Vadonaa Privacy Notice

Version 2.7 · Last updated: November 2026 (2026-11-02)

This notice explains which of your data we use, what for, with whom, and what you can do about it. We wrote it to be understood. If anything is unclear, write to us at privacidad@vadonaa.com.

I. Who is responsible for your data

Vadonaa, S.A.S. de C.V. ("Vadonaa", "we"), with tax ID (RFC) pending and registered address at Colima, Colima, Mexico, is the data controller responsible for processing your personal data under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (the "Law") and other applicable provisions. Email for anything about your data: privacidad@vadonaa.com.

II. What data we collect and which is sensitive

We only ask for what is needed to provide the service. The table says what the data is, whether the Law treats it as sensitive, what we use it for, on what basis, and with whom it is shared.

What we don't collect. We don't ask for your full name, your phone number or your address. We don't use your location. We don't read HealthKit or any other health data from your phone. We don't ask you to describe your injury or any condition. We don't ask for data on ethnic origin, religion, sexual orientation, political opinions or any other sensitive data other than the health data listed above.

Your payment data (card, Apple ID or Google account) is collected and processed by the store where you bought, Apple or Google, as an independent controller, under its own privacy notice. It never reaches us.

On your phone the app stores only what is needed to keep your session open, your screen preferences and a copy of your training week (the sessions and the weights you logged) so you can see it without signal; that copy doesn't carry your date of birth or your areas, and it is deleted when you sign out or delete your account. The answers you give at the start aren't stored on the phone until you send them. While you decide whether to allow analytics, the phone also stores the usage events of the first steps (that you installed the app, which onboarding screens you saw and that you created your account), without health data; if you allow it, they are sent with their original time, and if you don't allow it or delete the app, they are discarded without leaving the phone.

III. What we use your data for

Necessary purposes. Without them we can't provide the service:

1. Create and manage your account, verify it is you and send you the service notices (confirmations, codes to sign in or recover your password, the acknowledgment of your subscription, the notice before each charge, notices before deleting your data).
2. Build your weekly program with Vadonaa's AI and adapt it to what you do. While your subscription is current, the next week is built on its own on Sunday; if you withdraw the AI permission, it is built with our rules.
3. Log your progress and compute whether you met your week and your month.
4. Manage your subscription, your free trial and, if you used an athlete code, pay the athlete their commission in aggregate.
5. Keep the app secure, prevent fraud and abuse, and fix errors.
6. Comply with legal obligations and handle your requests.

Purposes that require your express consent (we ask for it in separate, unchecked boxes):

1. Process your health data (the areas you'd rather not load and your training log) to create your profile, build your program and track your progress.
2. Process your training data and the areas you marked, as labels only, with Vadonaa's AI, which uses a model from Anthropic in the United States (chapter IV).

Secondary purposes (you can say no and use the app all the same):

1. Measure how the app is used, without health data, to improve it.
2. Send you Vadonaa news and tips by email, including the reminders during your free trial.

We don't use your data for anything else. In addition, we use your training data in aggregates that don't identify you to measure whether the service works (for example, how many weeks are met), and to test changes before publishing them we use a copy of the database without your email, your name, your date of birth or your credentials, which stays with the same hosting provider. If one day we wanted to use your data for something new, we would ask you first (article 11 of the Law).

IV. Vadonaa's AI and your data

1. Your program is built by Vadonaa's AI using a model from Anthropic, PBC, in the United States. Anthropic works for us as a processor: it may only use what we send it to generate your program, under our instructions and with a duty of confidentiality; under its commercial terms, it does not train its models on what we send and deletes it within a limited period (today, 30 days at most).
2. What we send it: your level, your goal, your sessions per week, how much time you have per session, your equipment, the areas you marked from the list (as labels), a summary of your history without data that directly identifies you (which sessions you met or skipped, which exercises you tend to complete or avoid, which muscles you're missing) and the maximum weight you logged per exercise in the last four weeks.
3. What we never send it: your name, your email, your age, any identifier that leads to you, and any text you've written.
4. The model only chooses exercises from our catalog. We validate the answer and store it as your program.
5. We keep a record of each call (when, how many tokens, how much it cost, how long it took and whether it failed) and the resulting program, which is part of your account. We don't store the full text that is sent or the unvalidated answer.
6. Two things don't go through the AI: swapping an exercise your gym doesn't have and moving a session home. Our catalog solves them, without sending anything to anyone.
7. We only do this if you checked the box of express consent for AI processing. You can withdraw it in Profile → Privacy. From that moment we send nothing to the model provider: your week keeps being built with our rules, without AI, and the adjustments that use AI stop being available.
8. We do not use your personal data to train large language models, and we do not sell or provide it to anyone for that purpose.

