The data controller for A Stronger Climber (app.astrongerclimber.com and the installable app) is Dennis Steensen Blicher, authorised physiotherapist — Klatreskader, CVR 37848506, Bison Boulders Kødbyen, Flæsketorvet 89, 1711 København V, Denmark. Questions and requests: dennis@klatreskader.dk.
Booking, the questionnaire before a consultation, the consultation itself and its record are described in the clinic's own policy: klatreskader.dk/privatlivspolitik (in Danish).
You sign in by entering your email address. We send a six-digit code to that address, and entering it proves the address is yours. There is no password. Once you are signed in, your device keeps a token so you do not have to repeat this every time — you can revoke it from the menu (“Sign out everywhere”) if you lose a device.
We hold your email address because it is how you sign in and how we reach you, and the display name you chose because your coach and the app need something to call you. Both are stored in the same EU database as your training records.
Until August 2026 sign-in ran through a separate community platform, and this policy previously described the training data as pseudonymous on that basis. That is no longer how the platform works.
| Category | Examples | Why (legal basis) |
|---|---|---|
| Identity | Email address, display name, sign-in codes and device tokens | To sign you in and keep you signed in (contract, GDPR Art. 6(1)(b)) |
| Training data | Climbing sessions, finger-training timers, tests, journal entries, workouts, calendar plans | To provide the service (contract) |
| Profile | Bodyweight, birth year (the year only — never the full date) or an age band, climbing grades, training background, goals. If you are a client of the clinic, the climbing grade you gave in the questionnaire before your consultation is copied into your profile — no other answer is | To personalise your coaching (contract) |
| Health data | Injury logs, pain scores, rehab check-ins, the morning check, your rehab phase and its checklist, and notes your physiotherapist adds | In treatment with the clinic: treatment by an authorised health professional (Art. 9(2)(h) with Art. 6(1)(b)) and the duty to keep a patient record (Art. 6(1)(c)). Using the app on your own: your explicit consent (Art. 9(2)(a) with Art. 6(1)(b)). See section 4 |
| Coach chat | Messages with your coach or physiotherapist, and photos and videos you choose to share | To provide coaching and treatment (contract; for messages with your physiotherapist, also Art. 9(2)(h)) |
| Newsletter | If you subscribe to the A Stronger Climber newsletter (on klatreskader.dk): your email address, when you subscribed and confirmed, and the wording you agreed to. It is sent through Resend. Unconfirmed sign-ups are deleted after a few days | Your consent (Art. 6(1)(a)) — unsubscribe with the link in every issue, or by writing to us |
| App & device | A hashed sign-in token, push-notification address, the record of what you accepted and when | To keep you signed in securely and to document what you were told (contract, legal obligation) |
We do not collect advertising identifiers, analytics profiles, or location data, and the app never asks for your CPR number.
Injury and rehabilitation information is special-category data under GDPR Article 9. Which rule applies depends on whether you are in treatment with the clinic.
If you are in treatment with the clinic (a course or consultations with Dennis), it is processed as part of that treatment by an authorised physiotherapist, who is bound by professional confidentiality (Article 9(2)(h)). Because it is part of that treatment, it also forms part of your patient record, which the physiotherapist is required by law to keep.
If you use the app on your own, without being in treatment, anything health-related you log — for example a pain score in a session or test, or an injury you report to Dennis — is stored only with your explicit consent (Article 9(2)(a)). The app asks for it before your first such entry and records the wording you agreed to. If you later start treatment with the clinic, what you log from then on becomes part of your patient record.
Before health data is first stored, the app shows you what it collects, how it is used and who else sees it, and records what you accepted. For a client in treatment that record documents what you were told; the legal basis is still the treatment. You can stop at any time in the app — “Stop injury tracking” in Rehab mode, otherwise “Stop storing it” next to your coaching mode. Nothing new is recorded from then on. If you are in treatment, what is already recorded stays in your patient record for the period in section 10. If you are not, it is deleted straight away. Because that can't be undone, the app asks you to type DELETE first. Your training itself — sessions, tests, timers — stays; only the health answers in it, such as pain scores, are removed.
