Privacy Policy

‍

ARTICLE 1 — GENERAL

1.1 OnTracx BV (hereinafter "we", "us", "our" or "OnTracx"), with registered office at Vlasgaardstraat 52, 9000 Ghent, Belgium, registered with the Crossroads Bank for Enterprises under enterprise number 1000.197.286, assumes responsibility for the processing of your Personal Data as "Controller", in connection with:

the OnTracx Website at www.ontracx.com (hereinafter "Website");
the OnTracx mobile application (hereinafter "Application"); and
the OnTracx Pro platform for professional users (hereinafter "Pro Platform").

1.2 In this Privacy Notice, "Personal Data" means any information relating to an identified or identifiable natural person. We may collect, use, share or otherwise process Personal Data of individuals belonging to the following categories:

Visitors — visitors and users of the Website
Customers — consumers who purchase products via the Webshop
Application Users — individuals using the OnTracx Application (athletes, runners)
Professional Users — physiotherapists, coaches and other professionals using the Pro Platform
Business Partners — (representatives of) partners working with OnTracx
Suppliers — (representatives of) suppliers of goods or services, IT suppliers, consultants, lawyers, accountants and other third parties
Applicants — individuals applying for a position at OnTracx
Other Persons — all other individuals from whom OnTracx may process Personal Data

1.3 OnTracx processes Personal Data in accordance with applicable legislation, in particular Regulation (EU) 2016/679 of 27 April 2016 (the "GDPR") and all applicable Belgian implementing legislation.

1.4 Accessing or using our Website, Application or Pro Platform implies your full and unreserved understanding of this Privacy Notice. You are fully informed about how OnTracx collects, uses and processes your Personal Data for the purposes outlined herein.

1.5 This Privacy Notice applies to our Website, Application and Pro Platform. It does not apply to third-party websites to which we may link, and whose privacy policies may differ. OnTracx is not responsible for data processed by third-party websites.

1.6 OnTracx reserves the right to change, modify and update this Privacy Notice from time to time. We will notify you of material changes and advise you to regularly review this Privacy Notice.

1.7 If you have any questions, please contact us at info@ontracx.com.

ARTICLE 2 — CATEGORIES OF PERSONAL DATA PROCESSED

For the purposes outlined in Article 3, OnTracx may process the following categories of Personal Data:

2.1 Website, Webshop & Business Data

Data Category	Relevant Data Subjects	Details	Context
Category W1 — Professional identification & contact data	Customers, Business Partners, Suppliers, Applicants, Other Persons	Name, phone number, email, address, country; payment & delivery details; employer/company info (name, address, VAT number); social media info; communication content, IP address & technical details	Contacting us; entering into a business relationship; social media interaction
Category W2 — Contractual data	Customers, Business Partners, Suppliers	Data relating to agreements (date, type, financial data, other Personal Data related to the agreement)	Entering into or managing a contractual relationship
Category W3 — Applicant data	Applicants	Name, phone, email, address, country, photo (optional), CV, cover letter	Applying for a position or internship
Category W4 — Communication data	Customers, Visitors, Business Partners, Suppliers	Content and technical details of communications with OnTracx	Contacting us via any channel; business relationship communications
Category W5 — Website usage data	Customers, Visitors	See Article 8 — Cookies	Cookies set during Website visits

2.2 Application & Pro Platform Data

Data Category	Relevant Data Subjects	Details	Context
Category A1 — Account data	Application Users, Professional Users	Name, email address, date of birth, gender, height, weight, control questions related to running experience and injury proneness	Creating a personal user profile upon first login
Category A2 — Running data	Application Users	Location data (optional), average and cumulative load, running speed, distance, time, cadence, pain and comfort score, load progression score, running trajectory, history of previous runs	Processed during use of the Application to provide running metrics. Location services are optional; without them, speed, distance and trajectory will not be calculated.
Category A3 — Dashboard & insights data	Application Users	Load profile (load progression, pain score, cumulative load), weekly running statistics, injury risk estimation	Processed to provide insights regarding load profile and injury risk estimation
Category A4 — Application usage data	Application Users, Professional Users	Features and functionalities used, technical (device-related) information, feedback	Processed when using the Application or Pro Platform
Category A5 — Professional assessment data	Application Users (as assessed by Professional Users)	In-clinic mechanical load assessment results, personalized running programs, follow-up data, PDF reportsfeedback	Generated during professional assessments via the Pro Platform; stored on the athlete's own account

ARTICLE 3 — LEGAL BASES AND PURPOSES OF PROCESSING

We only process your Personal Data when we have a specific purpose and lawful basis to do so. We only process what is relevant for each specific purpose.

