Privacy policy
Last updated: 28 October 2026
This policy explains what data Corpus holds about you, why, who can see it, and what you can do about it.
Privacy, in plain words
The short version. The full policy below is what counts.
- Your data is stored in the EU (Germany), and kept apart from everyone else's data in the database.
- You decide who sees it: your team's coaches while you are on the team, a personal coach you choose, or nobody. Other players and other clubs never see it.
- On a club's team, the club is responsible for your data (the controller). MBM Tech and Management SL stores and processes it for the club.
- When you connect an AI assistant, it reads your data to answer your questions, under its provider's terms.
- We do not sell your data, we do not show ads, and this site sets no cookies of its own (Cloudflare may set one security cookie) and loads nothing from other companies.
- We keep your data for five years, or delete it when you ask. Backups clear within about three weeks.
- You can see, export or delete your data, and ask us anything about it. In the beta, write to hello@mycorpus.life and we do it for you.
Export and delete from your account are coming in the beta. Until then, write to hello@mycorpus.life and we do it for you.
Write to us about your data Ask a question1. Who we are
Corpus is a health and performance data service run by MBM Tech and Management SL, a company registered in Spain (tax number (CIF) B93937019, registered office Calle de Modesto Lafuente 71, 2.º A, 28003 Madrid, Spain; registered in the Registro Mercantil de Madrid, sheet M-897331, entry 1, on 26 August 2026, IRUS 1000479020364). In this policy, "we" and "us" mean MBM Tech and Management SL.
Contact for anything in this policy: hello@mycorpus.life.
Corpus is in beta. Access is by invitation only. Some features described below are planned for the team beta and are marked "when available".
2. Our role: controller or processor
Who decides what happens to your data depends on how you joined.
- If you joined through a club, academy or other organisation (as a player or as staff), that organisation is the data controller. It decides why your data is collected and who in the organisation sees it. We are its data processor: we store and process your data on its behalf, under a written data processing agreement, and only on its instructions. Questions about why your club collects your data, or requests to exercise your rights, can go to your club or to us; we will pass them on and help the club answer.
- If you signed up on your own (an individual, including a player or coach who uses Corpus outside any paying organisation), we are the data controller for your data.
If you are in both situations (for example, a player on a club team who also has a personal licence), the club is the controller for the data processed for the team, and we are the controller for the rest.
3. What data we process
3.1 Account data
When you sign in with Google we receive your Google account's email address, name and unique account identifier. We do not receive your Google password or access to your Gmail, Drive or calendar. We also store your profile settings, such as your time zone and the profile details you give us (for example, height, goals or training preferences).
3.2 Health and wellness data
This is the data you (or someone you allow) put into Corpus. You choose which of these to use:
- Check-in answers (when available): how you feel, sleep quality, soreness, fatigue and similar wellness questions, answered from a personal link.
- What you tell your AI assistant: food and drink (including barcode lookups), workouts with sets and weights, supplements, body weight, how you feel, and notes.
- Apple Health data, if you install the Corpus iPhone app and allow it: for example heart rate, heart rate variability, resting heart rate, sleep, steps, activity and energy, workouts and other measurements Apple Health holds and you choose to share.
- Oura data, if you connect an Oura ring: readiness, sleep and activity scores, temperature deviation, heart rate variability and lowest heart rate during sleep, sleep latency and efficiency, blood oxygen during sleep, breathing disturbance index, stress and recovery time, resilience, cardiovascular age, pulse wave velocity and VO2 max. We do not fetch heart rate, workouts, steps, calories or sleep stages from Oura.
- Team data (when available): team sessions, attendance, effort and training load, and logs a coach records on your behalf. Each row a coach logs records who logged it.
- Coach notes (when available): notes a coach keeps about a player that only coaches see.
- Results we derive from your data: daily and weekly summaries, weekly reports, trends, correlations, training load and recovery figures.
Health data is a special category of personal data under the GDPR (art. 9). We treat all of the data in this section as health data.
3.3 Connection data
- Device keys for the iPhone app. We store only a one-way fingerprint (a SHA-256 hash) of each key, never the key itself. You can have a key revoked at any time.
- Oura connection tokens, which let us fetch your Oura data. They are stored on our server and removed when you ask us to disconnect Oura, or when your account is deleted.
- Sign-in sessions for your AI assistant's connection to Corpus.
3.4 Technical logs
Our servers keep technical logs of requests and errors (for example time, path, response code and error messages). They may contain IP addresses and internal user identifiers. We use them only to run, secure and fix the service. Logs are rotated by size and are normally overwritten within days to a few weeks.
