abuse, fix errors and meet legal obligations.

We do not sell personal data. We do not use health data for advertising, marketing profiles or credit decisions, and we do not use it to train general-purpose AI models.

5. Legal basis and consent

We process health data only with your prior, freely given, specific, informed and explicit consent (for example, GDPR Article 9(2)(a)), which you give when you connect a device or app and approve the permissions on the provider's own sign-in screen. You can withdraw your consent at any time by disconnecting the provider in the app or portal, by revoking access in the provider's settings, or by contacting us. Withdrawing consent does not affect processing that took place before it.

We process other data to perform our contract with you or your Client, to meet legal obligations, and for our legitimate interests in operating and securing the service, which we balance against your rights.

6. Sharing

We share personal data only in these cases:

• With your Client. The coach, club or app that invited you sees the data from the providers you connect.
• With service providers that help us run AnyWatch, under contracts that require them to protect the data and use it only for our instructions: cloud hosting and database infrastructure, email delivery, and error monitoring.
• With device providers, to the extent needed to connect your account and receive data, for example when we exchange authorization tokens with them.
• When required by law, or to protect the rights, safety or property of our users, the public or SOLIT TECH.
• In a business transfer, such as a merger or acquisition, in which case this policy continues to protect the data.

7. Device providers

Each device or app provider handles your data under its own privacy policy and terms. We use data received from providers only to deliver AnyWatch features you or your Client requested, and we follow each provider's developer terms.

Where data comes from Google APIs, our use and transfer of that data adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data from Apple HealthKit is sent by the app you use only with your permission, and is not used for advertising or shared with data brokers.

8. International transfers

SOLIT TECH is based in Uruguay, and our servers and service providers may be located in other countries, including the United States. Your data may therefore be processed outside the country where you live. Uruguay is recognized by the European Commission as providing an adequate level of data protection. When we transfer data to a country without such recognition, we use appropriate safeguards, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, or rely on another basis permitted by the applicable law.

9. Retention and deletion

• We keep data for as long as your connection or your Client's account is active, or as agreed with your Client.
• When you disconnect a provider, we stop receiving new data from it and delete its access tokens.
• When you, or your Client on your behalf, ask us to delete your data, we delete your profile, connected-provider data and queued deliveries within 30 days, except where the law requires us to keep it.
• Backups are overwritten on a rolling basis and deleted data disappears from them within 35 days.

10. Security

We use technical and organizational measures appropriate to health data: encrypted connections (TLS) for all traffic, access to production systems limited to authorized personnel, hashed passwords, signed webhook deliveries, and logging of access. No system is completely secure, and if a breach affects your data we will notify you, your Client and the authorities as required by law.

11. Your rights

Wherever you live, you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct or update inaccurate data;
• delete your data;
• give you your data in a portable, machine-readable format;
• restrict or object to certain processing;
• withdraw your consent at any time.

To exercise these rights, write to us using the contact details below. We respond within 30 days, or sooner where the law requires it. We may need to confirm your identity first. We will not treat you differently for exercising your rights. If your data is held on behalf of a Client, we will pass your request to them and help them respond.

European Economic Area, United Kingdom and Switzerland

You have the rights listed above under the GDPR and UK GDPR, and you can complain to the data protection authority in your country of residence or work.

United States

Residents of California and other states with consumer privacy laws have the right to know, access, correct and delete their personal information, and to limit the use of sensitive personal information. We do not sell or share personal information for cross-context behavioral advertising, and we use sensitive personal information only to provide the service. Under consumer health data laws such as the Washington My Health My Data Act, we collect and share consumer health data only with your consent and only as needed to provide the service you requested, and you can ask us to delete it. You may use an authorized agent to make a request. If we deny your request, you can appeal by replying to our answer.

Other countries

Residents of Brazil, Canada, Uruguay and other countries have the rights given by their local laws, including the right to complain to the local data protection authority, such as the ANPD in Brazil, the Office of the Privacy Commissioner of Canada, or the URCDP in Uruguay.

12. Children

AnyWatch is not intended for children under 16, and we do not knowingly collect data from children under 13. Clients must not invite anyone under 16 without the verifiable consent of a parent or guardian where the law requires it. If we learn that we hold data of a child without such consent, we delete it.

13. Changes to this policy

We may update this policy. If the changes are significant, we will notify Clients by email and show a notice in the portal before they take effect. The date at the top shows when the policy was last updated.

14. Contact