3.1 General purposes

Data	Legal basis	Purpose
W1 — Identification & contact data	Performance of a contract (Art. 6.1(b) GDPR) and/or consent (Art. 6.1(a) GDPR) and/or legitimate interests (Art. 6.1(f) GDPR)	Providing services, conducting business activities, managing contractual relationships, delivering products, answering queries, providing information
W2 — Contractual data	Performance of a contract (Art. 6.1(b) GDPR)	Managing commercial and contractual relationships (payment, billing)
W3 — Applicant data	Performance of a contract (Art. 6.1(b) GDPR) and/or consent (Art. 6.1(a) GDPR) and/or legitimate interests (Art. 6.1(f) GDPR)	Evaluating applications and pursuing recruitment policy
W4 — Communication data	Performance of a contract (Art. 6.1(b) GDPR) and/or consent (Art. 6.1(a) GDPR)	Processing communications in connection with agreements or website contact
W5 — Website usage data	Consent (Art. 6.1(a) GDPR) and/or legitimate interests (Art. 6.1(f) GDPR)	Facilitating Website availability, analyzing and improving content, personalizing experience, maintaining security, generating statistics (see Article 8)
A1 — Account data	Performance of a contract (Art. 6.1(b) GDPR) and explicit consent (Art. 9.2(a) GDPR) for health-related data	Creating and maintaining your personal user profile
A2 — Running data	Performance of a contract (Art. 6.1(b) GDPR) and explicit consent (Art. 9.2(a) GDPR)	Providing running-related metrics
A3 — Dashboard & insights data	Performance of a contract (Art. 6.1(b) GDPR) and explicit consent (Art. 9.2(a) GDPR)	Providing insights regarding load profile and injury risk estimation
A4 — Application usage data	Legitimate interests (Art. 6.1(f) GDPR)	Improving services, providing technical support, ensuring functionality and security
A5 — Professional assessment data	Performance of a contract (Art. 6.1(b) GDPR) and explicit consent of the athlete (Art. 9.2(a) GDPR)	Enabling Professional Users to perform assessments, create programs and follow up athletes. Data is stored on the athlete's account and shared with the Professional User based on the athlete's consent.

3.2 Improvement of our algorithms

As part of our efforts to improve the Application and Pro Platform and provide the best possible user experience, we may process Personal Data for the purpose of training our algorithms. This may include refining and enhancing the functionality of the Application, tailoring analyses and optimizing user experience.

We will exclusively process Personal Data for this purpose in a strictly minimized manner, either in aggregated form or, whenever feasible, in pseudonymized form.

The processing for algorithm improvement is based on our legitimate interest (Art. 6.1(f) GDPR).

3.3 Direct marketing

If we have obtained your electronic contact details in the context of providing our services, we may use them to send you promotional material regarding similar services. This is based on our legitimate interest.

Promotional material concerning non-similar services will only be sent with your prior consent.

We may transfer some Personal Data to data processors for direct marketing purposes relating to our services.

You can opt out of receiving marketing emails at any time, free of charge and without motivation, by clicking the unsubscribe button in any promotional email or by emailing info@ontracx.com.

3.4 Transfer to third parties

We treat your Personal Data as confidential and will not disclose it to third parties except as specified in this Privacy Notice or as required by law.

We may disclose Personal Data to third parties to the extent necessary for our business activities, including suppliers and service providers offering IT support, hosting, computer security or other services. These third parties will not further disclose your data except:

where communication to their sub-contractors is necessary for our business activities;
where they are obliged by law to communicate information to competent authorities.

We will not sell or rent your Personal Data to third parties, except as described herein or with your explicit prior consent.

In the event of reorganization, transfer of activities or bankruptcy, your Personal Data may be transferred to new entities or third parties. We will inform you in advance if reasonably possible.

3.5 Data sharing in the Professional context

When an athlete uses the Application and is connected to a Professional User via the Pro Platform:

All athlete data is stored on the athlete's own account.
The athlete grants the Professional User access through explicit consent within the Application.
This consent may be withdrawn at any time by the athlete, at which point data sharing will cease.
Professional Users may export PDF reports of individual assessments. Export or sharing of raw data outside the Pro Platform is not permitted.

With respect to athlete/patient Personal Data accessed via the Pro Platform, OnTracx and the Professional User act as joint controllers within the meaning of Article 26 GDPR. The respective responsibilities of each controller are set out in this Privacy Notice and, where applicable, in a separate joint controller arrangement.

