Responsibility and contact
The controller for this website and operator of the platform is Michael Koller, Dr. Robert Fritz, Manfred Buxbaum und Tim Schneider, Alserstraße 27/6, 1080 Wien, Österreich(acting jointly under the brand Plenea; a company is in the process of being formed). You can reach us with questions at datenschutz@plenea.at. For care and health data within a practice, the respective practice is generally the controller; we operate the platform as a processor. The practice must determine the legal basis for the specific treatment or care and for the use of AI, and must actually obtain any consent required. We remain responsible for the agreed processing, the technical safeguards and the sub-processors we use.
Hosting and external processing
The application and database are hosted by Hetzner in Helsinki. Additional encrypted backups are stored by Scaleway in Paris. Plenea uses only Mistral AI for AI content, processed in the EU and European EFTA states, such as Norway or Switzerland. For other tasks, including calendars and usage analytics, we also use providers from the USA. The subprocessor register explains which providers receive which data and the rules for transfers outside the European Economic Area. Contact us for information about the safeguards used or a copy of the relevant guarantees.
Contact, demo and product launch updates
Information from contact and demo forms is stored in our sales system in order to handle your enquiry. This happens when you submit the form, even if you do not book an appointment afterwards. For the subsequent choice of appointment, we load Cal.com only after your explicit permission at the calendar and pass on booking details such as your name, email address and information about your enquiry. Cal.com, Inc. is a US provider; technical data such as your IP address may also be processed in the process. Information from the provider on processing and international transfers can be found in Cal.com’s privacy policy. You can withdraw permission at the calendar; it is not stored for later visits. The embedded calendar is used with your consent (Art. 6(1)(a) GDPR). You can also send an enquiry without the calendar via the contact page. Please do not send any patient or health data this way. You receive product launch updates after signing up and confirming by email. You can withdraw this consent via the unsubscribe link. Handling an enquiry about our offering serves pre-contractual measures (Art. 6(1)(b) GDPR). General enquiries and business enquiries on behalf of an organisation are handled in our legitimate interest in responding (Art. 6(1)(f) GDPR). Without the necessary contact details, we cannot reply or arrange an appointment. The basis for product launch updates is your consent (Art. 6(1)(a) GDPR).
Registration for events
When you register for an event (webinar, seminar, workshop or talk), we process your name, email address and the details you provide in advance about your company or organisation, role, services and any comments. The purpose is to run the event: confirmation, the access link for online events, organisational information and, where applicable, sending the recording. We notify our office of each registration by email. The legal basis is the performance of the contract concluded by registering (Art. 6(1)(b) GDPR). Optional consent to also be informed about further events and news is obtained by confirmation email and can be withdrawn at any time with effect for the future.
Cookies and consent on this website
We store your choice in the cookie banner in your browser, together with the time and the four consent signals under Google Consent Mode (analytics_storage, ad_storage, ad_user_data, ad_personalization). Necessary storage is always on; everything else is switched off until you consent. You can choose between Statistics (usage statistics with PostHog; EU endpoint, the provider is a US company; this records, among other things, page views and technical usage information), Ad measurement and Personalised advertising (both in the next section). The basis in each case is your consent (Art. 6(1)(a) GDPR, § 165(3) of the Austrian Telecommunications Act 2021, TKG 2021), which you can change at any time via “Cookie settings” in the footer or withdraw with effect for the future. We also count every decision anonymously: our server only receives which button you chose, which categories are switched on and the version of the banner. All we store is a daily count, without IP address, cookie or identifier. This shows us how the banner is received (legitimate interest, Art. 6(1)(f) GDPR). The fonts of this website are served locally.
Advertising and conversion measurement (Google Ads, LinkedIn)
We run ads on Google and LinkedIn to make practices and organisations aware of Plenea. Only if you allow Ad measurement in the cookie banner do we measure whether an ad led to an enquiry, a demo, a trial or the conclusion of a contract. For this, this website loads the Google Ads tag, which sets cookies and transmits the ad click identifier, your IP address and information about the page view to Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland). In addition, from our sales system we report to Google (Data Manager API) and to LinkedIn Ireland Unlimited Company (Wilton Place, Dublin 2, Ireland; Conversions API) the ad click identifier (gclid, gbraid, wbraid or li_fat_id), your business email address as a SHA-256 checksum (hash), the type and time of the step and, where a contract is concluded, its value. We do not use a LinkedIn tag on this website. Only if you additionally allow Personalised advertising may Google use this measurement to show you ads from Plenea in a more targeted way.
