1. Who we are

UTLC Management System ("UTLC", "we", "our") is the training platform of the UTLC coaching team in Thailand: coaches plan the week, athletes train and log it, and the two read the same record. This policy says what personal data we hold, why, who else sees it, how long we keep it, and what you can ask of us. It is written for Thailand's Personal Data Protection Act B.E. 2562 (PDPA).

---

2. The data we hold

• Account — your name, username or email, role (athlete / coach / admin), avatar, language; if you sign in with LINE, the LINE user id LINE gives us (never your LINE password).
• Training — planned sessions, results, RPE, your notes and your coach's, lactate tests and the zones drawn from them, races and goals, body weight, and the daily check-in you type (sleep, fatigue, soreness, mood, HRV).
• Health data from a wearable — only when you connect one: from Garmin, your daily sleep (its times, stages, breathing rate and score), HRV, resting heart rate, stress, steps, Body Battery and active minutes, Garmin's VO2max estimates and fitness age, weigh-ins, overnight skin temperature and — if you track it — your period dates; from WHOOP, your recovery score, HRV, resting heart rate, sleep (its times, stages, breathing rate and performance) and day strain (section 5).
• Activities from a connected service — from Strava and Garmin: each activity's sport, time, distance, duration, heart rate, power and pace, its laps and its second-by-second record (heart rate, power, speed, cadence, altitude) — never its GPS track.
• Supplements and medication — the VitaCheck records you choose to enter.
• Where you train — the place you pick for each weekday (a district, not a GPS trace), so we can show its weather, heat and air quality.
• Device and usage — push-notification tokens, whether the app is installed, which pages you open (to decide what to improve), and the usual server logs (IP address, time, page).

We never ask for payment details, government id numbers or precise location.

---

3. What we use it for

• Your week: the plan your coach writes, your results and your history.
• Coaching: the coaches assigned to you read your sessions, check-ins and wearable numbers to review the work and adjust the plan.
• Analysis: training load, PMC, readiness, zones, personal bests, heat and air guidance.
• Messages: in-app and push notifications, and LINE messages when you have linked LINE, about your training only.
• Keeping the service running and safe: logs, backups, abuse checks.

We do not sell your data, do not show advertising, and do not use your data to profile you for anyone else.

Coach assistant

Coaches may use an outside coach-assistant service to prepare a training week or a short report. For that, UTLC sends the service a summary of your training — zones, minutes, training load, recent results, your lactate-test zones — never your raw Garmin samples or health data from a wearable, your name, or your messages. The draft is a suggestion the coach edits; nothing reaches you unreviewed. Under the service's terms your data is used only to make the draft and is not used for anything of its own.

The administrator who coaches may also ask an outside coach-assistant service about the team. For that, UTLC sends it your nickname or first name (never your surname), your plan and your results with their figures, including each interval against its target, and the words you write to your coach — on a result, when you skip a session and in your notes (rest, travel, a request, a routine) — cut short; and your race checklist: the goal and splits, your coach's race plan, your nutrition, hydration and special-needs plans, how many gear items you ticked and your notes to the coach (never your travel plan). The RPE and pain score you enter with a result are health data and go with your nickname. Other health data goes only as team counts; nothing raw from a wearable. The service cannot change anything unless the coach says yes; under its terms your data is used only to answer the coach.

---

4. Who else sees your data

Inside UTLC: you, the coaches assigned to you, and the administrators who run the system. Other athletes see only what you choose to share (a shared week link, a post in The Root, a share card).

Outside UTLC, these are the only companies that process your data, each for one job:

No data brokers, no advertisers, no analytics companies. Our server is in Malaysia, so your data leaves Thailand; it is protected there by this policy and by our contract with the host.

---

5. Connected services

Each connection is yours to make and to end. You connect on the service's own consent screen (OAuth 2.0); UTLC stores the access token the service gives us and uses it only to read what you allowed. You can disconnect at any time on the Integrations page or in the service's own app.

Strava

We read your activities (summary, laps, streams) and match them to your planned sessions; a matched activity can fill in your result automatically. We never post to Strava. Disconnecting stops the reading; the activities already matched stay in your training log. You can also revoke UTLC at strava.com/settings/apps.

Garmin

With your consent on Garmin's screen, Garmin sends UTLC your completed activities (summary, laps and the second-by-second record, without the GPS track) and, as far as you allow it, your daily health summaries: sleep, HRV, resting heart rate, stress, steps, Body Battery and active minutes; Garmin's VO2max estimates and fitness age; weigh-ins from a Garmin scale or typed in Garmin Connect; your overnight skin temperature; and, if you track your cycle in Garmin Connect, the start date and length of each period — never a prediction and never anything of a pregnancy. An activity is shown with the session planned that day; your results, PMC and training load are made from Strava (or what you log yourself), whatever watch you wear. The health numbers show beside your daily check-in to you and your coaches and are read by the readiness and injury-risk checks; a weigh-in updates the weight on your profile; a period date is shown to your coach only if you share your cycle. If you turn it on, your coach's planned workouts can be sent to your Garmin Connect calendar, with your own tap on My Week or in LINE. When you disconnect — here or in Garmin Connect — we stop receiving data and delete the Garmin data we hold at once (your activity records, health days and the period dates Garmin sent); the workout results already in your training log stay, as your own record of the session, until you delete your account.

WHOOP

With your consent on WHOOP's screen, UTLC reads, once an hour, your recovery score, HRV, resting heart rate, sleep and day strain for the last three days (the last two weeks the first time). They show beside your daily check-in on My Week and to your coaches on Team Week, and a drop in HRV against your own two-week average is flagged to your coach. We never write to WHOOP and never share WHOOP data with anyone else. When you disconnect — here or in the WHOOP app — we stop reading and delete the WHOOP days we hold at once.