3.5 Website visitors and email
- This website has no analytics, no advertising cookies or pixels and no third-party scripts, and sets no cookies of its own. Like every site it serves, Cloudflare (section 7) processes visitors' IP addresses and request details to deliver the pages and protect against attacks. Cloudflare may set a strictly necessary security cookie (such as __cf_bm) to tell people from automated abuse. It is not used for advertising or analytics.
- If analytics are added later, this policy will be updated first, and consent will be asked where the law requires it.
- The sign-in pages use cookies that are strictly necessary to sign you in.
- Email you send us at hello@mycorpus.life is received through Cloudflare Email Routing and forwarded to our mailbox, hosted by Google (Google Workspace). We keep it as long as needed to answer you and for our legitimate business records.
4. Why we use your data, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Providing the service to you: storing your data, answering your questions through your AI assistant, producing summaries and reports | For health data: your explicit consent (GDPR art. 9(2)(a)). For account data: performance of the contract with you (art. 6(1)(b)), or for club members, the club's chosen basis. |
| Showing your data to coaches you share with (when available) | Your explicit consent, given in plain words when you join a team or share with a coach (art. 9(2)(a)). |
| Keeping the service secure and working (logs, alerts, backups) | Our legitimate interest in a secure, reliable service (art. 6(1)(f)), and for health data in backups, the same basis as the original processing. |
| Answering emails and access requests | Legitimate interest (art. 6(1)(f)). |
| Meeting legal obligations (tax, accounting, responding to authorities) | Legal obligation (art. 6(1)(c)). |
We do not sell your data, use it for advertising, or use it to train AI models. We do not make decisions about you that have legal or similarly significant effects by automated means alone.
5. Who can see your data
- You. Through your AI assistant and, when available, your account pages.
- Coaches you share with (when available). You own your data and choose who sees it.
- Team coaches: while you are on a team, its coaches see your data. On a paying team, sharing with the team's coaches is a condition of membership (see section 6). Every coach of a team has the same access, whatever their role label (head coach, assistant, physio and so on). A coach who joins your team sees your full history; a coach who leaves the team, or a team you leave, loses access to all of it, history included.
- A personal coach: you can also share directly with a coach outside any team, and you can revoke that share at any time.
- Coaches can log data on your behalf (for example a team session you attended). You see what coaches log about you.
- Your organisation (when available), through its coaches, for team members only.
- Your AI assistant (section 7.4) receives the data you ask it about. A coach's AI assistant receives the data of the players who share with that coach, when the coach asks about them.
- Our team. Only authorised members of our development and operations team have administrative access, and only to run, secure and fix the service. Administrative access to the server is only possible over a private network that requires single sign-on.
- Our subprocessors (section 7), only as needed to provide their service to us.
- Authorities, only when the law requires it.
Isolation between users is enforced by the database itself, not only by our application code: the service connects to the database with an unprivileged role that can only see the rows of the user it is acting for (and, when available, the users who share with that user).
6. Team sharing and consent
When you join a team, we ask you to accept, in plain words, that the team's coaches see your data. On a paying team this sharing is part of being on the team. Leaving the team ends coach access.
7. Subprocessors and where your data goes
We store your data in the European Union. We use the following providers.
| Provider | What they do for us | Where | Data they handle |
|---|---|---|---|
| Hetzner Online GmbH | Hosts our server and its database; daily server backups (Hetzner Cloud Backups) | Germany | All data in section 3 |
| Hetzner Online GmbH | Object storage for encrypted point-in-time database backups (when available) | Finland (Helsinki) | All data in the database, encrypted before it leaves the server |
| Cloudflare, Inc. | Carries all traffic to the website and to the service, protects against attacks, routes email to us | Global network, not limited to the EU; company in the USA | All data in transit, including health data (see 7.1) |
| Google LLC / Google Ireland Ltd | Sign-in with Google | EU and USA | Your email, name and Google account identifier |
| Google (Google Workspace) | Our email mailbox, receiving mail forwarded by Cloudflare Email Routing | EU and USA, under Google's data processing terms and the EU-US Data Privacy Framework | Email you send us |
| Anthropic | AI tooling we use to operate and maintain the service, which may process data while doing so | USA, under Anthropic's data processing terms | Any data on the server, when needed for maintenance |
| Telegram | Operational alerts to our team | Outside the EU | An 8-character internal user identifier only, never names, emails or health data |
| healthchecks.io | Uptime and heartbeat alerts | EU (Latvia) | An 8-character internal user identifier only, never names, emails or health data |
Before we send invites or check-in links by email, we will name the email delivery provider in this table.
