Privacy Policy

1 What personal information we collect

We list personal information by source and state the purpose and legal basis for each item.

On access paths: the table lists the paths currently in use. How changes are handled is set out in section 13.

2 How we use personal information

We use your personal information only within the purposes below. Where we rely on what is necessary for the security and quality of the Services rather than on your consent or on performance of the contract, we have assessed that necessity.

• Providing the Services: establishing and maintaining your account, connecting devices, synchronising data, generating training plans and reports, matching you with a coach, and exporting your data on request.
• Improving the Services: analysing feature usage, diagnosing and fixing faults, assessing demand for new features. We do not use Garmin-derived data to train, fine-tune or evaluate any machine learning model.
• Communicating with you: service changes, security notices, beta invitations and content you have subscribed to. We do not send marketing communications unless you subscribe.
• Compliance and security: responding to rights requests, meeting legal obligations, and notifying the relevant parties and regulators of a security incident as required.
• Performing the contract: payments and subscriptions, settling coach services, and the remaining obligations of the contract between you and us.

3 Sensitive personal information

The sensitive personal information we process includes health and activity data (heart rate, HRV, sleep, stress, respiration, body composition, height, weight, maximum heart rate), activity traces, and information relating to children under fourteen.

We process it only with your separate consent, and apply data minimisation: only the information required for the specific feature, not what is technically convenient. Full name and date of birth do not enter the report model; precise GPS traces are not sent to model providers; original food photographs are deleted immediately after recognition.

Withdrawal is described in section 12. Withdrawal does not affect processing carried out before it; after withdrawal we delete the corresponding data within 30 days and stop all processing other than storage and the security measures necessary to protect it.

How separate consent is obtained: during registration and device connection, sensitive-information processing, AI processing, disclosure to third parties and cross-border transfer are each obtained individually and are not bundled with a general consent. You may refuse any one of them without affecting the other features; refusing sensitive-information processing means training plans cannot be generated.

4 Device brands: access and attribution

This section sets out the rules that apply to every device brand we connect. Access paths and revocation per brand are in the brand table in section 1. Where an individual brand's agreement or brand guidelines impose requirements different from these general rules, we set them out separately in a brand-specific notice; see the index at the end of this section.

General rules (all device brands)

• Authorization: authorization is completed on the authorization page the brand provides. We never ask for your credentials for that brand, and we do not implement any alternative authorization mechanism the brand has not approved in writing. Granting, scoping and revoking authorization are handled by the brand within your account.
• Limits on use: device data is used only to serve you personally. We do not sell, license or rent it to third parties; we do not use it for advertising; we do not expose it through any API of our own to third-party applications; and we do not open a data access path outside the Services to coaches or anyone else.
• No implied endorsement: we do not state or imply in marketing, in the interface or in external communications that any device brand endorses, certifies, sponsors, approves or recommends the Services.
• Not used to train models: device data and content derived from it are not used to train, fine-tune, evaluate or improve any machine learning model, and do not enter any model-improvement corpus.
• Withdrawal: you may withdraw authorization in the app's Settings, or revoke it in the brand's own account; where access is through an aggregation service, you may also revoke that service's authorization. Any route takes effect.

Attribution

Wherever device-brand data is displayed — screens, reports, charts and exported files — we attribute the brand as the data source in accordance with the brand guidelines it publishes. Where the data is combined with other sources or used as an input to our algorithms, the brand is listed as a distinct or contributing data source, without implying that it endorses other devices or data. Attribution is preserved in exports.

Brand-specific notices

A brand-specific notice forms part of this Policy and addresses only that brand's access path, data scope, display attribution, or obligations specific to that brand's agreement. Where such a notice differs from the general rules in this section, the notice prevails for that brand; matters it does not address remain governed by this Policy. Brands not listed below, and without such a notice, are governed directly by the general rules in this section.

How this Policy changes when a brand is added: we add the corresponding row to the brand table in section 1 and to the attribution table in this section, and we update this Policy under section 13 before opening access. Only where a brand's agreement or brand guidelines impose requirements different from the general rules above do we issue a separate notice for that brand; each such notice stands alone and does not affect other brands. A change of access path does not affect the application of the rules in this section.

5 AI processing and automated decisions

We use artificial intelligence systems to reason and produce training-plan drafts, nutrition guidance and coach summaries. This section is a summary; the full AI transparency statement is in section 1 of Appendix I.