We transmit no data from our software, no data of patients or athletes and no health data. We do not use any advertising tags in the software, in the athlete portal or on practice, report or booking pages. Google and LinkedIn also process data in the USA; the basis is the EU-US Data Privacy Framework or EU Standard Contractual Clauses, as set out in the data processing terms of the respective ad account. We store click identifiers with your enquiry for as long as the sales process exists (for prospects without a contract, up to 24 months after the last activity). Steps are reported no later than 90 days after the respective step; thereafter storage is governed by the terms of Google and LinkedIn. Without your consent to ad measurement, we do not store any click identifiers and report nothing. The basis is your consent (Art. 6(1)(a) GDPR, § 165(3) TKG 2021); you can withdraw it at any time via “Cookie settings” in the footer or by email to datenschutz@plenea.at.
Source data
When you submit a form (such as contact, demo or webinar registration), we additionally transmit how you found us: campaign parameters from the address bar (utm_source, utm_medium, utm_campaign and similar), only the host name of a referring link, the entry page on our website and your cookie choice at that time. We only transmit and store click identifiers from ad networks (such as gclid or li_fat_id) with your consent to ad measurement. Full referrer URLs, IP addresses or device IDs are not collected for this purpose. Without consent to the Statistics category, this value only lives in your browser’s memory for the current session; with this consent, the first recognised contact remains stored locally in your browser for up to 90 days so that a later form can be attributed to the same source.
Software, accounts and practice data
Plenea is responsible for accounts, contracts, billing and secure operation. Your practice is generally responsible for treatment or care data; Plenea processes it on the practice’s behalf. Where you contract directly with Plenea, we act as controller for the data needed for that service. Data comes from you, your practice or a service you have connected. Required account and contract details are necessary to provide access and agreed services. You may refuse or withdraw optional consent without affecting other functions.
How we use this data
- Performance diagnostics — Measurements, analyses and reports support the agreed diagnostics and care. The responsible practice determines the legal basis. Health data needs a condition under Article 9(2) GDPR in addition to Article 6: for example, explicit consent or care by appropriately bound professionals under Article 9(2)(h) and 9(3). The medical exception does not automatically cover every sports or training service. This also applies to imported data.
- Training planning and personal progress data — Training, sleep and recovery data support the agreed care. Processing is based on the contract (Article 6(1)(b) GDPR); voluntarily provided portal health data additionally requires explicit consent (Article 9(2)(a)). Where a practice provides care, it determines the basis applicable to its use.
- Invoicing and payment processing — Article 6(1)(b) GDPR (contract).
- Error monitoring (logs, Sentry exceptions) — Article 6(1)(f) GDPR (legitimate interest in security and detection of abuse). Security logs for practice and platform sign-ins contain IP addresses and pseudonymous account identifiers; plain-text email addresses and health content are not sent to log storage. Better Stack checks only availability and technical heartbeats; no customer or user data is transmitted for this. Error context is redacted before being sent to Sentry. This runs without separate consent. Screen or session recordings (session replay) do not take place.
- Product analytics (PostHog, data hosted in the EU region) — Article 6(1)(a) GDPR (consent). Disabled by default and withdrawable at any time. In the browser, analytics starts only after you consent in the cookie banner (“Statistics” category); for practice accounts, the practice may instead consent under Settings → Privacy. Events reported by our server (such as “Test saved”) are sent only with practice consent and without athlete identifiers. The server sends no events for athletes; portal analytics is created only in the browser and only after personal consent. Nothing is sent from test or development environments.
- Backups and accountability — Backups support recovery after disruptions. Logs help trace access and changes. The basis is our legitimate interest in secure operation (Article 6(1)(f)) and the security requirements of Article 32 GDPR. Practice data follows the practice’s instructions and applicable legal bases; a backup does not create an additional duty to retain health data.
