legal notice
Privacy policy
Who are we?
ONAtrail® is the web platform developed as part of the MAGIC-Trail project (ManaGing Illness, Injuries and Challenges in Trail running), led by Dr. Nicolas Bouscaren at the Centre Hospitalier Universitaire de La Réunion (CHU de La Réunion).
The project is co-financed by the European Union and the Réunion Region: Europe is committed to La Réunion through the European Regional Development Fund (ERDF).
The platform offers trail runners tools for race preparation, performance analysis, pace optimization and training monitoring related to trail running and running.
1. Data controller and data protection officer
Data controller
Centre Hospitalier Universitaire de La Réunion (CHU de La Réunion)
CHU de La Réunion, Établissement Public de Santé, FINESS 970 408 589
Allée des Topazes – CS 11021 – 97400 Saint-Denis, La Réunion, France
Délégué à la Protection des Données (DPO)
Délégué à la Protection des Données
11, rue de l'Hôpital – 97460 Saint-Paul
dpo.onatrail@chu-reunion.fr
Contact du projet ONAtrail
Dr. Nicolas Bouscaren
2. Purposes of processing and legal bases
This information is provided in accordance with Article 13 of the General Data Protection Regulation (GDPR).
Pursuant to Articles 6 and 9 of the GDPR, processing operations are based on the following legal bases:
Creation and management of your account, operation of the platform, display and analysis of your activities → consent (Art. 6(1)(a) GDPR).
Personalized training, pace and performance recommendations → consent (Art. 6(1)(a)).
Training and improvement of our artificial intelligence models internal to the ONAtrail project → consent (Art. 6(1)(a)). Your consent is obtained separately and prior to any processing for this purpose.
Security, fraud prevention and technical maintenance → legitimate interest (Art. 6(1)(f) GDPR).
3. Data collected
The following data is collected depending on the services you use. Data marked with * is mandatory for the operation of the service;
Access restricted to persons of legal age. Registration on ONAtrail is restricted to persons aged 18 and over. The date of birth collected at registration makes it possible to verify this condition. ONAtrail does not knowingly collect data concerning minors; if an account created by a minor were identified, it would be deleted.
Account data: first name*, last name*, e-mail address*, date of birth*, sex*.
Sports activity data: distance, duration, elevation gain, training load and other performance indicators.
Access to your Garmin® data: to synchronize your data from Garmin Connect, ONAtrail receives an access token — a temporary code provided by this service that authorizes us to consult your data on your behalf and with your authorization, without ever knowing your username or the password used to access your personal account. This data includes in particular GPS tracks, pace and heart rate during exercise. Data source: Garmin Connect.
User profile: first name*, last name*, date of birth*, sex*, country, department of residence, sports activity data†. †Data source: Garmin Connect. The other data in this profile is collected directly from you.
Technical connection data: IP address*, connection logs, session identifier*. This data is collected automatically when the platform is used, independently of any cookie being placed. The platform also uses technical cookies* strictly necessary for its operation (session maintenance, security); these cookies do not collect any data for advertising or analytics purposes
4. Use of artificial intelligence
ONAtrail uses, or is likely to use, after obtaining your consent, your personal data (activity data, age, sex) in two distinct contexts involving artificial intelligence:
Personalized recommendations
Our models analyze your data to provide you with pace recommendations, injury risk estimation and training load analysis. This processing is based on the performance of the contract for standard activity data, and on your consent for the personal data involved.
Model training and improvement
Your data may be used to train, improve or evaluate our algorithms. This processing goes beyond the service directly provided to you and is based exclusively on your prior and explicit consent, obtained separately.
Origin of the data used for artificial intelligence. Only data from Garmin Connect (as well as the data you enter directly on ONAtrail) may be used for the purpose of training an AI model.
In both cases, no automated decision is taken on the basis of this processing. You may withdraw your consent to the use of AI for the analysis of your data at any time from your account settings, without this affecting access to the essential features of the platform.