7.1 Cloudflare decrypts traffic at its edge
All connections to Corpus are encrypted (HTTPS/TLS). To protect the service and hide our server, Cloudflare ends that encryption at its own servers ("the edge") and forwards the request to us over a separate encrypted tunnel. This means Cloudflare's servers see requests in readable form, including health data and sign-in tokens, while they pass through. Cloudflare's network is worldwide and is not limited to the EU, so this can be a transfer outside the EU. The safeguards we rely on are Cloudflare's Data Processing Addendum (which includes the EU Standard Contractual Clauses) and Cloudflare's certification under the EU-US Data Privacy Framework. Cloudflare processes request details such as IP addresses to deliver and secure the service, and may keep limited logs for that purpose under its Data Processing Addendum.
7.2 Google
Sign-in uses Google. Google learns that you signed in to Corpus. We request only your email, name and basic profile; we do not ask for access to any other Google data.
7.3 Our operational AI tooling (Anthropic)
We use an AI coding and operations assistant provided by Anthropic to maintain the service. While doing so it may read data on the server, for example when investigating an error. It is a subprocessor and is bound by Anthropic's commercial terms and data processing terms.
7.4 Your own AI assistant
Corpus works through the AI assistant you connect (today Anthropic's Claude; others that support MCP connectors may follow). When you ask a question, Corpus sends the relevant data to your assistant so it can answer. Your assistant's provider is not our subprocessor: you chose it, and it handles that data under your own agreement with that provider and its privacy policy. Check its settings (for example, whether your conversations may be used to train its models). The same applies to a coach's assistant receiving shared players' data.
8. How long we keep your data
- Your health and account data is kept for five years, or until you ask us to delete it, whichever comes first.
- When you delete your account or ask for deletion, we delete your data from the live database promptly. Copies in our backups expire on their own: backups are purged within about 21 days (point-in-time backups keep 14 days of history, and the oldest full backup can be up to about 21 days old; daily server backups rotate after 7 days). We do not restore deleted data from backups except to recover from a disaster, and if we ever do, we delete your data again.
- Technical logs: see section 3.4.
- For club members, the club as controller may instruct a different period within its agreement with us.
- Oura: if we ever restore from a backup, you may need to reconnect your Oura ring.
9. Security
What we have built:
- Per-user isolation enforced in the database: the service runs as an unprivileged database role that sees only the current user's rows; it cannot bypass this or define its own functions.
- Encryption in transit (HTTPS/TLS) for all traffic (see 7.1 for Cloudflare's role).
- No database exposed to the internet; the database is reachable only from inside our server.
- Administrative access only over a private network (Tailscale) with single sign-on.
- Device keys stored only as hashes, revocable one by one.
- Backups: daily server backups, and (when available) encrypted point-in-time backups in a second EU location, tested with restore drills.
- Automatic health checks and alerts that carry no personal data beyond an 8-character internal identifier.
We do not hold any security certification (such as ISO 27001). Corpus is not a medical device and does not give medical advice.
If a personal data breach affects your data, we tell your club without undue delay where it is the controller. Where we are the controller, we notify the AEPD, within 72 hours where the law requires, and we tell you when the risk to you is high.
10. Age
During the beta, Corpus is only for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe someone under 18 has an account, contact us and we will delete it.
11. Your rights
You have the right to:
- access your data and get a copy;
- export your data in a portable format (art. 20) (self-service when available; by email today);
- correct inaccurate data;
- delete your data and your account (self-service when available; by email today);
- restrict or object to certain processing;
- withdraw consent at any time, without affecting processing already done. Leaving a team ends that team's coaches' access; revoking a personal share ends that coach's access;
- complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD), www.aepd.es, or to the authority where you live or work.
How to exercise them: write to hello@mycorpus.life. If you joined through a club, you can also write to your club; where the club is the controller, we will forward your request to it and help it respond. We answer within one month, which can be extended by two months for complex requests. We may ask you to confirm your identity.
12. Changes to this policy
We will post changes here and update the date at the top. If a change materially affects how we use your data, we will tell you before it takes effect and, where needed, ask for your consent again.
13. Contact
MBM Tech and Management SL, Calle de Modesto Lafuente 71, 2.º A, 28003 Madrid, Spain. Email: hello@mycorpus.life.