Where the data is stored
The core application and the database run at Hetzner in Helsinki. AI content is processed exclusively by Mistral/Voxtral in the EU/EFTA region. Other services and operational metadata remain separate considerations.
Know what happens to the data.
Plenea works exclusively with Mistral and Voxtral in Europe (EU/EFTA). AI supports text, analysis, document search and speech. Mistral does not retain inputs and responses beyond processing or use them to train AI. This storage setting, enabled for Plenea, is called Zero Data Retention. Technical operational data and other services follow separate rules. Depending on the task, AI receives health data, text or audio; text filters do not guarantee complete anonymisation.
What matters.
In short.
Consent
Your athletes give consent in the portal, or an authorised person in your team records the consent.
Export and deletion
In the portal, athletes can export their data and request deletion. Other requests go through the practice or our data protection contact.
How Plenea protects the data
Each practice only sees its own data. Rules directly in the database ensure this. Within the practice, roles determine who may see what. Changes and consents are logged. We store secret credentials such as 2FA keys and wearable tokens encrypted. On its own, however, this does not prove that your use of Plenea is fully GDPR-compliant.
- Core application and database in the EU
- Separate data per practice, rights per role
- Secret credentials stored encrypted
Which AI providers for what
Plenea works exclusively with Mistral and Voxtral in Europe (EU/EFTA). AI supports text, analysis, document search and speech. Mistral does not retain inputs and responses beyond processing or use them to train AI. This storage setting, enabled for Plenea, is called Zero Data Retention. Technical operational data and other services follow separate rules. Depending on the task, AI receives health data, text or audio; text filters do not guarantee complete anonymisation.
Consent
If an athlete has actually consented to the use of AI, the practice can record this in Plenea. The purpose, version, time and the way in which the consent was recorded are stored. AI features that work with a specific person’s data only run under two conditions: there is a current, explicit AI consent, and the person is of age according to the stored date of birth. This applies regardless of where the data comes from. For minors or where the age is unknown, these features remain blocked. A withdrawal blocks new personal AI processing. You can continue to use features without AI. The limits of a withdrawal are set out in the data protection details.
Access, export and deletion
Athletes can export their data as a JSON file in the portal and request deletion there. A waiting period of seven days applies before automatic deletion. Export and automatic deletion do not yet cover all data areas. Further information requests and the review of a deletion go through the responsible practice or our data protection contact. Statutory retention obligations may need to be observed in individual cases.
Who is responsible for what
As a rule, your practice is the controller for the data it processes in Plenea. Plenea is a processor, meaning it processes the data on behalf of your practice. The data processing agreement (DPA) and the legal basis for health data and AI must fit your specific use. You can get contract documents and details of the service providers we use on request. EU hosting or a DPA template does not replace this review.
Is Plenea right for the way you coach?
Show us how you work. We’ll show you how Plenea fits in.