V. With whom we share your data, and transfers

Processors. These companies process data on our behalf and under our instructions, only to provide us the service the table indicates. They can't use it for anything else and don't decide about your data; each one is bound by contract to protect your data with safeguards equivalent to those required by Mexican law. The Law calls this a remission. The current list of processors, with name and country, is provided to anyone who requests it at privacidad@vadonaa.com.

Your data is hosted and processed outside Mexico, in the United States. Each processor is bound by contract to protect your data with safeguards equivalent to those required by Mexican law.

Apple and Google are not our processors: each is an independent controller of your purchase data and your account (Apple ID or Google account) when you buy in its store (App Store or Google Play), under its own privacy notice. We don't send them your data; it is the store that confirms to us, through our subscription management provider, that your subscription exists. If you request a refund from Apple, we answer only with categories (how long you've had the account, whether your week was built, whether you trained, and whether there were refunds before), never with your health data.

Identity providers. If you choose "Continue with Apple" or "Continue with Google", Apple or Google (both in the United States) confirm it is you so you can sign in. They send us only the identifier they assign you for Vadonaa, your email and, in Apple's case, your first name if you share it the first time. They are independent controllers of your account with them, under their own privacy notice, and they are not our processors. We don't send them your Vadonaa data: with Google we send nothing; with Apple, only what the sign-in itself needs and, when you delete your account, the notice so they revoke Vadonaa's access to your Apple ID.

Transfers clause (article 35 of the Law). Today we do not transfer your personal data to any third party that decides on its own what to do with it. The only transfers we could make without your consent are those the Law allows: to an authority that requires it under the law, or to comply with a legal obligation. If one day we wanted to transfer your data to another third party, we would ask you first, with a separate box where you can say "I accept" or "I don't accept", and your answer would be honored.

VI. What we never do

• We don't sell your data. To anyone, ever.
• We don't use your data for advertising and we don't let anyone use it for that. Your health data, in particular, never serves ads or commercial profiles, and no advertising service receives events from the app.
• We don't track you across other companies' apps and we don't use advertising identifiers.
• We don't send your name, email or age to the AI.
• We don't ask you to describe your injury. If your area isn't on the list, you mark "other" and we recommend consulting a professional; your routine doesn't change because of that option.
• We don't read HealthKit or any phone sensor. We don't use your location.
• We don't share with partner athletes who used their code. They see totals, never people.
• We don't ask for data from minors. Vadonaa is for people 18 or older.

VII. How to limit the use of your data

For the secondary purposes you have a direct switch:

• Usage analytics: Profile → Privacy → "Usage analytics". When you turn it off we stop sending usage events from that moment.
• News by email: Profile → Privacy → "News by email" or the unsubscribe link in every news email.

Saying no to either doesn't affect your access to the app. You can also ask us by email to stop using your data for a specific purpose.

VIII. Your ARCO rights and how to exercise them

You have the right to access your data, rectify it if it is wrong, cancel it (have us delete it) and object to its use for a specific purpose. This is how:

1. Write to us at privacidad@vadonaa.com, preferably from your account email: that way we know it is you. If you write from another email, attach a valid official ID (voter ID, passport or professional license). You can also do it from the app, in Profile → Privacy → "Request a copy of my data", which opens an email with the subject already written; send it from your account email.
2. Tell us: your name, your account email, which right you want to exercise and a clear description of what you're asking (for example, "I want a copy of all my data" or "I want my areas corrected").
3. If someone asks on your behalf, attach both IDs and the document that grants them power (a simple power of attorney signed before two witnesses, or a notarized one).
4. If something is missing, we ask you for it within the following 5 business days and you have 10 business days to complete it. Meanwhile, the deadline to answer you doesn't run. If you don't complete it, you can make the request again whenever you want.
5. We answer within 20 business days at most from receiving the complete request. If it proceeds, we make it effective within the 15 business days after the answer. Both deadlines can be extended once for the same length, and if that happens we tell you why (article 31 of the Law).
6. It is free. We would only charge shipping or copying costs if you asked for the data on paper, and we would tell you first.
7. Access: we send you a readable file with all your data to your account email.
8. Cancellation: you can also do it yourself, immediately, from Profile → Delete account, without writing to us.
9. If we don't answer in time or the answer doesn't satisfy you, you can go to the authority in chapter XIV.
10. If you live in the United States, in addition: you can appeal if we deny your request. Reply to our answer or write to privacidad@vadonaa.com with the subject "Appeal". We answer in writing within 45 days. If we deny your appeal, we tell you how to file a complaint with your state Attorney General. Access includes the list of third parties that received your health data and how to contact them. Details are in our Consumer Health Data Privacy Policy (United States), chapter XVI.
11. Objection to automated decisions. Your program is built, without a person reviewing it, by our rules and by Vadonaa's AI, with your profile and with what you log, including which exercises you complete or skip. It only decides which exercises we suggest and has no legal effects on you. Even so, you can object (article 26 of the Law): if you withdraw the AI permission, your week is built with fixed rules only; and if you write to us at privacidad@vadonaa.com, we stop using what we infer from what you complete or skip.

