Scope
This Privacy Policy applies to Recovery, including its backend infrastructure, mobile application, mobile SDK, administration dashboard, integrations, and any deployment operated for sports organizations, teams, coaches, athletes, or partner platforms.
Data We May Process
Recovery may process athlete, wearable, readiness, recovery, sleep, training workload, subjective wellness, and performance data when that information is provided by users, organizations, connected systems, or approved API integrations.
How Data Is Used
Recovery uses data only to provide readiness insights, recovery recommendations, athlete monitoring, coaching workflows, reporting, product operation, security, and approved organization-level analytics.
Garmin Consent and Lawful Basis
Connecting Garmin to Recovery is optional. When you choose to connect your Garmin account, you are redirected to Garmin Connect, where you review the requested data permissions and explicitly approve consent before Garmin shares that data with Recovery. We rely on your consent as the lawful basis for collecting and processing Garmin data for the purposes described in this policy, including explicit consent for health-related data where required by applicable law. Recovery only accesses the Garmin data you authorize. You may decline consent; features that depend on Garmin data will then be unavailable.
Withdrawing Garmin Consent
You may withdraw your consent at any time through the Garmin Connect app or website. In Garmin Connect, open Settings, go to Connected Apps, select Recovery, and choose Disconnect to remove its access. This revokes the connection and stops further Garmin data sharing with Recovery. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn. We will stop processing previously received Garmin data on the basis of that consent; any data that must be retained under applicable law will be used only for that purpose. Disconnecting does not automatically delete your Recovery account or previously stored data. You may request deletion or contact us for help at info@thebluebox.dev.
API Data Restrictions
Data obtained via API is not shared with, processed by, or otherwise made available to any third-party, including external AI or data processing services.
Third-Party Sharing
Recovery does not sell, rent, disclose, or make athlete or API-obtained data available to third parties for advertising, marketing, external analytics, model training, AI processing, or unrelated commercial purposes.
Security
Recovery should apply reasonable technical and organizational safeguards, including access control, authentication, data minimization, secure transmission, logging, and environment-level controls appropriate for sensitive athlete and performance data.
Data Retention
Recovery data should be retained only for as long as necessary to provide the product, support the customer organization, comply with contractual obligations, maintain auditability, or satisfy applicable legal requirements.
Your Personal Data Rights
Subject to applicable data protection law, you may request access to your personal data and a copy of it; correction of inaccurate data or completion of incomplete data; deletion of your data; restriction of processing in the circumstances provided by law; and object to processing where that right applies. You may also request an export of the personal data you provided in a structured, commonly used, machine-readable format and, where applicable and technically feasible, its transfer to another service (data portability). You may withdraw consent at any time where processing relies on consent.
How to Exercise Your Rights
To exercise these rights, contact The Blue Box at info@thebluebox.dev with your name, account email, organization or team, and a description of your request. You may also contact your team, organization, or platform administrator when they manage your Recovery account. We may request information reasonably necessary to verify your identity and will coordinate with the responsible organization where needed. We will respond within the time limits required by applicable law and explain any applicable limitations or reasons we cannot fulfill a request. You may also lodge a complaint with your competent data protection authority.
Account and Data Deletion
Where Recovery deployments include user accounts, users may request deletion of their account and associated personal data by contacting The Blue Box at info@thebluebox.dev or by following the deletion process provided by their team, organization, or platform administrator. Requests should include the user's name, account email, organization or team, and a clear description of the data or account to be deleted. After verifying the request, Recovery will delete or de-identify eligible data from active systems within a reasonable period, subject to data that must be retained for legal, security, fraud prevention, contractual, backup, audit, or organization-level operational obligations.
Contact
For questions about Recovery privacy, data handling, API restrictions, or deployment-specific data governance, contact:
The Blue BoxEmail: info@thebluebox.devWebsite: https://www.thebluebox.devRecovery: Recovery product