Service providers
Hetzner Online GmbH (Cloud); Scaleway S.A.S.; ALL-INKL.COM – Neue Medien Münnich; Mistral AI; Sentry (Functional Software Inc.); PostHog, Inc.; Intervals.icu (WattSoft Pty Ltd); Wahoo Fitness, LLC; Strava, Inc.; Cal.com, Inc.; Better Stack (Uptime und Heartbeats).
See data categories, locations and safeguards in the Trust Centre
Sign-in and account security
Account security at sign-in (practice and platform accounts; the athlete portal is excluded) — Article 6(1)(f) GDPR (legitimate interest in account security) in conjunction with Article 32 GDPR. At each sign-in, we check whether the device and country are known for this account. We set the login_device cookie with a random device identifier, valid for 400 days. We store only its hash, not a device fingerprint. We determine the country from the IP address using a country database on our own server (DB-IP “IP to Country Lite”). No external service is queried, and the IP address is not stored for this purpose. Country information: IP Geolocation by DB-IP, licensed under CC BY 4.0. When an account signs in from a new device or country, we send a “New sign-in” email to the account address with a “This was not me” option to end all sessions and reset the password. Unusual sign-ins may also require confirmation with a second factor or email link. You can view and remove known devices under Account → My devices. The cookie is technically necessary for account security, is not used for tracking and is therefore set without consent (§ 165(3) TKG 2021 in Austria; § 25(2)(2) TDDDG in Germany).
- Sign-in sessions: non-revoked session records for 30 days after last activity; revoked sessions remain as access-blocking records until account deletion.
- Sign-in context (hashed device identifier, country and general device information such as “Desktop · macOS · Chrome”): 180 days after last use, or when the account is deleted if earlier. The
login_devicecookie itself expires after 400 days. - Language preference: The technical
plenea-languagecookie stores your explicitly selected interface language for one year. It contains only the language code, with no account or person identifier. We also use a personal language preference saved in an account or portal for the corresponding automatic messages. The language preference is not used for advertising or analytics.
We use technically necessary cookies without consent (§ 165(3) TKG 2021 and § 25(2)(2) TDDDG) for sign-in and sessions, form protection, the login_device identifier and saving your cookie preferences (plenea_consent, 12 months, kept when you sign out). If you choose “Stay signed in on this device” when signing in, your session lasts up to 30 days (platform accounts 7 days), and after the second factor we set the cookie mfa_trust: it spares you the second factor on this device for 30 days (platform accounts 7 days) and is deleted when you sign out. You can change or withdraw your consent to PostHog analytics in the app at any time (Article 7(3) GDPR).
Change cookie preferences in the appTermination and withdrawal
When you terminate or withdraw from a contract through our forms, we store your name, contact address, contract details, declaration and time of receipt. We use this information to process and document your declaration (Article 6(1)(b) and (c) GDPR). Our team receives a notification, and an acknowledgement is sent to the email address you provide. We retain these details for as long as needed to administer the contract, meet legal obligations or resolve legal claims. Please do not include health data in these forms.
What data the AI receives
Plenea uses Mistral AI exclusively, a provider based in France, for AI-assisted text, analysis, document search and speech features. Content is processed in the EU/EFTA region. This regional processing does not cover all provider account, operational and billing data or processing by other service providers. Depending on your task, AI receives selected measurements, training data, notes or your question. Plenea checks the required permissions and data sharing settings. Recognised contact details are removed from text requests; names are sent or replaced according to consent and practice settings. Free text may contain further personal information; complete removal is not guaranteed. Even data without names may still identify a person. For document search, Mistral receives selected passages and your question. It converts these into numbers that help Plenea find relevant passages (called embeddings). Names in search text are not automatically removed, and these search aids are not automatically anonymous.
Dictation and speech output
When you use dictation, the recording is sent to Mistral to convert it into text. Spoken names and health details are not automatically removed from the recording. When you use speech output, Mistral receives the text to be read aloud. These requests also use Mistral’s European service. Limit recordings and text to the information needed for your task. These speech processing flows do not require a telephone connection.
