Orka Run – Privacy Policy

3.1 Information You Provide

• Account Information: Your name, email address, date of birth, gender, username, and password (stored hashed).
• Profile Information: Information you provide about yourself, such as your profile photo, fitness goals, target race distance, target race date, current fitness level, previous longest run, weight (optional), and weekly training availability.
• Coach Chat Messages: Content of text messages you send to elite running coaches through in-app Coach Chat, and their replies to you.
• Support Information: Information you provide in connection with support requests, including emails, messages, or feedback you send to our team.

3.2 Information We Receive from Your Connected Devices and Health Platforms

When you connect Orka Run to a wearable device or health platform, we receive Activity Data from that service. We do not collect this data independently — it flows to us only through the integrations you authorize.

“Activity Data” includes:

• Date, time, and duration of workouts
• Distance, pace, speed, cadence, and splits
• Heart rate (resting, active, and recovery)
• Calories burned
• Perceived exertion (if recorded by your device)
• GPS route data (as recorded by your wearable, not by Orka Run)
• HRV and recovery metrics (where supported by your device)
• Workout type and adherence to your training plan

Sources we receive Activity Data from:

• Strava — past and ongoing run activities, including distance, pace, heart rate, and GPS routes recorded by Strava
• Apple Health / HealthKit — heart rate, distance, pace, step count, workout data, and body measurements (only the categories you grant permission for)
• Apple Watch — heart rate and workout data synced through Apple Health
• Garmin Connect — workout data, heart rate, GPS routes, and recovery metrics (only the categories you grant permission for)

3.3 Information Generated by Your Use of the Services

• Usage Information: Which screens you view, which features you use, session duration, frequency of app opens, your preferences, and actions you take such as clicking links or logging in.
• Performance Metrics: Metrics we generate from your Activity Data to help you analyze your performance, such as your race-readiness score, fitness trend, and personal records.
• Adaptation Data: How Orka Run's adaptive engine has adjusted your plan based on your sessions, missed sessions, and recovery indicators.
• Device Information: Device model, operating system version, IP address (used for security and analytics), app version, log files, and analytics information.
• Diagnostic Data: Crash reports, error logs, and performance data.

3.4 Information from Other Sources

• Third-Party Accounts: You can sign up and log in using accounts with Google or Apple (“Third-Party Accounts”). If you do, we receive your name, email address, profile information, and unique user identifier. To control what we receive, adjust your privacy controls in the Third-Party Account.
• Payment Information: If you make a payment on Orka Run, we collect information about your purchase. We do not collect your payment card information. We use PCI-compliant third-party payment services.

5.1 To Provide the Services

Create and update your account; receive and process your Activity Data from connected devices; generate your adaptive training plan; adjust your plan after each session based on received performance data; calculate your race-readiness score; display your runs, progress, and training history; deliver Coach Chat replies from elite running coaches; send you reminders and session prompts (if notifications are enabled); and contact you about the Services.

5.2 To Assist You with a Request

We use information to provide support in response to your requests and comments. This may require us to access your account to troubleshoot or replicate a reported issue.

5.3 To Analyze and Improve Our Services

Measure traffic and usage trends, understand how users interact with our Services, identify and fix bugs, and improve features. This may include the use of analytics SDKs and crash reporting.

5.4 To Provide AI and Adaptive Training Features

We use and develop machine learning (“ML”) and artificial intelligence (“AI”) to provide features designed to enhance your training and improve the Services (“AI Features”). Our AI Features include generating and adapting your training plan, analyzing your performance, calculating your race-readiness score, and providing personalized training insights. We may use Activity Data, Profile Information, and other personal information to train, fine-tune, and improve our internal ML and AI models.

5.5 To Communicate with You

Respond to your support requests; send service notifications (security alerts, terms changes, important product news); and send optional marketing emails (only if you opt in — you can unsubscribe at any time).

5.6 To Protect You, Others, and the Services

Detect, prevent, and investigate fraud, abuse, or misuse; moderate Coach Chat content for safety; enforce our Terms; and protect against unauthorized access to accounts. We may also process your data when we believe it is necessary to prevent serious harm.

5.7 To Manage Legal and Regulatory Obligations

Comply with applicable laws; respond to lawful requests from authorities; and enforce our agreements and protect our legal rights.

6.1 Service Providers

We share your information with third-party companies that help us run Orka Run. These providers process data on our behalf, under contracts that limit how they can use it. Examples include cloud hosting providers, analytics providers, crash-reporting providers, email delivery services, payment processors, and customer support platforms.

6.2 Coaches

When you send a message via Coach Chat, the coach you are chatting with sees:

• the content of your messages;
• your first name and profile photo (if any); and
• your current training plan, race goal, race date, and recent session data — so they can give relevant advice.

Coaches are bound by confidentiality agreements with Orka Run and are not permitted to share your data outside the Services.

6.3 Third-Party Services You Have Connected

When you connect Orka Run to Strava, Apple Health, or Garmin Connect, data flows between Orka Run and that service in line with your authorization. Each of these services has its own privacy policy. Information you provide to these third parties is subject to their terms and policies.

6.4 Legal Requirements and Prevention of Harm

We may preserve and share your information with third parties, including law enforcement or governmental agencies, if we determine that the law compels or reasonably requires such disclosure. This may include responding to court orders, warrants, subpoenas, or other legal process.