5. Data recipients
Depending on the purposes described above, your data may be processed by the following entities, all located in France or in the European Union:
CHU de La Réunion (France) — Data controller. Hosts the data during the phases of analysis and work on data from the platform.
Mezcalito (France) — Web development provider and main host of the ONAtrail platform. Involved in the maintenance, technical development and hosting of the platform’s data.
Garmin (EU) — This platform transmits your data to ONAtrail via its API, within the limits of the authorizations you have granted it. It operates under its own terms of use and privacy policy.
No personal data is transferred outside the European Union.
We do not sell your personal data.
6. Garmin data
This section describes specifically how data retrieved via the Garmin Connect Application Programming Interface (API) is collected, used, processed, stored and shared.
Collection
ONAtrail collects data from your Garmin Connect account exclusively via the official Garmin Connect API, and only after you have explicitly granted authorization via Garmin’s OAuth authentication system. The data collected may include activity data (distance, duration, pace, elevation gain, GPS tracks, heart rate), depending on the authorizations you have granted.
Use
Garmin data is used to provide you with performance analysis, training monitoring and race preparation tools within the ONAtrail platform. It is also used by our AI infrastructure, only after your explicit consent has been obtained, to generate personalized recommendations (pace prediction, injury risk estimation, training load analysis, etc.).
No third-party artificial intelligence provider has access to your Garmin data.
Processing
Garmin data is processed exclusively within ONAtrail’s infrastructure. No Garmin data is transmitted to a third-party service, an external platform or an artificial intelligence provider external to the ONAtrail platform.
Storage
Garmin data is hosted on Mezcalito’s servers. Security measures including in particular the encryption of data in transit and at rest are implemented in accordance with the applicable contractual and regulatory requirements.
Sharing with third parties
Garmin data is not sold, rented or shared with third parties for purposes other than those described in paragraph 3 of the ONAtrail platform’s privacy policy.
To exercise your rights over the data retrieved from your Garmin account (access, rectification, erasure, portability), use the contact details in section 2. You may also disconnect your Garmin account from the ONAtrail platform at any time from the « My Account » section, which will end any further collection and will delete all previously collected data, in accordance with Garmin’s privacy policy
7. Data hosting
All of your personal data collected by ONAtrail is hosted in France or in the European Union. The ONAtrail platform and its data are hosted by Mezcalito, a development and hosting provider.
The CHU de La Réunion may host data in the context of the phases of analysis and work on the data.
8. Retention period
Your account data is retained for the entire duration of your registration on the ONAtrail platform and deleted within 30 days following its closure.
You may request the deletion of your account and the associated data at any time. To exercise your rights over the data retrieved from your Garmin account (access, rectification, erasure, portability), use the contact details in section 2.
9. Your rights
In accordance with the GDPR, you have the following rights:
Right of access to your personal data
Right to rectification of inaccurate data
Right to erasure (« right to be forgotten »)
Right to restriction of processing
Right to data portability (only for processed data whose purpose is based on consent)
Right to withdraw your consent at any time
Requests may be sent to the contact details indicated in section 2. We undertake to respond within one month, which may be extended to three months for complex requests, in accordance with Article 12 of the GDPR.
If you consider that your rights are not being respected, you have the possibility of lodging a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL): 3 Place de Fontenoy – TSA 80715 – 75334 Paris Cedex 07 — www.cnil.fr
10. Data security
Technical and organizational measures are implemented to protect your data against any unauthorized access, disclosure, alteration or destruction:
Encryption of data in transit and at rest
Strict access controls
Logging and traceability of access to personal data
Secure authentication procedures
Regular backups
Physical access control
11. Changes to this policy
This privacy policy may be updated.
Any substantial change affecting the purposes of processing or requiring a new collection of consent — in particular concerning the use of artificial intelligence technologies — will be communicated to you by e-mail and by notice on the website, in addition to the publication of the updated version on this page.
ONAtrail® uses or refers to the Garmin® service. Garmin is a registered trademark of Garmin Ltd. or its subsidiaries. ONAtrail is not affiliated with, endorsed by, or sponsored by Garmin Ltd