COROS

Open to every athlete, through COROS's own connection for apps (COROS MCP). With your consent on COROS's screen, UTLC can read your sleep, HRV, resting heart rate and recovery, your daily health summary and your COROS training calendar. For now nothing COROS sends is kept: an administrator may look at what COROS answers only to build the connection right. Your coach's run and ride sessions go to your COROS calendar only when you tap Send to COROS watch on My Training or ⌚ in LINE; UTLC keeps which session it sent, when, and COROS's answer. Soon your sleep, HRV and resting heart rate will show beside your daily check-in; this section will say so first. Your results, PMC and training load stay on Strava. One watch per athlete: you connect Garmin or COROS, not both (WHOOP goes with either). When you disconnect — here or in the COROS app — we stop reading, ask COROS to cancel UTLC's access, and delete what COROS sent. Help and support.

Ultrahuman

Open to every athlete with an Ultrahuman ring. With your consent on Ultrahuman's screen (ring data and profile only), UTLC can read your ring's sleep, HRV, resting heart rate, recovery and temperature, and your account's id; never your blood glucose. What Ultrahuman sends for each day — your sleep (hours, stages, score), HRV, resting heart rate, recovery, skin-temperature deviation and steps — is kept with your other wearable days and shows beside your daily check-in, to you and your coach; the answer itself is kept so the reading can be corrected. We never write to Ultrahuman. Your results, PMC and training load stay on Strava. When you disconnect — here or in the Ultrahuman app — we stop reading, ask Ultrahuman to cancel UTLC's access, and delete the access we held. Help and support.

Suunto

Not connected yet: UTLC receives nothing from Suunto today. Before a connection opens, this section will say exactly what is read and sent, under the same rules as Garmin's: it starts only with your consent on Suunto's screen, your results, PMC and training load stay on Strava, and disconnecting deletes what Suunto sent. Help and support.

LINE

If you sign in with LINE, LINE gives us your LINE user id and display name; we never see your LINE password or your chats. If you link LINE for messages, we send you training messages (a new week, a review, a reminder) through LINE's Messaging API; you can stop them in your Settings or by blocking the account.

The UTLC LINE account also answers questions about your training. In your own chat with it, you ask about yourself: last night's sleep, HRV and resting heart rate, your check-in, your sessions, your week, your readiness, your next race. In a LINE group with your coach and the account, your coach can ask the same, and only your coaches ask there. In a group of just you and your coach it answers at once, since you joined your coach's group; with anyone else in the group, only after you tap Agree there. At every question the account asks LINE whether you are still in the group: once you leave, it answers nothing more about you. When the account is added to a group, and when someone joins or leaves it, UTLC notes which UTLC members are in that group (never what is said there), so your coaches see on UTLC whether you share a LINE group with them; when you leave, it is marked as left. Everyone in the group reads the answers, which LINE carries like any message in that chat. Stop it any time: tag the account and write หยุดแชร์, or leave the group. We keep nothing of a group's conversation — a message not addressed to the account is not read — only that a question was asked. The answers are the same numbers you and your coach see in UTLC. You can also check in by LINE: write เช็คอิน to the account, or tag it in a group with your coach, and tap your answers — they are saved as your check-in, and in a group everyone in it sees what you tap. You can also send a session by LINE, in your own chat with the account: write ส่งการบ้าน and pick the session, its Strava activity, how hard it was and how your legs feel — it is saved as your result, as on the site.

---

6. How long we keep it

• While your account is active: everything in section 2, so that your history stays whole.
• A connected service's own data (section 5): deleted at once when you disconnect.
• After you ask for deletion: your personal data and training records are removed within 30 days; copies in our backups expire within 30 days more.
• Anonymised totals (how many sessions the team did in a month) may be kept; they no longer identify you.
• Server logs: 30 days.

---

7. Your rights

• Access — see what we hold about you; most of it is already on your own pages (My Week, Progress, Settings, Integrations).
• Correction — fix anything wrong: your own entries yourself, the rest through your coach.
• Export — receive your training data in a machine-readable file (CSV / JSON) within 30 days of asking.
• Withdraw consent — disconnect any service in section 5 at any time; turn messages off in Settings. Withdrawing does not undo what was lawfully done before.
• Deletion — ask for your account and data to be deleted on the Data Deletion page.
• Object and complain — tell us if you think we are handling your data wrongly; you may also complain to Thailand's Personal Data Protection Committee (PDPC).

To use a right, write to c.nessy@utlc.online, tell your coach, or send the request on the Data Deletion page; we answer within 30 days.

---

8. Security

All traffic is HTTPS. Passwords are stored as salted hashes, never in clear. Database access is by parameterised queries only. The access tokens of connected services are kept in our database on a server only we administer; they are never shown on a page, written to a log, or sent anywhere but to the service they belong to. Who sees what is decided by role: an athlete their own data, a coach the athletes assigned to them, an administrator the system.

---

9. Cookies

Two cookies: the session cookie that keeps you signed in, and the one that remembers your language. No tracking or advertising cookies.

---

10. Young athletes

Accounts are created by UTLC coaches for the athletes they coach. For an athlete under 20, the coach obtains a parent's or guardian's consent before the account is made, and the parent or guardian may use every right in section 7 on the athlete's behalf.

---

11. Changes to this policy

When this policy changes, the date at the top changes with it and a notice appears in the app. A change that widens what we collect or share takes effect only after that notice.

---

12. Contact

Questions about this policy or your data: c.nessy@utlc.online (the data controller's contact), your coach, the UTLC administrator in the app, or the Data Deletion page.