Consent and AI settings
Athletes can give their AI consent in the portal. Authorised practice staff can document consent given on site. Purpose, version, time and method of recording are recorded; recording by the practice is attributed to the person acting. A mere confirmation by staff does not replace the consent of the person concerned. Voluntary AI processing is based on explicit consent (Article 6(1)(a) and, for health data, Article 9(2)(a) GDPR). Personal athlete AI requires current, explicit AI consent and the person being of age according to the stored date of birth. This applies to newly created and imported athletes. Without a known date of birth, and for minors, these AI features remain locked. A withdrawal blocks new personal AI processing; data already transmitted are not retrieved retrospectively. Manual recording and evaluation remain available and require their own legal basis. The practice can additionally switch off AI processing for its account. Free texts and recordings must not contain information about other people without the required legal basis.
Model training and storage by AI providers
Mistral does not retain inputs and responses from our AI requests longer than needed for processing. This setting is called Zero Data Retention (ZDR) and is enabled for the Plenea organisation. It covers the calls we use for text, document search, dictation and speech output. Data sent through Plenea is not used to train AI models. Technical operational and billing data and legal retention obligations are separate from this short-term content storage policy. A report, note or chat saved in Plenea remains subject to Plenea’s applicable retention periods. More information: Mistral’s explanation of AI request storage.
AI output and automatic adjustments
AI supports professional work but does not take on medical responsibility. Review and approval steps are provided for reports and suggestions that require approval. Simple coaching answers can be output directly. Depending on the settings, the rule-based training control can also make adjustments automatically; safety-related reductions can apply regardless. A personal review of every single output is therefore not promised.
Wearables and other service providers
Currently connected are Strava (activities, connection per person in the portal), Wahoo (training sessions, connection per person in the portal) and intervals.icu (activities and training load; approved workouts can be transferred there, updated and removed, so the connection is not read-only). We only evaluate wellness data such as sleep or HRV once a connected provider supplies them. Imported data may feed into recommendations when AI features are enabled. The connection can be disconnected in the portal. Additional service providers are used for sending email, error diagnostics and other features, including Scaleway and Sentry. Scope and providers depend on the features used; details are in the sub-processor register.
Logs and retention
We retain personal data for as long as needed for its purpose or required by law. Enquiries from prospects without a contract are deleted after 24 months without further activity. Product updates continue until you withdraw consent; necessary consent records may be retained longer to address legal claims. Platform data has separate retention periods: records of user actions are generally kept for three years. Private Lumi chats are deleted after the practice’s chosen period of 1 to 90 days following the last change. Reports or notes created from them become part of the relevant documentation and have their own retention periods. For diagnostic data, the responsible practice determines the permitted purpose and any statutory documentation duties; there is no blanket ten-year period for all health data. Backups may contain deleted data until they expire: up to seven days locally and at Hetzner, and up to 35 days at Scaleway. Additional account and security data periods are explained in the app privacy policy.
Access, export, rectification and erasure
In the portal under Settings → Your data (Einstellungen → Deine Daten), a JSON export and an erasure request are available. A waiting period of seven days is provided for the automatic erasure process, during which you can withdraw the request. The self-service export and the automatic data clean-up do not yet cover all data areas. For additional information or a review of the erasure, contact your practice or us. Statutory retention obligations may prevent the erasure of certain data; this must be assessed for the specific case. Your rights of access, rectification, erasure, restriction, data portability and objection remain unaffected. You can withdraw consent with effect for the future. This does not affect the lawfulness of earlier processing. Where we rely on legitimate interests, you may object for reasons relating to your situation. You may object to direct marketing at any time without giving reasons. The statutory response period is generally one month; you must be informed of any permissible extension within this period. You can lodge a complaint with the Austrian Data Protection Authority or another competent supervisory authority.
Use on the iPhone
Where the athlete portal is used via the iPhone app (currently in pilot operation, not yet generally available in the App Store), the processing described here also applies when accessing via the app. Whether you use the platform in the browser or on the iPhone does not, in particular, change anything about the AI providers described or the possible transfers to third countries.
Data processing on behalf of the practice
Practices are responsible for their health data. Plenea provides the platform and processes data on the practice’s behalf. The data processing agreement (DPA) covers instructions, safeguards, service providers and the return or deletion of data. You can request the agreements and information about safeguards at datenschutz@plenea.at. These notices supplement your practice’s information about treatment or care.