IX. Withdrawing your consent

You can withdraw any consent whenever you want, from Profile → Privacy or by email to privacidad@vadonaa.com:

• Analytics and news: immediate effect, no consequences.
• AI processing: we stop sending your data to the model provider. Your week keeps being built with our rules and the AI adjustments turn off. You can accept it again whenever you want.
• Health data: without it the app can't work, because your program depends on it. We offer you two paths: delete your account or accept again.

Withdrawal has no retroactive effect on what was already done with your consent, but you can ask us to delete that data (cancellation).

X. How long we keep your data

Blocking means the data is no longer used for anything: it only exists to prove, if needed, that you gave your consent or that a transaction took place.

XI. How we protect your data and what happens if something goes wrong

1. We use administrative, technical and physical safeguards: encrypted connections (HTTPS) between the app and our servers, passwords stored with a modern and irreversible algorithm, your account separated from your health data, access to the internal panel only for those who need it and with two-factor authentication, and automated security tests before every release.
2. Within the team, only those who need it to handle a request of yours or an incident access people's data.
3. If a security breach occurs that significantly affects your rights (for example, unauthorized access to health data), we inform you without delay, as soon as we confirm it and start reviewing its scope, by email. We tell you what happened, which data was affected, what we did to correct it, what we recommend you do to protect yourself, and where you can ask us for more information. Then we review why it happened and change what is needed so it doesn't happen again. We also report it to the authority when the law requires it. If you live in the United States, we will also email you without unreasonable delay and no later than 60 calendar days after we discover the incident, including any access to or disclosure of your health data that you did not authorize, and we will notify the Federal Trade Commission (FTC) and state authorities when the law requires it.

XII. Minors

Vadonaa is only for people 18 or older. We don't ask for or want data from minors. If we find that an account belongs to a minor, we close it and delete its data. If you believe a minor opened an account, write to us at privacidad@vadonaa.com.

XIII. Changes to this notice

1. If we change this notice, we tell you by email and, when you open the app, we ask you to review the new version, with the date it takes effect and a summary of what changed. The current version, with number and date, is always at vadonaa.com/privacidad (and in English at vadonaa.com/en/privacy).
2. If the change involves new purposes, new sensitive data, a new processor that receives health data, or a new transfer, we ask for your consent again before applying it. Until you give it, we continue under the previous notice.
3. We never change this notice "by posting": a change we didn't notify you of doesn't apply to you.

XIV. Authority

If you believe your right to the protection of your personal data was violated, you can go to the Secretaría Anticorrupción y Buen Gobierno (Mexico's data protection authority), within the 15 business days following our answer or, if we didn't answer, from the day the deadline to do so expired (article 40 of the Law), through the channels it publishes for complaints and requests for protection of rights. First, if you like, write to us: we can almost always resolve it directly.

XV. Contact

• Personal data and ARCO rights: privacidad@vadonaa.com
• General support: soporte@vadonaa.com
• Vadonaa, S.A.S. de C.V., Colima, Colima, Mexico
• This notice: vadonaa.com/en/privacy · Terms and Conditions: vadonaa.com/en/terms

XVI. If you live in the United States

If you are in the United States, including Washington, Nevada and Connecticut, our Consumer Health Data Privacy Policy (United States) also applies to you, at vadonaa.com/en/health-data-privacy (in Spanish, vadonaa.com/privacidad-salud-eeuu). There you'll find the categories of health data we collect, where it comes from, with whom it is shared, your rights to access, withdraw consent and delete, how to appeal, and how to contact your state Attorney General. We do not use your personal data to train large language models. This notice was last updated in November 2026.