AI transparency statement: ① Nature and purpose: reasoning over a de-identified summary of your authorized training load, sleep and recovery to produce written training-plan drafts and guidance; no automated decisions with a significant effect on you. ② Explicit consent: sought separately before processing begins. ③ Withdrawal at any time: withdraw in Settings, after which we stop sending data to model providers. ④ Kept up to date: this statement is updated to reflect changes in applicable law, regulation and Garmin policy.

• Scope: we send model providers a de-identified summary only: periodized training load, aggregated sleep and recovery metrics, and the training goals you have stated. We do not send account identifiers, contact details, precise GPS traces or raw .FIT files.
• Provider constraints: providers are used for inference only. We use only products whose terms expressly commit that call data is not used to train models: we currently use the pay-as-you-go API of Alibaba Cloud Bailian (Tongyi Qianwen), whose terms commit that call data is not used for model training and that data is retained by default for no more than 30 days. Before changing or adding a provider we confirm that it offers equivalent constraints and update this Policy.
• We do not train our own models: we do not use your data to train our own models; model output is not used to train any model; and Garmin-derived content (prompts, responses, conversation logs, summaries, suggestions, insights) does not enter any model-improvement corpus.
• Human review: a training-plan draft is reviewed by a human coach before it is presented as formal guidance. AI suggestions are not medical advice; consult a physician about health concerns.

Automated decision-making: we do not make decisions that have a significant effect on you using algorithms or other automated processing. We do not build automated profiles, and we do not price or restrict your use of the Services on the basis of automated outcomes.

6 How we share personal information

On weather context: environmental weather context in training reports is provided by an external weather service. We send it only a city-level coordinate and the activity date; queries for the same city use the same coordinate and contain no location information identifiable to a particular individual. This therefore constitutes neither a sharing of personal information nor a cross-border provision of personal information, and is not listed in the table above.

Beyond the table, we disclose information only where we have your valid consent; where required by a valid subpoena, legal order or regulatory demand; where necessary to enforce our terms and policies; or where indispensable to judicial relief and the defence of our legal rights. If our business or assets undergo a reorganisation, merger, sale, joint venture or transfer, we may transfer personal information, but without notifying you or obtaining your consent, and the transferee may not process the data beyond the purposes required by this Policy.

Invited professionals: coaches, nutritionists and rehabilitation specialists can view the training plans, training load and related records of the members assigned to them, inside the Services. We give them access only to their assigned members, and no external interface for bulk retrieval. They are bound by the confidentiality and processing obligations in this Policy and remain responsible for the member data they handle.

7 Cross-border transfers

Business data is stored in mainland China. Reading your device data from services located outside the PRC is inbound transfer and does not constitute a cross-border transfer. Save as set out below, we do not provide personal information outside the PRC:

• Once we establish a direct connection with a device manufacturer and enable training-plan push, the plan content pushed will be transferred to that manufacturer's servers outside the PRC. This does not occur before a direct connection is established.

Where such a transfer occurs, we follow Article 38 of the Personal Information Protection Law, using lawful routes such as the Standard Contract on Cross-border Transfer of Personal Information, and we complete a personal information protection impact assessment before the transfer, retaining the report for not less than three years. At the point of authorization we separately inform you of the overseas recipient, the purpose and method of processing, the categories of personal information, the retention period and how to exercise your rights, and we obtain your separate consent.

On withdrawal of the relevant consent we stop the corresponding transfer and delete the data as described in the Garmin Data Connection Notice.

8 Cookies and application analytics

motion.vicnext.cn uses strictly necessary cookies and local storage to maintain sign-in state and page function. We do not use advertising cookies, cross-site behavioural tracking SDKs or third-party advertising pixels.

The usage data we collect in the app includes feature usage frequency, page navigation paths, API call records, error and crash logs, and device model and system version. It does not include your name, contact details or precise location, nor Garmin-derived content used to improve models or prompt templates. We collect feedback and survey responses you voluntarily submit, to improve the product and services.

The full description is in Appendix II.

9 Storage and retention

Unless otherwise stated, business data is stored in mainland China. Retention is limited to the shortest time necessary for the relevant purpose.