The app's rehab guidance supports your training. It does not diagnose injuries and does not replace an assessment by a physiotherapist or doctor.
Your identity, training and health records are stored in a database and file storage restricted to the European Union (Cloudflare D1 and R2, EU jurisdiction). Our web pages are hosted in Denmark.
A copy of the database is exported every night to EU file storage as a backup, and those backups are kept for 30 days before being overwritten.
Some processing necessarily crosses borders. Our infrastructure provider operates a global network, so a request you make while travelling may be handled at the nearest data centre, and short-lived caches — for example a coaching note the AI has already written, kept for up to 21 days so it is not written twice — are held on that network rather than in the EU database. Our AI provider processes coaching prompts in the United States. Those transfers rely on EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework.
| Processor | What they do | Where |
|---|---|---|
| Cloudflare | Database (EU jurisdiction), media and backup storage (EU jurisdiction), application runtime, short-lived caches, and the browser check on the sign-in page | EU storage; global network under SCCs / Data Privacy Framework |
| Resend | Sends your sign-in codes and, if you subscribe, the newsletter. Receives your email address (and the code itself) | Sent from the EU (Ireland) |
| NordicWay | Hosts the web pages themselves | Denmark |
| Anthropic | The AI that writes your coaching advice from your training (and, in Rehab mode, injury) context | USA, under SCCs — receives a random user ID, never your name or email |
| Google, Apple & Mozilla push services | Deliver notifications to your device, if you turn them on. They receive the notification text — and when your coach messages you, the start of that message is the notification, so what they wrote passes through and can show on your lock screen | Global |
A plainer list — including what each one sees and whether it touches health data — is at who processes your data.
Your coaching notes, plans and weekly summaries are generated by an AI model (Anthropic's Claude). It receives your training context — recent sessions, scores, profile, and, in Rehab mode, your injury status — identified only by a random user ID. It never receives your name or email address. Its output is advice for your training, not a medical or clinical decision.
Messages with your coach, and any photos or videos you share, are stored in EU-jurisdiction storage and served through unguessable links. Anything you or your coach downloads leaves the platform and is no longer under our control. Messages with your physiotherapist are part of your patient record, so deleting one hides it in the app but does not erase it.
You can at any time ask us to:
One honest detail about deletion: erasing your records from the live database is immediate, but nightly backups already taken still contain them until those backups age out, which takes up to 30 days. Backups are not used to restore individual accounts, only to recover the whole system after a failure.
Write to dennis@klatreskader.dk. We respond within one month. You can also complain to the Danish Data Protection Agency (Datatilsynet).
Who has looked at your record. Your coach can open your dashboard to do their job. Every time that happens we record it — who opened it, whose it was, when, and the network address and browser used. You can ask us for that list. We keep it for 12 months and then delete it automatically. Nobody, including us, can open an athlete’s dashboard without leaving that trace.
We keep your data for as long as you have an account, so your training history and progression work as intended — that history is the product, and a year-old session still shapes the advice you get today. If you stop using the platform, your data stays until you ask us to remove it, and we act on that within 30 days.
Two things outlive the account, because the law requires it.
The record of who opened your dashboard (section 9) is deleted automatically after 12 months. Resolved injuries older than 12 months are excluded from AI coaching automatically, whether or not you ask.
The dashboard uses no advertising or analytics cookies. It stores only what is strictly necessary on your device: your preferences, unsent drafts, and — if you install the app — a secure sign-in token so it opens without signing in again. Fonts and charting code are served from our own domain, so opening the dashboard contacts nobody but us. The exception is a demonstration video: if a session or exercise includes one, your browser fetches it from the video host, which sees your IP address and nothing about your training. Where that host is YouTube we embed through youtube-nocookie.com, which does not set tracking cookies unless you actually press play; the still image shown before you do is still fetched from YouTube's image servers.
If we make meaningful changes to this policy, we will tell you in the app before they take effect.