3.6 Legal requirements

In extraordinary circumstances, we may be obliged to transfer your Personal Data following a court order or to comply with applicable laws and regulations. We will, if reasonably possible, inform you beforehand, unless doing so is subject to legal constraints.

ARTICLE 4 — DURATION OF THE PROCESSING

We store Personal Data for the duration necessary to achieve the purposes listed in Article 3, including for as long as necessary for the contractual relationship between you and OnTracx.

We may also store data to comply with applicable laws or legal requirements, including storage obligations after termination of the contractual relationship. The retention periods below do not apply where we are legally obliged to store data for shorter or longer periods.

4.1 Website, Webshop & Business Data

Data	Retention period
W1 — Identification & contact data	Up to 2 years after first contact; up to 7 years after end of contractual relationship
W2 — Contractual data	Up to 7 years after end of contractual relationship
W3 — Applicant data	Up to 2 years after last qualitative contact
W4 — Communication data	Up to 2 years after first contact; up to 7 years after end of contractual relationship
W5 — Website usage data	See Article 8 — Cookies

4.2 Application & Pro Platform Data

Data	Retention period
A1 — Account data	2 years after deletion of user profile
A2 — Running data	2 years after deletion of user profile
A3 — Dashboard & insights data	2 years after deletion of user profile
A4 — Application usage data	2 years after deletion of user profile
A5 — Professional assessment data	Stored on the athlete's account; retained as long as the athlete's account exists. Upon account deletion, retained for 2 years.

ARTICLE 5 — YOUR RIGHTS

5.1 Right of access and right to obtain a copy

At any time, you have the right to request access to your Personal Data, as well as to be informed about the purpose of the processing.

5.2 Right to rectification, erasure or restriction

You have the right to ask us to rectify inaccurate Personal Data. You can also request restriction of processing if you believe your data is inaccurate. You have the right to request erasure of your Personal Data insofar as it cannot be anonymized.

5.3 Right to object

You have the right to object to the processing of your Personal Data when you have serious and legitimate reasons to do so. You have the right to object to direct marketing at any time without providing a specific reason.

5.4 Right to data portability

You have the right to obtain your Personal Data in a structured, commonly used format and/or to transfer it to another data controller.

5.5 Right to withdraw consent

When processing is based on your prior (explicit) consent, you have the right to withdraw this consent at any time.

5.6 Automated decisions and profiling

You have the right to request not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

5.7 Exercising your rights

You can exercise your rights by contacting us with a copy of the essential parts of your ID (such as name and date of birth) as attachment:

Email: info@ontracx.com
Mail: OnTracx BV, Vlasgaardstraat 52, 9000 Ghent, Belgium

Application Users may also delete their account and all associated data directly through the "Delete Account" function in the Application.

5.8 Right to file a complaint

You have the right to file a complaint with OnTracx's supervising Data Protection Authority:

Autorité de la protection des données — Gegevensbeschermingsautoriteit (APD-GBA) Address: Drukpersstraat 35, 1000 Brussels, Belgium Tel: +32 (0)2 274 48 00 Fax: +32 (0)2 274 48 35 Email: contact@apd-gba.be

This is without prejudice to proceedings before the civil courts. If you are from an EU Member State other than Belgium, you may also file a complaint with your national data protection authority (list of DPAs).

If you have suffered damage as a result of the processing of your Personal Data, you may file a claim for compensation.

ARTICLE 6 — SECURITY AND CONFIDENTIALITY

6.1 We have adopted appropriate safety measures on a technical, organizational and physical level to avoid the destruction, loss, forgery, adjustment, unauthorized access or accidental disclosure of your Personal Data, as well as unauthorized processing.

6.2 Your data is stored on high-security servers within the European Union.

6.3 In order to improve our Application, Pro Platform and services and ensure their safety, OnTracx may use the data you have provided. At all times, OnTracx shall use this data in a GDPR-compliant manner, using state-of-the-art software and solutions.

6.4 We have implemented internal procedures to ensure the confidentiality of our IT infrastructure and to make sure it is managed responsibly.

6.5 Should a data breach occur affecting your Personal Data, we will inform you without undue delay, including a summary description of the potential impact and recommendations on measures to mitigate possible adverse effects.

6.6 We shall not be liable for direct or indirect damages caused by wrongful or improper use of Personal Data by a third party.

6.7 You also share responsibility for maintaining the privacy and security of the Application and Pro Platform — for example, by not allowing any third party access to your confidential information.

ARTICLE 7 — APPLICABLE LAW AND JURISDICTION

This Privacy Notice is governed by and construed in accordance with Belgian law, which exclusively applies to any potential dispute.

