Privacy Policy

Last updated: 11 September 2026

1. Who Is Responsible

Helia AI GmbH
Rossertstr. 34
65817 Eppstein, Germany
Email: team@relayathletic.com

Relay has two roles, depending on the data:

• Relay as controller: For coach accounts, subscriptions, our website, analytics, advertising, sales and support, we decide how your data is used. This policy covers that data.
• Relay as processor: When a coach, club or team ("coach organization") uses Relay to manage its athletes, the coach organization decides what data about those athletes is recorded and why. It is the controller, and we process the data on its behalf under our Data Processing Agreement. If your coach invited you to Relay, please direct privacy questions and requests to your coach. If you contact us instead, we will pass your request on and help your coach respond.

2. Data We Collect

2.1 Account Data

When you register for Relay, we collect your name, email address, and password. If you subscribe to a paid plan, we also process billing information through our payment processor, Stripe. We do not store full card numbers.

2.2 Usage Data

We automatically collect information about how you interact with our service, including pages visited, features used, browser type, IP address, device information, and error reports.

2.3 Athlete Data

Coaches and athletes enter training and performance data, including names, training programs, workouts, sets and loads, performance results, coach notes, questionnaire answers, body measurements, and results from connected devices such as force plates. We process this data on behalf of the coach organization (see section 1).

Some of this data can count as health data under Art. 9 GDPR, for example wellness questionnaire answers about sleep, soreness or injuries. The coach organization is responsible for having a legal basis for it, which is usually the athlete's explicit consent.

2.4 Messages and Media

We store chat messages, images, videos and files that coaches and athletes send each other in Relay.

2.5 AI Features

When you use AI features, such as the AI assistant, program generation or voice input, we send your request and the training data needed to answer it to our AI providers, OpenAI and Google (Gemini API). Voice input is transcribed into text. The providers may keep this data for a limited period for abuse monitoring under their terms. We also record AI requests and responses in PostHog to monitor the quality of AI features.

3. Purpose and Legal Basis

For data where we are the controller, we rely on:

• Contract performance (Art. 6(1)(b)): To provide and maintain the Relay service, process subscriptions, and deliver AI features.
• Legitimate interests (Art. 6(1)(f)): To ensure security, prevent fraud, fix errors, understand how Relay is used, and respond to sales and support enquiries.
• Consent (Art. 6(1)(a)): For optional advertising cookies (see section 4).
• Legal obligation (Art. 6(1)(c)): To comply with tax, accounting, and other legal requirements.

For athlete data, the coach organization determines the legal basis. For health data this is usually explicit consent under Art. 9(2)(a) GDPR.

4. Cookies and Tracking

4.1 Essential Cookies

We use essential cookies for authentication and session management. These are necessary for the service to function and do not require consent.

4.2 Analytics (PostHog)

We use PostHog, hosted in the European Union, for product analytics, heatmaps, error tracking and session recordings to understand how people use Relay and to fix problems. PostHog stores a pseudonymous identifier in a cookie and in your browser's local storage. Requests pass through our own domain, and IP addresses are anonymised.

4.3 Advertising

With your consent where the law requires it, we use Google Ads conversion tracking and Meta Pixel to measure the effectiveness of our advertising campaigns. These services may set cookies and collect data about your visit for ad targeting and conversion measurement.

4.4 Manage your preferences

5. Service Providers and International Transfers

We store Relay data in Google Cloud in Frankfurt, Germany. We use the following providers to operate Relay:

• Google Cloud (Germany): Hosting, database, file storage and backups.
• OpenAI (United States) and Google Gemini API (United States and other regions): AI features.
• PostHog (European Union): Product analytics, error tracking and AI quality monitoring.
• Stripe (European Union and United States): Payments.
• Resend (United States): Transactional email.
• Expo and Google Firebase Cloud Messaging (United States): Push notifications, which contain no training or health content.
• Google Workspace: Support email.
• Google Ads and Meta (United States): Advertising measurement, only with your consent. For the Meta Pixel, we and Meta are joint controllers for the collection of the data.

The full list of providers that process athlete data is on our sub-processors page. Transfers outside the European Economic Area rely on the EU-US Data Privacy Framework where the recipient is certified, or otherwise on the EU Standard Contractual Clauses.

6. Data Retention

• Account data: For as long as your account is active. You can ask us to delete your account at any time by emailing team@relayathletic.com. Deleted data is removed from our backups within 7 days.
• Athlete data: As instructed by the coach organization, and deleted within 30 days after it stops using Relay.
• Invoices and accounting records: 10 years, as required by German tax and commercial law.
• Analytics: Pseudonymous usage events up to 7 years; session recordings 30 days.
• Sales and support contacts: Until you object, or 2 years after our last contact.

7. Security

We implement appropriate technical and organizational measures to protect your data, including encryption in transit (TLS) and at rest, access restricted to named administrators with 2-step verification, daily backups, and regular security reviews. Details are in Annex 2 of our Data Processing Agreement.

8. Your Rights (GDPR)

Under the GDPR, you have the following rights:

• Access (Art. 15): Request a copy of the personal data we hold about you.
• Rectification (Art. 16): Request correction of inaccurate personal data.
• Erasure (Art. 17): Request deletion of your personal data.
• Restriction (Art. 18): Request that we restrict the processing of your data.
• Data portability (Art. 20): Receive your data in a structured, commonly used, machine-readable format.
• Objection (Art. 21): Object to processing based on legitimate interests.
• Withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at team@relayathletic.com. If your data is managed by a coach organization, we will forward your request to it (see section 1).

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement.

9. Changes to This Policy

We update this policy when our processing changes. The date at the top shows the latest version. We will notify you of material changes by email or in the service.