Elsara / Legal
Privacy Policy
Last updated 3 November 2026 · Effective 3 November 2026
Elsara ("we", "us") builds an adaptive fitness service made up of the Elsara member app, the Elsara Coach app and our coaching consoles. This policy explains what we collect, why, who can see it, and how to get rid of it.
1. What we collect
| Category | Examples | Why we hold it |
|---|---|---|
| Account | Email address, display name, profile photo, sign-in provider | To create and secure your account |
| Onboarding profile | Goal, training history, availability, injuries and constraints, dietary pattern | To build a plan that fits you |
| Body metrics | Height, weight, date of birth, sex reference | To set targets and track change |
| Activity logs | Meals, workouts, session notes, photos you attach | To score the day and adapt the plan |
| Health & wearable data | With your permission: sleep, heart rate, resting heart rate, heart rate variability, steps, distance, calories, exercise sessions and workouts, body weight, body fat and lean mass, VO2 max, respiratory rate, blood oxygen and skin temperature. On Android through Health Connect we may also read the further categories you grant: blood pressure, blood glucose, body temperature, height, hydration, nutrition, mindfulness sessions and menstrual cycle information. You choose each category in the system permission screen and can turn any of them off at any time. | To judge readiness and adjust load |
| Conversations | Messages between you, Elsara and your coach | To deliver coaching and keep a history |
| Voice | If you use voice chat or dictation, the audio you speak is sent to our speech providers to turn it into text and to produce spoken replies | To let you talk to the assistant |
| Photos | Photos you take or choose to log a meal, stored in your account and analysed by our assistant to estimate what you ate | To log meals |
| Phone number | If you sign in with a text-message code, your phone number; the code is sent through Amazon Web Services. See Text messages | To sign you in securely |
| Device and notification data | A push notification token identifying your device, device type and operating system, app version, IP address, timestamps and diagnostic logs. We use Google Firebase Crashlytics to receive crash reports and Firebase Analytics to understand which features are used, identified only by an opaque account identifier and a Firebase installation identifier. We never send health measurements, meal contents, messages or other free text to analytics, and we use no advertising identifiers and no cross-app tracking | To send notifications, keep the service working and secure it |
| Coach calendar (coach accounts only) | If a coach connects a calendar, we read the coach's events from Google Calendar, Microsoft Outlook or Apple iCloud so their availability and appointments appear in Elsara. We request either full read access to events or free/busy information only, depending on the coach's choice, and never modify calendar events. Connection credentials are encrypted and the coach can disconnect at any time | To show a coach their own schedule |
| Coach credentials (coach accounts only) | Certification documents a coach uploads, stored privately and visible only to the coach and Elsara administrators | To verify and approve coaches |
We do not collect payment card numbers. If we introduce paid plans, payment is handled by the app stores or a payment processor and card details never reach our servers.
2. Health data
Health and fitness data is the most sensitive thing we hold, and it carries extra commitments. With your explicit permission we read data from Apple Health (HealthKit) and Health Connect on Android. We commit that:
- Health data is never used for advertising, marketing or any form of ad targeting.
- Health data is never sold, rented or traded to anyone.
- Health data is never disclosed to third parties for their own purposes, including data brokers.
- We use it only to deliver coaching to you, and to operate and secure the service.
- You can revoke access at any time in your device's system settings, and disconnect the integration inside the app.
Full detail is on our Health Data Use page.
Google user data
Elsara's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Calendar data only to show a coach their own schedule inside Elsara. We do not use it for advertising, do not sell it, do not use it to train generalised AI models, and do not let anyone read it except as needed to provide the feature, for security, or to comply with law.
3. Who can see your data
Your coach
If you are assigned a human coach, that coach can see your profile, plan, logs, adherence and recovery data in order to coach you. Anything you choose to hide from your coach is withheld, and our coach-facing tools are built so hidden information is not reconstructed or inferred from surrounding data. Your coach cannot see other members' data.