We may also disclose your information if we determine it is reasonably necessary to: (1) prevent death, serious bodily injury, or other significant harm; (2) address issues of national security or public importance; (3) prevent or detect violations of our Terms or fraud or abuse of Orka Run or its users; or (4) protect our operations, property, or legal rights.

6.5 Corporate Transactions

If Orka Run becomes involved in a merger, acquisition, securities offering, bankruptcy, reorganization, dissolution, or other similar transaction, we may share or transfer your information in connection with such transaction.

6.6 Aggregated and Deidentified Data

We may share aggregated, statistical data that cannot be used to identify you (such as “average marathon training plan completion rates”) with research partners, the public, or in marketing materials.

8A. Children's Privacy

Our Services are not intended for, nor directed to, children under 18 years of age, and we do not knowingly collect personal information from anyone under 18. If you are under 18, do not use the Services.

If we discover that we have collected personal data from a person under 18, we will delete it. If you are a parent or guardian who believes your child has provided data to Orka Run, contact us at privacy@orkarun.com.

8B. How We Protect Information

We implement administrative, technical, and physical safeguards in accordance with industry standards. These include encryption in transit (TLS) and at rest, restricted internal access on a need-to-know basis, regular security reviews, and incident response procedures.

No system is ever 100% secure. If we discover a data breach that affects your personal data, we will notify you and the relevant authorities as required by law.

8C. Retention of Information

We retain information as long as needed to provide the Services, subject to our legal obligations.

• Account data: kept until you delete your account; then deleted or anonymized within 90 days, except where law requires retention.
• Activity data received from connected devices: kept while your account is active; deleted with your account.
• Coach Chat messages: retained for 24 months for safety, quality, and legal compliance, then deleted.
• Diagnostic and analytics data: typically kept for 12–24 months in identifiable form, then aggregated.
• Payment records: retained for the period required by applicable US tax law (typically 7 years).

9.1 Categories of Personal Information Collected

In the past twelve (12) months, we have collected the following categories of personal information:

• Identifiers (such as name, IP address, email address, and unique user identifiers)
• Personal information categories listed in the California Consumer Records statute (such as name, contact information)
• Protected characteristics under California or federal law (such as age and gender)
• Sensitive personal information (such as health information received from connected wearables, and Coach Chat message content)
• Commercial information (such as subscription status, if any)
• Internet or similar network activity
• Geolocation information (received from connected wearables and Strava, not collected independently by Orka Run)
• Audio, electronic, visual, or similar information (such as photos)
• Inferences drawn from any of the above-listed categories (such as race-readiness score and personalized training recommendations)

9.2 Categories of Sources

We collect personal information from the following categories of sources:

• Directly from you (such as when you sign up, create your profile, or send a message to a coach)
• From wearable devices and health platforms you connect to Orka Run (such as Strava, Apple Health, Apple Watch, and Garmin Connect)
• Automatically from your use of the Services (such as usage data, device information, and diagnostic data)
• Service providers (such as analytics and crash reporting)

9.3 Sale and Sharing of Personal Information

We do not sell personal information for monetary value. We do not “sell” or “share” the personal information of users we know are under 16 years old (and our Services are intended only for users 18 and older).

To the extent that certain US State Privacy Laws consider some sharing of personal information for advertising purposes to be “selling” or “sharing,” Orka Run may, in the future, share Identifiers, Commercial Information, or Internet or similar network activity with advertising publishers and analytics partners. Where this occurs, we will provide a clear opt-out mechanism via our website footer and within the app.

We do not sell or share health data received from connected wearables or Apple Health for any purpose, including advertising.

9.4 Data Subject Rights under US State Privacy Laws

Only you or someone legally authorized to act on your behalf may make a request related to your personal information. The following rights may be available to you:

• Right to Know: request the categories and specific pieces of personal information we have collected about you.
• Right to Delete: request that we delete personal information we have collected from you.
• Right to Correct: request that we correct inaccurate personal information.
• Right to Opt Out of Sale or Sharing for Targeted Advertising: where applicable, opt out of the sale or sharing of your personal information.
• Right to Limit Use of Sensitive Personal Information: we do not use or disclose sensitive personal information for purposes other than those permitted by law or with your consent.
• Right to Non-Discrimination: we will not discriminate against you for exercising any of your privacy rights.
• Right to Appeal: you may have the right to appeal our decision regarding a request related to your privacy rights.

To exercise these rights, email privacy@orkarun.com. We will respond within the time period required by applicable law.

9.5 Authorized Agents

You may appoint an authorized agent to exercise any of your privacy rights on your behalf. To verify that your agent acts on your behalf, we will ask for proof and may require you to also verify your identity.

9.6 California Consumer Health Data and CMIA

For California residents: Orka Run processes consumer health data (such as heart rate, recovery metrics, and Activity Data received from your connected wearable) for the purposes described in this Policy. We do not share this data with third parties for advertising purposes without your explicit consent. Where applicable, we comply with the California Confidentiality of Medical Information Act (CMIA).

9.7 Washington State My Health My Data Act (MHMDA)

For Washington State residents: Orka Run receives consumer health data as defined under the MHMDA, including heart rate, exercise data, and workout metrics from your connected wearable, and Coach Chat messages that may reference health. We process this data only with your consent (which you provide by accepting this Privacy Policy and connecting your device) and only for the purposes described in this Policy. You have the right to access, delete, and withdraw consent for our processing of your consumer health data. Email privacy@orkarun.com to exercise these rights.