Privacy Policy
Pace Me, Daddy provides lactate threshold testing and training guidance for runners. This policy explains what personal data we collect when you test with us and use our athlete app, why we hold it, who we share it with, and the control you have over it.
We are the data controller for the information described here. Contact us at daddy@pacemedaddy.com with any question about this policy or your data.
The short version: we collect what we need to test you and coach you properly, we store it securely, we do not sell it, we do not advertise to you, and you can have a copy of it or have it deleted whenever you ask.
1. What we collect
Account information
- Your name and email address
- A password, which is stored by our authentication provider as a secure hash. We never see it and cannot recover it.
Health and performance data
This is the core of what we do, and under Thai law it counts as sensitive personal data, so we handle it accordingly. It includes:
- Blood lactate concentrations measured at each stage of your test, taken via a small capillary blood sample
- Heart rate, running pace and speed at each stage
- Derived physiological thresholds such as LT1, LT2 and MLSS, and your training zones
- Where a premium test was performed, metabolic metrics such as VO2max, VLamax, carbohydrate and fat oxidation rates and glycogen estimates
- Test date, notes recorded by your tester, and any goals or race dates you enter yourself
Technical data
- Standard server logs generated by our hosting providers, including IP address, browser type and timestamps
- A login session stored in your browser so you stay signed in. This is required for the app to work. We use no advertising or analytics trackers.
2. Why we hold it, and on what basis
| Purpose | Lawful basis |
|---|---|
| Performing your lactate test and producing your report | Performance of our contract with you, and your explicit consent for the health data itself |
| Showing your results, zones and training plan in the app | Performance of our contract with you |
| Comparing tests over time to show your progression | Your explicit consent |
| Emailing you your report, account information and re-test reminders | Performance of our contract, and legitimate interest in maintaining the coaching relationship. You can opt out of reminders at any time. |
| Keeping the service secure and working | Legitimate interest |
Because your test results are health data, we rely on your explicit consent to collect and process them. We ask for that consent when you first sign in to the athlete app, and we record the date you gave it. You can withdraw it at any time by emailing us. Withdrawing consent does not affect processing that already took place lawfully, and it does not undo a test you have already taken, but it does mean we stop using and, on request, delete your data.
3. Who we share it with
We do not sell your personal data, and we do not share it for advertising. Your results are not shown to other athletes.
We use a small number of service providers who process data on our behalf, under contract and only on our instructions:
| Provider | What they do | What they hold |
|---|---|---|
| Supabase | Database and login system | Your account and all test results |
| Netlify | Hosts the app itself | Server logs, including IP address |
| Resend | Sends our emails | Your email address and message content |
| jsDelivr | Delivers standard software libraries the app runs on | Your IP address, as with any website resource |
We may also disclose data where the law requires it, or to establish or defend a legal claim.
If you connect a sports watch
We may offer the ability to send your training sessions to a Garmin or COROS account. This is entirely optional and off unless you switch it on. If you connect one:
- You authorise the connection through that company's own login screen. We never see your watch account password.
- We send workout and training plan information to your account there. Their privacy policy governs what they then do with it.
- We store an access token so we can keep sending sessions. You can disconnect at any time in the app or in your watch account, and we delete the token.
4. Where your data is stored
Our providers operate internationally, so your data may be stored or processed outside Thailand, including in the United States and the European Union. Where that happens we rely on the providers' standard contractual protections and their own compliance frameworks to keep the level of protection appropriate.
5. How long we keep it
- Test results: for as long as you have an account with us, because the value of lactate testing is in comparing tests over years rather than months.
- Account information: for as long as your account is open.
- After a deletion request: we remove your data within 30 days.
- After a long period of inactivity: if you have not tested or logged in for three years, we will contact you before deleting your data.
- Server logs: retained by our hosting providers for their standard periods, typically a matter of weeks.
6. How we protect it
- All traffic to and from the app is encrypted in transit using HTTPS.
- Data is encrypted at rest by our database provider.
- Database access rules mean each athlete account can read only its own records. This is enforced by the database itself, not just by the app.
- Passwords are stored as secure hashes and are never visible to us.
- Administrative access is limited to Pace Me, Daddy staff who need it.
No system is perfectly secure, but if a breach ever affected your personal data we would notify you and the relevant authority as required by law.
7. Your rights
Under Thailand's Personal Data Protection Act, and under the GDPR where it applies to you, you have the right to:
- Access the personal data we hold about you, and receive a copy
- Correct anything inaccurate or incomplete
- Delete your data, subject to any legal obligation we have to keep it
- Withdraw consent at any time, including consent to hold your health data
- Object to or restrict how we process your data
- Portability: receive your data in a commonly used machine-readable format, or have it sent to another provider
- Complain to a supervisory authority, in Thailand the Personal Data Protection Committee
To exercise any of these, email daddy@pacemedaddy.com. We will respond within 30 days. There is no charge, and asking will never affect the service you get from us.
8. Children
Our testing and this app are intended for adults aged 18 and over. We do not knowingly collect data from children. If we become aware that we hold data belonging to a minor without appropriate parental consent, we will delete it.
9. Changes to this policy
If we change this policy we will update the date at the top of this page. If a change materially affects how we handle your data, we will tell you by email before it takes effect.
10. Contact
Pace Me, Daddy
Bangkok, Thailand
daddy@pacemedaddy.com
pacemedaddy.com