The courts of Ghent have exclusive jurisdiction to settle any dispute arising out of or in connection with the interpretation or execution of this Privacy Notice.

ARTICLE 8 — COOKIES

8.1 What are cookies and why do we use them?

A "cookie" is a small file sent by OnTracx's server and placed on your computer's hard drive. The information stored on these cookies can only be read by OnTracx and only for the duration of the visit to the Website.

Our Website uses cookies and similar technologies to distinguish your preferences from those of other users. The cookies we use are safe and help us provide you with a better user experience.

8.2 Types of cookies

Type	Function
Essential / Strictly necessary	Necessary for the Website to function. Cannot be disabled. Set in response to actions such as setting privacy preferences, logging in or filling out forms.
Functional	Increase user-friendliness by remembering your choices (e.g. language preferences) and offer improved functionality and personalization.
Performance / Analytic	Collect information about Website usage (number of visitors, time on page, error messages). Help improve Website performance. Do not identify you individually.
Targeting / Advertising	Used to deliver relevant content and targeted ads, measure campaign effectiveness, and may be used to create interest profiles across sites.

Cookies may be first-party (set by OnTracx) or third-party (set by cooperating organizations). For third-party cookies, we refer you to the cookie notices of the respective parties.

8.3 Overview of cookies

First-party cookies — Domain: www.ontracx.com

Cookie name	Type	Description	Retention
_fbp	Targeting / Advertising	Used by Meta/Facebook to deliver and measure advertising and build audiences (set by Facebook Pixel).	3 months
_ttp	Targeting / Advertising	Used by TikTok to track and measure advertising performance (set by TikTok Pixel).	1 year
ttcsid	Targeting / Advertising	Used by TikTok to track visitors across websites and measure advertising performance.	1 year

Third-party cookies

Cookie name	Type	Domain	Description	Retention
__cf_bm	Essential / Strictly necessary	calendly.com	Bot detection / security (Cloudflare), observed via Calendly widget.	1 day
_cfuvid	Essential / Strictly necessary	calendly.com / ontracx.com	Cloudflare cookie used for rate limiting / bot management and maintaining secure service delivery.	Session
cf.turnstile.u	Essential / Strictly necessary	challenges.cloudflare.com	Bot detection / security cookie related to Cloudflare Turnstile challenges.	Persistent (as detected)
__stripe_mid	Essential / Strictly necessary	calendly.com (via js.stripe.com)	Stripe fraud prevention and payment security cookie used by Stripe when embedded via third-party services (e.g., Calendly).	1 year
__stripe_sid	Essential / Strictly necessary	calendly.com (via js.stripe.com)	Stripe fraud prevention and payment security cookie used by Stripe when embedded via third-party services (e.g., Calendly).	1 day
_calendly_session	Functional	calendly.com	Calendly session management (e.g., booking flow). Scan indicates it may enable adding events to the visitor’s calendar after consent.	21 days
dd_cookie_test_#	Essential / Strictly necessary	calendly.com	Bot detection / security (Cloudflare), observed via Calendly widget.	1 day
sf_… / sf_domain_test_…	Unclassified	ontracx.com (initiated by track.salesflare.com)	“Cookie set by the Salesflare tracking script to test cookie/domain storage capability and enable visitor tracking functionality.”	Session
_tt_enable_cookie	Targeting / Advertising	ontracx.com	TikTok pixel cookie flag used to enable/record TikTok tracking based on consent configuration.	1 year
tt_appInfo / tt_sessionId / tt_pixel_session_index	Targeting / Advertising	analytics.tiktok.com	TikTok cookies used to measure ad performance and interactions.	Session
VISITOR_INFO1_LIVE / YSC / TESTCOOKIESENABLED / __Secure-*	Targeting / Advertising	youtube.com	YouTube embedded video cookies used to track interaction, measure performance, and store player preferences.	Session to ~180 days (varies)

8.4 Your consent

On your first visit to our Website, you will be asked to accept non-essential cookies. You can change cookie settings at any time via the hyperlink at the bottom of our Website and thus withdraw your consent.

You can refuse or block cookies by changing the configuration parameters of your browser. Disabling cookies may mean certain Website functionalities are unavailable.

For more information on how to manage cookies in your browser:

More information about cookies: www.allaboutcookies.org

More information about online behavioral advertising and privacy: www.youronlinechoices.eu

Last updated: April 2026 — OnTracx BV, Vlasgaardstraat 52, 9000 Ghent, Belgium — info@ontracx.com