When a retention period expires we delete the corresponding information and all backups; where deletion is technically not immediately possible, we stop all processing other than storage and the security measures necessary to protect it. On cancellation of an account, all data is deleted within 30 days.

10 How we safeguard information

Technical and organizational measures: encryption in transit; irreversible password storage; separate, encrypted storage of authorization credentials and health data; least-privilege access with logging; a data classification and retention schedule reviewed periodically; and an incident response process.

Where personal information is or may be leaked, altered, lost or illegally used, we take remedial measures to mitigate the impact on you, and notify you, notify the relevant counterparties and report to the regulator as required by law and the agreement.

We contractually bind all processors and invited professionals to process personal information in accordance with this Policy and applicable law, and not to use it beyond the agreed purposes.

11 Children

The Services are intended for athletes aged fourteen and above. We advise against registration and use by children under fourteen, and against the provision of their personal information to us. We do not knowingly collect such information, and delete it promptly on discovery.

Users aged fourteen but under eighteen should use the Services with the consent and accompaniment of a parent or guardian.

12 Your rights

Under the Personal Information Protection Law of the PRC and the laws applicable in your jurisdiction, you may exercise the following rights. We respond within 15 business days of receiving your request.

• Access and copy: obtain the personal information we process about you.
• Rectification: require correction of inaccurate or incomplete information.
• Erasure: require erasure of the personal information we process about you.
• Withdrawal of consent: withdraw consent you previously gave, without affecting processing carried out before it.
• Restriction: require restriction of processing for a specified purpose.
• Objection: object to processing based on consent or on the necessity described above.
• Portability: request a copy of your personal information and its transfer to a controller you specify.
• Explanation of rules: require an explanation of the rules governing personal information processing.

How to exercise them: in the app, under Settings you can withdraw consent for sensitive information, for AI processing and for coach data sharing, and can access, export and delete your data. You may also submit a written request using the contact details in section 14. To withdraw Garmin data, you additionally need to revoke our authorization in Garmin Connect.

Complaints: if you consider that our handling infringes your rights, you may file a complaint with the competent cyberspace administration authority or other personal information protection authority in your locality.

13 Updates to this Policy

As product features, service providers and data-processing practices change, and as laws and standards are revised, we may update this Policy. Updates take effect from the date shown at the top of the page; earlier versions are recorded in Appendix III.

Material changes are notified to you in-app or by email, and we seek your consent again where applicable law requires it. Where a device brand's access path changes, we will update this Policy and that brand's connection notice before opening access for that brand.

14 How to contact us

If you have questions, comments or complaints about this Policy or how we handle your information, contact us as below. We respond within 15 business days of receiving your request; if you are not satisfied with our response, you may file a complaint with the competent personal information protection authority in your locality.

Garmin Data Connection Notice

This notice addresses only the matters specific to Garmin data — data scope, detailed attribution rules, and the prohibition on altering the original data — and forms part of the VicMotion Privacy Policy. Where this notice differs from the general rules in section 4, the notice prevails for Garmin data; matters it does not address remain governed by this Policy. The general rules in section 4 also apply to Garmin data and are not repeated here. Garmin device-sourced data means any data accessed, retrieved, received or transmitted through the Garmin Connect Developer Program, including activity data, health data and derived content generated from them.

Authorization and access path

Authorization is completed on Garmin's side; granting, scoping and revoking it are handled by Garmin within your Garmin account. The authorization rule in section 4 and the access path in the brand table in section 1 also apply.

Scope of application: the clauses in this notice on data scope, how we use it, attribution for derived metrics and revocation apply to our processing of Garmin data and do not change with the access path (direct or via a third-party aggregation service). The clauses on pushing training plans and the corresponding cross-border transfer apply once we have established a direct connection with Garmin.

The Garmin data we receive

We do not receive Garmin data unrelated to training, such as golf data, women's health data, location backfill (available only under enterprise access and requiring you to enable it separately), or your social and community activity on Garmin's side.

How we use that data

Garmin data is used only to serve you personally: identifying and classifying training sessions; computing a training-load series; establishing a personal baseline; estimating recovery and adjusting load; displaying your own data; and producing exportable training summaries. The limits listed under "Limits on use" in section 4 also apply to Garmin data.

We do not alter the original data: except where the law permits, we make no modification to End User Personal Data provided by Garmin, adjusting only its presentation format where needed, and we do not distort the meaning of the original metrics. Only de-identified summaries enter model processing — see Appendix I.

