Privacy policy

This is a courtesy translation provided for convenience. The Italian version is the legally binding text.

Last updated: 21 June 2026 · Site version 2026-06-21

Which data we process, why, with whom and what rights you have, in plain language, under EU Regulation 2016/679 (GDPR).

1. Data controller

The data controller is Thomas Donzella (sole proprietorship "Donzella di Thomas Donzella"), VAT no. IT02865930180, with registered office at Via S. Francesco d'Assisi 47E, 20073 Opera (MI), Italy. For any request concerning your data you can write to info@dawtmilano.com.

2. What data we process

Account data: email and name, for registration, sign-in and service communications.

Training data: workout plans, sessions, sets, repetitions and loads, body measurements and goals.

Profile data: sex, age, height, weight, body fat, years of experience.

Health data (special category, Art. 9 GDPR): the health notes you enter (e.g. conditions, injuries, blood values) and the medical reports you upload (test results, check-ups). Of these we keep only a text excerpt generated at the time of upload: the original file is not retained.

Technical app data: your device token for push notifications, only if you enable them. Local storage (localStorage) is used exclusively to make the app work and is not a profiling tool.

Website browsing data (dawtmilano.com): aggregate, anonymous statistics on site usage collected through Plausible Analytics, which does not use cookies and does not track users across different sites (see §6). In addition, to display the typefaces, your browser may send its IP address to Google Fonts (see §4 and §6).

3. Why we process data and on which legal basis

Providing the service (account, workout plans, tracking, personal statistics): legal basis = performance of the contract (Art. 6(1)(b)).

Personalisation through the AI using your health data (notes and medical reports): this takes place only with your explicit consent (Art. 9(2)(a)), which you can give or withdraw at any time from Profile → "Health data and AI". Without consent, the AI receives neither notes nor reports.

Reminder notifications: based on your consent (Art. 6(1)(a)), which you can withdraw from Settings.

Service communications (e.g. welcome email, security alerts) and aggregate site statistics: legitimate interest of the controller (Art. 6(1)(f)) in operating and improving the service, and/or performance of the contract.

Nature of the provision of data. Providing your email, name and basic profile data is necessary to deliver the service: without them, it is not possible to create the account or generate the workout plans. Providing health data is instead optional and is based on your consent: not providing it does not prevent you from using the app, but it reduces personalisation.

4. Who we share data with (data processors)

To run DAWT we rely on selected providers that process data on our behalf, on the basis of data processing agreements (DPAs):

We do not sell or transfer your data to third parties for marketing purposes.

5. Transfers outside the European Union

Processing through the AI involves a transfer of data to the United States (Anthropic). The transfer takes place on the basis of the European Commission's Standard Contractual Clauses, included in Anthropic's data processing agreement (DPA), supplemented by a Transfer Impact Assessment. By sending your health data to the AI with your consent, you consent to this transfer. The request for typefaces to Google Fonts may also involve a transfer of your IP address to the United States, on the same basis of the Standard Contractual Clauses. In any event, where a provider processes data outside the European Union (for example the push notification services of Apple or Google), the transfer is supported by appropriate safeguards under Chapter V of the GDPR, normally the Standard Contractual Clauses.

6. Cookies and tracking

The site and the app do not use profiling cookies or advertising tracking tools, which is why there is no cookie banner. In detail:

• Plausible Analytics collects aggregate statistics (page views, referral source, device) without cookies and without identifying individual visitors, in compliance with the GDPR.
• Local technical storage (localStorage) in the app: it is used only to save your workouts and make the app work offline. It is not shared with third parties.
• Google Fonts: the typefaces are loaded from Google's servers, which receive your browser's IP address in order to serve them.

7. How long we keep your data

We keep account and training data for as long as your account is active. Health data is kept for as long as the account is active or until you withdraw your consent, after which it is no longer used for personalisation. The push notification token is kept for as long as notifications remain enabled and the subscription is valid. If you delete your account (Account → "Delete account"), we erase your data from our servers together with your sign-in credential; some technical backup copies may persist until automatic rotation, within a short period. Health data sent to the AI (Anthropic) is retained by the provider for a maximum of 30 days and then deleted (with limited exceptions for content flagged for abuse). Aggregate site statistics cannot be traced back to you.

8. Your rights

As a data subject you have the right to: access your data and export it (Account → "Download my data"); rectify it; erase it (Account → "Delete account"); restrict or object to processing; withdraw your consent at any time (without affecting processing already carried out). You may also lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it).

To exercise your rights, write to info@dawtmilano.com.

9. Security

We adopt appropriate technical and organisational measures (Art. 32 GDPR): encrypted connections (HTTPS), authentication-protected access to data, security headers, anti-abuse limits and per-user data separation. Health data is additionally encrypted at rest on our servers (AES-256-GCM).

10. Minors

The service is not directed at children under 16. If you are a minor, do not use DAWT without the consent of a person holding parental responsibility.

11. Artificial intelligence, profiling and automated decision-making

Training advice is generated by an artificial intelligence system (Claude by Anthropic): you are interacting with an AI, not with a flesh-and-blood professional.

Profiling and logic of the processing. To personalise workout plans and suggestions, the AI processes your profile and training data and (only with your consent) your health data, correlating them (for example load history, perceived exertion, goals, any limitations) to produce a tailor-made plan and advice. This activity constitutes profiling within the meaning of Art. 4(4) GDPR. There is no fully automated decision-making that produces legal effects concerning you or similarly significantly affects you within the meaning of Art. 22 GDPR: the results are suggestions that you remain free to accept, modify or ignore, and you can always intervene and contact us.

DAWT is a wellness and fitness app. Its suggestions are for information and training purposes and do not constitute diagnosis, therapy or medical advice, nor do they replace consultation with a healthcare professional: DAWT is not a medical device. Consult a doctor before starting a training programme, and if you have medical conditions, injuries or doubts about your health. See also the Disclaimer.

12. Changes to this policy

We may update this privacy policy: in the event of substantial changes we will notify you and, within the app, ask you to accept it again. The current version is indicated at the top.