Hyperion Performance · Closed pilots and waitlist
Hyperion — Privacy Notice
25 October 2026
1. Controller and contact
Natalia Lewczuk, operating under the Hyperion Performance brand, is the controller of data collected through Hyperion's website, waitlist and correspondence, and of account and participation data in closed pilots. Correspondence address: ul. Dubois 4a/4, 15-349 Białystok, Poland. For privacy matters and data rights, email contact@hyperion-performance.com. The website and example-data preview do not provide open access to the measurement system. Closed pilots are arranged individually; research participation requires the relevant information, consents and approvals. Where an athlete shares data with a club or trainer, the recipient's own purposes and responsibility for received data require a separate assessment and notice from that recipient.
2. Data and sources
For a waitlist signup we collect an email address, language, signup source and date, the consent text and version, and the applicable discount terms. Pilot enquiries contain the contact and organisational information you choose to submit; do not include athletes' personal or health data in them. A signup or enquiry does not create a system account. If a participant is admitted to a closed pilot and an account is provided, account registration collects an email address, secured password, verification of mailbox control and an age-13 attestation. The profile may include age, a guardian-consent declaration for minors, sporting and body information. Before a Core Test we record measurement consent and answers about contraindications. We keep qualified task events, results and history, signal-source information, and consent and security logs. Selected Apple Health / Health Connect, sleep, weather or aggregated calendar data is obtained only within the enabled feature and relevant permission. Picture description records task completion, not a voice-content analysis result; other voice functions may send text to a speech-synthesis provider. Photos voluntarily added to meal or training-plan analysis may be sent to an AI provider. Some of this is health data. These application data flows concern participants with access to the relevant feature, not visitors merely viewing the website or preview.
3. Purposes and lawful bases
We send development and availability updates on the basis of a separate mailing consent (GDPR Article 6(1)(a)); it can be withdrawn at any time. We answer enquiries and arrange cooperation under Article 6(1)(b) where this involves steps requested before an agreement, or Article 6(1)(f) for other correspondence. For admitted participants, we operate the account, verify email and synchronize history to perform the applicable participation agreement (Article 6(1)(b)). We process health data for measurements, scores and recovery features on the basis of separate explicit consent by the participant or authorised guardian (Article 9(2)(a)), alongside Article 6(1)(b). Optional data sources and trainer access require separate choices. Within R&D, we analyse measurement quality and produce summaries to improve the system within the scope of given consents and the applicable pilot or research documentation; identifiable histories are not published without separate consent. We rely on legitimate interests (Article 6(1)(f)) for account security, abuse prevention, documenting applicable discount entitlements and handling requests, and Article 6(1)(c) where a specific legal obligation applies. Waitlist signup, a pilot enquiry or acceptance of these documents is not consent to research, health-data processing or use of one's likeness.
4. Automated outputs and AI
Qualified Core Test data is automatically calculated into an informational score and explanation. Passive context is not currently an automatic component of the active score. Selected features use AI to phrase explanations, answer chat messages, analyse an uploaded photo or synthesize speech. Chat messages may contain wellbeing or health information and are sent to a model provider after limiting identifying details. Do not treat the score as a diagnosis. If a club makes a decision about an athlete with legal or similarly significant effects, the club must establish an appropriate basis and protect the athlete's rights.
5. Recipients and transfers
Depending on the feature, data may be received by Replit infrastructure and Google file storage, Resend email services, OpenAI and Google Gemini models, and ElevenLabs speech synthesis. Not every feature sends data to every provider. Marketing-site signups are securely transferred between servers to the central mailing system at hyperion-performance.app, under the same controller, to manage contacts, consents, unsubscribes and applicable discount terms. This transfer does not include athletes' measurements or health data. A chosen trainer or club receives only data covered by the permissions granted. Waitlist signup and a pilot enquiry require no payment data. Some providers may process data outside the European Economic Area; in such cases a GDPR transfer mechanism is required, such as an adequacy decision or standard contractual clauses. Information on the mechanism for a specific transfer can be requested at the contact in section 1. We do not sell your personal data, including health data, to any third party.
6. Retention and account closure
Account and measurement data are kept while you participate to provide history and chosen features. Consent and security records are kept for as long as needed to establish what happened, protect the system and establish or defend claims, and no longer than necessary for those purposes. Account closure disables sign-in and ordinary access to data; it does not automatically erase every measurement record. After verifying identity, we review an erasure request and assess what must be removed and what must be retained for a specific legal obligation, claim or lawful research purpose. An authorised person carries out erasure in the admin panel; the system checks deletion of the account, associated records and linked files. If the entire operation cannot be verified, the case stays open for resolution and is not marked completed. When no further basis applies, we delete or irreversibly anonymise the data. Pseudonymisation alone is not anonymisation. Consent withdrawal stops further measurements based on it but does not automatically erase history; it does not affect the lawfulness of earlier processing.
7. Your rights
You may request access, rectification, erasure, restriction and, where applicable, portability. You may object to processing based on legitimate interests and withdraw consent at any time without affecting earlier lawful processing. Send a request to the section 1 contacts or file it in the app's data-rights feature. An authorised person may register an email request in the system after confirming control of the email address linked to the account. We review it after verifying identity where necessary and generally reply within one month, subject to extensions allowed by the GDPR. You may complain to the Polish supervisory authority, the President of the Personal Data Protection Office (uodo.gov.pl).
8. Minors and changes
Closed-pilot eligibility, including age, is determined individually by its terms and, where applicable, research protocol; there is no open enrolment from age 13. The existing account age threshold does not establish eligibility for a pilot. If a pilot admits participants aged 13–17, a parent or authorised legal guardian must be involved, read the relevant documents, provide the required consents and be able to withdraw them; the young person's objection must also be respected. Account registration collects a minimum-age attestation, while the profile records age and a guardian-consent declaration. We will explain material changes to processing purposes or scope before they apply and obtain fresh consent when required by law.
9. Website, mailing and enquiries
The .com website presents the system and accepts waitlist signups and cooperation enquiries. Mailing consent covers development and availability updates, including information about the future offer and the signup benefit. An unsubscribe in the central .app mailing system applies to signups from both sites; a retry, repeated signup or historical import does not automatically reactivate an unsubscribed or suppressed address. Unsubscribing does not cancel an already granted discount, delete a system account or withdraw a separate research consent. Contact data is used for mailing until consent is withdrawn; a limited record may then be retained as necessary to respect the unsubscribe, document consent and benefit terms, and establish or defend claims. Enquiries are retained as needed to answer them, arrange cooperation and meet applicable obligations or establish or defend claims, no longer than necessary. A club enquiry is for correspondence only and does not subscribe its sender to a newsletter. We use first-party website statistics to understand visits and interactions, such as page views, approximate visit duration and CTA clicks, and campaign-source information when present. Browser storage is used for the selected language and visit/campaign identifiers. This is separate from application measurements and does not make a website visitor a research participant. Necessary security processing and proportionate website statistics are based on legitimate interests (Article 6(1)(f)), subject to applicable requirements for access to information on a device. We do not use advertising networks or sell these data. You may exercise the rights in section 7 or object to statistics processing by contacting us.