Derived metrics and attribution

Metrics computed from Garmin data — the training-load series (CTL/ATL), steady-state session detection, recovery scores and training plans — are derived content containing Garmin device-sourced data, and carry the same attribution requirements as the original data.

• Placement: the attribution "Garmin [device model]" appears directly beneath or adjacent to the primary title of any screen, dashboard, report or summary displaying Garmin device-sourced data. It must be above the fold and visually associated with the data it supports, and must never be buried in a tooltip, footnote or expandable container.
• When the model is unknown: list Garmin as the data source.
• Combined data: where Garmin data is combined with other sources or used as an input to our algorithms, Garmin is listed as a distinct or contributing data source, and nothing may imply that Garmin endorses other devices or data.
• Exports and sharing: exported files, printed reports and images shared externally must carry a visible Garmin attribution. In exports, the attribution sits adjacent to the data and is repeated on each page.

Acceptable wording: "Garmin Forerunner 965"; "Insights derived in part from Garmin device-sourced data."; "This chart was created using data provided by Garmin devices."
Not acceptable: wording such as "Garmin speed model", which could imply endorsement.

Pushing training plans (applies once a direct connection is established)

Once authorized, we can push structured training plans to your Garmin device through the Garmin training interface. What we push consists of the plan name, structured training steps and target intensity ranges. Before pushing, we seek your consent for training-plan push as a separate step in the consent flow.

Cross-border transfer (applies once a direct connection is established)

Garmin Connect's international service and its servers are outside the PRC. Once training-plan push is enabled, the plan content pushed constitutes a cross-border transfer. Before enabling that feature we will enter into the Standard Contract on Cross-border Transfer of Personal Information with Garmin and complete the required filing, obtain your separate consent for the transfer, and complete a personal information protection impact assessment.

Revoking authorization and deleting data

There are three routes, and any of them takes effect immediately: withdraw the Garmin authorization in Settings; revoke our authorization in Garmin Connect; and, while access is through an aggregation service, revoke VicMotion's authorization in that service. After the access path changes, the third route is as listed in the brand table in section 1.

After revocation we stop receiving new Garmin data and stop pushing training plans on Garmin's side. Data already received is handled under the retention periods in section 9; if you withdraw your separate consent for sensitive information, the corresponding data is deleted within 30 days. If you revoke on Garmin's side without withdrawing consent in the app, we will prompt you to do so.

Appendix I AI Processing Notice

This Appendix explains how we use artificial intelligence to process your data when generating training-plan drafts, nutrition guidance and coach summaries, and forms part of this Policy. The role of AI in the Services is to produce drafts for you and your coach to review, not to make the final judgment. AI processing means reasoning over data with a large language model or similar model to generate textual output; prompt content means the input we send with a request; model output means what the model returns to us.

1. AI transparency statement

We use artificial intelligence systems to process your data. We make the following statement in four parts:

• Nature and purpose: the AI systems reason over a de-identified summary of your authorized training load, sleep and recovery to produce written training-plan drafts, nutrition guidance and coach summaries. We do not use AI to make automated decisions that have a significant effect on you.
• Explicit consent: before this processing begins, we seek your consent for it separately during registration and device connection; that consent is not bundled with your general consent to this Policy.
• Withdrawal at any time: you may withdraw consent for AI processing at any time in Settings, after which we stop sending data to model providers; withdrawal does not affect the retention or display of content already generated.
• Kept up to date: this statement is updated to reflect changes in applicable law, regulation and Garmin policy, effective from the date shown at the top of the page.

2. What enters the model

Full name and date of birth do not appear in the data sent to the model. Height, weight and sex are passed only as profile context alongside the aggregated data, to explain the basis of your guidance.

3. Purpose and legal basis

Processing is limited to four purposes: producing training-plan drafts for coach review; producing nutrition and fuelling guidance; explaining your training state and recovery; and producing a daily summary for you. We do not use AI processing outside those purposes, and we do not price the Services, restrict your use of them, or treat you differently on the basis of model output. The legal basis is your separate consent; on withdrawal we stop sending your data to model providers immediately.