Service providers
| Provider | Role | Region |
|---|---|---|
| Amazon Web Services | Hosting, database, file storage, email (SES), text messages (SNS), speech to text (Transcribe), text to speech (Polly), AI models (Bedrock), encryption keys | US East (N. Virginia) |
| Google Firebase | Sign-in with Google and Apple, push notifications, crash reporting (Crashlytics) and usage analytics | Global |
| Apple | Sign in with Apple, push notifications on iOS | Global |
| Z.ai (GLM models) | AI models that read your messages and photos and write the assistant's replies. Only after you allow it in the app (see section 4) | Per provider terms |
| NVIDIA (hosted AI models) | AI models that read your messages and photos and write the assistant's replies. Only after you allow it in the app (see section 4) | Per provider terms |
| Google, Microsoft, Apple iCloud (coach accounts only) | Calendar sync a coach chooses to connect | Per provider terms |
Providers act on our instructions under contract. They may not use your data for their own purposes.
Everyone else
We do not sell your personal data. We disclose it otherwise only where the law requires it, or to protect someone's safety.
Text messages (SMS)
- We text you only when you ask for a sign-in code. We never send marketing texts. Reply STOP to opt out.
- No mobile information will be shared with third parties or affiliates for marketing or promotional purposes.
- SMS opt-in data and consent are never shared with any third party.
4. The assistant and the AI services we use
Elsara's chat, voice, meal-photo and coaching features are powered by AI models run by other companies. The apps ask your permission before anything is sent to them: after you sign in, a screen lists what is sent and who receives it, and you choose Allow or Don't allow. Until you allow it, nothing goes to these services.
| AI service | What it receives | Why |
|---|---|---|
| Z.ai (GLM models) | Your messages, photos you attach (such as meals and body scans), and the parts of your profile, goals, plan, logs and health measurements needed for the answer | To understand your request and write the reply |
| NVIDIA (hosted AI models) | The same as above | To understand your request and write the reply |
| Amazon Web Services (Amazon Bedrock, Transcribe, Polly) | Voice recordings, the text of replies to be spoken, and the same data as above when a Bedrock model answers | Speech to text, text to speech, and AI replies |
If you are a coach, this includes the details of the clients you ask about: their profile, goals, plans, logs, and the health data they have chosen to share with their coach.
These services process the data under contract, only to produce the answer, over an encrypted connection. We do not permit them to train their models on your data, and they must protect it at least as well as this policy requires. Health values are included only when they are needed for the answer.
You can withdraw your permission at any time: in the Elsara app under Me, Account, Legal & consents, and in Elsara Coach under Me, Privacy. The AI features then stop and the rest of the app keeps working.
5. Where your data lives
Your data is stored in the United States (AWS US East). If you are in the EEA, the UK or India, this means your data is transferred outside your home jurisdiction. We rely on Standard Contractual Clauses or equivalent safeguards for those transfers.
6. How long we keep it
- While your account is open: for as long as you use Elsara.
- After you delete: removed from live systems within 30 days; encrypted backups age out within 90 days.
- Short-lived data: sign-in codes expire within minutes, and data export links expire after 15 minutes. When you disconnect a wearable or calendar we delete the stored credentials. When you delete your account we also delete your photos and voice-related data.
- Where law requires: a minimal record of the deletion itself, and anything we must keep for tax or legal reasons.
7. Your rights
Wherever you live, you can ask us to: access a copy of your data; correct it; delete it; export it; restrict or object to processing; and withdraw consent. If you are in the EEA or UK, these are your GDPR rights. If you are in India, these are your rights under the Digital Personal Data Protection Act. If you are in California, you additionally have the right not to be discriminated against for exercising them.
The fastest route is in the app: Me → Account → Delete account. Otherwise write to privacy@elsara.ai and we will respond within 30 days. See Delete your account.
8. Security
Data is encrypted in transit (TLS) and at rest. Access by our staff is limited to what is needed to run the service and is logged. Coach access is scoped to their own assigned clients and enforced server-side. See Security.
9. Children
Elsara is for adults aged 18 and over and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, write to privacy@elsara.ai and we will delete it.
10. Changes
If we change this policy materially we will tell you in the app or by email before the change takes effect. The "last updated" date above always reflects the current version.
11. Contact
Data controller: Elsara, Inc.
Privacy enquiries: privacy@elsara.ai
General: hello@elsara.ai