4. Model providers

On provider selection: we use only products whose terms expressly commit that call data is not used for model training. Where Bailian is used, it is the pay-as-you-go API or the team edition; its Coding Plan and individual Token Plan carry different data-use terms that authorize use of inputs and outputs for service improvement and model optimisation, and we do not use them. We update this Appendix before using a new or changed provider.

5. Our constraints

• We do not train our own models: we do not use your data to train our own models, and model output is not used to train any model.
• Garmin-derived content never enters model-improvement corpora: Garmin device-sourced data, and the prompts, responses, conversation logs, summaries, suggestions and insights generated or derived from it, are not used to train, fine-tune, evaluate or improve any machine learning model, and are not included in any corpus or dataset used for model improvement.
• Our own logs are excluded: call logs in our systems do not contain Garmin-derived content used to improve models or prompt templates. Those logs are retained for the period stated in section 9.
• We do not provide it onward: we do not provide your data or model output to third parties for their own products or model training.
• No significant automated decision-making: we do not make decisions that have a significant effect on you based on model output, and we do not build automated profiles.

6. Human review and limits of responsibility

A training-plan draft is reviewed and amended by a human coach where necessary before it is presented as formal guidance; your coach may override any part of a draft. AI-generated suggestions are not medical advice, and are not a diagnosis or a rehabilitation protocol; if you have health concerns, an injury or a rehabilitation need, please consult a physician or rehabilitation specialist. We do not use model output as the basis for professional medical, diagnostic or treatment decisions. Nutrition guidance is labeled as an estimate rather than a measurement.

7. Your controls

You may withdraw consent for AI processing at any time in Settings. After withdrawal we stop sending your data to model providers; reports and plans already generated are retained and handled under the retention periods in section 9. You may also disable personalization, after which we stop generating targeted guidance based on your history. Neither action affects your use of the other features.

Appendix II Cookie and Application Analytics Policy

This Appendix describes which cookies and local storage motion.vicnext.cn uses, and which usage data we collect in the app, and forms part of this Policy. A cookie is a small piece of text a website writes to your browser when you visit it, used to recognize your device on later visits; local storage is data written directly to your browser or device by the page, not sent with each request. We refer to both as "storage".

What storage we use

None of this storage contains your name, contact details, precise location or device traces, nor Garmin-derived content used to improve models or prompt templates. Necessary storage is what the Services depend on: if you refuse or clear it, signing in and some features will not work.

Analytics

None of this data is shared with advertisers or used for ad targeting. We process it on the basis of what is necessary to keep the Services secure, stable and of adequate quality, within the limits of what is necessary; we have assessed that necessity and applied de-identification and time-limited retention. Usage records and error logs are retained for 12 months.

What we do not use

• Third-party cookies for advertising targeting;
• Cross-site behavioural tracking SDKs or scripts;
• Third-party advertising pixels or ad measurement code;
• Browser fingerprinting or other cross-device identification techniques;
• Selling, renting or sharing your browsing and usage records with advertisers.

How to manage storage

You can clear or refuse storage in your browser settings. Refusing necessary storage means you cannot sign in and some features will not work; after clearing, you will need to sign in again. Inside the app you can also withdraw consent for health data and for AI processing, disable personalization, and export or delete your data — see section 12.

Appendix III Policy History

This Appendix archives successive versions of this Policy and forms part of it. of this Policy. This is the first version; each subsequent version will be published here, and material changes will be notified separately. The current version is the one indicated by the date at the top of the page, and it is the version that applies to you; earlier versions are retained for reference only.

What version 1.0 covers: the personal information and sensitive personal information we collect and how it is categorised; the rules, purposes and legal bases for processing, by source and by purpose; the device brands we have connected, with their access paths and the routes for authorization and revocation; attribution requirements for Garmin device-sourced data; the scope of AI processing and the constraints on model providers; the third-party sharing list with each party's role and the data received; the circumstances of cross-border transfer and the separate consents obtained; storage locations and retention periods by category; security safeguards; the terms relating to children; your rights and how to complain; and the cookie and application analytics policy.

How changes are notified

Where a material change is made, we notify you in-app and by email. Where a change affects the processing of sensitive personal information, AI processing, disclosure to third parties, or cross-border transfers, we seek your consent again before the change takes effect. Each updated Policy takes effect from the date shown at the top of the page and is archived in this Appendix; earlier versions no longer apply.

If you need the full text of an earlier version for your records or for comparison, contact us at privacy@vicnext.cn.